Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

An online retail company runs a web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group. The DevOps team wants to automate the configuration management of these instances by applying an Ansible playbook stored in a secured Amazon S3 bucket. The solution must ensure that the configuration is applied automatically to all newly launched instances, and that any subsequent manual configuration changes on the instances are detected and corrected every 24 hours. Which of the following approaches represents the most operationally efficient way to meet these requirements?

Create an AWS Systems Manager State Manager association. Specify the document as AWS-ApplyAnsiblePlaybooks and configure the source parameter to point to the Amazon S3 bucket. Target the EC2 instances using the Auto Scaling group's resource tags, and set the association schedule to run every 24 hours.

Configure the Auto Scaling group to launch instances with a User Data script that downloads and executes the Ansible playbook. Create an Amazon EventBridge rule that runs on a 24-hour schedule to invoke an AWS Lambda function, which runs a remote SSH command on all active EC2 instances to re-apply the playbook.

Use AWS CloudFormation StackSets to deploy the Auto Scaling group. Enable CloudFormation drift detection with an automatic remediation rule that downloads and runs the Ansible playbook from the Amazon S3 bucket whenever OS-level configuration drift is detected.

Configure an AWS CodePipeline pipeline with an AWS CodeDeploy deployment group targeting the Auto Scaling group. Write a CodeDeploy Hook script to run the Ansible playbook, and configure a cron job within the instance operating system to trigger a new pipeline deployment every 24 hours.

Cevabı ve açıklamayı göster

Cevap: Create an AWS Systems Manager State Manager association. Specify the document as AWS-ApplyAnsiblePlaybooks and configure the source parameter to point to the Amazon S3 bucket. Target the EC2 instances using the Auto Scaling group's resource tags, and set the association schedule to run every 24 hours.

Cevap

Create an AWS Systems Manager State Manager association targeting the instances using the Auto Scaling group's tags, specifying the AWS-ApplyAnsiblePlaybooks document with the Amazon S3 source path, and setting a 24-hour execution schedule.

The correct approach utilizes AWS Systems Manager State Manager with the AWS-ApplyAnsiblePlaybooks document. State Manager is designed to enforce configuration state on EC2 instances. It automatically applies to new instances when they register and match the targeted tags, and runs on a recurring schedule to correct any configuration changes made manually.

Adım Adım Çözüm

Store the Ansible playbook in a secured Amazon S3 bucket.

The playbook is centrally located and accessible by Systems Manager via appropriate IAM roles.

Allows AWS Systems Manager to fetch the configuration files during association runs.

Create an AWS Systems Manager State Manager association.

An association is created using the AWS-ApplyAnsiblePlaybooks document, pointing to the Amazon S3 source, targeting instances with specific tags.

This establishes the desired state configuration and targets the correct fleet of instances automatically.

Set a schedule of 24 hours on the State Manager association.

Systems Manager runs the association on a cron or rate expression every 24 hours.

Ensures that configuration drift is detected and corrected periodically without manual intervention.

Anahtar Kavram

AWS Systems Manager State Manager provides a native, scalable solution for defining and enforcing resource state configurations, automatically applying them to new instances and remediating configuration drift on a schedule.

Soru 1682Soru →

A logistics enterprise is designing a new global fleet-tracking platform. The platform must support two main data requirements:

1. A real-time NoSQL telemetry ingestion store for GPS coordinates from 200,000 active delivery vehicles, sustaining 20,000 writes/sec with sub-millisecond latency. The store must support multi-region disaster recovery with a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 15 minutes.
2. An object store for raw daily telemetry log files (averaging 500 GB/day). These files must be accessible by an external auditor's AWS account.

All data must be encrypted at rest. Which database and storage strategy meets these requirements with the lowest operational complexity?

Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK). Grant the auditor's AWS account cross-account access by updating both the S3 bucket policy and the CMK key policy to allow the auditor's IAM principal read permissions.

Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3). Configure the S3 bucket policy to allow the auditor's AWS account read permissions.

Deploy a single-region Amazon DynamoDB table in the primary region, and configure an AWS Lambda function triggered by DynamoDB Streams to export changes to Amazon S3. Set up S3 Cross-Region Replication (CRR) to replicate the DynamoDB backups to the secondary region. For log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) and share it via a cross-account bucket policy and CMK key policy.

Deploy Amazon RDS for PostgreSQL in a Multi-AZ deployment to store the telemetry data, directing the read-heavy dashboard queries to the standby instance in the secondary Availability Zone to scale read performance. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) and share it via a cross-account bucket policy and CMK key policy.

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon DynamoDB global tables with replica tables in the secondary region. For the log files, create an Amazon S3 bucket encrypted with a Customer Managed Key (CMK). Grant the auditor's AWS account cross-account access by updating both the S3 bucket policy and the CMK key policy to allow the auditor's IAM principal read permissions.

Cevap

The correct strategy uses Amazon DynamoDB global tables to meet the high write throughput NoSQL requirement with low-latency cross-region replication for RTO/RPO targets. It uses Amazon S3 for log file storage and encrypts it with a Customer Managed Key (CMK). By updating both the S3 bucket policy and the CMK key policy, the external auditor's AWS account is granted the necessary permissions to read and decrypt the log files.

Adım Adım Çözüm

Select the appropriate database engine and replication strategy for the real-time NoSQL fleet tracking data.

Choose Amazon DynamoDB global tables.

DynamoDB is a NoSQL store capable of handling 20,000 writes/sec with sub-millisecond latency. Global tables replicate data automatically across regions, achieving RPO < 1 second and RTO < 15 minutes.

Select the appropriate storage service for raw telemetry log files.

Choose Amazon S3.

S3 is the optimal object store for daily telemetry files (500 GB/day) and offers robust cross-account sharing capabilities.

Configure encryption and cross-account access for the S3 bucket.

Use an AWS KMS Customer Managed Key (CMK) and update its key policy along with the S3 bucket policy.

AWS-managed KMS keys (like aws/s3) cannot be shared across accounts. A Customer Managed Key must be used so its key policy can be modified to trust the auditor's AWS account, in addition to configuring the S3 bucket policy.

Anahtar Kavram

Selecting multi-region NoSQL databases for low RTO/RPO and configuring cross-account access with Customer Managed Keys.

Soru 1683Soru →

A company is planning to migrate an on-premises 15 TB Oracle database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The source database is highly active, generating over 35 GB of redo logs per hour. To minimize downtime, a Solutions Architect is designing a heterogeneous database migration strategy using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) with Change Data Capture (CDC). The migration must minimize CPU overhead on the source database and prevent replication lag during the CDC phase.

Which combination of actions should the Solutions Architect perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the AWS DMS source database endpoint to use the Binary Reader method rather than LogMiner to access the archived and active redo logs directly.

Enable minimal supplemental logging at the database level and table-level supplemental logging for all tables selected for replication on the source Oracle database.

Disable supplemental logging on the source Oracle database to prevent write amplification and minimize CPU utilization during the Change Data Capture (CDC) phase.

Configure the AWS DMS target database endpoint with the useLogminerReader connection attribute to offload log parsing from the source database.

Install the AWS Schema Conversion Tool (AWS SCT) directly on the AWS DMS replication instance to automatically convert and apply schemas in real-time during the CDC phase.

Cevabı ve açıklamayı göster

Cevap: Configure the AWS DMS source database endpoint to use the Binary Reader method rather than LogMiner to access the archived and active redo logs directly.; Enable minimal supplemental logging at the database level and table-level supplemental logging for all tables selected for replication on the source Oracle database.

Cevap

Configure the AWS DMS source database endpoint to use the Binary Reader method rather than LogMiner to access the archived and active redo logs directly, and enable minimal supplemental logging at the database level and table-level supplemental logging for all tables selected for replication on the source Oracle database.

The correct combination of actions requires configuring the AWS DMS source database endpoint to use the Binary Reader method instead of LogMiner, and enabling minimal supplemental logging at the database level along with table-level supplemental logging for all replicated tables. The Binary Reader method is designed for high-volume Oracle databases (typically generating more than 10-20 GB of redo logs per hour) because it reads the redo logs directly from the file system or ASM, minimizing database CPU overhead. Supplemental logging is a prerequisite for AWS DMS to read change data from Oracle redo logs.

Adım Adım Çözüm

Analyze database migration scale and constraints.

Identified a heterogeneous migration from a 15 TB Oracle database to Amazon Aurora PostgreSQL-Compatible Edition, with a high write load generating 35 GB/hour of redo logs. The solution must minimize CPU overhead and replication lag.

This establishes that AWS DMS Change Data Capture (CDC) is required alongside AWS SCT for schema conversion, and that standard LogMiner may struggle with high redo log volume.

Select the appropriate log reader method for AWS DMS.

Determined that the Binary Reader method should be used on the source endpoint instead of LogMiner.

Binary Reader reads redo and archived logs directly from the OS or ASM, bypassing the database engine for log processing. This mitigates the CPU overhead on the highly active source database and handles high-throughput logs much more efficiently.

