Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 141Soru →

A financial technology company is launching a new mobile app that provides real-time portfolio valuation updates to users. The application backend is deployed on Amazon EC2 instances inside an Auto Scaling group, fronted by an Application Load Balancer (ALB). The application queries an Amazon RDS for MySQL Multi-AZ database. The company expects the traffic to spike from 1,0001,000 requests per second to over 500,000500,000 requests per second within 55 minutes at the market open every day. Users require near-instantaneous responses, and session state must be persisted across multiple Availability Zones to prevent data loss if an instance fails. Which combination of actions will ensure the application scales efficiently and maintains low latency during the morning traffic spikes?

Cevabı ve açıklamayı göster

Cevap: Request AWS Support to pre-warm the Application Load Balancer prior to the daily market open, deploy Amazon ElastiCache for Redis to store session state with replication, and configure RDS Read Replicas to offload read traffic from the primary database instance.

Cevap

Request AWS Support to pre-warm the Application Load Balancer prior to the daily market open, deploy Amazon ElastiCache for Redis to store session state with replication, and configure RDS Read Replicas to offload read traffic from the primary database instance.
The correct answer combines three standard scalability techniques: pre-warming the ALB to handle the massive 500,000 requests per second traffic spike immediately; using ElastiCache for Redis to store session state with multi-AZ replication; and offloading read operations to RDS Read Replicas to avoid overloading the primary database instance.

Adım Adım Çözüm

1
Address the rapid, massive traffic spike at the Application Load Balancer tier.
Contact AWS Support to pre-warm the Application Load Balancer.
An Application Load Balancer scales automatically, but a sudden spike from 1,000 to 500,000 requests per second in 5 minutes exceeds its default scaling speed, leading to connection timeouts. Pre-warming prepares the ALB resources in advance.
2
Address the session persistence and replication requirements.
Deploy an Amazon ElastiCache for Redis cluster with replication.
Redis is designed to handle key-value data with replication and durability, ensuring session data persists across Availability Zones. Memcached does not natively support multi-AZ replication.
3
Address the database read scalability.
Deploy RDS Read Replicas and point the application's read queries to them.
RDS Read Replicas offload the read traffic from the primary DB instance, which preserves write capacity and resolves high CPU utilization. Multi-AZ standby instances are passive and cannot accept read queries.

Anahtar Kavram

Designing for high-performance and rapid scalability across compute, load balancing, caching, and database layers.
Soru 142Soru →

A digital ride-hailing company is launching a new carpooling service that matches passengers traveling along similar routes. The matching service runs on Amazon ECS tasks using AWS Fargate behind an Application Load Balancer (ALB). During rush hours, the platform expects requests to scale instantly from 2,0002,000 to 180,000180,000 requests per second. Passenger and ride metadata is stored in an Amazon Aurora PostgreSQL database cluster. During initial load testing, the database experiences CPU exhaustion due to read-heavy query surges, and the ALB drops incoming requests during the initial minutes of the traffic spike.

Which two actions should a Solutions Architect recommend to optimize the performance and scalability of the architecture under these conditions? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit a support case to AWS to pre-warm the Application Load Balancer to the anticipated peak traffic volume.; Provision an Amazon ElastiCache for Redis cluster to cache the passenger and ride metadata, offloading the read queries from the database.

Cevap

The solutions architect should recommend submitting a support case to AWS to pre-warm the Application Load Balancer, and provisioning an Amazon ElastiCache for Redis cluster to cache the read-heavy passenger and ride metadata.
To handle sudden, extreme spikes in traffic, the Application Load Balancer must be pre-warmed by AWS Support to ensure it can immediately accept the load without scaling latency. Caching the highly repetitive passenger and ride metadata in an Amazon ElastiCache for Redis cluster offloads the read traffic from the Amazon Aurora database, preventing CPU starvation and ensuring low-latency data access.

Adım Adım Çözüm

1
Analyze the scaling characteristics of the Application Load Balancer during instant spikes.
Identified that Application Load Balancers scale gradually in response to incoming traffic, meaning a sudden surge from 2,0002,000 to 180,000180,000 requests per second will cause dropped packets during the provisioning lag.
To prevent dropped requests at the entry point, the load balancer capacity must be pre-provisioned by requesting ELB pre-warming from AWS Support.
2
Address the database CPU exhaustion caused by read-heavy matching queries.
Determined that caching passenger and ride metadata will offload highly repetitive read queries from the Aurora PostgreSQL database.
Amazon ElastiCache for Redis offers sub-millisecond latency and high-throughput read capabilities, resolving database bottlenecks.
3
Evaluate and rule out sub-optimal storage, replication, and scaling options.
Discarded Memcached due to lack of replication/persistence features, and ruled out Multi-AZ standby routing because standby nodes in RDS cannot serve reads, and dynamic replica scaling experiences spin-up lag during instant spikes.
Ensures that the final architecture adheres to AWS best practices for high-performance and low-latency workloads.

Anahtar Kavram

Handling instant flash traffic using Application Load Balancer pre-warming and database read caching with Amazon ElastiCache for Redis.
Soru 143Soru →

A smart-home IoT provider is building a telemetry analysis dashboard. The architecture requires a serverless application running in the Analytics Account to retrieve encrypted device logs from an Amazon S3 bucket located in the Operations Account. The Operations Account encrypts the S3 bucket using an AWS KMS Customer Managed Key (CMK). The design must follow the principle of least privilege and allow secure cross-account access to the logs. Which combination of configuration steps will securely permit the Analytics Account to read these logs?

Cevabı ve açıklamayı göster

Cevap: In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and configure the CMK key policy to allow kms:Decrypt access to the Analytics IAM role. In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket and kms:Decrypt on the Operations CMK.

Cevap

In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and configure the CMK key policy to allow kms:Decrypt access to the Analytics IAM role. In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket and kms:Decrypt on the Operations CMK.
The correct answer correctly specifies the configuration of the three policy layers required for cross-account S3 bucket access with KMS encryption: the S3 bucket policy, the KMS key policy, and the local IAM identity policy. Each must explicitly allow the cross-account operations.

Adım Adım Çözüm

1
Select the correct key type for cross-account S3 access.
Use a Customer Managed Key (CMK) instead of an AWS managed key.
AWS managed keys cannot have their key policies modified and therefore cannot support cross-account decryption.
2
Configure policies in the Operations Account (resource owner).
Update the S3 bucket policy to allow s3:GetObject for the Analytics role, and update the CMK key policy to allow kms:Decrypt for the Analytics role.
Cross-account resource access requires the resource-owning account to explicitly trust and grant permission to the external account or role.
3
Configure policies in the Analytics Account (consuming client).
Attach an IAM policy to the Analytics IAM role allowing s3:GetObject and kms:Decrypt on the Operations resources.
For cross-account access, both the resource-based policies and the identity-based policy must explicitly grant the required permissions.

Anahtar Kavram

Cross-account access controls involving S3 and KMS CMK encryption
Tahmini Süre:2m 0s
Soru 144Soru →

A SaaS company is launching a real-time reservation platform for dental clinics. The platform must handle a high volume of appointment searches and bookings. During a nationwide promotional campaign, search traffic is expected to scale instantly from a baseline of 500500 requests per second to over 60,00060,000 requests per second. The application runs on Amazon ECS container instances behind an Application Load Balancer (ALB). The primary database is a Multi-AZ Amazon RDS for PostgreSQL DB instance. The application requires highly available, replicated caching of session states and search results, and must scale to meet the demand without dropping requests or overloading the database. Which set of actions should the Solutions Architect take to optimize the performance and scalability of the platform?

Cevabı ve açıklamayı göster

Cevap: Request AWS Support to pre-warm the Application Load Balancer to handle the sudden surge. Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled to cache search results and sessions. Create RDS Read Replicas and configure the application to route read queries to the replicas instead of the primary DB instance.

Cevap

Request AWS Support to pre-warm the Application Load Balancer to handle the sudden surge. Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled to cache search results and sessions. Create RDS Read Replicas and configure the application to route read queries to the replicas instead of the primary DB instance.
The correct solution addresses scalability bottlenecks at every tier. First, because the traffic spike is instant (scaling from 500500 to over 60,00060,000 requests per second), the Application Load Balancer must be pre-warmed by contacting AWS Support to prevent connection timeouts and HTTP 502502 or 503503 errors. Second, scaling database read capacity for Amazon RDS PostgreSQL requires the creation of RDS Read Replicas, as Multi-AZ standby instances are passive and cannot serve read traffic. Third, session and search caching requires a highly available, replicated cache. Amazon ElastiCache for Redis supports replication, Multi-AZ, and automatic failover, whereas Amazon ElastiCache for Memcached does not.

Adım Adım Çözüm

1
Address the load balancer layer scaling limitation for instant spikes.
Identify that the ALB needs to be pre-warmed by contacting AWS Support, as normal auto-scaling cannot react fast enough to a sudden surge from 500500 to 60,00060,000 requests per second.
Gradual scaling of the ALB under standard conditions will cause connection drops and HTTP 502502 or 503503 errors during the initial minutes of the surge.
2
Select the correct caching engine for replication and high availability.
Choose Amazon ElastiCache for Redis with Multi-AZ enabled rather than Memcached.
The requirement specifies highly available, replicated caching. Memcached does not support replication, Multi-AZ, or automatic failover, whereas Redis does.
3
Select the appropriate mechanism to scale read queries on Amazon RDS.
Deploy RDS Read Replicas and modify the application to point read traffic to their endpoints.
Amazon RDS Multi-AZ deployments use a passive standby DB instance that cannot accept read or write traffic. To scale read operations horizontally, RDS Read Replicas must be provisioned.

Anahtar Kavram

Multi-tier scalability design for sudden flash traffic, involving load balancer pre-warming, caching selection (Redis vs. Memcached), and horizontal read-scaling for relational databases.
Tahmini Süre:2m 0s
Soru 145Soru →

A global financial firm, "ApexCapital," is designing a secure reporting application. Users authenticate via an external SAML 2.0 Identity Provider (IdP) mapped to an IAM role in an Identity Account. Once authenticated, users must read financial reports from an Amazon S3 bucket located in a separate Core Data Account. The S3 bucket is encrypted. The solution must enforce strict compliance controls and restrict access to authorized users. Which two configurations are required to grant the federated users access to the encrypted reports in the Core Data Account? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy in the Core Data Account to explicitly grant s3:GetObject permissions to the ARN of the federated IAM role from the Identity Account.; Encrypt the S3 bucket using a Customer Managed Key (CMK) in the Core Data Account, and configure its key policy to grant the federated IAM role from the Identity Account kms:Decrypt permissions.

Cevap

To allow cross-account access to encrypted S3 objects, you must grant read permissions in the S3 bucket policy and decrypt permissions in the KMS key policy using a Customer Managed Key (CMK).
To enable federated users from the Identity Account to access encrypted S3 objects in the Core Data Account, two main configurations are required. First, the S3 bucket policy in the Core Data Account must explicitly trust the cross-account role ARN and grant s3:GetObject permission. Second, because cross-account S3 access to KMS-encrypted objects requires permissions on the KMS key, a Customer Managed Key (CMK) must be used. The CMK key policy in the Core Data Account must explicitly grant kms:Decrypt permissions to the IAM role in the Identity Account.

Adım Adım Çözüm

1
Evaluate S3 bucket encryption requirements for cross-account access.
Determine that a Customer Managed Key (CMK) must be used instead of the default AWS-managed key.
AWS-managed KMS keys do not allow their policies to be modified, making cross-account delegation impossible.
2
Configure the S3 bucket policy in the Core Data Account.
A bucket policy is added that allows s3:GetObject to the federated IAM role principal from the Identity Account.
Cross-account access requires permissions to be granted explicitly at both the source (IAM policy) and target (resource policy) levels.
3
Configure the KMS key policy in the Core Data Account.
The CMK key policy is updated to grant kms:Decrypt permissions to the federated IAM role.
The S3 service uses the caller's identity (the cross-account federated role) to decrypt the data, requiring key policy permissions.

Anahtar Kavram

Cross-account S3 access with KMS encryption requires explicit delegation on both the S3 bucket policy and a Customer Managed Key (CMK) policy.
Soru 146Soru →

A financial news and analysis company hosts a portal that publishes quarterly corporate earnings reports. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon Aurora PostgreSQL database. At the exact second an earnings report is published, traffic instantly spikes from a baseline of 2,0002,000 requests per second to over 200,000200,000 requests per second. During the first 1010 minutes of these events, users experience HTTP 503503 Service Unavailable errors and significant delays in database query responses.

Which two actions should the Solutions Architect recommend to optimize the performance and scalability of the platform under these conditions?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit a support case to AWS Support to pre-warm the Application Load Balancer (ALB) based on the anticipated traffic volume and rate of increase.; Configure Aurora Auto Scaling to dynamically add Aurora Replicas to the DB cluster, and update the application to route read-only queries to the cluster reader endpoint.

Cevap

Submit a support case to AWS Support to pre-warm the Application Load Balancer (ALB) based on the anticipated traffic volume, and configure Aurora Auto Scaling to dynamically add Aurora Replicas while directing read queries to the cluster reader endpoint.
The correct options target the two primary layers under pressure during the flash traffic event: the entry point (ALB) and the database. Pre-warming the ALB ensures that the load balancer can ingest the instant surge of 200,000200,000 requests per second without dropping connections. Using Aurora Auto Scaling alongside the cluster reader endpoint allows the database layer to automatically spin up additional read replicas to handle the query workload without overloading the primary writer.

Adım Adım Çözüm

1
Submit a support case to AWS Support to pre-warm the ALB.
The ALB is provisioned with sufficient capacity to support the peak request rate of 200,000200,000 requests per second from the start of the event.
This prevents HTTP 503 Service Unavailable errors caused by the ALB failing to scale out rapidly enough to handle the sudden, massive surge in connections.
2
Configure Aurora Auto Scaling for the database cluster and point read-heavy queries to the reader endpoint.
The application routes read traffic to the reader endpoint, which distributes queries across dynamically scaled Aurora Replicas.
This offloads read operations from the primary writer instance, maintaining low latency for queries during peak reporting periods.

Anahtar Kavram

Handling sudden, extreme scale spikes requires pre-allocating load balancing capacity (pre-warming) and utilizing horizontal read-scaling (Aurora Replicas with Auto Scaling) rather than relying on reactive instance-level scaling.
Tahmini Süre:2m 0s
Soru 147Soru →

An enterprise is deploying a centralized audit solution where an IAM role in the Security Account (Account A) must analyze compliance reports stored in an Amazon S3 bucket within the Production Account (Account B). The S3 bucket is configured with default encryption, and the organization's compliance policy mandates that all data access must be audited and restricted to the minimum required cross-account permissions. Which combination of configuration steps will successfully and securely enable the S3 bucket and KMS key access for Account A?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket in Account B to be encrypted using a Customer Managed Key (CMK). Update the key policy of the CMK in Account B to grant kms:Decrypt permissions to the IAM role in Account A. Update the S3 bucket policy in Account B to grant s3:GetObject and s3:ListBucket permissions to the IAM role in Account A. Attach an IAM policy to the IAM role in Account A that allows s3:GetObject and s3:ListBucket on the S3 bucket, and kms:Decrypt on the CMK in Account B.

Cevap

Configure the S3 bucket in the Production Account to use a Customer Managed Key (CMK), update its key policy to grant decryption permissions to the Security Account's IAM role, configure the S3 bucket policy to grant read access to the role, and configure the IAM policy in the Security Account to allow these S3 and KMS operations.
The correct solution uses a Customer Managed Key (CMK) which supports policy modification, allows cross-account access via the key policy, specifies the external principal in the S3 bucket policy, and configures the identity policy of the calling role to trust the external resources.

Adım Adım Çözüm

1
Ensure the S3 bucket is encrypted using a Customer Managed Key (CMK) rather than an AWS managed key.
Allows customization of the KMS key policy to grant cross-account access, which is impossible with AWS managed keys.
AWS-managed keys do not allow policy modifications to authorize cross-account principals.
2
Modify the KMS CMK key policy in the Production Account to grant decryption permissions to the Security Account's IAM role.
Authorizes the external IAM role to decrypt the data encrypted by the key.
Cross-account KMS access must be explicitly enabled at the key level.
3
Configure the S3 bucket policy in the Production Account to grant read access to the Security Account's IAM role.
Authorizes the external role to perform read operations on the bucket resources.
S3 bucket access across accounts requires permission in the bucket policy.
4
Attach an IAM policy to the IAM role in the Security Account that allows access to the S3 bucket and the KMS CMK.
Grants the role permission to initiate S3 read and KMS decrypt calls to the resources in the Production Account.
For cross-account access, permissions must be granted on both the trust side (resource policy) and the calling side (identity policy).

Anahtar Kavram

Cross-account resource access with KMS encryption
Tahmini Süre:2m 0s
Soru 148Soru →

A financial technology startup is designing a new multi-region transaction processing application. The primary infrastructure is located in the `us-east-1` Region, consisting of an Amazon ECS cluster running on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The database tier uses an Amazon Aurora PostgreSQL cluster. For internal service discovery, microservices resolve endpoints using a Route 53 Private Hosted Zone named `fintech.internal`.

The startup must establish a disaster recovery (DR) site in the `us-west-2` Region to comply with regulatory standards. The architecture must satisfy a Recovery Time Objective (RTO) of 1515 minutes and a Recovery Point Objective (RPO) of 11 minute. Outbound internet access from the application instances is required in both regions to communicate with external payment gateways, and this outbound path must survive the failure of any single Availability Zone (AZ) within a region. During normal operations, all public customer traffic must be routed to `us-east-1`, and costs in the secondary region must be minimized.

Which of the following architectures meets these requirements with the lowest cost and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, deploy the ALB and configure the ECS ASG with a minimum capacity of 11 instance. In both VPCs, deploy a NAT Gateway in each Availability Zone and associate private subnet route tables with the local NAT Gateway in the same Availability Zone. Associate the fintech.internal Private Hosted Zone with both VPCs. Create Route 53 failover routing records in the public hosted zone, setting the us-east-1 ALB as primary with health checks, and the us-west-2 ALB as secondary.

Cevap

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, deploy the ALB and configure the ECS ASG with a minimum capacity of 1 instance. In both VPCs, deploy a NAT Gateway in each Availability Zone and associate private subnet route tables with the local NAT Gateway in the same Availability Zone. Associate the fintech.internal Private Hosted Zone with both VPCs. Create Route 53 failover routing records in the public hosted zone, setting the us-east-1 ALB as primary with health checks, and the us-west-2 ALB as secondary.
The correct architecture uses Amazon Aurora Global Database to achieve near-zero replication lag, satisfying the 1-minute RPO requirement. An ECS Auto Scaling group with a minimum capacity of 1 instance in the recovery region ensures that the standby ALB has at least one active backend target, allowing the Route 53 health check to pass while minimizing compute costs during normal operations. Outbound NAT gateway redundancy (deploying a NAT Gateway in each Availability Zone) ensures that internet-bound traffic remains operational if a single Availability Zone experiences an outage. Associating the internal Route 53 Private Hosted Zone with both VPCs ensures that microservices can resolve internal endpoints in either region. Finally, Route 53 Failover routing records automatically redirect public traffic from the primary region to the secondary region if the primary load balancer fails health checks.

Adım Adım Çözüm

1
Select a database replication strategy that satisfies the RPO requirement.
Amazon Aurora Global Database provides sub-second replication lag to the secondary region, meeting the 11-minute RPO constraint, whereas daily snapshots only offer a 2424-hour RPO.
Regulatory compliance demands near-real-time replication to prevent transaction data loss in a disaster scenario.
2
Ensure outbound connectivity meets the high availability criteria in both regions.
Deploying one NAT Gateway per Availability Zone (AZ) in both regions ensures that a failure in a single AZ does not disrupt outbound internet traffic for resources in other AZs.
A single regional NAT Gateway is a single point of failure, violating the requirement that outbound paths survive any single AZ outage.
3
Establish cross-region DNS resolution and failover configurations.
Associate the Route 53 Private Hosted Zone with both the primary and standby VPCs, and create Route 53 failover routing records pointing to the ALBs.
Private Hosted Zones must be explicitly associated with each VPC that requires internal domain resolution. Failover routing ensures all public traffic stays in the primary region during normal operations.
4
Configure the standby application tier to support health checking while minimizing cost.
Set the ECS Auto Scaling Group in the secondary region to a minimum capacity of 11 running instance behind the secondary Application Load Balancer.
If capacity is set to 00, the secondary ALB health check will fail, which prevents Route 53 from routing traffic to it during a failover event. A Warm Standby with 1 instance minimizes cost while remaining functional.

Anahtar Kavram

Multi-Region High Availability and Disaster Recovery Design with Aurora Global Database, Route 53 failover, NAT Gateway redundancy, and Private Hosted Zone sharing.
Soru 149Soru →

A retail corporation manages 7575 member accounts in AWS Organizations. They need to aggregate VPC Flow Logs from all VPCs in all accounts into a single S3 bucket in a dedicated Logging account. The logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK). The security team requires that the configuration uses the most operationally efficient method and conforms to the principle of least privilege, preventing member accounts from having direct IAM write access to the central S3 bucket.

Which TWO of the following configurations are required to implement this centralized logging solution?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the bucket policy on the centralized S3 bucket in the Logging account to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions, restricted by a condition matching the AWS Organization ID.; Configure the key policy of the Customer Managed Key (CMK) in the Logging account to grant the delivery.logs.amazonaws.com service principal kms:GenerateDataKey* permissions, restricted by a condition matching the AWS Organization ID.

Cevap

Configure the bucket policy on the centralized S3 bucket to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions restricted by the AWS Organization ID, and configure the key policy of the Customer Managed Key (CMK) to grant the delivery.logs.amazonaws.com service principal kms:GenerateDataKey* permissions restricted by the AWS Organization ID.
The correct solution involves configuring the centralized S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to execute s3:PutObject and s3:GetBucketAcl actions, while also configuring the Customer Managed Key (CMK) key policy to allow the same service principal to execute kms:GenerateDataKey* actions. Both policies should be restricted to the AWS Organization ID using the aws:PrincipalOrgID condition. This setup ensures that the native log delivery service can write encrypted logs to the central bucket on behalf of all accounts within the organization without needing IAM roles or compromising the principle of least privilege.

Adım Adım Çözüm

1
Analyze the log delivery mechanism for VPC Flow Logs to S3.
Identify that VPC Flow Logs writes to S3 using the delivery.logs.amazonaws.com service principal.
This establishes that permissions must be granted to this service principal in the destination account's S3 bucket policy and KMS key policy rather than through cross-account IAM roles or AWS Resource Access Manager.
2
Evaluate S3 bucket policy requirements.
Determine that the central logging S3 bucket policy must allow s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com, restricted by the aws:PrincipalOrgID condition.
This ensures that only member accounts belonging to the organization can successfully deliver logs to the central bucket, satisfying the security and least-privilege constraints.
3
Evaluate KMS CMK key policy requirements.
Determine that because a CMK is used for S3 bucket encryption, the delivery.logs.amazonaws.com service principal requires kms:GenerateDataKey* permissions in the CMK key policy, restricted by the aws:PrincipalOrgID condition.
The delivery service must be able to generate data keys to encrypt the log objects before writing them to the bucket. Using an AWS-managed key (aws/s3) is not possible since its policy cannot be modified for cross-account access.

Anahtar Kavram

Cross-account VPC Flow Logs delivery to a centralized S3 bucket encrypted with a KMS CMK requires granting permissions to the delivery.logs.amazonaws.com service principal in both the S3 bucket policy and the KMS key policy.
Soru 150Soru →

A company has a multi-account AWS environment with 12 spoke VPCs in a single AWS Region. The company needs to design a highly available hybrid network architecture to connect these VPCs to its on-premises data center. The primary path must use a 10 Gbps AWS Direct Connect connection with a Direct Connect Gateway and an AWS Transit Gateway. An IPsec VPN over the public internet connected to the same Transit Gateway must serve as the backup path. All traffic must prefer the Direct Connect path under normal operations and automatically fail over to the VPN if the Direct Connect connection becomes unavailable. Which TWO routing configurations must the Solutions Architect implement on the customer gateway to ensure this symmetric routing behavior? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the customer gateway to set a higher BGP local preference attribute for routes received from AWS via the Direct Connect connection than for routes received via the VPN connection.; Configure the customer gateway to advertise the on-premises network prefixes over both connections, but prepend the customer gateway's Autonomous System (AS) number multiple times when advertising over the VPN connection.

Cevap

Configure the customer gateway to set a higher BGP local preference attribute for routes received from AWS via the Direct Connect connection, and configure the customer gateway to advertise the on-premises network prefixes over both connections while prepending the AS number multiple times over the VPN connection.
Under normal operations, setting a higher local preference for routes received via the Direct Connect connection ensures that on-premises outbound traffic (inbound to AWS) uses the Direct Connect link. Prepending the AS path on the VPN link ensures that AWS prefers the Direct Connect path for outbound traffic from the VPCs. These two configurations guarantee symmetric routing over the primary path with automatic failover to the backup VPN path.

Adım Adım Çözüm

1
Determine the routing mechanism for traffic originating from the on-premises data center (inbound to AWS).
BGP local preference is a local attribute used within an Autonomous System to prefer one exit point over another. Setting a higher local preference for the Direct Connect path ensures that the on-premises routers select this path for all traffic destined to AWS VPCs.
This establishes primary routing for inbound traffic to AWS.
2
Determine the routing mechanism for traffic originating from AWS VPCs (outbound to the on-premises data center).
AWS Transit Gateway selects the path with the shortest AS Path when multiple BGP routes are propagated. Prepending the AS number on the VPN connection artificially increases its AS Path length, making the Direct Connect path the preferred route.
This establishes primary routing for outbound traffic from AWS, preventing asymmetric routing.

Anahtar Kavram

BGP path selection attributes (Local Preference and AS Path prepending) are critical for establishing symmetric, deterministic routing over redundant hybrid connections (Direct Connect and VPN) connected to AWS Transit Gateway.
Soru 151Soru →

A utility company is deploying a smart water grid telemetry system on AWS. The system must continuously collect telemetry data from thousands of regional flow sensors and store it in a relational database. To protect against a regional outage, the architecture must span two AWS Regions (a primary and a secondary region) with a Recovery Point Objective (RPO) of 55 minutes and a Recovery Time Objective (RTO) of 1515 minutes. The processing applications run on Amazon EC2 instances in private subnets and must periodically send reports to an external compliance service over the public internet. Which two architecture components should a solutions architect recommend to meet these requirements with high availability while minimizing regional failover delay? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. If a regional failure occurs, promote the secondary cluster to support write traffic, keeping data replication latency under 11 second.; Deploy a NAT Gateway in each Availability Zone in both regions. Update the route tables of the private subnets to direct outbound traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in the same Availability Zone.

Cevap

Configure Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region, promoting the secondary cluster during a failover. Additionally, deploy a NAT Gateway in each Availability Zone in both regions, updating the route tables of the private subnets to route outbound traffic through their respective local NAT Gateways.
Implementing Amazon Aurora Global Database allows for replication lag of under 11 second and fast cluster promotion in the event of a regional failure, which satisfies the 55-minute RPO and 1515-minute RTO. Deploying a NAT Gateway in each Availability Zone and configuring local VPC routing ensures that outbound internet traffic has no single point of failure within a region, maintaining high availability for reporting services.

Adım Adım Çözüm

1
Select a replication strategy that supports near-zero data loss and rapid recovery to satisfy the 55-minute RPO and 1515-minute RTO.
Amazon Aurora Global Database provides physical block-level replication with lag under 11 second, and can be promoted to a primary cluster in less than a minute.
Traditional backup and restore methods fail both RPO and RTO requirements, making live cross-region replication mandatory.
2
Ensure outbound connectivity for reporting nodes does not have a single point of failure in any Availability Zone.
By deploying a NAT Gateway in each Availability Zone, subnet route tables can resolve internet-bound traffic locally, preventing a single zone's failure from blocking outbound data.
High availability requires removing single points of failure at the zone level, which is compromised by using a single NAT Gateway.
3
Verify DNS and secondary database accessibility configurations.
Confirm that Private Hosted Zones are associated with all participant VPCs, and that database replication targets are read-capable or promotable rather than passive standbys.
Improper DNS association and attempts to read from passive standbys are common design flaws that prevent successful failovers.

Anahtar Kavram

High Availability and Disaster Recovery Design for Multi-Region Architectures
Soru 152Soru →

A large enterprise is setting up centralized logging for its AWS Organization, which contains 3535 member accounts. The solutions architect is configuring an organization-wide AWS CloudTrail trail to deliver management events to a centralized Amazon S3 bucket located in a dedicated Security account. The security policy requires that all logs be encrypted at rest using AWS KMS with a Customer Managed Key (CMK) to allow detailed auditing of key access. Which of the following configurations must the solutions architect implement to ensure successful log delivery from all accounts?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy in the Security account to grant write permissions to the AWS CloudTrail service principal, restricting access using the Organization ID condition. Update the Customer Managed KMS key policy to grant the CloudTrail service principal permissions to generate data keys and decrypt, restricted by the Organization ID.

Cevap

Configure the S3 bucket policy to grant write permissions to the CloudTrail service principal with the Organization ID condition, and configure the Customer Managed KMS key policy to allow CloudTrail to generate data keys and decrypt.
The correct configuration requires granting write access (s3:PutObject) to the AWS CloudTrail service principal (cloudtrail.amazonaws.com) via the S3 bucket policy in the Security account, using the aws:PrincipalOrgID condition to ensure only trails within the organization can write. Additionally, because a Customer Managed KMS Key is used, the key policy must grant permissions (kms:GenerateDataKey* and kms:Decrypt) to the CloudTrail service principal, as AWS-managed keys do not support policy modification and cannot be shared across accounts.

Adım Adım Çözüm

1
Configure the S3 bucket policy in the Security account.
Grants CloudTrail service principal write permissions (s3:PutObject) restricted by aws:PrincipalOrgID.
Enables CloudTrail to deliver logs from any account in the organization while preventing external access.
2
Configure the Customer Managed KMS Key (CMK) policy.
Grants CloudTrail service principal permissions to kms:GenerateDataKey* and kms:Decrypt.
Required to encrypt logs using a custom key at rest, since default AWS-managed KMS keys cannot be shared for cross-account log delivery.

Anahtar Kavram

Cross-account centralized logging with AWS CloudTrail, S3 bucket policies, and Customer Managed KMS Keys.
Tahmini Süre:1m 30s
Soru 153Soru →

An enterprise manages 120120 AWS accounts using AWS Organizations. The security team wants to enable a centralized audit trail using AWS CloudTrail to record all API activity across all accounts. The logs must be stored in a central Amazon S3 bucket located in a dedicated Security account. All logs must be encrypted at rest using an AWS KMS key. The solution must ensure that new accounts created within the organization are automatically included in the trail, and that member accounts cannot modify or delete the logging configuration.

Which approach should the Solutions Architect implement to meet these requirements securely?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon S3 bucket in the Security account with a bucket policy that grants s3:PutObject and s3:GetBucketAcl permissions to the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. Create a customer managed KMS key in the Security account with a key policy that allows CloudTrail to use kms:GenerateDataKey* and kms:DescribeKey. Create an organization trail in the Organizations management account that points to the central S3 bucket and uses the customer managed KMS key.

Cevap

To securely centralize CloudTrail logging across an AWS Organization, the Solutions Architect must deploy an organization trail, use a centralized S3 bucket with a bucket policy that permits cross-account CloudTrail delivery using the aws:PrincipalOrgID condition, and encrypt the logs using a customer managed KMS key with a policy configured to allow CloudTrail access from all member accounts.
The correct solution uses an organization trail, which automatically logs events across all member accounts (including newly created ones) and prevents local modification by member accounts. Log aggregation is secured via a resource-based S3 bucket policy in the Security account that restricts writes to the organization's accounts using the aws:PrincipalOrgID condition. Encryption uses a customer managed key with a custom key policy, which is required because the default AWS managed key (aws/cloudtrail) does not allow policy modification to support cross-account operations.

Adım Adım Çözüm

1
Configure the central S3 bucket policy in the Security account.
Allows the CloudTrail service principal to write logs (s3:PutObject) and check ACLs (s3:GetBucketAcl) for all accounts within the organization by specifying the organization ID in the aws:PrincipalOrgID condition.
Ensures that CloudTrail can deliver logs from any member account without needing individual account policies.
2
Configure the customer managed KMS key policy in the Security account.
Grants CloudTrail permissions to use kms:GenerateDataKey* and kms:DescribeKey to encrypt logs prior to writing them to the bucket.
Since AWS managed KMS keys cannot be shared cross-account, a customer managed key with explicit cross-account permissions is required.
3
Deploy an organization trail from the Organizations management account.
Deploys a standardized, non-modifiable trail to all current and future member accounts.
Meets the requirement to automatically include new accounts and prevent local modification of the audit configuration.

Anahtar Kavram

Centralized auditing and logging using AWS Organizations organizational trails, S3 bucket policies, and cross-account customer managed KMS keys.
Tahmini Süre:2m 0s
Soru 154Soru →

A gaming company is deploying an updated matchmaking microservice package using AWS Lambda. The microservice receives high volume traffic via Amazon API Gateway. To minimize the blast radius of any potential deployment failures, the DevOps team requires a deployment strategy that routes exactly 10%10\% of incoming production traffic to the new Lambda version for a validation period of 1515 minutes. If no latency or error alarms are triggered during this period, all remaining traffic must immediately shift to the new version. The team wants the entire deployment to complete in the shortest time possible once the validation window is successfully passed. Which AWS CodeDeploy deployment configuration should the solutions architect specify to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.LambdaCanary10Percent15Minutes

Cevap

CodeDeployDefault.LambdaCanary10Percent15Minutes
The correct configuration is the canary deployment that routes 10%10\% of traffic initially, holds it for 1515 minutes to monitor CloudWatch alarms, and then shifts all remaining traffic (90%90\%) to the new version. This satisfies both the validation duration and the requirement to complete the deployment in the shortest time after validation.

Adım Adım Çözüm

1
Analyze the traffic shifting pattern requirement.
The requirements ask for an initial 10%10\% shift, followed by a 1515-minute validation period, and then a final shift of all remaining traffic (100%100\% total) in a single step. This defines a canary deployment pattern (two-step shifting), not a linear deployment pattern (multi-step gradual shifting).
Identifying the deployment pattern eliminates linear configurations which continue to shift traffic in small increments over a long duration.
2
Evaluate the validation duration requirement against default AWS configurations.
The validation period is specified as 1515 minutes. The appropriate canary configuration must hold the initial 10%10\% traffic routing for exactly 1515 minutes.
This rules out shorter configurations such as the 55-minute canary option.
3
Select the matching AWS CodeDeploy predefined configuration.
The predefined configuration matching a 10%10\% initial shift and 1515-minute validation window is CodeDeployDefault.LambdaCanary10Percent15Minutes.
Using predefined configurations simplifies pipeline management and ensures AWS-native behavior without custom scripting.

Anahtar Kavram

AWS CodeDeploy deployment configurations for Lambda allow architects to choose between canary, linear, and all-at-once traffic-shifting patterns. A canary pattern shifts traffic in two increments (a specified percentage for a validation period, followed by the remainder), whereas a linear pattern shifts traffic in equal increments at regular intervals.
Tahmini Süre:1m 30s
Soru 155Soru →

A company is designing a high-availability telemetry processing system for a regional electric vehicle (EV) charging network. The application tier runs on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones, positioned behind an Application Load Balancer (ALB). The database tier uses Amazon Aurora PostgreSQL. The design requirements specify a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 2 minutes. Outbound communications from the EC2 instances to external third-party APIs must remain highly available even during local network device failures. In the event of a regional disaster, the application must fail over to a secondary AWS region with minimal manual intervention. Which two options should the solutions architect choose to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary DB cluster in the active region and a secondary DB cluster in the disaster recovery region to achieve sub-minute data replication.; Deploy a NAT Gateway in each Availability Zone within the active region, and update the route tables of the private subnets in each zone to point outbound traffic to the NAT Gateway in their corresponding zone.

Cevap

Deploying an Amazon Aurora Global Database with a secondary DB cluster in the disaster recovery region, and deploying a NAT Gateway in each Availability Zone with local route configurations.
Deploying an Amazon Aurora Global Database provides physical replication to a secondary region with sub-second lag, satisfying the 2-minute RPO. Promoting this secondary cluster handles failovers within the 15-minute RTO. Additionally, deploying separate NAT Gateways in each Availability Zone prevents a single Availability Zone outage from disrupting outbound network traffic for the remaining zones.

Adım Adım Çözüm

1
Evaluate the database replication strategy against the 2-minute RPO constraint.
Amazon Aurora Global Database replication occurs at the storage layer with typical lag of less than 1 second, meeting the 2-minute RPO requirement, whereas snapshot restoration has an RPO of up to 1 hour.
Ensuring the selected replication mechanism matches the target data loss threshold.
2
Evaluate outbound traffic routing for high availability.
A multi-AZ application tier requires localized NAT Gateways in each Availability Zone so that an outage in one zone does not disrupt outbound traffic originating from other zones.
Eliminating single points of failure in outbound network pathing.
3
Assess the internal DNS name resolution requirements across VPC boundaries.
Route 53 Private Hosted Zones require explicit association with target VPCs across peered networks to resolve internal DNS names.
Ensuring cross-region service connectivity behaves as expected.

Anahtar Kavram

Designing multi-region disaster recovery and multi-Availability Zone high availability configurations on AWS.
Soru 156Soru →

An enterprise is designing a deployment pipeline for a critical online transaction processing API hosted on Amazon ECS with AWS Fargate, fronted by an Application Load Balancer (ALB). The API is highly sensitive to service disruptions, and any new deployment must support an automated rollback that completes in under 60 seconds if the containerized application logs an elevated rate of HTTP 5XX errors. The development team proposes using AWS CloudFormation to manage the stack, utilizing the default ECS deployment controller with a rolling update strategy, setting the minimum healthy percent to 100% and the maximum percent to 200%. What is the primary risk associated with this proposed strategy, and what is the most effective way to redesign the deployment pipeline to meet the rollback requirements?

Cevabı ve açıklamayı göster

Cevap: A rolling update rollback requires CloudFormation or ECS to launch new tasks of the previous version and wait for them to pass health checks, which exceeds the 60-second target. The pipeline should be redesigned to use the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY), configuring CloudWatch alarms for ALB 5XX errors that trigger an immediate rollback by shifting traffic back to the original task set at the load balancer level.

Cevap

The primary risk is that rolling back an ECS rolling update requires launching new tasks of the previous version and waiting for them to pass health checks, which exceeds the 60-second target. The most effective redesign is to use the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY) with CloudWatch alarms to trigger an immediate traffic shift back to the original task set at the load balancer level.
The correct option correctly identifies that ECS rolling updates cannot meet a 60-second rollback window because rolling back requires provisioning new tasks and waiting for health checks. By using AWS CodeDeploy with the blue/green deployment controller (CODE_DEPLOY), the active tasks of the previous version (blue) are kept running and registered to their target group during the deployment. If the CloudWatch alarm for HTTP 5XX errors is breached, CodeDeploy immediately shifts traffic back to the blue target group at the ALB level, achieving rollback in seconds without provisioning new infrastructure.

Adım Adım Çözüm

1
Analyze the rollback time constraint of 60 seconds for an ECS service fronted by an ALB.
Identify that a standard rolling update rollback requires provisioning new tasks of the previous task definition, which typically takes minutes due to container startup and ALB health check verification.
To evaluate if the proposed rolling update strategy meets the 60-second rollback SLA.
2
Evaluate the capabilities of the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY) for ECS.
CodeDeploy maintains two target groups (blue and green). During deployment, the blue target group remains active and serving traffic. Once the green target group is provisioned, CodeDeploy shifts traffic. If a rollback is triggered, CodeDeploy immediately updates the ALB listener to point back to the blue target group.
To determine how to achieve near-instantaneous traffic redirection for rollbacks.
3
Configure the automated rollback triggers.
Associate a CloudWatch alarm monitoring HTTP 5XX metrics on the target group with the CodeDeploy deployment group.
To ensure that rollbacks are automated and initiated immediately upon detecting service degradation.

Anahtar Kavram

ECS Blue/Green Deployments via AWS CodeDeploy
Tahmini Süre:2m 30s
Soru 157Soru →

A Solutions Architect is designing the deployment strategy for a new web application hosted on Amazon ECS with AWS Fargate. The application is fronted by an Application Load Balancer (ALB). The deployment process must satisfy the following business requirements:

- Shift 10% of the traffic to the new version initially, and shift the remaining 90% after 10 minutes of successful monitoring.
- Automatically roll back the deployment immediately if the HTTP 5xx error rate on the ALB exceeds 1% during the evaluation period.
- Rollbacks must incur zero downtime and ensure that no lingering traffic is directed to the new version.

Which two configurations should the Solutions Architect specify to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS CodeDeploy with a deployment group that specifies the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration.; Create an Amazon CloudWatch alarm for the Application Load Balancer HTTPCode_Target_5XX_Count metric, and add this alarm to the rollback configuration of the CodeDeploy deployment group.

Cevap

The correct configurations are to configure AWS CodeDeploy with a deployment group that specifies the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration, and to create an Amazon CloudWatch alarm for the Application Load Balancer HTTPCode_Target_5XX_Count metric, adding this alarm to the rollback configuration of the CodeDeploy deployment group.
The correct answer combines AWS CodeDeploy's native canary deployment capability for Amazon ECS with Application Load Balancer monitoring. AWS CodeDeploy provides the built-in CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration, which shifts 10% of the traffic to the replacement task set (the new version), waits 10 minutes, and then shifts the remaining 90%. To automate the rollback based on HTTP 5xx errors, a CloudWatch alarm must be configured for the Application Load Balancer's HTTPCode_Target_5XX_Count metric and defined as a rollback trigger in the CodeDeploy deployment group. If the alarm transitions to the ALARM state during the deployment, CodeDeploy immediately and automatically reroutes 100% of the traffic back to the original task set, achieving zero downtime.

Adım Adım Çözüm

1
Set the deployment controller for the Amazon ECS service to AWS CodeDeploy.
Enables blue/green deployments and canary routing configurations on the target ECS service.
Allows AWS CodeDeploy to manage the creation of a replacement task set and control traffic routing using target groups.
2
Specify the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration in the CodeDeploy deployment group.
Configures a traffic shifting pattern where 10% of traffic is routed to the new task set, followed by the remaining 90% after 10 minutes.
Directly satisfies the business requirement for a 10% canary traffic shift and a 10-minute evaluation period.
3
Create an Amazon CloudWatch alarm monitoring the HTTPCode_Target_5XX_Count metric on the Application Load Balancer.
Generates an alarm state if the rate of HTTP 5xx errors exceeds the specified threshold.
Establishes a quantitative monitoring mechanism for the application's error rate.
4
Associate the CloudWatch alarm as a rollback trigger within the AWS CodeDeploy deployment group.
Triggers an automatic rollback of the deployment if the alarm goes into the ALARM state during the canary phase.
Ensures immediate rollback to the original task set with zero downtime and no lingering traffic to the replacement tasks.

Anahtar Kavram

Deployment Strategy Design using AWS CodeDeploy for Amazon ECS
Soru 158Soru →

A logistics company is designing a new multi-region package tracking application to be deployed across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The public web tier uses Application Load Balancers (ALBs) in both regions. The internal microservices communicate with one another using private domain names managed via a single Amazon Route 53 Private Hosted Zone. The database tier uses Amazon Aurora PostgreSQL.

The architecture must meet a Recovery Time Objective (RTO) of 1515 minutes and a Recovery Point Objective (RPO) of 55 minutes. Under normal operations, public users should be routed to the region that provides the lowest network latency. If a regional outage occurs, traffic must fail over automatically to the healthy region, and internal microservices in the secondary region must be able to resolve each other's endpoints using the same private domain names.

Which configuration will meet these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Create Amazon Route 53 latency routing records pointing to the public ALBs in each region, and associate them with Route 53 health checks. Associate the Route 53 Private Hosted Zone with the VPCs in both us-east-1 and us-west-2.

Cevap

The correct configuration is to use Amazon Aurora Global Database for sub-second database replication, Route 53 latency routing with health checks for public endpoint failover, and associate the shared Route 53 Private Hosted Zone with the VPCs in both regions to enable internal name resolution.
The configuration utilizing Amazon Aurora Global Database achieves a near-zero RPO (under 1 second) and an RTO of under 1 minute for database promotion, satisfying the 15-minute RTO and 5-minute RPO. Route 53 latency-based routing with health checks ensures public traffic is routed to the region with the lowest latency under normal conditions and automatically redirects to the healthy region during a failure. Finally, associating the Route 53 Private Hosted Zone with the VPCs in both regions ensures internal microservices can resolve endpoints cross-region using the same private DNS names.

Adım Adım Çözüm

1
Determine the disaster recovery pattern required to satisfy the 55-minute RPO and 1515-minute RTO.
Select Amazon Aurora Global Database, which offers sub-second replication latency (RPO) and can be promoted in less than 11 minute (RTO).
Traditional backup-and-restore or snapshot copy methods (e.g., every 44 hours) exceed the 55-minute RPO.
2
Design the DNS routing configuration for routing users based on lowest latency with automatic failover.
Use Route 53 latency-based routing records for public ALBs, associated with Route 53 health checks.
Route 53 Latency routing routes traffic to the closest region, and health checks ensure Route 53 automatically stops sending traffic to an unhealthy region.
3
Configure private name resolution for internal microservices across both regions.
Associate the shared Route 53 Private Hosted Zone with the VPCs in both the primary and secondary regions.
Route 53 Private Hosted Zones must be explicitly associated with any VPC that requires resolution of those private records.

Anahtar Kavram

High Availability and Disaster Recovery Design
Tahmini Süre:2m 0s
Soru 159Soru →

A global retail company is deploying a mission-critical order processing application on AWS. The primary site is located in the `us-west-2` Region, and the secondary disaster recovery (DR) site is in the `us-east-1` Region. The architecture must satisfy a Recovery Point Objective (RPO) of less than 11 minute and a Recovery Time Objective (RTO) of less than 1515 minutes. The database tier runs on Amazon Aurora PostgreSQL. Additionally, application servers in private subnets must send transaction confirmations to an external payment processor via the internet; this outbound traffic must remain highly available even during an Availability Zone (AZ) outage. Internal microservices communicate privately using a Route 53 Private Hosted Zone (PHZ). Which combination of actions will meet the disaster recovery objectives while ensuring high availability for all system components? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary cluster in `us-west-2` and a secondary cluster in `us-east-1` to maintain an RPO of less than 11 minute. Set up Route 53 public Active-Passive Failover routing records with health checks pointing to the Application Load Balancers in both Regions to automate public DNS failover.; Deploy a NAT Gateway in each Availability Zone of the VPCs in both `us-west-2` and `us-east-1` to ensure highly available outbound connectivity. Associate the Route 53 Private Hosted Zone for the internal microservices with the VPCs in both Regions to ensure private DNS resolution remains operational after failover.

Cevap

The correct actions are to configure Amazon Aurora Global Database with Route 53 Active-Passive Failover, and to deploy redundant NAT Gateways across all Availability Zones in both regions while associating the Route 53 Private Hosted Zone with the VPCs in both regions.
Configuring Amazon Aurora Global Database provides sub-second replication lag across regions, satisfying the sub-minute RPO. Route 53 public failover routing with health checks automates traffic redirection to the secondary region within the RTO target. Additionally, deploying a NAT Gateway in each AZ avoids a single point of failure for outbound traffic, while associating the Route 53 Private Hosted Zone with the VPCs of both Regions ensures that internal name resolution works correctly in both environments.

Adım Adım Çözüm

1
Select a database replication mechanism that supports an RPO of less than 11 minute across regions.
Identify that Amazon Aurora Global Database provides sub-second replication, which easily meets the RPO constraint.
Traditional backup/restore and snapshot replication methods take hours, violating the strict RPO.
2
Establish an automated multi-region DNS failover strategy that fits within the 1515-minute RTO.
Configure Route 53 Failover routing policies coupled with active health checks pointing to regional ALBs.
This automatically detects primary region failures and updates DNS records to route traffic to the secondary region within minutes.
3
Ensure outbound connectivity for payment gateway processing is highly available and resilient to AZ failures.
Deploy a NAT Gateway in each Availability Zone of the VPCs in both the primary and secondary regions.
A single NAT Gateway per region is a single point of failure; multi-AZ NAT Gateways prevent outages if one AZ goes down.
4
Configure internal service discovery for cross-region disaster recovery.
Associate the Route 53 Private Hosted Zone with the VPCs in both regions.
Route 53 Private Hosted Zones do not resolve DNS queries from another VPC unless they are explicitly associated with that VPC, even over a peered connection.

Anahtar Kavram

Multi-Region High Availability and Disaster Recovery Design
Soru 160Soru →

A retail company is designing a hybrid network to connect 2525 spoke VPCs in the `eu-west-1` Region to two on-premises data centers. The company has established a 10 Gbps10\text{ Gbps} AWS Direct Connect connection at each data center. To ensure high availability, they also want to deploy a backup AWS Site-to-Site VPN connection over the internet. The traffic between the on-premises data centers and the spoke VPCs must use the Direct Connect connections as the primary path and fail over to the VPN connection only during a total Direct Connect outage. Additionally, the spoke VPCs must be able to communicate with each other directly through the central hub. Which configuration should a solutions architect recommend to meet these requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway and attach all 2525 spoke VPCs. Create a Direct Connect Gateway, associate it with the Transit Gateway, and establish Transit Virtual Interfaces. Configure an AWS Site-to-Site VPN connection as a VPN attachment on the Transit Gateway. Configure BGP on the on-premises routers to advertise the on-premises CIDR blocks over both paths, prepending the AS Path on the VPN connection to ensure the Direct Connect connection is preferred.

Cevap

Deploy an AWS Transit Gateway and attach all spoke VPCs, associate a Direct Connect Gateway with Transit Virtual Interfaces, and establish a Site-to-Site VPN connection as an attachment on the Transit Gateway, using BGP AS Path prepending to prefer the Direct Connect path.
The correct option correctly uses AWS Transit Gateway to attach the 25 spoke VPCs, satisfying the inter-VPC communication requirement. It integrates both the primary Direct Connect connections (via a Direct Connect Gateway and Transit VIFs) and the backup VPN connection (via a Transit Gateway VPN attachment) into a single hub. By prepending the BGP AS Path on the VPN path, the Direct Connect connections are preferred for inbound traffic, and BGP routing ensures automatic failover during a Direct Connect outage.

Adım Adım Çözüm

1
Centralize VPC connectivity using AWS Transit Gateway.
All 25 spoke VPCs are attached to the Transit Gateway, enabling inter-VPC communication and centralizing external connectivity.
Transit Gateway acts as a cloud router, supporting transitive routing between VPCs and external networks with low administrative overhead.
2
Configure the primary hybrid path using AWS Direct Connect and a Direct Connect Gateway.
A Direct Connect Gateway is associated with the Transit Gateway, and Transit VIFs are established from the on-premises data centers to the Direct Connect Gateway.
Transit VIFs are required to carry traffic between a Direct Connect Gateway and a Transit Gateway.
3
Configure the backup hybrid path using an AWS Site-to-Site VPN connection.
A VPN connection is created and attached directly to the Transit Gateway as a VPN attachment.
This provides a secondary path over the public internet that terminates on the same Transit Gateway hub.
4
Manage routing preferences using BGP path attributes.
Both paths advertise the same on-premises routes, but the VPN path has its BGP AS Path prepended multiple times.
AWS will prefer the Direct Connect path due to the shorter AS Path. If the Direct Connect path fails, BGP will automatically fail over to the VPN path.

Anahtar Kavram

AWS Transit Gateway acts as a centralized hub that supports transitive routing between VPCs, Direct Connect Gateways (via Transit VIFs), and Site-to-Site VPN attachments. By utilizing BGP attributes such as AS Path prepending, network traffic can be dynamically routed to prefer Direct Connect over a backup VPN connection.
ÖncekiSayfa 8 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin