Tüm alıştırma soruları

A multinational enterprise is designing a hybrid network connectivity architecture to connect its on-premises data center (IP range $192.168.0.0/16$) to its AWS multi-account environment. The AWS environment consists of dozens of VPCs distributed across $us-east-1$ and $us-west-2$. The company requires a highly available network design that satisfies the following conditions:

* Primary connectivity must use a $10\text{ Gbps}$ AWS Direct Connect connection terminated at a location associated with $us-east-1$.
* Backup connectivity must use AWS Site-to-Site VPN connections over the public internet.
* All outbound traffic from both AWS regions to the on-premises data center must prefer the Direct Connect connection under normal conditions, and automatically fail over to the local region's VPN connection if the Direct Connect path becomes unavailable.
* Inbound traffic from the on-premises data center to AWS must prefer the Direct Connect path under normal conditions.
* Administrative overhead and manual route table updates must be minimized.

Which configuration should a solutions architect recommend to meet these requirements?

A financial services organization has a multi-account AWS environment with twenty VPCs in the us-east-1 region and ten VPCs in the us-west-2 region. The backend development teams require private, low-latency connectivity from their on-premises data center to all thirty VPCs. Additionally, applications in us-east-1 must communicate directly with databases in us-west-2. The network design must minimize BGP sessions, scale efficiently for future VPCs, and avoid routing inter-VPC traffic through the on-premises data center. Which network design meets these requirements?

Luminary Healthcare is modernizing its legacy patient record indexing engine by migrating it to AWS. The workload consists of a front-end user interface container and a back-end indexing processor container. The legacy code is hardcoded to communicate over the local loopback address ($127.0.0.1$) on port $8080$. The company wants to deploy this solution to Amazon ECS using the AWS Fargate launch type to eliminate EC2 instance provisioning and minimize operational overhead. Traffic between the two containers must remain private and secure without transiting external load balancers. Which configuration should the Solutions Architect select to meet these requirements?

A technology company has configured a centralized Active Directory Federation Services (AD FS) portal to authenticate internal engineers. The portal is integrated with multiple AWS target accounts in an AWS Organization using SAML 2.0. However, during the initial deployment, engineers receive authentication failures when attempting to log in to target AWS accounts from the AD FS landing page. Which configuration must be applied to the IAM roles in the target AWS accounts to successfully establish federation with the corporate Identity Provider (IdP)?

An international maritime shipping corporation is designing a high-availability and disaster recovery solution for its core cargo routing system on AWS. The system is deployed in a VPC in us-east-1 (primary) and must failover to a VPC in us-west-2 (secondary). The business requires a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 2 minutes.

The application tier consists of Amazon EC2 instances in an Auto Scaling group in private subnets, which make outbound API calls to external customs agencies via NAT Gateways. For internal microservices communication, the corporation uses a Route 53 Private Hosted Zone (PHZ) named internal.cargo.platform to resolve service endpoints. The database tier uses Amazon Aurora PostgreSQL.

Which architecture will meet these requirements with the lowest RTO and RPO while maintaining database and network redundancy in the secondary region?

A financial technology company manages 45 member accounts in an AWS Organization. A solutions architect is designing a solution to centralize VPC Flow Logs from all VPCs in the member accounts into a single Amazon S3 bucket located in a dedicated Log Archive account. Security policy dictates that all logs must be encrypted at rest using SSE-KMS. What configuration must the solutions architect implement to allow the logs to be successfully delivered to the centralized S3 bucket?

An enterprise is implementing a multi-account strategy using AWS Organizations. The solutions architect is setting up SAML 2.0-based federation to allow users from the corporate identity provider (IdP) to access resources in the target member accounts. Which of the following configurations are required to successfully establish this federated access? (Select TWO.)

A company is designing a deployment pipeline for an internal microservices-based application running on Amazon ECS with AWS App Mesh. The development team wants to implement a canary deployment strategy for a critical microservice. The strategy must initially route $10\%$ of traffic to the new version and automatically roll back to the stable version if the HTTP 5xx error rate or latency exceeds predefined thresholds on the new version. The solutions architect must design a solution that minimizes management overhead and ensures immediate rollback. Which two actions should the solutions architect recommend to implement this deployment strategy? (Select two.)

A company is modernizing a legacy, on-premises payment settlement service by migrating it to a serverless architecture on AWS. The solution must expose a private API to external financial partners connecting via AWS Direct Connect. The partners authenticate using JSON Web Tokens (JWT) issued by a third-party Identity Provider (IdP). The backend consists of AWS Lambda functions that query an Amazon Aurora PostgreSQL database cluster.

The architecture must satisfy the following requirements:
- Partners must access the API securely over the private network connection without exposing traffic to the public internet.
- The database must be protected from connection exhaustion during sudden traffic spikes.
- The application must prevent the payment settlement workload from exhausting the regional unreserved Lambda concurrency pool, which would starve other critical services in the same AWS account.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

A financial services company is designing a new multi-region web portal that spans two AWS accounts (Account A in us-east-1 and Account B in us-west-2). The workload type is an OLTP database for user sessions and Object storage for secure audit logs. The system must support active-passive disaster recovery with a recovery time objective (RTO) of less than $1\text{ minute}$ and a recovery point objective (RPO) of less than $1\text{ second}$. Audit logs generated in Account A must be stored in Amazon S3 in Account A and instantly replicated to a centralized auditing bucket in Account B. Read scaling must be supported on the database in the primary region to handle sudden traffic spikes without affecting write throughput. Which two database and storage designs should a Solutions Architect implement to meet these requirements? (Select TWO.)

A solutions architect is implementing region-restriction Service Control Policies (SCPs) across an organization in AWS Organizations. The architect needs to ensure that the restrictions do not disrupt existing applications or logging workflows, and that they are applied safely.

Arrange the steps in the correct order to design, test, and safely deploy the SCPs.

A company is planning to migrate 40 on-premises VMware virtual machines (VMs) to native Amazon EC2 instances in a target VPC using AWS Application Migration Service (MGN). The migration must be completed over a private network connection using an existing AWS Direct Connect connection. The corporate security policy strictly prohibits replication traffic and agent communications from traversing the public internet. The on-premises network is connected to the target VPC via an AWS Transit Gateway. Which of the following configuration strategies should the Solutions Architect implement to meet these requirements?

An enterprise is migrating its on-premises data center workloads to AWS and needs to transfer two primary datasets within a strict 14-day migration window. The enterprise has a dedicated $500\text{ Mbps}$ AWS Direct Connect connection. The datasets consist of:

* $850\text{ TB}$ of active user documents stored on an on-premises SMB file share, which must be migrated to Amazon FSx for Windows File Server.
* $250\text{ TB}$ of media files stored on an on-premises NFS export, which must be migrated to Amazon S3.

The security policy mandates that all migrated data must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key that is owned and managed by a centralized security account. Additionally, an existing on-premises SFTP server used by external partners to access the media files must be replaced with a fully managed service on AWS, preserving existing credentials and hostnames.

Which combination of actions will meet these requirements within the migration window? (Select TWO.)

A company is deploying a new version of a critical web application that runs on Amazon ECS with the AWS Fargate launch type. The application is behind an Application Load Balancer (ALB). The application handles multi-step transactions and maintains state using session affinity (sticky sessions) stored in the local memory of the containers. The transaction workflow can take up to 20 minutes to complete. The deployment strategy for the new version must meet the following requirements:

* Shift traffic gradually to the new version to minimize the blast radius of potential issues.
* Ensure that users with active sessions are not routed to the new version mid-transaction, which would break their session state.
* Automatically roll back the deployment if the HTTP 5XX error rate or the target response time of the new version exceeds defined thresholds.

Which combination of actions will meet these requirements? (Select TWO.)

An automated inventory fulfillment platform is designing a disaster recovery strategy for its core supply chain database and API on AWS. The application currently runs in a primary AWS Region with an Amazon Aurora PostgreSQL DB cluster and Amazon EC2 instances inside private subnets using NAT Gateways. The disaster recovery strategy must achieve a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $2$ minutes. The architecture must minimize ongoing running costs while ensuring that the infrastructure in the secondary Region can be scaled up rapidly during a failover event.

Which two configuration steps should the solutions architect implement to meet these requirements? (Select TWO.)

A financial compliance platform must deploy a transaction auditing application across two AWS Regions: `eu-west-1` (Primary) and `us-east-1` (Secondary). The application tier runs on Amazon EC2 instances in private subnets across three Availability Zones (AZs) in each Region. The architecture must satisfy a Recovery Time Objective ($RTO$) of less than 5 minutes for a regional disaster recovery failover. The Recovery Point Objective ($RPO$) requires zero data loss ($RPO = 0$) within the primary Region during an AZ failure, and less than 10 seconds ($RPO < 10\text{ seconds}$) for a regional failover. Outbound internet connectivity to external payment validation APIs must remain operational in each Region even if an entire Availability Zone or its NAT Gateway experiences an outage. Additionally, private internal DNS names must resolve correctly across VPCs in both Regions. Which architecture meets these requirements while minimizing recovery time and administrative complexity?

A global logistics firm needs to migrate 120 virtual machines (VMs) from an on-premises VMware vSphere 7.0 environment to a newly provisioned VMware Cloud on AWS (VMC) Software-Defined Data Center (SDDC). The workload consists of 80 stateless web/application servers that must remain online during migration with zero service disruption, and 40 stateful database and backend processing servers that can tolerate a maximum downtime of 10 minutes during a scheduled maintenance window. The on-premises data center is connected to AWS via a 10 Gbps AWS Direct Connect connection. The company has a multi-account AWS architecture where several spoke VPCs are connected via a customer-managed AWS Transit Gateway (TGW) in a central network account. The VMC SDDC is connected via a VMware Transit Connect gateway. The solution must ensure that resources in the spoke VPCs can access the migrated VMs using private DNS names, and that the migration is completed within the downtime constraints. Which two actions should the solutions architect recommend to meet these requirements?

A company is designing a deployment pipeline for a new microservice running on AWS Lambda behind an Amazon API Gateway. The business requires a deployment strategy that minimizes blast radius by routing a small portion of traffic to the new version initially. The traffic allocation must steadily increase in equal increments of $10\%$ every $3$ minutes until the new version receives all traffic. If any CloudWatch alarms are triggered during the deployment, AWS CodeDeploy must automatically roll back the changes. Which CodeDeploy deployment configuration should the solutions architect select to meet these requirements?

A national education board is hosting an online portal for high school exam results. The portal experiences virtually no traffic throughout the year, but when results are released, it experiences an immediate influx of $80,000$ requests per second within a $5$-minute window. The current architecture consists of an Application Load Balancer (ALB) distributing traffic to Amazon EC2 instances in an Auto Scaling Group, with a backend Amazon RDS for MySQL Multi-AZ database. During a mock release, the system failed due to ALB HTTP 503 (Service Unavailable) errors and database exhaustion from read queries. How should the solutions architect redesign the architecture to handle the next release?

A solutions architect is designing a new document management platform for an enterprise. The platform must store PDF documents and their metadata. The document storage must use a shared file system that supports the NFSv4 protocol and automatically reduces storage costs for files that are not accessed for 30 days, while keeping them immediately available when requested. The metadata database must support an OLTP workload with high read volume, and must dynamically scale read capacity while maintaining low latency. In the event of an Availability Zone outage, the database must have a recovery point objective (RPO) of less than 1 second and a recovery time objective (RTO) of less than 1 minute. Which two database and storage configurations should the solutions architect choose to meet these requirements?