Tüm alıştırma soruları

A logistics company is designing its multi-account governance strategy using AWS Organizations. The Security team must ensure that no member account in the Workloads Organizational Unit (OU) can disable or modify AWS Config configurations. Simultaneously, the Development team within the Workloads OU needs the ability to deploy and delete AWS CloudFormation templates that manage EC2 and RDS resources. What is the most operationally efficient way to implement these access controls?

A healthcare enterprise is planning to migrate a $680\text{ TB}$ dataset from an on-premises S3-compatible object storage system to an Amazon S3 bucket. The enterprise has a $100\text{ Mbps}$ internet connection and a dedicated $1\text{ Gbps}$ AWS Direct Connect connection. To minimize impact on other corporate workloads, only $150\text{ Mbps}$ of the Direct Connect bandwidth can be allocated for this migration. The migration must be completed within 30 days. The source dataset is actively modified, with approximately $2\text{ TB}$ of new files added weekly. Security policies require all data to be encrypted at rest in the target bucket using an AWS KMS Customer Managed Key (CMK). Which migration strategy meets these requirements within the specified timeframe and with the lowest operational overhead?

An energy trading firm is modernizing its legacy real-time gas nomination settlement system. The API is hosted on Amazon API Gateway in Account A, which must invoke an AWS Lambda function in Account B. The Lambda function in Account B is deployed inside a VPC across three Availability Zones to securely query an Amazon Aurora PostgreSQL database in Account A via an Amazon RDS Proxy. The database credentials are stored in AWS Secrets Manager in Account A and are encrypted. The Lambda function must also make outbound HTTPS calls to an external public energy pricing index API to fetch daily indexes. To handle sudden settlement spikes, the design must protect Account B from regional concurrency exhaustion and prevent database overload. Outbound internet connectivity must not have a single point of failure. Secrets decryption must work across accounts. Code updates must shift $10\%$ of traffic to the new version, wait $10$ minutes for evaluation, and roll back automatically if errors occur. Which architecture design meets these requirements?

An enterprise is planning to migrate its on-premises VMware vSphere environment to VMware Cloud (VMC) on AWS. The migration scope includes $50$ virtual machines (VMs) running multi-tier applications, including a critical Oracle database VM that requires zero replication-induced downtime during the cutover. The on-premises data center is connected to AWS via a $10\text{ Gbps}$ AWS Direct Connect connection terminated on a Direct Connect Gateway (DXGW).

Additionally, the architecture requires:
- Transitive routing between the VMC on AWS Software-Defined Data Center (SDDC), the on-premises environment, and multiple spoke VPCs across different AWS accounts.
- Resolution of the private domain `corp.internal` hosted in a Route 53 Private Hosted Zone (PHZ) in a shared-services VPC.

Which TWO actions should the Solutions Architect take to migrate these workloads and configure the network connectivity?

A financial services institution is designing a hybrid and multi-account network topology. The environment comprises 30 spoke VPCs divided equally across the us-east-1 and us-west-2 Regions, managed under a single organization in AWS Organizations. The network design must connect all spoke VPCs to an on-premises data center. The primary connection must be a high-speed AWS Direct Connect connection, with a backup path using AWS Site-to-Site VPN connections. Traffic from AWS to the on-premises data center must default to the Direct Connect link and automatically fail over to the VPN connections if the Direct Connect link becomes unavailable. The design must minimize administrative routing complexity and support transitive routing between all spoke VPCs and the on-premises network. Which TWO actions should the Solutions Architect take to implement this architecture? (Select TWO)

A logistics company, SwiftRoute, is modernizing its on-premises package tracking application by migrating it to Amazon ECS on AWS Fargate. The tasks must be deployed in private subnets, pull container images from Amazon ECR, and write tracking data to Amazon DynamoDB. The company's security policy strictly prohibits the use of NAT Gateways or Internet Gateways. Additionally, the solutions architect must minimize costs and operational overhead. Which configuration should the solutions architect recommend to meet these requirements?

An enterprise is designing a deployment strategy for a high-throughput financial transaction processing application that uses a proprietary TCP-based protocol. The application runs on Amazon EC2 instances within an Auto Scaling group and is exposed via a Network Load Balancer (NLB) in the `us-east-1` Region.

The company needs to implement a canary deployment strategy for new releases. The strategy must route $5\%$ of the production traffic to the new version (Green) while keeping $95\%$ on the current version (Blue). If the new version meets key performance indicators (KPIs) over a $2$-hour monitoring window, all traffic must be routed to it. If any anomalies are detected, the deployment must support an instantaneous rollback to the Blue version without waiting for DNS records to expire, as client applications are known to ignore DNS Time to Live (TTL) settings and cache IP addresses indefinitely.

Which deployment strategy meets these requirements with the least operational complexity?

A Solutions Architect needs to set up centralized security monitoring across all AWS accounts in an organization using AWS Organizations. The architect wants to delegate security administration to a dedicated Security Tooling account and implement standardized security controls across different Organizational Units (OUs) using AWS Security Hub.

Arrange the steps in the correct order to configure AWS Security Hub with delegated administration and centralized configuration management.

An enterprise is implementing a multi-account strategy using AWS Organizations. The solutions architect is configuring federated access for a remote team of data engineers who must access Amazon S3 buckets across multiple target member accounts. The authentication flow must use the company's external SAML 2.0-compliant Identity Provider (IdP). The solutions architect has created the SAML identity provider object in each target AWS account. The data engineers must authenticate via the IdP and assume a specific cross-account IAM role named DataEngineerRole in the target accounts. However, during testing, the data engineers receive an "Access Denied" error immediately after authenticating with the IdP and attempting to redirect to the AWS Management Console. Which combination of configuration adjustments must the solutions architect perform to resolve this issue?

A company operates an online multiplayer game matchmaking service. The matchmaking application runs on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer. The application has a complex initialization process that takes about 10 minutes to load static assets and establish connections to external databases. During sudden peaks of player logins, the ASG scales out, but the newly launched instances take 10 minutes before they can process requests. During this initialization window, the target tracking policy launches multiple redundant batches of instances, leading to excessive resource provisioning and increased costs. Which configuration change will prevent the Auto Scaling group from launching unnecessary instances during the initialization period?

A research organization is designing a new cloud-native genomics analysis platform. The platform handles an OLTP workload consisting of DNA sequence metadata stored in a relational database, and raw sequencing files (each averaging $150\text{ MB}$) stored in Amazon S3. The relational database requires dynamic horizontal read scaling to handle sudden spikes in query volume. The disaster recovery (DR) strategy requires replicating both the database and raw sequencing files from the primary account in `us-east-1` to a secondary account in `us-west-2` with an RPO of under $5\text{ minutes}$ and an RTO of under $15\text{ minutes}$. All data must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) to support cross-account sharing. Audit logs from the platform's S3 buckets in both regions must be written directly to a centralized S3 bucket in a separate Security Account. Which of the following database and storage architectures meets these requirements while satisfying the RTO, RPO, and security compliance constraints?

A multinational enterprise is integrating two AWS Organizations following an acquisition. Organization A has a hub-and-spoke network in the us-east-1 Region centered around an AWS Transit Gateway (TGW-A). TGW-A connects to the on-premises datacenter using an existing 10 Gbps AWS Direct Connect (DX) connection with a Direct Connect Gateway (DXGW) and a Transit Virtual Interface (Transit VIF).

Organization B has its own AWS Organization with an independent Transit Gateway (TGW-B) in the us-east-1 Region, connecting multiple spoke VPCs and a Shared Services VPC.

A solutions architect must design a hybrid connectivity and DNS architecture for Organization B that meets the following requirements:
- Primary hybrid path: Use the existing DX connection in Organization A.
- Backup hybrid path: Implement an AWS Site-to-Site VPN over the internet to TGW-B with automatic failover.
- Network Isolation: Spoke VPCs in Organization B must not communicate with VPCs in Organization A, but both must communicate with the on-premises datacenter.
- Centralized Egress: All internet-bound (0.0.0.0/0) traffic from Organization B's spoke VPCs must route through an Egress VPC in Organization B. The design must minimize costs while ensuring high availability across multiple Availability Zones (AZs).
- Name Resolution: Spoke VPCs in Organization B must resolve DNS queries for internal services hosted in a Route 53 Private Hosted Zone (PHZ) managed within the Shared Services VPC.

Which architecture should the solutions architect design to meet these requirements?

An enterprise is centralizing its multi-account access management using AWS IAM Identity Center. The company wants to federate identities from an external SAML 2.0 identity provider (IdP) and ensure that user accounts and group memberships are automatically synchronized from the IdP. Which of the following configuration steps must be performed to establish this integration? (Select TWO.)

A financial tech company is modernizing its transaction reconciliation system by migrating the backend database to an Amazon Aurora PostgreSQL cluster. The system's application logic is refactored to run on AWS Lambda. The API must be accessible only to client microservices running in different VPCs across several AWS accounts within the same AWS Organization, and all traffic must remain private. The Aurora database has a maximum connection limit of 500, whereas the client microservices can generate transient bursts of up to 10,000 requests per second. The Lambda functions require access to sensitive database credentials encrypted with an AWS KMS key. Which architecture most securely and reliably meets these requirements while preventing database connection exhaustion and performance degradation?

A retail company is migrating its legacy point-of-sale (POS) application consisting of 6 servers from an on-premises data center to AWS. The migration is being conducted using AWS Application Migration Service (MGN) over an AWS Direct Connect connection. The Direct Connect virtual interface is connected to an AWS Transit Gateway, which is attached to the Staging Area VPC. The company's security policy requires that all traffic to AWS remain entirely private, and no public IP addresses or internet pathways can be used. After installing the AWS Replication Agent on the on-premises servers, the Solutions Architect notes that the replication status on the AWS MGN console displays as 'Stalled' and data replication has not started. Which of the following configuration steps must the Solutions Architect take to successfully establish replication? (Select TWO.)

A company uses an AWS CloudFormation template to manage a stateless web application. The application runs on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG has a desired capacity of 8 instances. The company needs to deploy a new version of the application by updating the launch template with a new Amazon Machine Image (AMI). The deployment must maintain the full capacity of 8 instances at all times during the update to prevent performance issues. Which configuration of the `UpdatePolicy` attribute for the Auto Scaling group in the CloudFormation template meets this requirement?

A software-as-a-service (SaaS) provider uses AWS Organizations to manage multiple AWS accounts. The security team wants to centralize AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The security policy dictates that the logs must be encrypted at rest using an AWS Key Management Service (KMS) key. Which strategy should the solutions architect implement to configure this logging and encryption mechanism with the least operational complexity?

A financial services corporation is implementing a centralized governance model for its AWS environment, which consists of 65 member accounts managed under AWS Organizations. The security team requires a centralized logging architecture that aggregates all AWS CloudTrail logs across all accounts and regions into a single Amazon S3 bucket. The S3 bucket will reside in a dedicated Log Archive account. The solution must ensure that all log files are encrypted at rest using a customer managed KMS key, and log integrity validation must be enabled. Additionally, member accounts must be prevented from disabling CloudTrail logging or altering the centralized trail configuration, while developers in the member accounts must retain their existing administrative permissions. Which combination of configurations will meet these requirements?

An enterprise uses AWS Organizations to manage multiple member accounts. A solutions architect is designing a centralized auditing solution using AWS Config. The configuration history and configuration snapshots from all member accounts must be delivered to a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted using an AWS KMS key. The solution must ensure that member account administrators cannot disable AWS Config recorders or delivery channels. The S3 bucket policy and KMS key policy must follow the principle of least privilege. Which two actions should the solutions architect perform to meet these requirements?

A financial services company is designing a new multi-region payment processing system with the following database and storage requirements:

1. An OLTP database workload that requires a Recovery Point Objective (RPO) of less than $1$ second and a Recovery Time Objective (RTO) of less than $1$ minute across two AWS regions. The read traffic is highly dynamic and spikes unpredictably.
2. A centralized audit logging storage solution where application logs from multiple AWS accounts must be consolidated into a single S3 bucket in a dedicated security account. The logs must be encrypted at rest, and the encryption key must support cross-account access delegation.

Which two configurations should the Solutions Architect select to meet these requirements?