Configure required logging on the source Oracle database.

Enabled minimal supplemental logging at the database level and supplemental logging at the table level for primary keys/unique keys.

AWS DMS requires supplemental logging on the source Oracle database to populate redo logs with the data needed to reconstruct SQL updates for CDC. Without this, the DMS task cannot perform ongoing replication.

Anahtar Kavram

AWS Database Migration Service (DMS) Change Data Capture (CDC) configurations for high-volume Oracle databases.

Soru 1684Soru →

Veridian Credit Union is modernizing its high-frequency ledger processing microservice by migrating it from on-premises virtual machines to AWS. The microservice will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks will reside in the Production VPC across three Availability Zones in private subnets with no internet access (no NAT Gateways). The container images must be pulled from a centralized Amazon ECR repository located in a Shared Services AWS account, where the images are encrypted using a KMS key. The application also retrieves database credentials from AWS Secrets Manager in the Production account. Additionally, the application must communicate with an on-premises core banking API via an AWS Direct Connect connection attached to an AWS Transit Gateway. All network traffic to AWS services must remain within the AWS private network. Which TWO configurations must the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create VPC interface endpoints for ECR API, ECR Docker, and Secrets Manager, and a gateway VPC endpoint for Amazon S3.

In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK) for encryption. Update the key policy of the CMK to grant kms:Decrypt and kms:DescribeKey permissions to the ECS task execution role in the Production account, and grant the role ECR read permissions in the repository policy.

Configure the ECS task definition to use the bridge network mode to allow container-to-container port mapping. Create a single NAT Gateway in the Production VPC to route the image pull requests to the public ECR endpoints.

Configure the ECR repository in the Shared Services account to use the AWS-managed KMS key (aws/ecr) for image encryption. In the Production account, attach an IAM policy to the ECS task execution role granting kms:Decrypt permissions on the Shared Services account's aws/ecr key.

Create the ECR VPC interface endpoints in the Shared Services VPC. Associate the Route 53 Private Hosted Zone created for ECR in the Shared Services VPC with the Production VPC, and route all image pull traffic transitively from the Production VPC to the Shared Services VPC endpoints over the Transit Gateway.

Cevabı ve açıklamayı göster

Cevap: Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create VPC interface endpoints for ECR API, ECR Docker, and Secrets Manager, and a gateway VPC endpoint for Amazon S3.; In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK) for encryption. Update the key policy of the CMK to grant kms:Decrypt and kms:DescribeKey permissions to the ECS task execution role in the Production account, and grant the role ECR read permissions in the repository policy.

Cevap

Configure the ECS task definition to use the awsvpc network mode, create local VPC interface endpoints for ECR and Secrets Manager, and a gateway VPC endpoint for Amazon S3. In the Shared Services account, use a Customer Managed Key (CMK) to encrypt the ECR repository and grant cross-account KMS decryption and ECR read permissions to the Production account's ECS task execution role.

The correct options specify using the awsvpc network mode, which is mandatory for AWS Fargate, and setting up local VPC endpoints (including ECR API, ECR Docker, Secrets Manager, and the S3 Gateway endpoint) to allow private communication. They also correctly use a Customer Managed Key (CMK) in the Shared Services account with key policy modifications to grant decrypt permissions to the Production account's ECS task execution role, which is the only way to support cross-account image decryption.

Adım Adım Çözüm

Select the appropriate network mode for AWS Fargate tasks.

The task definition must be configured to use the awsvpc network mode, as Fargate does not support bridge or host network modes.

AWS Fargate only supports the awsvpc network mode, where every task receives its own Elastic Network Interface (ENI).

Configure private AWS service connectivity for the Production VPC.

Interface VPC endpoints are created for ECR API, ECR Docker, and Secrets Manager, along with a gateway VPC endpoint for S3.

Since the VPC has no internet gateway or NAT gateways, private endpoints are required to interact with AWS services, and ECR requires S3 access to download container image layers.

Set up cross-account access and encryption for the ECR repository.

The ECR repository is configured to use a Customer Managed Key (CMK), and its key policy is updated to grant access to the Production account's ECS task execution role.

AWS managed keys cannot be shared across accounts. A Customer Managed Key is required to permit the task execution role in another account to decrypt the image layers during task launch.

Anahtar Kavram

Modernizing legacy workloads using Amazon ECS on AWS Fargate requires configuring the awsvpc network mode, establishing private VPC endpoints for service access without internet routing, and correctly delegating cross-account IAM and KMS permissions when using shared image registries.

Tahmini Süre:3m 0s

Soru 1685Soru →

An enterprise is strengthening its identity and access security for a multi-account environment. System administrators must federate from an on-premises identity provider (IdP) via SAML 2.0 to access a centralized administration role in AWS Account A. To perform their duties, administrators must also manage encrypted backup files stored in an Amazon S3 bucket in Account B. The security team mandates that:

1. Administrators can only federate and assume the role in Account A when requests originate from the corporate network IP range ( $203.0.113.0/24$ ).
2. The administration role must be allowed to access and decrypt the backups in Account B without exposing the backup data to external accounts.

Which combination of configuration steps meets these security requirements?

Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to

203.0.113.0/24

. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.

Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRole`, and a condition restricting `aws:SourceIp` to

203.0.113.0/24

. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.

Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to

203.0.113.0/24

. In Account B, encrypt the S3 bucket using the default AWS-managed KMS key for Amazon S3 (`aws/s3`), and attach an IAM policy to the role in Account A allowing KMS decrypt operations.

Apply a Service Control Policy (SCP) at the Organization root that denies all access if `aws:SourceIp` is not

203.0.113.0/24

, assuming this SCP will automatically grant the federated role in Account A the required trust permissions without configuring a role trust policy. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.

Cevabı ve açıklamayı göster

Cevap: Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to $203.0.113.0/24$ . In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.

Cevap

Configure the trust policy of the IAM role in Account A with the action set to `sts:AssumeRoleWithSAML` and a condition restricting `aws:SourceIp` to the corporate network range, and use a Customer Managed Key (CMK) in Account B with a key policy allowing the role cross-account access.

The correct solution configures the IAM role trust policy in Account A with the `sts:AssumeRoleWithSAML` action to support SAML 2.0 federation and includes a condition matching `aws:SourceIp` to restrict access to the corporate network range. For cross-account access to encrypted backups in Account B, a Customer Managed Key (CMK) must be used because its key policy can be updated to trust the role in Account A, whereas AWS-managed keys cannot be shared across accounts.

Adım Adım Çözüm

Establish secure SAML 2.0 federation with source IP constraints.

The IAM role trust policy in Account A must trust the SAML IdP as principal, allow `sts:AssumeRoleWithSAML`, and restrict access using a condition block for `aws:SourceIp` to

203.0.113.0/24

SAML federation requires the specific `sts:AssumeRoleWithSAML` action to process SAML assertions. Restricting `aws:SourceIp` at the trust policy level ensures federation is only permitted from the corporate network.

Configure cross-account KMS encryption for S3 bucket backups.

Encrypt the S3 bucket in Account B with a Customer Managed Key (CMK) and update its key policy to grant key usage permissions to the federated IAM role in Account A.

AWS-managed KMS keys do not support key policy modifications and cannot be accessed across different AWS accounts. Using a CMK allows the key policy to be customized for cross-account access.

Anahtar Kavram

Implementing cross-account KMS access and securing SAML federation with trust policy source IP conditions.

Soru 1686Soru →

A clinical research organization is migrating its regulatory-compliant data ingestion workload, consisting of $18$ servers, from a private colocation facility to AWS. Security policies mandate that all replication traffic must be encrypted in transit and must not traverse the public internet. The hybrid connectivity is established using an AWS Direct Connect connection terminating at an AWS Transit Gateway. A dedicated staging VPC contains the AWS Application Migration Service (MGN) staging area subnet. During the agent installation on the on-premises servers, replication fails to initiate. A solutions architect discovers that while the agent can establish a control plane connection to the MGN VPC endpoints over port $443$ , the agent cannot establish a data replication connection to the MGN replication servers in the staging area subnet.

Which of the following actions will resolve this replication failure?

Configure the on-premises firewall to allow outbound traffic on TCP port

1500

to the staging area subnet, and verify that the security group for the MGN replication servers allows inbound traffic on TCP port

1500

from the on-premises server CIDR block.

Modify the MGN replication template to use TCP port

443

for data replication traffic instead of TCP port

1500

, and configure the on-premises firewall to allow outbound HTTPS traffic to the staging area subnet.

Deploy a Direct Connect Gateway and associate it directly with the virtual private gateway of the staging VPC, then configure the Transit Gateway route tables to allow transitive routing between the Direct Connect gateway and the replication servers.

Associate the Route 53 Private Hosted Zone for the MGN VPC endpoints with the staging VPC, and configure the on-premises DNS forwarder to route all queries for the replication server hostnames to the Route 53 Resolver inbound endpoint.

Cevabı ve açıklamayı göster

Cevap: Configure the on-premises firewall to allow outbound traffic on TCP port $1500$ to the staging area subnet, and verify that the security group for the MGN replication servers allows inbound traffic on TCP port $1500$ from the on-premises server CIDR block.

Cevap

Configure the on-premises firewall to allow outbound traffic on TCP port 1500 to the staging area subnet, and verify that the security group for the MGN replication servers allows inbound traffic on TCP port 1500 from the on-premises server CIDR block.

AWS Application Migration Service (MGN) requires two distinct paths of network communication: control plane communication over TCP port

443

to the MGN service endpoints, and data replication traffic over TCP port

1500

directly to the replication servers in the staging area subnet. Since the control plane connection over port

443

is working but replication cannot initiate, the corporate firewall or the security group in the staging area is blocking the replication channel on TCP port

1500

. Allowing outbound traffic on port

1500

at the corporate firewall and inbound traffic on port

1500

in the staging area security group resolves this block.

Adım Adım Çözüm

Identify the network ports required for AWS Application Migration Service (MGN) agent data replication.

Determine that the replication agent requires outbound TCP port

1500

to send data blocks directly to the replication servers in the staging area subnet.

AWS MGN separates control plane traffic (TCP port

443

) from data replication traffic (TCP port

1500

Examine the status of the replication connection from the source servers to the staging area.

Identify that the control plane connection over port

443

is successful, but the data replication channel to the replication servers is failing.

This isolates the issue specifically to TCP port

1500

routing, firewall rules, or security groups rather than DNS resolution or endpoint configuration.

Adjust the security groups and on-premises firewall configurations to permit replication traffic.

Allow outbound TCP port

1500

on the corporate firewall and inbound TCP port

1500

on the staging area subnet's security group.

This allows the replication agent on the on-premises servers to establish a direct data channel to the replication servers over the private Direct Connect and Transit Gateway connection.

Anahtar Kavram

AWS Application Migration Service (MGN) requires TCP port

1500

to be open for data replication from the source servers to the replication servers in the staging area subnet. Control plane communication uses TCP port

443

Tahmini Süre:2m 30s

Soru 1687Soru →

A national energy grid operator is planning to migrate its hybrid workload portfolio to AWS. The portfolio includes:

* 300 VMware vSphere VMs running enterprise Linux and Windows Server OS.
* 10 physical bare-metal servers running CentOS 7 that handle sensitive telemetry data. These servers are located in a secure network zone with no direct outbound internet access, but they can route traffic through an on-premises HTTP proxy.
* 8 legacy physical servers running IBM AIX that run critical database backends.

The operator requires a discovery solution that maps network dependencies to group servers into applications, gathers CPU and memory utilization data for right-sizing, and tracks the migration status in a centralized dashboard using AWS Migration Hub. Due to strict security policies, the virtualization team refuses to install any agents on the hypervisors or inside the VMware VMs, but they allow read-only vCenter read access.

Which combination of discovery mechanisms and configuration steps will meet these requirements while mapping dependencies and tracking the migration? (Select TWO.)

Geçerli olan tümünü seçin

Install the AWS Application Discovery Agent on the 10 CentOS physical servers, and configure the agents to route traffic through the HTTP proxy by setting the HTTPS_PROXY environment variable during installation.

Install the AWS Application Discovery Agent on the VMware VMs, and configure the AWS Application Discovery Agentless Collector to discover the IBM AIX and CentOS physical servers.

Deploy the AWS Application Discovery Agentless Collector, and configure it to perform network dependency scanning across both the VMware VMs and the CentOS physical servers.

Use AWS Application Migration Service (MGN) replication agents to automatically discover the OS configurations of the VMware VMs and IBM AIX servers, and sync the metadata directly to AWS Migration Hub.

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware environment to discover VM configurations and resource utilization, and manually populate the AWS Migration Hub import template CSV file to record the IBM AIX servers' configurations and dependencies.; Install the AWS Application Discovery Agent on the 10 CentOS physical servers, and configure the agents to route traffic through the HTTP proxy by setting the HTTPS_PROXY environment variable during installation.

Cevap

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware environment to discover VM configurations and resource utilization, and manually populate the AWS Migration Hub import template CSV file to record the IBM AIX servers' configurations and dependencies. Install the AWS Application Discovery Agent on the 10 CentOS physical servers, and configure the agents to route traffic through the HTTP proxy by setting the HTTPS_PROXY environment variable during installation.

The correct combination requires using the Agentless Collector for VMware VMs to respect the no-agent policy, while using the Agent-based discovery on the CentOS physical servers to map network dependencies (using the HTTP proxy settings). For unsupported architectures like physical IBM AIX, manual inventory collection and CSV import into AWS Migration Hub is the appropriate mechanism.

Adım Adım Çözüm

Evaluate the discovery mechanism for the VMware vSphere VMs.

Since the virtualization team forbids installing agents inside the VMs or on the hypervisors, the AWS Application Discovery Agentless Collector is selected. It deploys as an OVA in vCenter and collects metadata and performance history without agents.

Meets the constraint of not installing agents while gathering VM configurations and performance history.

Determine the discovery mechanism for the physical CentOS telemetry servers.

The AWS Application Discovery Agent is installed on the physical CentOS servers. Since they are in a secure network zone with HTTP proxy egress, the HTTPS_PROXY environment variable is configured to allow the agent to register and send discovery data to AWS.

Allows process-level network dependency tracking and performance data collection for compatible Linux systems behind a proxy.

Address the legacy physical IBM AIX servers.

Because IBM AIX is not supported by either the Application Discovery Agent or the Agentless Collector, and they are physical systems, their configuration and network dependency data must be collected manually and uploaded via the AWS Migration Hub CSV import template.

Ensures unsupported operating systems are included in the overall migration plan and application grouping in Migration Hub.

Anahtar Kavram

Selecting and configuring AWS Application Discovery Service agents, collectors, and import options based on OS support, virtualization type, proxy network constraints, and security policies.

Soru 1688Soru →

A company runs a logistics tracking application on Amazon EC2 instances in private subnets across multiple Availability Zones in the us-east-1 Region. An analysis of the monthly billing details reveals high data transfer and processing charges associated with NAT Gateways. The network traffic patterns show the following:

* Outbound uploads of telemetry files (30 TB per month) to Amazon S3.
* Inbound and outbound database operations (10 TB per month) with Amazon DynamoDB.
* Mapping updates (15 TB per month) downloaded from a partner company's API hosted in another AWS account in the same Region.

Which combination of actions will most cost-effectively reduce the NAT Gateway charges? (Select TWO.)

Geçerli olan tümünü seçin

Configure Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and associate them with the route tables of the private subnets.

Work with the partner company to expose their API via an AWS PrivateLink VPC Endpoint Service, and create an Interface VPC Endpoint in the application's VPC.

Provision Interface VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and configure the application to use these endpoints.

Create a VPC Peering connection with the partner's VPC, and route S3 and DynamoDB traffic through the peered connection.

Replace the NAT Gateways with NAT Instances configured in an Auto Scaling group to handle all external traffic to S3, DynamoDB, and the partner API.

Cevabı ve açıklamayı göster

Cevap: Configure Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and associate them with the route tables of the private subnets.; Work with the partner company to expose their API via an AWS PrivateLink VPC Endpoint Service, and create an Interface VPC Endpoint in the application's VPC.

Cevap

Configure Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and associate them with the route tables of the private subnets. Work with the partner company to expose their API via an AWS PrivateLink VPC Endpoint Service, and create an Interface VPC Endpoint in the application's VPC.

Configuring Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB is the most cost-effective way to route S3 and DynamoDB traffic because Gateway Endpoints are free. Using AWS PrivateLink to connect to the partner API via an Interface VPC Endpoint decreases the data processing fee from the NAT Gateway rate of

0.045 per GB to the Interface Endpoint rate of

0.01 per GB, yielding significant savings for the 15 TB of partner API traffic.

Adım Adım Çözüm

Identify the high-volume traffic targets traversing the NAT Gateways.

S3 receives 30 TB/month, DynamoDB receives 10 TB/month, and the partner API receives 15 TB/month.

Categorizing the traffic flows allows targeting the most expensive components first.

Apply Gateway VPC Endpoints for S3 and DynamoDB.

Bypasses NAT Gateways for 40 TB/month of traffic at $0 cost.

Gateway Endpoints are free of charge and automatically route S3 and DynamoDB traffic locally within the VPC.

Address the partner API traffic using AWS PrivateLink.

Bypasses NAT Gateways for 15 TB/month of traffic, reducing the processing cost from

0.045 per GB to

0.01 per GB.

Since the partner's API is hosted in the same Region, exposing it via a VPC Endpoint Service allows the logistics company to access it via an Interface Endpoint, avoiding NAT Gateway processing charges.

Anahtar Kavram

Bypassing NAT Gateways using S3/DynamoDB Gateway Endpoints and AWS PrivateLink Interface Endpoints to optimize data transfer and processing costs.

Soru 1689Soru →

An enterprise has a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is fronted by an Amazon CloudFront distribution. A security audit recommends strengthening the network and application-layer security by preventing common SQL injection attacks, rate-limiting aggressive clients at the edge, and restricting direct public internet access to the ALB so that it only processes requests originating from the CloudFront distribution. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the CloudFront distribution to insert a custom HTTP header into all origin requests. Configure the ALB listener rules to forward traffic to the target group only when this header is present with the correct value, and return an HTTP 403 response for all other requests.

Associate an AWS WAF Web ACL with the CloudFront distribution. Configure the Web ACL with SQL injection detection rules and a rate-based rule to restrict high-volume clients, evaluating these rules before the default action.

Associate an AWS WAF Web ACL with the ALB. Add a rule to allow all traffic at a high priority, and place the SQL injection detection and rate-limiting block rules at a lower priority.

Attach a Service Control Policy (SCP) to the member account that restricts ingress traffic on the ALB security group to allow only CloudFront managed prefix lists.

Create a Route 53 Private Hosted Zone for the application's domain name, configure an alias record pointing to the ALB, and do not associate the hosted zone with any VPC to isolate resolver queries.

Cevabı ve açıklamayı göster

Cevap: Configure the CloudFront distribution to insert a custom HTTP header into all origin requests. Configure the ALB listener rules to forward traffic to the target group only when this header is present with the correct value, and return an HTTP 403 response for all other requests.; Associate an AWS WAF Web ACL with the CloudFront distribution. Configure the Web ACL with SQL injection detection rules and a rate-based rule to restrict high-volume clients, evaluating these rules before the default action.

Cevap

Configure the CloudFront distribution to insert a custom HTTP header into origin requests, configure the ALB to only forward requests matching that header, and associate an AWS WAF Web ACL with CloudFront containing SQL injection and rate-limiting rules.

The correct combination involves inserting a custom HTTP header in CloudFront origin requests and validating this header on the ALB listener rules to restrict direct access to the ALB. Additionally, deploying AWS WAF at the CloudFront distribution enables filtering of SQL injection attacks and rate-limiting at the edge before the requests reach the application origin.

Adım Adım Çözüm

Configure origin request custom headers in Amazon CloudFront.

CloudFront automatically appends a custom header (e.g., X-Verify-Origin) with a secret value to every request forwarded to the ALB.

This establishes a shared secret between CloudFront and the Application Load Balancer to prove the request's origin.

Modify the Application Load Balancer listener rules.

The ALB evaluates incoming requests, forwards matching headers to the target group, and rejects others with an HTTP 403 response.

This restricts traffic to the ALB, preventing clients from bypassing edge security controls and accessing the ALB directly.

Deploy and associate AWS WAF with CloudFront.

Web exploits such as SQL injection and high-rate client requests are blocked at the edge before reaching the AWS infrastructure.

This leverages edge locations to drop malicious traffic, minimizing resource consumption on the ALB and target instances.

Anahtar Kavram

Strengthening identity, access, and network security by restricting ALB access to CloudFront and applying application-layer firewalls at the edge.

Soru 1690Soru →

An online gaming studio uses AWS Organizations to manage its game development, testing, and production environments. The environment includes a parent organizational unit (OU) called Engineering, which contains a child OU named Game-Dev for individual game development teams. To maintain compliance, the security team has deployed a centralized auditing IAM role named SecurityAuditRole in all member accounts under the Game-Dev OU. The security team wants to ensure that local administrators in the Game-Dev accounts cannot delete, modify, or detach policies from the SecurityAuditRole, while still retaining full administrative control over other resources. Which solution should the solutions architect implement to meet these requirements with the least administrative effort?

Attach a Service Control Policy (SCP) to the Game-Dev OU that denies iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, and iam:DetachRolePolicy actions when the resource is the SecurityAuditRole ARN.

Define an IAM Permission Boundary in the Game-Dev member accounts that denies modifications to the SecurityAuditRole, and require all developers to attach this boundary when creating new IAM users or roles.

Configure a SAML 2.0 identity provider (IdP) in each member account and configure the trust policy of SecurityAuditRole to allow access only from the central security account's IdP entity.

Enable AWS KMS encryption using an AWS-managed key (aws/iam) in the management account to encrypt the configuration of the SecurityAuditRole, and restrict access to this key.

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Game-Dev OU that denies iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, and iam:DetachRolePolicy actions when the resource is the SecurityAuditRole ARN.

Cevap

Attach a Service Control Policy (SCP) to the Game-Dev OU that denies resource-modifying and deleting actions on the SecurityAuditRole.

Attaching a Service Control Policy (SCP) to the OU restricts permissions for all IAM entities in the member accounts, including the local administrators. By denying IAM modification and deletion actions specifically on the Amazon Resource Name (ARN) of the central audit role, the organization ensures the role remains intact. SCPs act as guardrails and do not require modification of individual IAM policies, making this the most operationally efficient method.

Adım Adım Çözüm

Identify the organizational boundary where the governance rule must be enforced. Since the target is the Game-Dev accounts, the policy should be attached to the Game-Dev OU.

Enforcement targets the entire organizational unit containing the member accounts.

Attaching policies at the OU level ensures inheritance across all current and future accounts under that OU.

Write a Service Control Policy (SCP) that specifies an explicit Deny for iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, and iam:DetachRolePolicy actions.

A policy document containing the specified Deny actions is generated.

An explicit Deny in an SCP overrides any local administrator permissions in the member accounts.

Apply a resource constraint in the SCP to limit the Deny rule to only affect the specific ARN of the SecurityAuditRole.

The SCP restricts operations only on the specified role.

This maintains administrative flexibility in the member accounts, allowing local admins to manage other roles.

Anahtar Kavram

Service Control Policies (SCPs) act as organizational guardrails to restrict permissions in member accounts without granting permissions directly.

Tahmini Süre:2m 0s

Soru 1691Soru →

A company has configured a multi-account environment using AWS Organizations. The IT security team is setting up federated access for external database administrators to access a target database administration account. The company uses an on-premises SAML 2.0-compliant Identity Provider (IdP). A solutions architect creates an IAM SAML provider entity named "CorporateIDP" in the database administration account and configures the IdP with the corresponding AWS metadata. The solutions architect now needs to configure the IAM role in the database administration account that the database administrators will assume after authenticating via the IdP. Which configuration must be applied to the IAM role's trust policy in the database administration account to allow these users to federate successfully?

Configure the trust policy with the principal set to the SAML provider ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP), the action set to sts:AssumeRole, and a condition verifying that the SAML:sub attribute matches the database administrators group.

Configure the trust policy with the principal set to the AWS Organizations management account root user, and rely on a Service Control Policy (SCP) applied to the Organizational Unit (OU) to delegate permissions using the sts:AssumeRoleWithSAML action.

Configure the trust policy with the principal set to the SAML provider ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP), the action set to sts:AssumeRoleWithSAML, and a condition verifying that the SAML:aud attribute matches https://signin.aws.amazon.com/saml.

Configure the trust policy with the principal set to the corporate Identity Provider's public IP address range, and the action set to sts:AssumeRoleWithWebIdentity to allow direct federation from the enterprise network.

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy with the principal set to the SAML provider ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP), the action set to sts:AssumeRoleWithSAML, and a condition verifying that the SAML:aud attribute matches https://signin.aws.amazon.com/saml.

Cevap

Configure the trust policy with the principal set to the SAML provider ARN, the action set to sts:AssumeRoleWithSAML, and a condition verifying that the SAML:aud attribute matches the standard AWS SAML endpoint.

The correct configuration requires defining a trust relationship where the principal is the IAM SAML provider ARN representing the corporate IdP. The action must be sts:AssumeRoleWithSAML to authorize the SAML assertion payload, and the SAML:aud condition ensures that the target audience is the official AWS SAML endpoint.

Adım Adım Çözüm

Identify the SAML provider resource in the target AWS account.

The SAML provider resource ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP) represents the trust relationship configuration.

The IAM role trust policy must specify this provider ARN as the trusted principal for incoming authentication assertions.

Select the correct STS API action for SAML token exchange.

Use the sts:AssumeRoleWithSAML action in the trust policy.

This specific action is designed for SAML 2.0 identity providers to exchange external SAML assertions for temporary AWS credentials.

Configure the audience constraint in the trust policy conditions.

Set a condition for the SAML:aud context key to match https://signin.aws.amazon.com/saml.

Verifying the audience matches the AWS SAML console endpoint prevents potential replay attacks and ensures validity of the token exchange.

Anahtar Kavram

SAML 2.0 Federation Trust Configuration in Multi-Account Environments

Tahmini Süre:1m 30s

Soru 1692Soru →

A logistics enterprise is designing a new fleet tracking application. The architecture includes a write-heavy telemetry ingestion service (NoSQL workload) that must process up to $30,000\text{ writes/second}$ with sub- $10\text{ ms}$ latency. It also includes an administrative portal (OLTP workload) for managing vehicle metadata and driver schedules. The administrative data requires encryption at rest using a Customer Managed Key (CMK) to allow a dedicated compliance team in a separate AWS account to run weekly audit queries directly on database replicas. The disaster recovery requirements specify a Recovery Point Objective (RPO) of $5\text{ minutes}$ and a Recovery Time Objective (RTO) of $15\text{ minutes}$ . Which database and storage design meets these requirements?

Deploy Amazon DynamoDB for the telemetry workload, and deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas for the vehicle metadata workload. Encrypt the Aurora cluster using a Customer Managed Key (CMK), grant the compliance account key usage permissions in the key policy, and configure the compliance team to query the Aurora Replicas.

Deploy Amazon DynamoDB for the telemetry workload, and deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ deployment for the vehicle metadata workload. Configure the compliance team to query the Multi-AZ standby instance directly to avoid performance impacts. Encrypt the database using the AWS-managed key 'aws/rds'.

Deploy Amazon RDS for PostgreSQL with a Multi-AZ deployment for both workloads. Export database backups daily to Amazon S3, encrypting them with the AWS-managed key 'aws/rds', and configure the compliance team to query the data using Amazon Athena. Configure Amazon RDS Read Replicas to handle the disaster recovery RTO and RPO.

Deploy Amazon DynamoDB for the telemetry workload, and deploy an Amazon Aurora PostgreSQL DB cluster for the vehicle metadata workload. Encrypt the Aurora cluster using the AWS-managed key 'aws/rds'. Direct the compliance team to query the primary Aurora DB instance directly during scheduled maintenance windows to minimize lock contention.

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon DynamoDB for the telemetry workload, and deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas for the vehicle metadata workload. Encrypt the Aurora cluster using a Customer Managed Key (CMK), grant the compliance account key usage permissions in the key policy, and configure the compliance team to query the Aurora Replicas.

Cevap

Deploy Amazon DynamoDB for the telemetry workload and Amazon Aurora PostgreSQL for the metadata workload, using a Customer Managed Key for encryption to support cross-account replica queries.

The correct option proposes using Amazon DynamoDB for the high-throughput NoSQL telemetry workload and Amazon Aurora PostgreSQL for the OLTP metadata workload. Aurora PostgreSQL provides read replicas that can be queried by the compliance team. Encrypting the cluster with a Customer Managed Key (CMK) allows the primary account to delegate access to the compliance account by modifying the KMS key policy, satisfying both the security and auditing requirements.

Adım Adım Çözüm

Identify the storage requirements for the telemetry ingestion workload (

30,000\text{ writes/second}

with sub-

10\text{ ms}

latency) and the administrative metadata workload.

The telemetry ingestion requires a highly scalable NoSQL database like Amazon DynamoDB. The metadata requires a relational OLTP database like Amazon Aurora or Amazon RDS.

DynamoDB handles high-throughput NoSQL workloads with single-digit millisecond latency, while Aurora/RDS provides transactional consistency for relational metadata.

Evaluate the encryption and cross-account access requirements for database replicas.

The database must use a Customer Managed Key (CMK) because the default AWS-managed key ('aws/rds') cannot be shared or delegated to another AWS account. The compliance team must query replica nodes.

AWS-managed keys do not allow policy modifications to grant cross-account access, which is required for the compliance team's account to decrypt and query the replicas.

Assess the disaster recovery and replica access requirements.

Aurora PostgreSQL DB clusters support multi-AZ deployments with read replicas that can be queried and handle failover within seconds (meeting the

15\text{ minute}

RTO and

5\text{ minute}

RPO). RDS standby instances cannot be read from.

Amazon RDS Multi-AZ standby instances do not serve read traffic. Only Aurora Replicas or RDS Read Replicas support reading.

Anahtar Kavram

Designing a hybrid storage strategy separating NoSQL and OLTP workloads while addressing cross-account KMS key sharing and read replica routing limits.

Soru 1693Soru →

VoltGrid Solutions is modernizing its on-premises telemetry ingestion engine by migrating it to AWS. The engine processes real-time smart grid data from public utility endpoints and saves temporary states. The company wants to run this engine on Amazon ECS using the AWS Fargate launch type across $3$ Availability Zones for high availability. To satisfy strict security compliance standards, Fargate tasks must run in private subnets with no direct route to the internet, and no NAT Gateways may be used. The container images are hosted in a centralized shared services AWS account ( $111122223333$ ) in an Amazon ECR repository, which is encrypted using a Customer Managed Key (CMK) in AWS KMS. Additionally, tasks require access to a shared Amazon EFS file system to store and read active session states. All network traffic to AWS services must traverse VPC endpoints to keep traffic within the AWS private network. Which TWO actions should a solutions architect take to configure this environment and meet the security and architectural requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure interface VPC endpoints in the application's VPC for Amazon ECS telemetry, ECS agent, ECS service, Amazon ECR API, Amazon ECR Docker Registry, AWS KMS, and Amazon EFS, along with a gateway VPC endpoint for Amazon S3. Update the shared ECR repository policy and the KMS CMK key policy in the shared services account to grant permissions to the ECS task execution role in the application VPC.

Configure the ECS task definition using the awsvpc network mode and define the EFS volume using an EFS access point. Assign an ECS task execution role with permissions to read from ECR and decrypt with the KMS CMK. Set the security group on the EFS mount targets to allow inbound NFS traffic on TCP port

2049

from the security group associated with the ECS Fargate tasks.

Configure the ECS task definition using the host network mode to map container ports directly to the underlying host network interface for optimal throughput. Use the default AWS-managed KMS key (aws/ecr) to encrypt the ECR repository, and delegate decryption permissions to the ECS task execution role via the service-linked role.

Configure a single NAT Gateway in the shared services VPC and route the application's outbound ECS and ECR traffic through an AWS Transit Gateway. Ensure the private subnet route tables point to the Transit Gateway for all outbound destinations.

Configure a Route

53

Private Hosted Zone (PHZ) for the ECR and KMS service endpoints in the shared services account to override public DNS resolution. Do not associate this PHZ with the application's VPC, and rely on standard DNS forwarders in the application VPC to resolve AWS service hostnames.

Cevabı ve açıklamayı göster

Cevap: Configure interface VPC endpoints in the application's VPC for Amazon ECS telemetry, ECS agent, ECS service, Amazon ECR API, Amazon ECR Docker Registry, AWS KMS, and Amazon EFS, along with a gateway VPC endpoint for Amazon S3. Update the shared ECR repository policy and the KMS CMK key policy in the shared services account to grant permissions to the ECS task execution role in the application VPC.; Configure the ECS task definition using the awsvpc network mode and define the EFS volume using an EFS access point. Assign an ECS task execution role with permissions to read from ECR and decrypt with the KMS CMK. Set the security group on the EFS mount targets to allow inbound NFS traffic on TCP port $2049$ from the security group associated with the ECS Fargate tasks.

Cevap

To modernise the workload on ECS Fargate, the solutions architect must: 1) Deploy interface endpoints for ECS, ECR API, ECR Registry, KMS, and EFS, along with a gateway endpoint for S3 in the application's VPC, and configure the target cross-account policies. 2) Configure the task definition using the awsvpc network mode with EFS access points, and configure the EFS security groups to allow NFS traffic (TCP port

2049

) from the tasks.

The correct configuration requires establishing PrivateLink interface endpoints in the application VPC for ECS, ECR, KMS, and EFS, along with an S3 gateway endpoint (since ECR stores image layers in S3). It also requires using the awsvpc network mode for ECS Fargate tasks, defining EFS access points, updating the cross-account ECR and KMS policies, and authorizing NFS traffic on TCP port

2049

between the ECS task security group and the EFS mount target security group.

Adım Adım Çözüm

Configure VPC Endpoint Infrastructure

Create interface VPC endpoints (PrivateLink) for com.amazonaws.region.ecs, com.amazonaws.region.ecs-agent, com.amazonaws.region.ecs-telemetry, com.amazonaws.region.ecr.api, com.amazonaws.region.ecr.dkr, com.amazonaws.region.kms, and com.amazonaws.region.elasticfilesystem. Create a gateway endpoint for Amazon S3 in the application VPC.

Required to pull images, send logs, decrypt KMS keys, and mount EFS volumes without traversing the public internet or using a NAT Gateway.

Set up Cross-Account Policies

Attach a repository policy to the shared ECR repository allowing access from the application account. Update the KMS Customer Managed Key policy in the shared services account to allow the ECS task execution role in the application account to perform kms:Decrypt.

Allows the application account's ECS agent to pull ECR images and decrypt the key used to encrypt the images.

Configure Task Networking and Mount Security Groups

Set the task definition network mode to awsvpc. Configure the security group associated with the EFS mount targets to allow inbound NFS traffic on TCP port

2049

from the security group of the ECS Fargate tasks.

Fargate requires awsvpc network mode, which provisions elastic network interfaces for tasks. Security groups must allow NFS communication between the tasks and EFS.

Anahtar Kavram

Deploying fully private ECS Fargate tasks with cross-account ECR, KMS, and EFS dependencies requires configuring awsvpc network mode, cross-account IAM and KMS policies, and dedicated interface and gateway VPC endpoints.

Tahmini Süre:3m 0s

Soru 1694Soru →

A company uses AWS CloudFormation StackSets to deploy application infrastructure across multiple AWS accounts in an AWS Organization. The application requires secure, cross-account access to environment-specific credentials stored in a central operations account. The infrastructure team has also noticed that local administrators occasionally perform manual configuration changes directly on the resources within their individual accounts, leading to configuration drift. The Solutions Architect needs to implement a solution that automates drift detection and remediation while securing the cross-account dynamic parameters. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Encrypt the credentials in AWS Systems Manager Parameter Store using an AWS KMS Customer Managed Key (CMK), and update the key policy to grant decryption permissions to the application roles in the target accounts.

Deploy AWS Systems Manager State Manager associations to automatically enforce and remediate configuration consistency on the managed instances, and use AWS CloudFormation drift detection to identify stack-level resource changes.

Encrypt the credentials in AWS Systems Manager Parameter Store using the default AWS-managed KMS key (aws/ssm), and configure its policy to delegate read and decrypt permissions to the target accounts.

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly permits access to the Parameter Store resources in the central operations account, assuming this inherits downstream permissions.

Configure the CloudFormation StackSets to automatically delete and recreate the stacks daily to overwrite any manual modifications and reset resource configurations.

Cevabı ve açıklamayı göster

Cevap: Encrypt the credentials in AWS Systems Manager Parameter Store using an AWS KMS Customer Managed Key (CMK), and update the key policy to grant decryption permissions to the application roles in the target accounts.; Deploy AWS Systems Manager State Manager associations to automatically enforce and remediate configuration consistency on the managed instances, and use AWS CloudFormation drift detection to identify stack-level resource changes.

Cevap

The correct solution involves utilizing a Customer Managed Key (CMK) in AWS KMS to allow cross-account key policy configurations, and using AWS Systems Manager State Manager associations in tandem with CloudFormation drift detection to enforce configuration and check for stack modifications.

The correct actions involve deploying Systems Manager State Manager associations to continuously enforce configurations and using CloudFormation drift detection to verify infrastructure compliance, while using a Customer Managed Key (CMK) in KMS to securely permit cross-account decryption of dynamic parameters.

Adım Adım Çözüm

Determine how to safely share encrypted parameters across accounts.

Select the option that configures Systems Manager Parameter Store with a Customer Managed Key (CMK).

AWS-managed KMS keys do not support key policy modifications and cannot be shared with external or child AWS accounts.

Identify the appropriate mechanisms for infrastructure drift detection and configuration enforcement.

Deploy Systems Manager State Manager associations alongside CloudFormation drift detection.

This combination allows continuous enforcement of configuration compliance on the instances while maintaining stack integrity checks.

Anahtar Kavram

Cross-account AWS KMS resource policies and automatic configuration drift remediation

Tahmini Süre:2m 0s

Soru 1695Soru →

An enterprise hosts a legacy document processing application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances reside in private subnets across two Availability Zones, AZ-A and AZ-B. Outbound internet traffic from both private subnets is routed through a single NAT Gateway located in the public subnet of AZ-A to allow instances to download critical libraries during startup.

The application instances require approximately $420$ seconds to complete bootstrapping, start services, and pass ALB health checks. The ASG is currently configured with a simple scaling policy based on CPU utilization and has a default cooldown of $300$ seconds.

During sudden traffic surges, the ASG launches excessive redundant instances, resulting in database connection exhaustion. Additionally, a recent outage in AZ-A caused the instances launching in AZ-B to fail bootstrapping, resulting in application downtime.

Which combination of actions should a solutions architect take to resolve the scaling and fault tolerance issues?

Configure a target tracking scaling policy with an estimated instance warmup of

450

seconds. Deploy a second NAT Gateway in the public subnet of AZ-B, and update the route table for the private subnets in AZ-B to route outbound internet traffic through the new NAT Gateway.

Configure a simple scaling policy with a decreased default cooldown period of

180

seconds. Deploy a second NAT Gateway in the public subnet of AZ-B, and update the route table for the private subnets in AZ-B to route outbound internet traffic through the new NAT Gateway.

Configure a target tracking scaling policy with an estimated instance warmup of

450

seconds. Maintain the single NAT Gateway in AZ-A to minimize operational costs, and increase the Application Load Balancer health check grace period to

500

seconds.

Submit a request to AWS Support to pre-warm the Application Load Balancer to absorb the traffic surges. Retain the simple scaling policy with the

300

-second default cooldown, and enable cross-zone load balancing on the Application Load Balancer to route traffic to AZ-B without deploying an additional NAT Gateway.

Cevabı ve açıklamayı göster

Cevap: Configure a target tracking scaling policy with an estimated instance warmup of $450$ seconds. Deploy a second NAT Gateway in the public subnet of AZ-B, and update the route table for the private subnets in AZ-B to route outbound internet traffic through the new NAT Gateway.

Cevap

Configure a target tracking scaling policy with an estimated instance warmup of

450

seconds. Deploy a second NAT Gateway in the public subnet of AZ-B, and update the route table for the private subnets in AZ-B to route outbound internet traffic through the new NAT Gateway.

The correct option addresses both the scaling delay and network fault tolerance. Configuring a target tracking scaling policy with an estimated instance warmup of

450

seconds ensures the Auto Scaling group does not launch additional instances while existing ones are still bootstrapping (since

450

seconds covers the

420

-second startup delay). Deploying a dedicated NAT Gateway in AZ-B ensures that instances in AZ-B retain internet access for library downloads if AZ-A undergoes an outage.

Adım Adım Çözüm

Evaluate the bootstrapping timeline against scaling thresholds.

Identify that the current

300

-second cooldown is shorter than the

420

-second instance launch time, causing premature additional scale-out actions.

Aligning scaling evaluation intervals or warmup periods with actual instance readiness prevents over-provisioning.

Address the single point of failure in network routing.

Deploy a second NAT Gateway in AZ-B and configure the private route tables locally.

This guarantees that instances in AZ-B can still download required dependencies and bootstrap successfully even if AZ-A goes down.

Anahtar Kavram

Auto Scaling Warmup and Multi-AZ Redundancy

Tahmini Süre:2m 0s

Soru 1696Soru →

A global pharmaceutical manufacturing company is planning to migrate its regulated drug development platform to AWS. The on-premises environment consists of 200 VMware vSphere virtual machines (VMs) running Red Hat Enterprise Linux (RHEL) and 15 physical bare-metal servers running IBM AIX that host legacy database systems. The company's security policy prohibits any inbound traffic to the on-premises environment, and all outbound traffic to the internet must route through a designated forward proxy. The migration team requires detailed process-to-process network dependency mapping for the VMware VMs to group applications correctly, and system inventory details for the AIX servers. The team also wants to consolidate all discovery data and track the migration status of all assets in AWS Migration Hub. Which combination of discovery mechanisms and configurations should a solutions architect recommend to satisfy these requirements?

Deploy the AWS Application Discovery Agentless Collector on the VMware cluster to perform initial inventory discovery. Install the AWS Application Discovery Agent on the in-scope RHEL VMs, configuring the agent to use the forward proxy for outbound communications, to gather process-to-process network dependencies. For the AIX physical servers, manually populate the AWS Migration Hub import CSV template with their inventory details and upload it, then group all discovered and imported assets into applications within AWS Migration Hub to track the migration.

Install the AWS Application Discovery Agent on all VMware RHEL VMs and the IBM AIX physical servers. Configure the agents to route discovery data through the forward proxy. Since the security policy prohibits inbound traffic, configure a temporary site-to-site VPN to allow the Application Discovery Service to poll the agents, ensuring TCP port 1500 is opened in the local firewall for data replication.

Deploy the AWS Application Discovery Agentless Collector on the VMware vCenter Server and configure it to collect process-level network dependency mappings from the RHEL VMs. For the legacy AIX database servers, use the AWS Schema Conversion Tool (SCT) to perform a source database discovery assessment, then configure AWS Database Migration Service (DMS) with Change Data Capture (CDC) to automatically register and track the servers in AWS Migration Hub.

Deploy the AWS Application Discovery Agentless Collector to discover the VMware VMs. For the AIX physical servers, request an AWS Snowball Edge Storage Optimized device, run a local discovery script on the AIX servers to export inventory data to the device's S3-compatible storage, and ship the device to AWS to automate the import of configurations into the AWS Migration Hub tracking dashboard.

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agentless Collector on the VMware cluster to perform initial inventory discovery. Install the AWS Application Discovery Agent on the in-scope RHEL VMs, configuring the agent to use the forward proxy for outbound communications, to gather process-to-process network dependencies. For the AIX physical servers, manually populate the AWS Migration Hub import CSV template with their inventory details and upload it, then group all discovered and imported assets into applications within AWS Migration Hub to track the migration.

Cevap

Deploy the AWS Application Discovery Agentless Collector on the VMware cluster for initial VMware VM discovery, install the AWS Application Discovery Agent on the in-scope RHEL VMs configured to use the outbound forward proxy for detailed network dependencies, manually upload the AIX server details using the AWS Migration Hub import CSV template, and group and track all assets within AWS Migration Hub.

The correct solution uses the agentless collector for initial vCenter discovery and the agent-based collector on Linux VMs to gather process-level network connections. The agent supports outbound-only connectivity through a proxy. For unsupported operating systems like IBM AIX on physical hardware, the manual CSV import template is the standard, supported method to register those assets. AWS Migration Hub serves as the central hub to group and track both discovered and imported assets.

Adım Adım Çözüm

Evaluate the discovery requirements for VMware VMs.

The requirement for process-to-process network dependency mapping dictates the use of the agent-based AWS Application Discovery Agent, as the Agentless Collector only gathers host-level configuration and utilization metrics from vCenter.

Agentless discovery cannot inspect OS-level processes and their active network connections.

Address the operating system support and collection limits for IBM AIX physical servers.

Identify that the AWS Application Discovery Agent only supports specific Windows and Linux distributions, and does not support Unix operating systems like IBM AIX. The Agentless Collector also cannot discover physical bare-metal servers.

Alternate discovery mechanisms, such as manual CSV import or supported third-party discovery integrations, must be used for unsupported operating systems and non-virtualized physical hardware.

Assess the network connectivity and firewall restrictions.

Confirm that the Application Discovery Agent supports outbound communication over port 443 through a forward proxy, matching the company's security requirement of no inbound traffic.

The agents push data outbound to the Application Discovery Service endpoints using standard HTTPS connections.

Consolidate and track all discovered assets.

Import the AIX inventory using the CSV template and associate both the agent-discovered VMware assets and CSV-imported AIX assets into the same applications inside AWS Migration Hub.

AWS Migration Hub allows for a unified repository of discovered and imported assets to plan and track migration status across the entire application portfolio.

Anahtar Kavram

Selecting and configuring AWS Application Discovery Service agents, collectors, and import methods based on OS compatibility, network constraints, and tracking requirements in AWS Migration Hub.

Tahmini Süre:3m 0s

Soru 1697Soru →

AeroSpire Systems is modernizing its core ERP microservices by migrating them from on-premises virtual machines to Amazon EKS. The target architecture spans two AWS accounts: a Shared Services account and a Production account. In the Production account, the Amazon EKS cluster runs worker nodes in private subnets across three Availability Zones (AZs). The worker nodes must pull container images from a private Amazon ECR repository in the Shared Services account, and resolve internal endpoints via a Route 53 Private Hosted Zone (PHZ) managed in the Shared Services account. For security compliance, the Production VPC has no direct internet route; instead, all outbound internet traffic must route through a central egress VPC in the Shared Services account via AWS Transit Gateway. The application requires high availability with an Active-Active multi-AZ deployment to meet a Recovery Time Objective (RTO) of less than 1 minute. Which configuration should the Solutions Architect implement to meet these requirements with the minimum operational overhead?

Configure EKS worker nodes to run on AWS Fargate using host networking to bypass virtual interface overhead. Associate the Route 53 Private Hosted Zone with the Production VPC. Deploy a single NAT Gateway in the central egress VPC, and configure route tables to route all outbound traffic from the Production VPC to the central egress VPC via Transit Gateway.

Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Rely on the default AWS-managed DNS in the Production VPC to resolve the Route 53 Private Hosted Zone without explicit VPC association. Deploy a NAT Gateway in each Availability Zone in the central egress VPC, and configure a Direct Connect Gateway to perform transitive routing for outbound traffic.

Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Associate the Route 53 Private Hosted Zone with the Production VPC. Deploy a NAT Gateway in each of the three Availability Zones in the central egress VPC, and configure the Route Tables and Transit Gateway to route all outbound traffic through them.

Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Associate the Route 53 Private Hosted Zone with the Production VPC. Implement a Pilot Light disaster recovery strategy by deploying the Amazon EKS worker nodes in a single Availability Zone, and route outbound traffic through a single NAT Gateway in the egress VPC via Transit Gateway.

Cevabı ve açıklamayı göster

Cevap: Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Associate the Route 53 Private Hosted Zone with the Production VPC. Deploy a NAT Gateway in each of the three Availability Zones in the central egress VPC, and configure the Route Tables and Transit Gateway to route all outbound traffic through them.

Cevap

The correct answer states that interface VPC endpoints for Amazon ECR and a gateway endpoint for Amazon S3 must be created in the Production VPC, the Route 53 Private Hosted Zone must be associated with the Production VPC, and redundant NAT Gateways must be deployed in each Availability Zone in the central egress VPC with routing configured via Transit Gateway.

To securely pull images from a private ECR repository in another account without internet access, EKS worker nodes require interface VPC endpoints for ECR (api and dkr) and a gateway endpoint for S3 (since ECR storing layers uses S3). For DNS resolution, a Route 53 Private Hosted Zone hosted in a Shared Services account must be explicitly associated with the client VPC (Production VPC) to allow DNS query resolution. To maintain high availability and prevent a single point of failure for outbound internet traffic, a NAT Gateway must be deployed in each Availability Zone of the central egress VPC, and Transit Gateway should route outbound traffic dynamically.

Adım Adım Çözüm

Configure private container registry access for EKS worker nodes.

Interface VPC endpoints for Amazon ECR (api and dkr) and a gateway VPC endpoint for Amazon S3 are deployed in the Production VPC.

Since the Production VPC has no internet access, the worker nodes must access Amazon ECR via local VPC endpoints. ECR stores its image layers in S3, which necessitates the S3 gateway endpoint.

Enable cross-account DNS resolution for internal service endpoints.

The Route 53 Private Hosted Zone from the Shared Services account is associated with the Production VPC.

EKS pods and worker nodes in the Production VPC cannot resolve hostnames within the Private Hosted Zone unless it is associated with the client VPC.

Establish highly available egress routing for third-party traffic.

Transit Gateway routes the 0.0.0.0/0 traffic from the Production VPC to the central egress VPC, which has one NAT Gateway per Availability Zone.

To ensure active-active high availability and meet the low RTO requirement, NAT Gateways must be deployed redundantly across all Availability Zones in the egress path.

Anahtar Kavram

Designing secure, highly available, and isolated container architectures using EKS with cross-account resources, private hosted zones, and Transit Gateway routing.

Soru 1698Soru →

A biotechnology firm uses AWS Organizations to manage its multi-account environment, which is structured into several Organizational Units (OUs), including Core-Security, Workloads-Prod, and Workloads-Dev. The solutions architect must establish governance controls to satisfy the following requirements:

1. Security logging (AWS CloudTrail) and compliance auditing (AWS Config) must remain enabled in all workload accounts, and member account administrators must be prevented from disabling or deleting these resources.
2. Developers in the Workloads-Dev OU must be restricted to launching only pre-approved configurations of Amazon EC2, Amazon RDS, and AWS Lambda resources to ensure compliance and cost control.

Which two actions should the solutions architect implement to meet these requirements?

Geçerli olan tümünü seçin

Attach a Service Control Policy (SCP) to the Workloads-Prod and Workloads-Dev OUs that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, cloudtrail:DeleteTrail, and config:DeleteConfigRule actions.

Configure an organizational CloudTrail trail in the management account to write logs to an S3 bucket in the Core-Security account, encrypting the trail using the default AWS-managed KMS key (aws/cloudtrail) to automatically allow member accounts to write encrypted logs.

Create AWS Service Catalog portfolios of approved EC2, RDS, and Lambda configurations in the management account, share them with the Workloads-Dev OU using AWS Service Catalog portfolio sharing, and attach an SCP to the Workloads-Dev OU that denies direct resource creation actions unless the request is made via servicecatalog.amazonaws.com using the aws:CalledVia condition.

Create an IAM permissions boundary in each member account that permits only the creation of EC2, RDS, and Lambda resources, and assign local administrators the responsibility of attaching this boundary to all IAM users and roles, assuming this delegates enforcement without needing an SCP.

Create AWS Service Catalog portfolios containing the approved configurations in the management account, share the portfolios with the Workloads-Dev OU using AWS Resource Access Manager (RAM), and attach an SCP to the Workloads-Dev OU that allows only servicecatalog:* actions.

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Workloads-Prod and Workloads-Dev OUs that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, cloudtrail:DeleteTrail, and config:DeleteConfigRule actions.; Create AWS Service Catalog portfolios of approved EC2, RDS, and Lambda configurations in the management account, share them with the Workloads-Dev OU using AWS Service Catalog portfolio sharing, and attach an SCP to the Workloads-Dev OU that denies direct resource creation actions unless the request is made via servicecatalog.amazonaws.com using the aws:CalledVia condition.

Cevap

The correct options are attaching a Service Control Policy (SCP) to deny modification of logging/auditing resources, and sharing AWS Service Catalog portfolios with a CalledVia SCP constraint to restrict developer resource creation.

The correct approach combines Service Control Policies (SCPs) to prevent member account administrators from altering auditing baselines and AWS Service Catalog sharing combined with an SCP using the aws:CalledVia condition key to restrict resource creation. Applying an SCP that denies CloudTrail and Config modification prevents even root or administrator users in member accounts from tampering with compliance resources. Sharing Service Catalog portfolios and enforcing their use via the aws:CalledVia condition key ensures developers can only deploy approved configurations of EC2, RDS, and Lambda.

Adım Adım Çözüm

Address the logging and auditing requirements by identifying the correct policy type that can restrict local administrators.

Apply a Service Control Policy (SCP) to the Workloads-Prod and Workloads-Dev OUs that explicitly denies actions like cloudtrail:StopLogging and config:DeleteConfigRule. This ensures local administrators cannot bypass these guardrails.

SCPs act as permission filters across accounts in an AWS Organization, overriding local administrative permissions.

Address the developer resource restriction requirement by defining approved configurations and enforcing their usage.

Share AWS Service Catalog portfolios containing the approved configurations from the management account to the Workloads-Dev OU, and use an SCP containing a Deny statement with the aws:CalledVia condition key to prevent direct creation outside Service Catalog.

This enforces compliance by blocking direct resource provisioning while allowing creation when mediated by the approved Service Catalog products.

Anahtar Kavram

Multi-account governance using Service Control Policies (SCPs) to establish organization-wide guardrails and AWS Service Catalog to enforce standardized resource provisioning.

Soru 1699Soru →

A financial services corporation is establishing a multi-account compliance auditing architecture using AWS Organizations. The solutions architect needs to configure AWS Config at the organization level to automatically record resource configurations and evaluate compliance using custom rules. The architect decides to delegate administrative capabilities to a dedicated Security tooling account instead of using the Organizations management account for daily compliance management. Arrange the following steps in the correct logical sequence to successfully configure this delegated compliance monitoring setup.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct logical sequence is to first enable trusted access for AWS Config in the Organizations management account, then register the Security tooling account as the delegated administrator, followed by creating the organization aggregator in the Security account, and finally deploying the organization conformance packs from the Security account.

To successfully establish delegated administration for compliance monitoring, trusted access for AWS Config must first be enabled in the Organizations management account. Next, the management account registers the Security tooling account as the delegated administrator. Finally, from this delegated admin account, the organization aggregator is created to gather configuration details, and the organization conformance packs are deployed to apply the compliance rules across the member accounts.

Adım Adım Çözüm

Enable trusted access for AWS Config (config.amazonaws.com) from the AWS Organizations management account.

AWS Config is granted permission to call AWS Organizations APIs to retrieve account list and structure details.

This is a prerequisite for registering a delegated administrator. Without trusted access, AWS Config cannot interact with the Organization's members.

The Security tooling account receives permissions to manage AWS Config settings and deploy resources across the entire organization.

The delegated administrator registration authorizes the member account to perform administrative tasks on behalf of the organization.

Create an organization aggregator within the registered Security tooling account.

A centralized dashboard is created that aggregates configuration history and compliance status from all accounts and regions.

Establishing the aggregation framework first ensures that compliance data generated by rules is immediately collected and visible.

Deploy organization conformance packs from the Security tooling account.

Config rules and remediation actions are automatically deployed and run in all existing and future member accounts.

Conformance packs contain the actual compliance rules that evaluate the resources, completing the configuration setup.

Anahtar Kavram

Delegated Administration in AWS Organizations

Soru 1700Soru →

A telecommunications service provider is planning to migrate its primary billing and network analytics platform to AWS. The on-premises infrastructure is distributed across different network zones and virtualization technologies:

1. Analytics Tier: 300 VMware vSphere VMs running Rocky Linux. The internal security policy strictly prohibits the installation of any third-party agents or software inside the operating systems of these VMs, and does not allow sharing or configuring OS-level administrative credentials.
2. Billing Core: 40 physical bare-metal servers running Red Hat Enterprise Linux (RHEL) 8. These servers reside in a secured, air-gapped network zone with no direct route to the internet, but outbound traffic to an on-premises HTTPS forward proxy is permitted.
3. Legacy Processing: 10 physical bare-metal servers running FreeBSD 12.

The provider needs to perform discovery to analyze server dependencies, collect server utilization data to size target EC2 instances, and continuously track the migration progress of these workloads inside AWS Migration Hub. Which combination of discovery and tracking mechanisms should a Solutions Architect recommend?

Install the AWS Application Discovery Agent on all 300 VMware VMs and the 40 RHEL bare-metal servers, configuring the agents to route traffic through the on-premises HTTPS proxy. For the 10 FreeBSD servers, deploy the Agentless Collector in the VMware environment and configure it to scan the bare-metal subnet using SNMP to discover their hardware configuration. Group all discovered systems into applications within AWS Migration Hub.

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vSphere environment to discover VM configurations and utilization data. Install the AWS Application Discovery Agent on the 40 RHEL bare-metal servers, configured to route outbound traffic through the on-premises HTTPS proxy. Manually collect configuration details for the 10 FreeBSD servers and import them using the AWS Migration Hub import template. Group all discovered and imported servers into applications within AWS Migration Hub.

Deploy the AWS Application Discovery Agentless Collector in the VMware vSphere environment. Configure it to discover the 300 VMware VMs, and enable the Agentless Collector's network-based host discovery feature using OS-level credentials to discover the 40 RHEL and 10 FreeBSD bare-metal servers on the network. Import the resulting configurations directly into AWS Migration Hub, and use AWS Systems Manager Inventory to collect performance metrics.

Deploy the AWS Application Discovery Agentless Collector to discover the 300 VMware VMs by configuring it with read-only vCenter credentials. Install the AWS Application Discovery Agent on the 40 RHEL bare-metal servers and the 10 FreeBSD bare-metal servers, establishing an AWS Site-to-Site VPN to route their discovery traffic directly to AWS, bypassing the local proxy. Import all server metrics into AWS Migration Hub using the import API.

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vSphere environment to discover VM configurations and utilization data. Install the AWS Application Discovery Agent on the 40 RHEL bare-metal servers, configured to route outbound traffic through the on-premises HTTPS proxy. Manually collect configuration details for the 10 FreeBSD servers and import them using the AWS Migration Hub import template. Group all discovered and imported servers into applications within AWS Migration Hub.

Cevap

The correct answer is the option that deploys the Agentless Collector for the VMware VMs, installs the Discovery Agent on the RHEL bare-metal servers configured with a proxy, manually imports the FreeBSD servers using the Migration Hub CSV import template, and groups the servers into applications in AWS Migration Hub.

The correct option correctly maps each environment to its technically viable and policy-compliant discovery mechanism. The VMware VMs are discovered agentlessly via the vCenter API using the Agentless Collector, which requires no guest OS modifications or credentials. The RHEL bare-metal servers use the Discovery Agent configured with an HTTPS proxy, which is natively supported. The FreeBSD bare-metal servers, which run an unsupported OS and cannot be discovered agentlessly, are handled via manual CSV import. Finally, grouping the systems into applications in AWS Migration Hub enables tracking.

Adım Adım Çözüm

Evaluate the discovery options for the 300 VMware VMs under the constraint of no OS agents and no OS credentials.

Determine that the AWS Application Discovery Agentless Collector is the only suitable choice because it gathers configuration and utilization data agentlessly via the vCenter API.

It respects the security policy prohibiting guest OS agents or credential sharing.

Evaluate the discovery options for the 40 RHEL 8 bare-metal servers in the air-gapped zone.

Choose the AWS Application Discovery Agent and configure it to route traffic through the allowed on-premises HTTPS proxy.

Agentless Collector cannot discover physical bare-metal servers. RHEL 8 is a supported OS for the Discovery Agent, and the agent supports proxy settings to overcome the lack of direct internet access.

Evaluate the discovery options for the 10 FreeBSD 12 bare-metal servers.

Collect their details manually and use the Migration Hub Import template (CSV format).

FreeBSD is not supported by the Discovery Agent, and Agentless Collector cannot discover bare-metal systems, making manual import the only viable method.

Determine how to track the overall migration progress.

Group the discovered and imported servers into applications within the AWS Migration Hub console.

Migration Hub requires servers to be associated with applications to track migration progress dynamically.

Anahtar Kavram

Selecting the correct AWS Application Discovery mechanisms based on operating system support, hypervisor integration, and network proxy constraints.

Tahmini Süre:3m 0s

ÖncekiSayfa 85 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram