Tüm alıştırma soruları

An enterprise is migrating its legacy data center workloads to AWS. The migration involves two primary NFS-based datasets that must be migrated within a strict $30\text{-day}$ window:

* Dataset 1: A $1.2\text{ PB}$ historical archive dataset containing static files. This data will be migrated to Amazon S3 and must be accessible by an external, third-party auditing application located in a separate AWS account.
* Dataset 2: An $80\text{ TB}$ active operational dataset that is continuously updated. This data must be migrated to an Amazon EFS file system, and all POSIX metadata (ownership, permissions, and directory structures) must be preserved.

The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but bandwidth throttling limits the maximum dedicated network throughput for migration traffic to $400\text{ Mbps}$. All data at rest must be encrypted using an AWS KMS key that supports cross-account sharing.

Which two actions should the Solutions Architect recommend to achieve this migration within the required timeline? (Select TWO.)

A company is planning to migrate its on-premises MySQL 8.0 database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains several tables with JSON and large binary object (BLOB) columns that are updated frequently. A solutions architect has already used the AWS Schema Conversion Tool (SCT) to migrate the schema. The architect now configures an AWS Database Migration Service (AWS DMS) replication instance and task to perform a full load with ongoing replication (Change Data Capture - CDC). During initial testing of the CDC phase, the replication task fails with errors when update operations occur on tables containing the BLOB columns. Which configuration change must the solutions architect apply to resolve this issue and ensure successful CDC replication?

A financial technology company is migrating its core ledger database and transaction processing servers from an on-premises VMware environment to AWS using AWS Application Migration Service (MGN). The migration must occur over a private network path using an existing AWS Direct Connect connection. The staging area subnet in the target VPC has no path to the public internet. Which two configurations must the Solutions Architect implement to establish replication? (Select TWO).

A company is planning to migrate its on-premises IBM DB2 LUW database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains complex PL/SQL-equivalent stored procedures and is approximately 8 TB in size. The company requires a migration strategy that minimizes downtime to under 30 minutes and converts the database schema and application logic with minimal manual effort. Which of the following approaches should a solutions architect recommend to meet these requirements?

A financial services firm is refactoring a legacy, on-premises stock-trading API into a serverless microservices architecture on AWS. The modernized solution uses Amazon API Gateway (regional endpoint) and AWS Lambda functions deployed inside private subnets of a VPC. The Lambda functions must execute trades by writing to an Amazon Aurora PostgreSQL database and must also communicate with a third-party regulatory compliance endpoint over the public internet.

The architecture must meet the following requirements:
- Prevent the trade-processing Lambda functions from exhausting the Aurora database's connection pool during peak market hours.
- Prevent trade-processing traffic spikes from consuming the entire regional Lambda concurrency pool, which would throttle other critical services in the same AWS account.
- Ensure high availability for all outbound internet traffic from the Lambda functions.
- Securely store and decrypt regulatory API credentials using AWS Systems Manager Parameter Store. The decryption key must support custom key policy modifications to delegate read-only access to a separate security auditing AWS account.
- Deploy updates to the Lambda function safely using gradual traffic shifting, with automatic rollback if CloudWatch alarms detect errors.

Which design strategy should the Solutions Architect implement to satisfy these requirements?

A global gaming publisher is designing a new cloud-based multiplayer game. The game requires a database and storage architecture for two key workloads:

1. Player session state: A database that supports global active-active replication with sub-10 millisecond latency for both reads and writes to serve players in North America, Europe, and Asia.
2. Historical match data: Long-term archival logs that must be stored durably and made accessible to a data analytics team operating in a separate, dedicated AWS account. This data must be encrypted at rest, and the encryption keys must allow cross-account access configuration.

Which two options should the solutions architect choose to meet these requirements?

A healthcare provider maintains a hybrid environment of Amazon EC2 instances and on-premises servers, all registered as managed instances under AWS Systems Manager. A security policy mandates that a security logging agent must be installed and continuously running on all instances. The operations team has noticed that system administrators occasionally uninstall or stop the agent during manual troubleshooting, creating configuration drift. A Solutions Architect must design a solution to automatically detect drift, reinstall the agent, and report compliance. Which solution meets these requirements with the least operational overhead?

Apex Healthcare is modernizing its prescription processing application by migrating it to AWS. The application will be deployed as containerized tasks using Amazon ECS on AWS Fargate in a VPC in the Production account. The container images must be securely pulled from a centralized Amazon ECR repository in the Shared Services account. To meet regulatory compliance, the ECR images are encrypted at rest using AWS KMS, and all image pull traffic must remain within the AWS network without traversing the public internet.

Which TWO configurations must a solutions architect perform to establish this architecture? (Select TWO.)

A financial services firm is establishing a federated identity mechanism across their AWS Organizations environment. Users stored in an on-premises Active Directory must authenticate via an external SAML 2.0 identity provider to manage resources within individual target AWS accounts.

To set up direct federation with the target accounts without using AWS IAM Identity Center, which configuration steps must a solutions architect implement in each target AWS account? (Select TWO.)

A smart agriculture company operates a real-time soil moisture and environmental monitoring telemetry platform on AWS. The telemetry ingestion service runs on Amazon EC2 instances in an Auto Scaling group (ASG) situated in private subnets across two Availability Zones. Traffic is distributed by an Application Load Balancer (ALB). The EC2 instances process the telemetry messages and require internet connectivity to post aggregated metrics to a third-party SaaS analytics API. During seasonal agricultural cycles, sensor devices wake up simultaneously, causing traffic to surge from $50$ requests per second to $25,000$ requests per second within $2$ minutes. During these spikes, many requests fail with $502\text{ Bad Gateway}$ or gateway timeout errors. Additionally, if an Availability Zone fails, outbound traffic to the SaaS API is interrupted for all instances.

Which two actions should a Solutions Architect implement to scale the architecture efficiently and ensure fault tolerance? (Select TWO.)

A company is migrating a self-managed Microsoft SQL Server database running on-premises to an Amazon Aurora MySQL-Compatible Edition DB cluster. A solutions architect uses the AWS Schema Conversion Tool (SCT) to convert the database schema. The migration strategy requires continuous replication to keep the target database in sync with the source database until the cutover window. The solutions architect configures an AWS Database Migration Service (AWS DMS) replication task with the migration type set to 'Full load and CDC'. During a test run, the full load phase completes successfully, but subsequent transactional updates on the source SQL Server database are not reflected in the target Aurora DB cluster. Which of the following is the most likely cause of this replication failure?

A smart utility provider is designing a new IoT monitoring platform to ingest and store metrics from $10 \text{ million}$ smart meters globally. The system requirements include:
- High-throughput write ingestion of telemetry data (each write payload is approximately $500 \text{ bytes}$) with sub-second response times.
- Aggregated daily telemetry summaries that must be retained for audit purposes, where they are queried occasionally but must be highly durable and cost-effective.

Which two database and storage strategies should the solutions architect choose to meet these requirements? (Select TWO.)

A technology company manages its multi-account environment using AWS Organizations. The security team has established a dedicated Sandbox Organizational Unit (OU) for developers to experiment with new services. Developers are granted administrator privileges in their respective sandbox accounts to allow rapid prototyping. The security team has deployed a security audit tool that relies on a specific IAM role named SecurityAuditRole in every sandbox account. The security team must ensure that developers cannot delete or modify this role, its attached policies, or its trust relationships, even though the developers have administrator permissions in their accounts. Which strategy should a solutions architect implement to meet these requirements with the least operational overhead?

An enterprise is migrating a business-critical multi-tier application from an on-premises VMware vSphere cluster to a VMware Cloud (VMC) on AWS Software-Defined Data Center (SDDC). The application consists of a write-heavy database VM with an $8\text{ TB}$ virtual disk that requires zero downtime during migration, and fifty stateless web servers that can tolerate a brief reboot of less than $10\text{ minutes}$. The on-premises network ($192.168.10.0/24$) must be extended to VMC on AWS to maintain IP addresses. The VMC on AWS SDDC is connected to native AWS VPCs containing shared services via an AWS Transit Gateway. The network path between the on-premises environment and VMC on AWS is established over a $10\text{ Gbps}$ AWS Direct Connect connection.

To optimize the migration timeline, minimize downtime, and prevent sub-optimal routing (hairpinning) for migrated VMs communicating with native AWS services, which actions should the Solutions Architect take? (Select TWO.)

A utility enterprise is designing a new cloud-based smart-grid monitoring platform. The system handles two primary data workloads. First, a time-series telemetry ingest workload receives smart meter readings at a rate of $100,000$ writes/second with sub-millisecond latency. Second, an online transaction processing (OLTP) workload manages customer billing and subscription metadata. The billing metadata requires a disaster recovery strategy with a Recovery Time Objective (RTO) of less than $15$ minutes and a Recovery Point Objective (RPO) of less than $5$ seconds across AWS regions. Additionally, weekly billing reports must be saved to object storage and securely shared with a third-party auditing AWS account. Encryption-at-rest is mandatory for these reports, and the primary account must maintain full control over the encryption key policy. Which database and storage architecture should a solutions architect design to satisfy these requirements with the lowest operational overhead?

An enterprise needs to migrate an $850\text{ TB}$ dataset from an on-premises NFSv4 file system to an Amazon EFS file system. The migration must be completed within a strict $45\text{-day}$ window. The enterprise has a dedicated $1\text{ Gbps}$ AWS Direct Connect connection, but local network policy restricts migration traffic to a maximum of $250\text{ Mbps}$ to avoid impacting production workloads. The data must be encrypted at rest in AWS using a KMS key that supports annual rotation and custom policy modifications. The migration process must preserve all POSIX permissions, ownership metadata, and directory structures. Which of the following solutions meets these requirements with the least operational overhead?

A retail enterprise is modernizing its legacy on-premises inventory replenishment system by moving to a serverless architecture on AWS. The system must expose a private REST API via Amazon API Gateway to multiple partner AWS accounts over an AWS Transit Gateway. The API invokes AWS Lambda functions deployed inside private subnets of a shared services VPC. These Lambda functions must perform high-frequency read and write operations against a centralized Amazon Aurora PostgreSQL database situated in a dedicated database VPC. The database credentials are stored in AWS Secrets Manager within the database VPC account. The Lambda functions in the shared services account must retrieve and decrypt these credentials. The design must prevent database connection exhaustion, support cross-account access to the credentials, and ensure that bursts in replenishment traffic do not exhaust the regional concurrency limits, which would throttle other critical customer-facing Lambda functions in the shared services account. Which TWO options should a solutions architect implement to meet these requirements? (Select TWO.)

LogiTransit Global is modernizing a legacy order processing workload by migrating it to Amazon ECS on AWS Fargate. The ECS tasks will run in a private subnet within an application VPC that has no internet access. The application container images are stored in an Amazon Elastic Container Registry (ECR) repository located in a separate Shared Services AWS account. The container image layers in the ECR repository are encrypted using an AWS KMS Customer Managed Key (CMK) in the Shared Services account. Which configuration will allow the ECS Fargate tasks to pull the container images while adhering to the security principle of least privilege and minimizing data transfer costs?

An enterprise has an existing workload running on Amazon EC2 instances in a private subnet of VPC A. The application on these instances must access Amazon DynamoDB and must also assume a cross-account IAM role in Account B to write data to a partner API. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway to the internet. To strengthen network and identity security, a solutions architect must ensure that traffic to DynamoDB does not traverse the public internet, and the IAM role in Account B can only be assumed if the request originates from VPC A.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

A smart agriculture technology provider is migrating its telemetry aggregation workloads, consisting of $15$ on-premises physical servers, to AWS using AWS Application Migration Service (MGN). The on-premises data center is connected to AWS via an AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated on an AWS Transit Gateway. The target environment is a multi-account structure under AWS Organizations, where the migration staging area resides in a dedicated Staging VPC. Due to strict security policies, neither the on-premises environment nor the Staging VPC has direct internet access, and all data transfer must go over private networks. During the replication phase, the migration team observes that the MGN Replication Agent on the source servers cannot connect to the AWS MGN control plane or the staging area replication servers, preventing initial sync. Which of the following configuration steps must the Solutions Architect perform to successfully establish replication? (Select TWO.)