Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 1661Soru →

A technology company is designing a new critical business application utilizing an online transaction processing (OLTP) database. The system must support high-availability read operations that scale dynamically during peak traffic periods, while maintaining a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of near-zero. Additionally, transaction logs must be stored securely in an Amazon S3 bucket located in a separate, centralized Compliance Audit AWS account. All data at rest must be encrypted. The security policy mandates that the Compliance Audit account must be able to decrypt the transaction logs, and the encryption keys must be managed in the Production account using custom key policies to delegate access. Which database and storage design satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling configured for the reader instances. Encrypt the DB cluster using a Customer Managed Key (CMK) in AWS KMS. Configure log replication to the Amazon S3 bucket in the Compliance Audit account, and configure the KMS CMK key policy in the Production account to allow the Compliance Audit account to decrypt the data.

Cevap

Deploying an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling for reader instances, encrypting with a Customer Managed Key (CMK), and updating the KMS key policy to allow cross-account S3 decrypt permissions.
The correct answer utilizes Amazon Aurora PostgreSQL with reader replicas and Auto Scaling to scale read performance dynamically while ensuring low latency replication. It also correctly specifies a Customer Managed Key (CMK) rather than an AWS-managed key, enabling the policy modifications necessary to delegate cross-account decryption rights to the Compliance Audit account.

Adım Adım Çözüm

1
Select database engine and architecture to support horizontal read scaling and low RTO/RPO.
Amazon Aurora PostgreSQL with reader auto-scaling is selected as it replicates data with minimal lag and allows readers to scale out. Standard RDS Multi-AZ standby instances cannot serve traffic.
To satisfy the high-availability read scaling requirements and strict recovery times.
2
Determine the required encryption key configuration for cross-account access.
A Customer Managed Key (CMK) is chosen instead of the default AWS-managed key.
Default AWS-managed keys do not support policy modification and cannot be shared across accounts.
3
Configure permissions for the S3 bucket and encryption keys to allow compliance decryption.
Update the KMS CMK key policy in the Production account to trust the Compliance Audit account principal.
Allows the cross-account compliance system to decrypt the replicated transaction logs.

Anahtar Kavram

Selecting high-performance databases with cross-account access delegation and horizontal scaling.
Tahmini Süre:2m 0s
Soru 1662Soru →

A retail logistics company is migrating its legacy inventory management servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The on-premises environment is connected to AWS via an AWS Direct Connect connection terminated at an AWS Transit Gateway. The migration team has configured the replication settings in AWS MGN to use the private IP addresses of the replication servers in the staging area VPC to ensure traffic does not traverse the public internet. However, after installing the replication agent on the source servers, the replication status remains in a disconnected state and no data is being transferred.

Which of the following configuration actions is required to resolve this connectivity issue and allow data replication to begin?

Cevabı ve açıklamayı göster

Cevap: Configure the on-premises firewalls to allow outbound traffic to the replication staging area subnet CIDR block on TCP port 1500, and ensure the security group attached to the replication servers in the staging VPC allows inbound traffic from the on-premises subnet range on TCP port 1500.

Cevap

Configure the on-premises firewalls to allow outbound traffic to the replication staging area subnet CIDR block on TCP port 1500, and ensure the security group attached to the replication servers in the staging VPC allows inbound traffic from the on-premises subnet range on TCP port 1500.
The correct configuration is to configure the on-premises firewalls to allow outbound traffic to the replication staging area subnet CIDR block on TCP port 1500, and ensure the security group attached to the replication servers in the staging VPC allows inbound traffic from the on-premises subnet range on TCP port 1500. This is because AWS Application Migration Service (MGN) replicates data continuously from the source agents to the replication servers in the staging area over TCP port 1500. Over a private connection such as AWS Direct Connect, security groups and firewalls must be explicitly configured to permit this traffic.

Adım Adım Çözüm

1
Identify the data replication mechanism and port requirements for AWS Application Migration Service (MGN).
AWS MGN requires TCP port 1500 for continuous data replication from the Replication Agent on the source servers to the replication servers in the staging area.
Data replication traffic runs over a dedicated, secure channel on port 1500, distinct from control plane API traffic (which runs over port 443).
2
Analyze the network path and security controls in place between the on-premises data center and the staging VPC.
The path goes through a Direct Connect connection and a Transit Gateway. Network routing is private, but firewalls and security groups block the necessary ports by default.
Private network paths must still permit port-level traffic in both the on-premises firewall and the AWS security groups.
3
Formulate the remediation step to open TCP port 1500.
Allow outbound TCP 1500 from the source servers on the on-premises firewall, and inbound TCP 1500 from the on-premises network range on the replication servers' security group in AWS.
This establishes bidirectional flow for the replication stream over the private Direct Connect link.

Anahtar Kavram

AWS MGN Staging Area Data Replication Port Requirements
Soru 1663Soru →

An enterprise has a multi-account AWS Organization. Account A hosts an Amazon Aurora PostgreSQL database cluster in a private VPC subnet. Account B hosts a critical business application running on Amazon ECS tasks in a private VPC subnet. Network connectivity between the two VPCs is established using an AWS Transit Gateway. The database cluster has IAM database authentication enabled. The security team requires that the application in Account B must connect to the database in Account A securely, using private DNS resolution and the principle of least privilege, while avoiding the use of long-term credentials.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account A, authorize the association of the Route 53 Private Hosted Zone with the VPC in Account B. In Account B, associate the VPC with the hosted zone to enable private DNS resolution of the database endpoint.; In Account A, create an IAM role with a trust policy that allows Account B's ECS task role to assume it, and attach an IAM policy allowing the rds-db:connect action. In Account B, configure the application to assume this role and generate a temporary database connection token.

Cevap

The correct actions are: authorizing and associating the Route 53 Private Hosted Zone from Account A with the VPC in Account B, and creating a cross-account IAM role in Account A that the ECS task role in Account B can assume to connect to the database via IAM database authentication.
To secure the cross-account database connection with private DNS resolution, the Solutions Architect must authorize and associate the Private Hosted Zone in Account A with Account B's VPC. Additionally, to avoid long-term credentials and follow the principle of least privilege, the Solutions Architect must configure a cross-account IAM role in Account A that Account B's ECS task role can assume, which grants permissions to connect to the database via IAM database authentication.

