Tüm alıştırma soruları

A public transit agency, MetroTransit, is modernizing its real-time bus tracking application by migrating it from on-premises virtual machines to AWS. The application consists of an API gateway container and two backend processing containers that need to communicate with each other with sub-millisecond latency. The application also needs to fetch real-time weather updates from an external public API every minute. The system must be highly available and resilient to Availability Zone outages, and it must run with the least possible operational overhead. The Solutions Architect plans to deploy the application on Amazon ECS using the AWS Fargate launch type across two Availability Zones in a new VPC. Which design meets these requirements?

An enterprise is planning to migrate a mission-critical multi-tier application from an on-premises VMware vSphere cluster to a newly provisioned VMware Cloud on AWS (VMC on AWS) Software-Defined Data Center (SDDC). The application comprises:

* `$15$` transactional database virtual machines (VMs) requiring zero downtime and continuous replication to meet a Recovery Time Objective (RTO) of zero during switchover.
* `$105$` web and application server VMs that can tolerate a brief service interruption (maximum `$15\text{ minutes}$` of downtime for a reboot) during cutover.

The network architecture requires transitive routing between the on-premises datacenter, the VMC on AWS SDDC, and four spoke VPCs in a multi-account AWS Organization. An existing `$10\text{ Gbps}$` AWS Direct Connect (DX) connection terminates at a Direct Connect Gateway (DXGW) in a shared network account. The migrated VMs must also resolve private DNS records in an AWS Route 53 Private Hosted Zone (PHZ) managed in a Shared Services account.

Which combination of actions will meet these requirements with the least operational overhead? (Select TWO.)

An enterprise is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of $30$ spoke VPCs in a single AWS Region, divided into Production and Development workloads. The on-premises network must connect to the AWS environment using a $10\text{ Gbps}$ AWS Direct Connect connection as the primary path and an IPsec VPN over the internet as a backup path. The network design must support transitive VPC-to-VPC routing, restrict the Development VPCs from accessing the on-premises network while allowing the Production VPCs full access, and support dynamic routing failover using BGP.

Which two options should the Solutions Architect select to meet these requirements?

A gaming publisher is migrating its legacy multiplayer matchmaking and lobby servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The hybrid network architecture consists of an AWS Site-to-Site VPN terminating on an AWS Transit Gateway that is attached to a staging VPC. The source servers are in a highly secure zone with no direct route to the public internet and must perform data replication strictly over the private VPN connection.

After installing the AWS replication agent on the source servers, the replication status shows as stalled, and the agent logs indicate a connection timeout when attempting to reach the replication servers in the staging VPC.

Which two configuration steps must the Solutions Architect perform to resolve this connectivity issue? (Select TWO.)

An enterprise needs to migrate $450\text{ TB}$ of historical compliance records from an on-premises SFTP server to Amazon S3. The migration must be completed within $25\text{ days}$. The enterprise has a dedicated $200\text{ Mbps}$ network connection to AWS. Legacy applications must continue to access the records using the SFTP protocol without code modifications. Corporate auditing standards mandate that all data at rest must be encrypted using a customer managed key (CMK) in AWS KMS. Which two options should the solutions architect select to meet these requirements?

An image processing application runs on Amazon EC2 instances in private subnets across three Availability Zones in a VPC. The application downloads and processes approximately $80\text{ TB}$ of raw files per month from an Amazon S3 bucket in the same Region and uploads the results back. The application also queries a metadata database hosted in a partner company's VPC in the same Region. These API queries transfer approximately $15\text{ TB}$ of data monthly and are currently routed over the public internet through the application's NAT Gateways to the partner's public API endpoint. The company wants to reduce the high data transfer and NAT Gateway processing costs while maintaining high availability.

Which two of the following actions should the Solutions Architect recommend to achieve these goals? (Select TWO.)

A company manages a multi-account AWS environment using AWS Organizations. The company needs to grant read-only access to a third-party compliance team. The compliance team authenticates using an external corporate SAML 2.0 Identity Provider (IdP). The compliance team must access resources across several target accounts in the 'Compliance' Organizational Unit (OU) without managing local AWS IAM user credentials in each account.

An administrator needs to configure the trust relationship so that the external compliance team can federate directly into the target accounts. Service Control Policies (SCPs) are applied to the 'Compliance' OU to restrict administrative access.

Which configuration strategy correctly establishes this federated access in a secure manner?

An aerospace defense systems provider is planning to migrate its mission-critical flight monitoring and logistics workloads to AWS. The on-premises environment consists of:

* $150$ VMware vSphere virtual machines (VMs) running a mix of Linux and Windows.
* $40$ physical bare-metal servers running IBM AIX $7.2$.
* $15$ physical bare-metal servers running CentOS $7.9$.

The company's security compliance policy strictly forbids installing any third-party agents or software directly inside the guest operating systems of the virtualized VMware environment. Outbound internet access from the bare-metal network segment is prohibited, except through an authenticated on-premises forward proxy. The provider wants to gather configuration and performance utilization data for all workloads, along with process-level network dependency details for the CentOS servers. Finally, they require a centralized dashboard to track the migration status using both AWS Migration Service tools and their existing third-party migration tracking tool.

Which migration discovery and tracking strategy should a solutions architect recommend?

A financial technology company is designing a new global payment settlement platform. The solution requires a highly available transactional metadata database (OLTP) to process high-throughput transaction records, alongside a high-volume NoSQL database for real-time audit logs. The OLTP database must support a cross-region disaster recovery strategy with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute. Additionally, during peak trading hours, the OLTP database must dynamically scale to support sudden read traffic spikes. All data stored in both database engines must be encrypted using customer-managed keys (CMKs) in AWS KMS, allowing a centralized security account to manage and rotate the keys. Which two database and storage configurations should the solutions architect choose to meet these requirements?

A company is planning to migrate its on-premises application environment to AWS and wants to track the overall migration progress in AWS Migration Hub. The environment consists of 120 VMware vSphere virtual machines running supported versions of Windows Server and Red Hat Enterprise Linux, along with 10 physical bare-metal servers running IBM AIX 7.2. The company's corporate security policy strictly prohibits direct outbound internet access from these servers, but a site-to-site VPN connection to an AWS VPC is available. The Solutions Architect must collect system configurations, gather performance utilization history, map network dependencies to identify application boundaries, and minimize manual effort. Which combination of actions should the Solutions Architect take to accomplish these goals?

A financial services company manages its multi-account environment using AWS Organizations. To ensure strict compliance, the security team wants to restrict member accounts in the Development Organizational Unit (OU) to only use Amazon S3, Amazon EC2, and Amazon DynamoDB. A solutions architect creates a custom Service Control Policy (SCP) that allows all actions (`*`) for `s3`, `ec2`, and `dynamodb`. The architect attaches this SCP to the Development OU and removes the default `FullAWSAccess` SCP. Shortly after, a developer in a development member account attempts to upload objects to an S3 bucket. The S3 bucket is encrypted with a Customer Managed Key (CMK) stored in the same account. The developer's IAM role has the AWS-managed policy `AmazonS3FullAccess` attached. However, the developer receives an 'Access Denied' error. What is the root cause of this issue?

An enterprise IoT data ingestion platform runs on Amazon EC2 instances inside an Auto Scaling group (ASG) spread across three Availability Zones. The instances require 5 minutes to download configuration files and bootstrap before they can accept requests from an Application Load Balancer (ALB). During sudden morning traffic spikes, the ALB returns HTTP 503 Service Unavailable errors, and the ASG launches far more instances than needed, leading to severe resource over-provisioning and high costs. Additionally, the current network architecture uses a single NAT Gateway located in a public subnet in Availability Zone A for all outbound traffic. If Availability Zone A suffers an outage, outbound connectivity for instances in Availability Zones B and C is completely lost. Which two modifications should the Solutions Architect implement to resolve the scaling issues and eliminate the single point of failure with the lowest recovery time objective (RTO)? (Select TWO.)

An enterprise manages a multi-account environment with $180$ AWS accounts organized under AWS Organizations. The security team is designing a centralized auditing solution to aggregate VPC Flow Logs from all VPCs in all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The solution must prevent member accounts from reading or deleting logs, while allowing the log delivery service to write logs directly to the bucket.

Which of the following actions should the Solutions Architect perform to meet these requirements? (Select TWO.)

An enterprise needs to migrate a $2.4\text{ PB}$ Hadoop Distributed File System (HDFS) dataset to an Amazon S3 bucket. The enterprise has a $1\text{ Gbps}$ dedicated network connection, but only a maximum of $400\text{ Mbps}$ can be allocated for migration activities to avoid impacting daily operations. The migration must be completed within $45$ days. During the migration, the source dataset is actively modified on-premises. The final migrated data in Amazon S3 must be securely accessed by an external analytics partner operating in a separate AWS account, and all data must be encrypted at rest. Which architecture strategy will migrate the dataset within the timeline and satisfy the security requirements?

Veloce Telemetry is migrating a Kubernetes-based telemetry application from an on-premises data center to AWS. The application must connect to an Amazon Aurora PostgreSQL database located in a separate dedicated Database VPC. The application pods must also securely pull container images from a central Amazon ECR repository in a Shared Services VPC. The architecture must prevent all traffic, including container image pulls and database queries, from traversing the public internet. Infrastructure management and operational overhead must be minimized, and the solution must remain highly available across multiple Availability Zones. The database endpoint is resolved using a Route 53 Private Hosted Zone (PHZ) created in the Database VPC. Which TWO actions should a Solutions Architect take to design a solution that meets these requirements? (Select TWO.)

A company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 12 spoke VPCs in a single AWS Region, a shared services VPC, and an on-premises data center. The company requires:

- Hybrid connectivity from all VPCs to the on-premises data center using an existing AWS Direct Connect connection.
- Private DNS resolution for an on-premises domain, `corp.internal`, from all spoke VPCs.
- High-availability outbound internet connectivity for workloads running in the spoke VPCs.

Which combination of steps should a solutions architect recommend to meet these requirements with the least administrative overhead?

An organization is transitioning its multi-account AWS environment to use an external SAML 2.0-compliant Identity Provider (IdP) for user authentication. The solutions architect has created the SAML identity providers in the target member accounts. However, when users attempt to authenticate, the federation process fails, and they are unable to assume the designated IAM roles. To diagnose this, the architect reviews the configurations of the member accounts and the parent AWS Organization. Which combination of actions must the solutions architect take to resolve the authentication failures and establish federated access to the target accounts? (Select TWO.)

A company's application runs on Amazon EC2 instances in private subnets across three Availability Zones in a VPC. The instances regularly download configuration files from an Amazon S3 bucket in the same region, transferring approximately $40\text{ TB}$ of data per month. The instances also stream application logs to Amazon CloudWatch Logs, transferring approximately $15\text{ TB}$ of data per month. Currently, all outbound traffic from the private subnets is routed through NAT Gateways deployed in each Availability Zone. A solutions architect needs to implement a solution to reduce the data transfer costs without compromising security or availability.

Which of the following configurations is the most cost-effective?

A global retail banking corporation is planning to migrate its hybrid on-premises application portfolio to AWS. The environment consists of 300 VMware vSphere virtual machines (VMs) running supported Linux and Windows Server operating systems, 50 physical servers running Oracle Solaris, and 20 bare-metal servers running CentOS. Security policies mandate that database servers have no direct internet access and must route outbound traffic through a central corporate HTTP proxy. The security team also prohibits installing any software agents on the VMware ESXi hypervisors. The corporation requires detailed host performance data, running process lists, and network dependency mappings to plan the migration, and wants to track the discovery progress centrally using AWS Migration Hub. Which two actions should a solutions architect recommend to perform the discovery? (Select two.)

A multinational retail corporation operates a multi-account AWS environment with $15$ spoke VPCs and a central Shared Services VPC in the `us-east-1` Region, all connected via an AWS Transit Gateway. The corporation recently acquired a logistics firm that has $10$ VPCs in the same Region and an on-premises warehouse network connected to AWS via a $10\text{ Gbps}$ AWS Direct Connect connection.

The solutions architect must design a hybrid network topology that satisfies the following requirements:
1. The logistics firm's VPCs must be able to access a shared inventory API hosted in the corporation's Shared Services VPC.
2. The logistics firm's VPCs must not have any network connectivity to the retail corporation's spoke VPCs.
3. Both the retail corporation's spoke VPCs and the logistics firm's VPCs must be able to communicate with the logistics firm's on-premises warehouse network.
4. Administrative overhead must be minimized, and no additional Direct Connect connections should be provisioned.

Which of the following network architectures meets these requirements?