Adım Adım Çözüm

1
Authorize and associate the Private Hosted Zone with the VPC in Account B.
The application VPC in Account B can resolve the private DNS endpoint of the Aurora database in Account A.
This establishes private DNS resolution across AWS accounts without exposing the database to public DNS.
2
Configure the cross-account IAM role and trust relationship.
The application ECS tasks in Account B can assume the role in Account A to generate a database connection token.
This facilitates IAM database authentication using temporary credentials, eliminating the need to store long-term credentials.
3
Ensure Transit Gateway routing permits traffic between the VPCs on the database port.
Bidirectional network connectivity is allowed on port 5432.
Enables the application in Account B to connect to the database endpoint in Account A over the private network.

Anahtar Kavram

Cross-account IAM authentication and private DNS resolution to secure multi-account database traffic.
Soru 1664Soru →

A financial services organization is preparing to migrate its core transactional platform from an on-premises datacenter to AWS. The environment consists of 120 VMware vSphere VMs hosting the web and application tiers, 15 bare-metal servers running Red Hat Enterprise Linux (RHEL) 8 hosting Oracle databases, and 5 legacy bare-metal servers running IBM AIX hosting transactional processing workloads. The organization's security policy defines strict network isolation: the web and application tiers are allowed outbound web access via an HTTP proxy, but the database and legacy tiers are completely isolated with no outbound internet or proxy access allowed. The organization requires detailed network dependency mapping to group servers into applications before planning migration waves. The migration must be tracked centrally in AWS Migration Hub, utilizing AWS Application Migration Service (MGN) for the virtualized tiers and AWS Database Migration Service (DMS) for the databases. Which discovery and tracking strategy should a Solutions Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agent on the VMware vSphere VMs, configured to communicate through the outbound HTTP proxy to perform network dependency mapping. Manually collect configuration and dependency data for the RHEL database servers and IBM AIX legacy servers, format it using the Application Discovery Service import templates, and upload the CSV files. Group the discovered servers into applications in AWS Migration Hub, and associate the AWS MGN replication jobs and AWS DMS replication tasks with these applications to track progress.

Cevap

Deploy the AWS Application Discovery Agent on the VMware vSphere VMs configured to use the outbound HTTP proxy, manually collect and import the configuration and dependency data for the RHEL database and IBM AIX servers using CSV templates, group the servers into applications in AWS Migration Hub, and associate the AWS MGN replication jobs and AWS DMS replication tasks with these applications.
The correct strategy uses the Application Discovery Agent on the vSphere VMs since they have outbound proxy access and require deep network dependency mapping (which the Agentless Collector does not provide). For the bare-metal RHEL 8 database servers and IBM AIX legacy servers, the Agent cannot be used because RHEL is in a completely isolated network segment, and AIX is an unsupported operating system. Therefore, manual discovery data collection and import using the CSV templates is required. All discovered and imported resources can then be grouped into applications in Migration Hub and linked to MGN and DMS replication components for unified status tracking.

Adım Adım Çözüm

1
Analyze OS compatibility for discovery.
The vSphere VMs run standard OSs (Windows/Linux) and can support the Application Discovery Agent. RHEL 8 supports the Agent. IBM AIX is a Unix operating system that is NOT supported by the AWS Application Discovery Agent. Therefore, AIX servers must use manual data collection and the import template.
This determines which servers can run the agent and which require manual discovery data collection.
2
Evaluate network isolation and agent connectivity requirements.
The vSphere VMs have outbound access via an HTTP proxy, so the Discovery Agent can be installed and configured to communicate through this proxy. The database tier (RHEL 8) has no outbound internet or proxy access. Since the Discovery Agent requires direct or proxy outbound connectivity (port 443) to AWS, the agent cannot be used on these database servers. Consequently, the RHEL 8 database servers must also use manual collection and the CSV import template.
This maps out-of-band and in-band discovery boundaries based on the security compliance architecture.
3
Choose the correct discovery mechanism based on data requirements.
The organization requires detailed network dependency mapping. The Application Discovery Agentless Collector does not capture active network dependencies or process-level data. Thus, the Agentless Collector is insufficient for the vSphere VMs where dependency mapping is required. The Discovery Agent must be used on the vSphere VMs.
Ensures that dependency discovery requirements are satisfied, which is only supported by the Agent-based approach.
4
Design the tracking and grouping strategy in AWS Migration Hub.
After importing the RHEL/AIX servers via CSV and discovering the vSphere VMs via the Agent, group them into logical applications. Configure AWS MGN and AWS DMS. Ensure their replication tasks are associated with these application groups in AWS Migration Hub so that migration progress can be tracked in a single pane of glass.
Fulfills the centralized tracking requirement across multiple migration tools in AWS Migration Hub.

Anahtar Kavram

Selecting and configuring the correct discovery mechanism (Agent-based vs. Agentless vs. CSV Import) based on operating system support, network isolation constraints, and dependency data needs, then linking these discovered assets in AWS Migration Hub for unified tracking.
Tahmini Süre:3m 0s
Soru 1665Soru →

An enterprise is designing a secure multi-account governance strategy using AWS Organizations. The security team wants to establish a secure, managed landing zone with automated account provisioning, centralized logging, and strict service control policies (SCPs) to prevent member accounts from disabling security monitoring. Arrange the following steps in the correct sequence to configure and secure this multi-account environment, ensuring that guardrails are active before member accounts begin deploying workloads.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Deploy AWS Control Tower in the management account, register the Audit account as the delegated administrator, enable security services from the Audit account, attach the protective SCP from the management account, and finally provision member accounts.
The correct sequence begins with deploying AWS Control Tower to establish the landing zone, which creates the foundational OUs and core accounts (including the Audit account). Once the Audit account exists, delegated administration is configured from the management account, allowing the Audit account to manage security services organization-wide. The Audit account then enables GuardDuty and Security Hub. Next, the management account applies SCPs to member OUs to prevent disabling these monitoring tools, establishing the necessary guardrails. Finally, workload accounts are provisioned via Account Factory, ensuring they are governed by the established security baselines and SCPs from the moment of creation.

Adım Adım Çözüm

1
Deploy AWS Control Tower in the management account.
Establishes the foundational landing zone, OUs, and core accounts (Log Archive and Audit).
Creates the target accounts and OUs needed for delegation and policy attachment.
2
Designate the Audit account as the delegated administrator for GuardDuty and Security Hub from the management account.
Grants the Audit account organization-wide management permissions for the security services.
The Audit account cannot enable or configure services across other accounts without this delegation.
3
Enable and configure GuardDuty and Security Hub for all accounts from the Audit account.
Security monitoring is active across the organization.
Ensures that all member accounts are baseline-monitored before restricting changes or adding workloads.
4
Attach a protective SCP to member OUs from the management account.
Member accounts are restricted from disabling or modifying GuardDuty and Security Hub.
Establishes policy-based guardrails to maintain security posture.
5
Provision member accounts using AWS Control Tower Account Factory.
New member accounts are created with full guardrails and monitoring enabled from day one.
Ensures no unmonitored window of time exists for new workloads.

Anahtar Kavram

Multi-Account Security Governance and Control Delegation
Soru 1666Soru →

A digital media broadcasting company is migrating its on-premises video rendering workload consisting of 4040 servers to AWS using AWS Application Migration Service (MGN). The hybrid environment is connected via a dedicated 1 Gbps1\text{ Gbps} AWS Direct Connect connection to an AWS Transit Gateway, which routes traffic to a dedicated staging VPC and a target production VPC. The migration must use a private replication channel over the Direct Connect connection. The solutions architect configures AWS MGN VPC interface endpoints in the staging VPC and associates them with the appropriate Route 53 Private Hosted Zone. Although the AWS Replication Agent is successfully installed on all source servers, the replication status remains stuck in the 'Initiating' state, and the console reports a connection timeout to the replication servers. Which action should the solutions architect take to resolve this replication connection failure?

Cevabı ve açıklamayı göster

Cevap: Ensure that the security group of the replication servers in the staging VPC allows inbound traffic on TCP port 1500 from the on-premises subnet, and verify that the on-premises network allows outbound traffic on TCP port 1500 to the staging area subnets.

Cevap

Ensure that the security group of the replication servers in the staging VPC allows inbound traffic on TCP port 1500 from the on-premises subnet, and verify that the on-premises network allows outbound traffic on TCP port 1500 to the staging area subnets.
The correct action is to ensure that the security group of the replication servers in the staging VPC allows inbound traffic on TCP port 1500 from the on-premises subnet, and that the on-premises network allows outbound traffic on TCP port 1500 to the staging area subnets. AWS Application Migration Service (MGN) uses TCP port 1500 for replication data transmission from the source server to the replication servers launched in the staging VPC. While control plane traffic (such as registration and commands) uses TCP port 443, data plane replication requires TCP port 1500. If this port is blocked, the replication will fail to initialize and time out.

Adım Adım Çözüm

1
Analyze the migration status and symptoms.
The replication agent is successfully installed, which indicates that the control plane connection (TCP port 443) via the interface endpoints is working, but the data replication channel is failing to connect.
Identifying that the control plane functions but the data plane is blocked isolates the problem to the data replication port.
2
Identify the ports required by AWS Application Migration Service (MGN) for data replication.
The AWS replication agent sends replicated blocks to the staging area replication servers (which are lightweight EC2 instances launched by MGN) using TCP port 1500.
Understanding the network protocol requirements for MGN is critical for troubleshooting connectivity issues.
3
Verify and adjust the security group and firewall configurations.
Ensure that the security group attached to the replication servers in the staging VPC allows inbound traffic on TCP port 1500 from the on-premises source subnets, and that the on-premises firewall allows outbound traffic on TCP port 1500 to the staging subnets.
This establishes the bi-directional path for replication traffic over the private Direct Connect link.

Anahtar Kavram

AWS MGN private replication over Direct Connect requires TCP port 1500 to be open between source agents and staging replication servers.
Soru 1667Soru →

A company manages a large fleet of Amazon EC2 instances across multiple AWS accounts in an AWS Organization. A recent security audit reveals that several instances are running without a required third-party logging agent, and some instances have had their configurations manually modified after deployment. A Solutions Architect must design an automated, continuous compliance solution to ensure the logging agent is installed, running, and configured identically on all instances, and that any configuration drift is automatically corrected.

Which two of the following actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an AWS Systems Manager State Manager association targeting the target EC2 instances to install and configure the logging agent, and configure it to run on a regular schedule to apply the desired configuration state.; Configure an AWS Config rule across all accounts to check for the presence of the logging agent, and associate the rule with an AWS Systems Manager Automation runbook as a remediation action to install the agent when non-compliance is detected.

Cevap

Create an AWS Systems Manager State Manager association to install the agent and run on a schedule, and configure an AWS Config rule with an AWS Systems Manager Automation runbook as a remediation action.
The solution requires enforcing OS-level compliance and remediating changes. AWS Systems Manager State Manager is designed to enforce OS configurations on a schedule, correcting manual alterations. Additionally, an AWS Config rule can monitor compliance and initiate remediation via an AWS Systems Manager Automation runbook, satisfying both requirements securely and natively.

Adım Adım Çözüm

1
Enforce the desired operating system configuration state.
An AWS Systems Manager State Manager association is created to install and configure the logging agent on a regular schedule.
This automatically overwrites any manual modifications made to the agent or its configuration directly inside the OS.
2
Monitor compliance and configure automatic remediation.
An AWS Config rule is configured to audit the presence of the agent, backed by an AWS Systems Manager Automation runbook.
If an instance drifts or is deployed without the agent, AWS Config flags it as non-compliant and triggers the SSM runbook to install the agent automatically.

Anahtar Kavram

Automating operating system configuration compliance, drift detection, and remediation using AWS Systems Manager and AWS Config.
Soru 1668Soru →

TerraGrid Energy is modernizing its local power-grid telemetry processing application by migrating it to AWS. The workload requires low-latency connectivity (under 10 ms10\text{ ms}) to physical on-premises SCADA systems and must comply with local regulations that mandate all raw data storage and processing remain within the physical facility. The company has deployed an AWS Outposts rack in their local data center. The Solutions Architect needs to run the containerized application on Amazon EKS using worker nodes on the Outposts rack while managing the control plane from the parent AWS Region. The architecture must ensure that the worker nodes can privately communicate with the EKS control plane and write data directly to the local SCADA network without routing local traffic through the parent Region. Which network and compute architecture should the Solutions Architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the Amazon EKS control plane in the parent AWS Region. Launch EKS worker nodes on EC2 instances within the subnets associated with the AWS Outposts rack. Enable private cluster endpoint access and associate the Route 53 Private Hosted Zone for the cluster endpoint with the Outposts VPC. Configure the AWS Outposts Local Gateway to route SCADA-bound telemetry traffic directly to the local network, and use a private virtual interface over AWS Direct Connect for control plane communication.

Cevap

Deploy the Amazon EKS control plane in the parent AWS Region, run worker nodes on EC2 instances in the AWS Outposts subnets, associate the Route 53 Private Hosted Zone with the Outposts VPC, and route telemetry traffic directly to the local SCADA network using the Outposts Local Gateway.
The correct solution correctly targets worker nodes on EC2 instances within the AWS Outposts subnets, ensuring physical data residency and low-latency access. By leveraging the Outposts Local Gateway (LGW), local SCADA traffic bypasses the parent AWS Region completely, staying under the 10 ms10\text{ ms} latency limit. Private EKS cluster connectivity over AWS Direct Connect requires the Route 53 Private Hosted Zone containing the cluster endpoint to be associated with the Outposts VPC so that the worker nodes can privately resolve and connect to the regional EKS control plane.

Adım Adım Çözüm

1
Deploy EKS worker nodes on EC2 instances inside subnets mapped to the AWS Outposts rack.
The workload runs physically on-premises, satisfying the local data residency and low-latency execution requirements.
AWS Fargate is not supported on Outposts for EKS, making EC2 worker nodes on the Outpost subnets the correct compute platform.
2
Configure the AWS Outposts Local Gateway (LGW) route tables to direct SCADA network ranges directly to the local gateway.
Telemetry traffic is routed directly to the on-premises SCADA system with a latency of less than 10 ms10\text{ ms}.
Using the LGW keeps local traffic on the local network rather than routing it through the parent AWS Region.
3
Associate the Route 53 Private Hosted Zone for the EKS cluster endpoint with the VPC containing the Outposts subnets.
Worker nodes on the Outpost can resolve the cluster endpoint DNS to the private ENI IP addresses in the VPC.
Private Hosted Zones must be explicitly associated with a VPC to allow instances within that VPC to resolve those private domain names.

Anahtar Kavram

Amazon EKS on AWS Outposts local gateway (LGW) routing and private cluster endpoint resolution via Route 53 Private Hosted Zone associations.
Soru 1669Soru →

A financial analytics company hosts a batch processing application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer. The application instances require a complex initialization script that takes approximately 88 minutes to download external libraries and establish database connection pools before they can accept traffic. The ASG uses a step scaling policy based on CPU utilization to scale out. During a rapid increase in traffic, the ASG continuously launches multiple new instances before the previously launched instances finish bootstrapping, leading to massive over-provisioning and increased costs. Which of the following configurations should a Solutions Architect implement to prevent this over-provisioning issue?

Cevabı ve açıklamayı göster

Cevap: Configure the estimated instance warmup time for the step scaling policy to be greater than 88 minutes (480480 seconds) to ensure that the ASG does not launch additional instances while the new instances are still bootstrapping.

Cevap

Configure the estimated instance warmup time for the step scaling policy to be greater than 88 minutes (480480 seconds).
Configuring the estimated instance warmup time for the step scaling policy to be greater than the 88-minute bootstrapping time ensures that Amazon EC2 Auto Scaling does not launch additional instances while the previously launched instances are still in the process of starting up. This directly addresses the over-provisioning behavior caused by the lag in instance initialization.

Adım Adım Çözüm

1
Analyze the cause of the Auto Scaling group's over-provisioning.
The issue is that the 88-minute bootstrapping script creates a delay before instances are ready to accept traffic and start reducing the CPU utilization metric.
Before these instances are marked as healthy and start processing requests, the scaling policy continues to evaluate high CPU utilization and triggers additional, unnecessary scale-out events.
2
Identify the scaling policy configuration parameter that handles instance bootstrapping delay.
Step scaling policies use the estimated instance warmup parameter to determine how long to wait after launching an instance before counting its impact on metrics or evaluating further scale-out actions.
By default, if there is no warmup or the warmup is shorter than the bootstrapping time, the ASG will launch additional instances during the bootstrapping window.
3
Configure the estimated instance warmup to exceed the bootstrapping time.
Setting the warmup to 88 minutes or more prevents additional scale-out actions during this initialization window, stabilizing the fleet size.
This ensures the ASG allows the newly launched instances to fully initialize and begin handling load before deciding whether more capacity is needed.

Anahtar Kavram

Instance Warmup vs Cooldown in EC2 Auto Scaling
Soru 1670Soru →

Zephyr Retail is modernizing its on-premises containerized inventory microservice by migrating it to AWS. To adhere to strict security and compliance standards, the Production environment must be isolated inside a private subnet of a Production VPC with no route to the internet, and no NAT Gateways are permitted. The modernized containerized application must run on AWS Fargate using Amazon Elastic Container Service (Amazon ECS). Additionally, container images must be pulled from a centralized, Shared Services AWS account using an Amazon Elastic Container Registry (Amazon ECR) repository. The application must achieve high availability across multiple Availability Zones, with the container deployment mechanism configured to authenticate and pull images securely without traversing the public internet. Which of the following configurations will allow the ECS tasks in the Production VPC to successfully pull the container images from the Shared Services account's ECR repository?

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon ECS task definition to use the awsvpc network mode. In the Production VPC, create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr, and a gateway VPC endpoint for Amazon S3. Configure the ECS task execution IAM role in the Production account to allow ECR pull actions, and configure the ECR repository policy in the Shared Services account to grant read permissions to the Production account.

Cevap

The configuration that uses the awsvpc network mode for ECS Fargate tasks, creates ECR interface endpoints and an S3 gateway endpoint in the Production VPC, and sets up cross-account access via IAM execution roles and ECR repository policies.
The correct configuration uses the awsvpc network mode, which is mandatory for AWS Fargate. It also creates interface VPC endpoints for the Amazon ECR APIs (ecr.api and ecr.dkr) and the gateway endpoint for Amazon S3, which is required because ECR stores image layers in S3. Finally, it sets up cross-account access by configuring the ECS task execution role in the Production account and granting read access in the ECR repository policy in the Shared Services account.

Adım Adım Çözüm

1
Ensure container networking compatibility on Fargate
The ECS task definition is configured to use the awsvpc network mode, which is the only network mode supported by AWS Fargate.
AWS Fargate does not support bridge or host network modes.
2
Set up private connectivity in the VPC without internet access
Create com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr Interface VPC Endpoints, and a Gateway VPC Endpoint for Amazon S3 in the Production VPC.
The ECR API calls are routed through the interface endpoints, while the actual image layer downloads (which ECR stores in S3 under the hood) are routed through the S3 gateway endpoint.
3
Configure cross-account IAM and ECR repository permissions
The Production account's ECS task execution role is given permissions to perform ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability. The ECR repository policy in the Shared Services account is updated to trust the Production account/role.
By default, cross-account access to ECR repositories requires explicit permissions on both the pulling IAM role and the destination ECR repository policy.

Anahtar Kavram

Cross-account ECR image pulling with ECS on AWS Fargate in private VPCs using VPC endpoints
Tahmini Süre:2m 0s
Soru 1671Soru →

A multinational financial institution is designing a new retail banking portal. The portal contains a transaction processing workload (OLTP) and a customer monthly account statements storage system (Object storage).

The transaction database requires high availability across multiple Availability Zones with a recovery time objective (RTO) of under 3030 seconds and a recovery point objective (RPO) of 00. The database must also scale read capacity dynamically to handle sudden spikes in query volume.

The account statement storage system must encrypt all statements at rest and grant read-only access to an auditing application located in a separate AWS account within the same AWS Organization.

Which two database and storage designs should the Solutions Architect select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora PostgreSQL DB cluster with a Multi-AZ deployment, and configure Aurora Auto Scaling to dynamically add Aurora Replicas to scale read performance based on CPU utilization.; Store the monthly account statements in an Amazon S3 bucket. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK), update the KMS key policy to permit cross-account access from the auditing account, and use an S3 bucket policy to allow read operations from that account.

Cevap

Deploy an Amazon Aurora PostgreSQL DB cluster with a Multi-AZ deployment and configure Aurora Auto Scaling to dynamically add Aurora Replicas to scale read performance based on CPU utilization. Additionally, store the monthly account statements in an Amazon S3 bucket encrypted using an AWS KMS Customer Managed Key (CMK), update the KMS key policy to permit cross-account access from the auditing account, and use an S3 bucket policy to allow read operations from that account.
The correct solution combines Amazon Aurora PostgreSQL and Amazon S3. Aurora's Multi-AZ architecture features synchronous replication at the storage tier to guarantee an RPO of 00 and handles failover within 3030 seconds. Dynamic read replica scaling is achieved using Aurora Replicas managed by Auto Scaling. For cross-account compliance access, S3 objects must be encrypted with a Customer Managed Key (CMK) rather than an AWS-managed key, because only CMK policies can be modified to delegate decryption permissions to external AWS accounts. Combining this key policy modification with an S3 bucket policy ensures safe and functional cross-account access.

Adım Adım Çözüm

1
Evaluate the database tier for high availability, RTO, RPO, and read scalability constraints.
Identify that Amazon Aurora PostgreSQL with Multi-AZ provides synchronous replication (RPO of 00) and automatic failover in under 3030 seconds (RTO requirement). Aurora Auto Scaling dynamically manages Aurora Replicas to handle read spikes.
Ensures the database selection meets both the immediate recovery parameters and horizontal scaling requirements.
2
Analyze cross-account access requirements for S3 bucket objects encrypted at rest.
Determine that a Customer Managed Key (CMK) is required because the default AWS-managed KMS key (`aws/s3`) cannot be shared across accounts due to fixed key policies.
Establishes a secure and valid key management strategy that permits cross-account permission delegation.
3
Configure permissions on both S3 and KMS for the external auditing account.
Modify the KMS key policy to delegate decryption capability to the external account, and add an S3 bucket policy allowing read access to the external account's IAM principal.
Allows the external auditing account to successfully retrieve and decrypt the account statements.

Anahtar Kavram

Selecting high-availability database engines that support active read scaling, combined with cross-account KMS key policies and bucket policies for secure storage sharing.
Soru 1672Soru →

A financial services company is establishing governance controls across its AWS multi-account environment managed by AWS Organizations. The organization contains a Production OU and a Development OU. The security team mandates the following requirements:

* Developers in the Development OU must only be allowed to deploy resources in the `us-east-1` and `us-west-2` Regions.
* No user or IAM role within any member account, including administrators, should be able to disable or modify AWS CloudTrail logging configuration.
* The Organization's management account must remain unaffected by these restrictions to allow global operations.

Which of the following governance actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Service Control Policy (SCP) that denies all actions if the `aws:RequestedRegion` condition is not `us-east-1` or `us-west-2`, and attach it to the Development OU.; Create a Service Control Policy (SCP) that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach it to the organization's Root.

Cevap

The correct strategy involves creating a Service Control Policy (SCP) that denies actions outside the specified regions and attaching it to the Development OU, and creating another SCP that denies CloudTrail modification actions and attaching it to the organization's Root.
To satisfy the requirements, the Solutions Architect should attach an SCP restricting regions to the Development OU and attach an SCP restricting CloudTrail modifications to the Root. Service Control Policies (SCPs) define the maximum permissions for member accounts. Because SCPs do not apply to the organization's management account, attaching the CloudTrail restriction at the Root will secure member accounts while keeping the management account unaffected.

Adım Adım Çözüm

1
Analyze regional restriction requirements.
Create an SCP using the `aws:RequestedRegion` condition key to restrict operations to `us-east-1` and `us-west-2` and attach it to the Development OU.
SCPs applied to OUs restrict all accounts and users (including root/administrators) under that OU, which is ideal for isolating development account permissions.
2
Analyze CloudTrail protection requirements.
Create an SCP denying `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` and attach it to the Root.
Attaching the policy to the organization's Root ensures the policy is inherited by all member accounts under the organization, protecting CloudTrail settings globally.
3
Evaluate the management account exemption requirement.
Confirm that the management account is unaffected by the Root-level SCP.
By design, AWS Organizations Service Control Policies (SCPs) do not apply to the organization's management account, fulfilling the requirement without needing explicit exclusion logic.

Anahtar Kavram

AWS Organizations Multi-Account Governance with Service Control Policies (SCPs)
Tahmini Süre:2m 0s
Soru 1673Soru →

FinQuery is migrating its high-frequency transaction verification application from an on-premises data center to AWS. The application consists of containerized services that require low-latency communication and raw access to the host network interface. Additionally, the containers must modify specific namespaced kernel parameters, such as `net.core.somaxconn`, using sysctl configurations to handle high volumes of concurrent connections. The container images are stored in a centralized shared services AWS account (account 111122223333111122223333) in an Amazon Elastic Container Registry (Amazon ECR) repository. This repository is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The containerized application will run in a separate production AWS account (account 444455556666444455556666) inside a VPC that has no path to or from the internet. All container image download traffic must remain entirely within the AWS private network. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon ECS task definition to use the host network mode, and specify the required sysctl parameters in the systemControls parameter of the container definition. Launch the tasks on an Amazon ECS cluster using the Amazon EC2 launch type.; In the shared services account, update the Amazon ECR repository policy to allow the IAM task execution role from the production account to pull images, and update the KMS key policy to grant decrypt permissions to the same role. In the production account's VPC, create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3.

Cevap

Configure the task definition to use host networking on Amazon ECS EC2 launch type to satisfy host access and sysctl modifications, and update the shared ECR repository and KMS key policies while provisioning ECR and S3 VPC endpoints in the application VPC.
The transaction verification workload requires raw host network access and namespaced kernel adjustments, which mandates Amazon ECS using the EC2 launch type with host network mode. AWS Fargate's awsvpc limitation makes it unsuitable here. For the cross-account ECR access, permissions must be granted on both the repository policy and the Customer Managed KMS key policy to the ECS task execution role in the production account. Additionally, Interface VPC endpoints for ECR and a Gateway VPC endpoint for Amazon S3 are required to fetch ECR images privately without internet connectivity.

Adım Adım Çözüm

1
Identify container configuration and networking requirements.
The application requires modifying specific kernel settings (sysctl) and raw access to the host network interface. Because AWS Fargate only supports the awsvpc network mode and restricts host-level settings, the workload must run on the Amazon ECS EC2 launch type with host networking.
This configuration satisfies the low-latency host networking and sysctl system controls requirement.
2
Determine cross-account access and encryption permissions.
To allow the production account to pull images from the shared services account, the ECR repository policy and the Customer Managed KMS key policy must be updated to grant decrypt and read access to the production account's ECS task execution IAM role.
AWS-managed KMS keys cannot be shared across accounts, meaning a Customer Managed Key is required for cross-account ECR encryption.
3
Ensure private VPC routing for container images.
Create interface VPC endpoints for ECR and a gateway VPC endpoint for S3 inside the production VPC.
Since the production VPC has no internet connection, traffic must route privately to the AWS services. An S3 endpoint is required because ECR stores its image layers in S3.

Anahtar Kavram

Designing secure, high-performance containerized workloads using Amazon ECS EC2 launch type with host networking and cross-account ECR/KMS private integrations.
Soru 1674Soru →

A global hospitality and reservation booking platform is planning to migrate its core reservation portal and loyalty program database to AWS. The current on-premises environment comprises:
- 150150 VMware vSphere virtual machines (VMs) running supported Windows Server and Red Hat Enterprise Linux (RHEL) operating systems.
- 1010 physical bare-metal servers running RHEL 7 that host production Oracle databases.
- The company's compliance policies strictly prohibit the installation of third-party software agents on the database servers.
- The outbound network policy blocks direct internet access from all on-premises servers. All outbound traffic must be routed through a centralized forward HTTP proxy.
- To perform right-sizing and design migration groupings, the solutions architect must collect CPU and memory utilization, disk I/O metrics, and detailed network dependency mappings (inbound and outbound connections) for both VMs and physical servers.

Which combination of actions should the solutions architect take to gather the discovery data and track the migration in AWS Migration Hub? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install the AWS Application Discovery Agent on the VMware VMs and configure the agents to route traffic through the outbound HTTP proxy.; Use the AWS Migration Hub import template to manually import the database server configurations and performance metrics, then group them with the discovered VMs in AWS Migration Hub.

Cevap

Install the AWS Application Discovery Agent on the VMware VMs with proxy configuration, and manually import the database server configurations using the AWS Migration Hub import template.
The correct options involve installing the AWS Application Discovery Agent on the VMware VMs, which is necessary to gather the required network dependency mappings, and configuring the agent to use the forward HTTP proxy. For the database servers, since agents are prohibited and the servers are physical, importing their configuration via the CSV template is the only supported way to include them in the Migration Hub tracking dashboard.

Adım Adım Çözüm

1
Evaluate the discovery requirements for the VMware VMs where network dependency mappings are required.
Determine that the AWS Application Discovery Agent must be installed on the VMs, since the Agentless Collector does not support collecting process-level network connections.
Network dependency mapping requires OS-level inspection of network sockets and processes, which is only supported by the agent-based tool.
2
Configure the Discovery Agents to bypass direct outbound network blocks.
Configure the agent settings on each VM to route outbound HTTPS discovery traffic through the forward HTTP proxy.
Since direct internet access is blocked on-premises, routing agent traffic through the proxy enables secure data delivery to AWS.
3
Address discovery for the database servers where agent installation is prohibited.
Collect inventory and performance metrics for the physical database servers and import them using the Migration Hub CSV template.
Manual import bypasses the need for agent installation on the database servers while still capturing their resource specs and utilization details for planning.
4
Group and track the servers in AWS Migration Hub.
Group the discovered VMs and imported database servers into logical applications within the AWS Migration Hub console.
This establishes a central tracking mechanism for the migration progress of the entire reservation system.

Anahtar Kavram

Selecting the correct AWS Application Discovery Service tool based on OS access, virtualization platform, network topology, and application dependency requirements.
Soru 1675Soru →

A company operates an online multiplayer game session manager that runs on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances are located in private subnets across two Availability Zones. The instances require internet access to fetch game assets and configuration files during startup, which takes approximately 6 minutes. Outbound internet access is currently routed through a single NAT Gateway located in one public subnet.

During sudden game updates and player surges, new instances are launched to handle the load. However, the company notices two issues:
1. The NAT Gateway bandwidth limit is temporarily saturated, causing asset download timeouts and causing the EC2 instance bootstrapping process to stall.
2. Newly launched instances are terminated by the ASG's health check mechanism before they can complete bootstrapping, leading to continuous instance replacements.

Which combinations of architectural changes should a Solutions Architect implement to improve the fault tolerance and scalability of this system? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in each Availability Zone and update the route tables of the private subnets to route outbound traffic through the local NAT Gateway.; Increase the Health Check Grace Period of the Auto Scaling group to at least 450 seconds.

Cevap

Deploy a NAT Gateway in each Availability Zone and increase the Health Check Grace Period of the Auto Scaling group to at least 450 seconds.
Deploying a NAT Gateway in each Availability Zone ensures that outbound traffic remains localized to each zone, eliminating the single point of failure and increasing the total outbound bandwidth capacity. Increasing the Health Check Grace Period of the Auto Scaling group to 450 seconds ensures that the group waits long enough for the EC2 instances to complete their 6-minute bootstrapping process before evaluating their health, preventing premature terminations and scaling loops.

Adım Adım Çözüm

1
Analyze the outbound dependency traffic path.
The single NAT Gateway represents a single point of failure (SPF) and is experiencing bandwidth saturation during surges.
Outbound traffic from all instances in both Availability Zones traverses a single NAT Gateway.
2
Redesign the outbound NAT routing topology.
Deploy one NAT Gateway per Availability Zone and update the private route tables accordingly.
This setup provides zone-level fault tolerance and doubles the available outbound bandwidth for bootstrapping instances.
3
Evaluate the instance bootstrapping duration against Auto Scaling group settings.
Instances require 6 minutes (360 seconds) to boot, but are being marked unhealthy and terminated prematurely by the ASG.
The default health check grace period is shorter than the bootstrapping time, causing the ASG to terminate instances before they can serve traffic.
4
Adjust the health check grace period.
Set the Health Check Grace Period to a value greater than the bootstrap time (e.g., 450 seconds).
This allows newly launched instances sufficient time to complete initialization before being evaluated by the ASG health checks.

Anahtar Kavram

Designing multi-AZ fault tolerance and alignment of Auto Scaling health check grace periods with instance bootstrapping times.
Soru 1676Soru →

AeroRoute Logistics is migrating an on-premises containerized fleet routing application to AWS. The application consists of a front-end API service and a backend routing engine. The Solutions Architect has designed a multi-account AWS architecture where the container images will be stored in a centralized Amazon Elastic Container Registry (Amazon ECR) repository in a Shared Services account. The application must run on Amazon ECS using AWS Fargate within an Application VPC. The Application VPC is distributed across three Availability Zones with public and private subnets. For service discovery, a Route 53 Private Hosted Zone (PHZ) is hosted in the Shared Services account. The deployment must be highly available, minimize operational overhead, and allow tasks to securely resolve internal endpoints and pull images. Which TWO actions should the Solutions Architect perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the ECS task definitions to use the `awsvpc` network mode, and grant the ECS task execution role permissions to pull container images from the Amazon ECR repository in the Shared Services account.; Associate the Route 53 Private Hosted Zone in the Shared Services account with the Application VPC.

Cevap

Configure the ECS task definitions to use the `awsvpc` network mode, grant the ECS task execution role permissions to pull container images from the Amazon ECR repository in the Shared Services account, and associate the Route 53 Private Hosted Zone in the Shared Services account with the Application VPC.
To deploy containers on AWS Fargate, the `awsvpc` network mode is mandatory. The task execution role requires permissions to perform the cross-account image pull from the ECR registry in the Shared Services account. For DNS resolution of internal service endpoints across accounts, the Route 53 Private Hosted Zone in the Shared Services account must be explicitly associated with the Application VPC.

Adım Adım Çözüm

1
Identify the mandatory container runtime environment and networking requirements for AWS Fargate.
AWS Fargate requires the `awsvpc` network mode, and the ECS task execution role must have permission to pull the container image from the centralized ECR repository in the Shared Services account.
Fargate does not support bridge or host networking modes; each task must receive its own Elastic Network Interface (ENI).
2
Determine the service discovery and DNS resolution strategy across accounts.
The Route 53 Private Hosted Zone (PHZ) in the Shared Services account must be associated with the Application VPC in the Application account.
PHZ records are not shared or synced automatically; an explicit cross-account association is required for DNS resolution to function.
3
Verify high availability requirements for outbound network paths.
NAT Gateways must be deployed in each Availability Zone rather than a single NAT Gateway.
A single NAT Gateway creates a single point of failure, violating the high availability requirement across multiple Availability Zones.

Anahtar Kavram

Cross-account Amazon ECS Fargate deployment, private DNS resolution, and high-availability egress routing.
Soru 1677Soru →

A hospitality enterprise is migrating its centralized property management system consisting of multiple legacy servers to AWS using AWS Application Migration Service (MGN). The migration network path is established over an AWS Direct Connect connection terminated at an AWS Transit Gateway that connects to the staging VPC. After installing the AWS Replication Agent on the source servers, the replication status remains in the initiating stage, and data replication fails to start. Which of the following configuration actions should the solutions architect perform to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the on-premises firewalls and the staging area security groups to allow traffic on TCP port 1500 to the replication servers.; Verify and update the route tables of the staging area subnets to route outbound traffic destined for the on-premises servers via the Transit Gateway.

Cevap

The correct configuration actions are to allow traffic on TCP port 1500 in on-premises firewalls and staging area security groups, and to configure staging area subnet route tables to route on-premises destined traffic through the Transit Gateway.
The correct actions require opening TCP port 1500 on firewalls and security groups to allow data replication, and ensuring the staging area subnet route tables route traffic back to the on-premises network through the Transit Gateway. This establishes the necessary TCP connection and bidirectional routing for the replication servers.

Adım Adım Çözüm

1
Analyze the replication architecture and state
Identify that the Replication Agent is stuck in 'Initiating', which points to either network connectivity or credential permission issues.
To narrow down why replication traffic is not reaching the staging area.
2
Check the port configurations for data replication
Ensure TCP port 1500 is allowed between the source servers and the staging subnets.
AWS MGN uses TCP port 1500 exclusively for secure replication data transport.
3
Verify transit network routing path
Ensure that the route tables in the staging subnets have routes pointing back to the on-premises networks via the Transit Gateway.
Bidirectional routing is necessary to establish and maintain the replication tunnel.

Anahtar Kavram

Infrastructure Migration with AWS Application Migration Service (MGN)
Tahmini Süre:2m 0s
Soru 1678Soru →

A global media streaming provider has organized its cloud environment using AWS Organizations. The structure contains a root OU, a Production OU, and a Sandbox OU. The engineering team has the following governance requirements:

- Developers in Sandbox accounts require full administrative permissions to experiment but must be prevented from disabling AWS Security Hub or deleting its resources.
- Member accounts in the Production OU must only deploy resources in the us-east-1 and eu-west-1 regions.
- An emergency response team requires the ability to bypass the regional restrictions in the Production OU during active incidents to deploy resources globally, but this bypass must be restricted to a specific emergency IAM role (EmergencyAdminRole) that is only assumable via multi-factor authentication (MFA).

Which governance strategy should a solutions architect recommend to satisfy these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Sandbox OU that denies securityhub:* actions. Attach an SCP to the Production OU that denies all actions except for global services and operations in us-east-1 and eu-west-1, with a Condition block that excludes the EmergencyAdminRole role and requires aws:MultiFactorAuthPresent to be true. Create the administrative and emergency roles locally in each member account with appropriate IAM policies.

Cevap

Attach an SCP to the Sandbox OU to deny Security Hub modification, attach an SCP to the Production OU to deny operations outside the approved regions except for the emergency role with MFA, and manage administrative permissions via local IAM policies.
The correct strategy uses an SCP on the Sandbox OU to restrict Security Hub access and an SCP on the Production OU to enforce regional compliance. By utilizing a Condition block with ArnNotEquals and aws:MultiFactorAuthPresent, the solutions architect can exempt the emergency role from regional restrictions when assumed with MFA. Local IAM policies must be maintained because SCPs only act as guardrails and do not grant permissions directly.

Adım Adım Çözüm

1
Evaluate the mechanism to enforce Security Hub restrictions globally in Sandbox accounts.
Identify that a Service Control Policy (SCP) attached to the Sandbox OU denying securityhub:* is the most operationally efficient method as it applies to all principals including root.
SCPs act as guardrails that restrict permissions for all accounts under the OU, regardless of local IAM permissions.
2
Determine the strategy for regional restrictions with an emergency bypass in the Production OU.
Use an SCP with a Deny effect on actions outside us-east-1 and eu-west-1, except for global services. Use a Condition block with ArnNotEquals to exempt the EmergencyAdminRole and Bool to require aws:MultiFactorAuthPresent.
Exempting specific roles and requiring MFA ensures that only authorized incident response activities can bypass the guardrails.
3
Ensure alignment between SCP policies and IAM permission models.
Recognize that local IAM policies must still be created in each member account to grant administrative and emergency access.
SCPs do not grant permissions directly; they only set the maximum boundary of allowed permissions. Local IAM policies must grant the actual permissions.

Anahtar Kavram

AWS Organizations Service Control Policies (SCPs) act as permission boundaries and must be combined with local IAM policies to grant permissions. They support conditions to exempt specific roles and enforce MFA.
Tahmini Süre:3m 0s
Soru 1679Soru →

A multinational healthcare conglomerate is planning to migrate its core patient portal and clinical data processing applications from an on-premises datacenter to AWS. The environment consists of two main components: a VMware vSphere 7.0 cluster hosting 400 virtual machines (VMs) running Red Hat Enterprise Linux (RHEL) and Ubuntu, and a bare-metal cluster hosting 50 database servers running legacy IBM AIX and Oracle Solaris operating systems.

Due to strict HIPAA and PCI-DSS compliance regulations, the security team enforces the following constraints:
- No software agents or third-party packages can be installed on the bare-metal database servers.
- VMs within the restricted PCI-DSS network segment have no direct internet access, but can communicate with an on-premises central proxy server.
- The migration team must minimize administrative overhead on the hypervisor hosts while still gathering network dependency mapping for the application VMs to plan migration waves.

The organization wants to discover this environment, group resources into applications, and track migration progress using AWS Migration Hub.

Which TWO actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agentless Collector in the VMware environment to gather VM metadata and performance utilization. For the application VMs requiring network dependency mapping, install the Application Discovery Agent and configure the agent's proxy settings to route data through the central proxy.; For the bare-metal database servers, manually populate the AWS Migration Hub import CSV template with server details and upload it. Group the imported database servers and the discovered application VMs into logical applications within AWS Migration Hub to track the migration progress.

Cevap

Deploy the AWS Application Discovery Agentless Collector in the VMware environment, install the Application Discovery Agent on the application VMs routing through the central proxy, and manually import the bare-metal database server specifications using the Migration Hub CSV import template.
Deploying the Agentless Collector on VMware provides a low-overhead inventory collection, while deploying the Agent-based collector on the application VMs captures the detailed process-level network connections required for application dependency mapping. The agents can be configured to use the existing central proxy for outbound connectivity to satisfy PCI-DSS constraints. For the bare-metal database servers running unsupported OSs (AIX/Solaris) where agents are forbidden, importing their data manually using the Migration Hub CSV template is the only viable discovery mechanism. Once both discovered and imported servers are available, they can be grouped into logical applications in Migration Hub to track the migration waves.

Adım Adım Çözüm

1
Select the discovery tool for VMware VMs based on mapping and overhead requirements.
Deploy the Application Discovery Agentless Collector to gather general VM metadata with low overhead, but install the Application Discovery Agent on the application VMs because agentless discovery cannot capture process-level network dependency mappings required for planning migration waves.
Agent-based discovery is required for network connection mapping, while Agentless Collector minimizes hypervisor overhead for general inventory.
2
Configure agent network access in the restricted PCI-DSS segment.
Configure the Application Discovery Agents on the restricted VMs to route their outbound discovery traffic through the central proxy.
The Application Discovery Agent supports outbound communication via a proxy, satisfying security constraints without modifying the network architecture.
3
Address discovery for the legacy Unix bare-metal servers.
Prepare and upload a CSV file using the Migration Hub import template with specifications of the AIX and Solaris servers.
The Application Discovery Agent and Agentless Collector do not support bare-metal servers running AIX or Solaris, and security policies prohibit agent installations on these servers. Manual import is the supported alternative.
4
Group discovered and imported resources into applications in AWS Migration Hub.
Create application groups in AWS Migration Hub combining the discovered VMs and imported bare-metal databases.
Grouping resources allows tracking the migration progress of logical application stacks as a single unit on the Migration Hub dashboard.

Anahtar Kavram

Selecting and configuring AWS Application Discovery Service tools (Agent vs. Agentless vs. Manual Import) to satisfy compliance, operating system compatibility, and dependency mapping requirements.
Soru 1680Soru →

A company is planning to migrate an on-premises Oracle database to an Amazon Aurora PostgreSQL DB cluster. A solutions architect uses the AWS Schema Conversion Tool (SCT) to convert the database schema and configures an AWS Database Migration Service (DMS) replication task using the Full Load and ongoing replication (CDC) option. The Full Load phase completes successfully, but the DMS replication task transitions to a failed state shortly after the Change Data Capture (CDC) phase starts. Which of the following is the most likely cause of this failure?

Cevabı ve açıklamayı göster

Cevap: The source Oracle database was not configured with supplemental logging enabled, preventing AWS DMS from reading the change data from the redo logs.

Cevap

The source Oracle database was not configured with supplemental logging enabled, preventing AWS DMS from reading the change data from the redo logs.
The correct answer is correct because AWS DMS CDC tasks require supplemental logging to be enabled on the source Oracle database. This allows DMS to capture the full row changes from the Oracle redo logs. If supplemental logging is not enabled, the DMS task will fail to replicate ongoing changes after the full load completes.

Adım Adım Çözüm

1
Analyze the migration scenario and tools used.
The migration is heterogeneous (Oracle to Aurora PostgreSQL) using SCT for schema conversion and DMS for data replication.
Understanding the source, target, and tools is the first step in identifying migration configuration requirements.
2
Identify the phase where the failure occurs.
The Full Load phase succeeded, but the Change Data Capture (CDC) phase failed immediately after starting.
Since the Full Load succeeded, connectivity and basic write permissions to the target are functioning, meaning the failure is specific to the CDC configuration.
3
Evaluate the source database configuration requirements for DMS CDC.
For Oracle source databases, AWS DMS requires supplemental logging to be enabled to read ongoing changes from the redo logs.
Without supplemental logging, the redo logs do not contain the complete column information needed by DMS to reconstruct changes, leading to task failure.

Anahtar Kavram

Enabling source database logging mechanisms (such as supplemental logging for Oracle or binary logging for MySQL) is a mandatory prerequisite for AWS DMS Change Data Capture (CDC) tasks.
Tahmini Süre:2m 0s
ÖncekiSayfa 84 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin