Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

Soru 1901Soru →

A financial services firm needs to relocate its historical transaction archives from an on-premises legacy POSIX storage array to Amazon S3. The archive consists of $750\text{ TB}$ of data. The target S3 bucket is hosted in the firm's production AWS account (Account A). The security policy requires that all archived data must be encrypted at rest using a customer managed key (CMK) hosted in a separate security governance AWS account (Account B). The migration must be completed within $25$ days. The firm has an active $1\text{ Gbps}$ AWS Direct Connect connection, but network utilization reports indicate that only $200\text{ Mbps}$ of bandwidth can be spared for this migration without impacting core trading operations. Which migration strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

Deploy AWS DataSync agents on-premises to mount the POSIX storage array. Establish a private virtual interface over the Direct Connect connection to an AWS Transit Gateway, and run a DataSync task to transfer the data directly to the S3 bucket in Account A, specifying the customer managed key from Account B for target object encryption.

Deploy AWS DataSync agents on-premises connected to Account A. Configure a Direct Connect Gateway associated directly with the VPC containing the DataSync VPC endpoints, and configure Transit Gateway static routes to bypass the

200\text{ Mbps}

limitation on the Direct Connect connection, allowing the DataSync task to transfer the data using the customer managed key from Account B.

Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B for encryption when creating the jobs. Configure Account B's key policy to allow Account A's IAM entities and the Snowball service principal to use the key. Copy the data to the devices on-premises, and ship them back to AWS to import the data into Account A's S3 bucket.

Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the default AWS-managed KMS key (aws/s3) for transit encryption. Once the data is imported into the S3 bucket in Account A, run an Amazon S3 Batch Operations job to copy and re-encrypt the objects in-place using the customer managed key from Account B.

Cevabı ve açıklamayı göster

Cevap: Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B for encryption when creating the jobs. Configure Account B's key policy to allow Account A's IAM entities and the Snowball service principal to use the key. Copy the data to the devices on-premises, and ship them back to AWS to import the data into Account A's S3 bucket.

Cevap

Ordering multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B, and configuring the key policy to allow cross-account access is the correct solution.

The correct strategy involves using AWS Snowball Edge devices to physically transfer the

750\text{ TB}

of data, which easily completes within the

25

-day window (typically taking a few days for copy and shipping). To satisfy the security requirement of encrypting the data with Account B's customer managed KMS key, the job must be created with the cross-account key ARN, and the key policy in Account B must be configured to permit the Snowball service principal and Account A's IAM identities to use the key.

Adım Adım Çözüm

Calculate the network transfer time for the dataset over the available network bandwidth.

750\text{ TB}

of data transferred over a

200\text{ Mbps}

connection would take

\approx 347

days, which is far greater than the

25

-day migration window. Therefore, offline data transfer using AWS Snowball Edge is required.

Determines if an online or offline migration strategy is required based on bandwidth and time constraints.

Configure the KMS Customer Managed Key policy in Account B to allow cross-account usage.

Add the target AWS Account A's root ARN or specific IAM role, along with the Snowball service principal (`import.snowball.amazonaws.com`), to the key policy with actions such as `kms:DescribeKey`, `kms:CreateGrant`, `kms:Decrypt`, and `kms:GenerateDataKey*`.

Enables the Snowball service in Account A to use Account B's customer managed key for encryption during the import process.

Order AWS Snowball Edge Storage Optimized devices from Account A and copy the data.

Multiple devices are ordered, specifying the cross-account KMS key ARN. The data is copied from the on-premises storage to the devices using the Snowball client, and the devices are shipped back to AWS.

Executes the physical data transfer within the timeline and ensures data is encrypted at rest using the correct key.

Anahtar Kavram

Selecting between online and offline migration based on bandwidth and time constraints, and configuring cross-account KMS key policies for Snowball Edge imports.

Soru 1902Soru →

A media production company is designing a collaborative video editing platform. The platform has two main requirements:

1. A relational metadata database for video clips (OLTP) that requires complex SQL queries, a recovery point objective (RPO) of under $1$ minute, and a recovery time objective (RTO) of under $15$ minutes in a secondary disaster recovery region.
2. An object store for raw video assets in a central AWS account that must be securely accessed by an external vendor's IAM roles in a separate AWS account, requiring cross-account access and server-side encryption.

Which of the following database and storage strategies meets these requirements with the least operational overhead?

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with the default AWS-managed S3 key (aws/s3), and configure the S3 bucket policy to grant read access to the external vendor's IAM roles.

Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary region, routing read traffic to the standby instance to optimize performance during peak hours, and set up cross-region read replicas in the secondary region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary region, using AWS Backup to replicate database backups to the secondary region to support a pilot light disaster recovery strategy. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Cevap

The correct strategy uses Amazon Aurora Global Database to achieve near-zero RPO and low RTO because of its storage-level replication. For S3 cross-account access, a customer managed key is required because its key policy can be modified to trust the external account's IAM principal, which is not possible with AWS-managed keys like aws/s3.

Adım Adım Çözüm

Evaluate the RTO and RPO requirements for the database.

Identify that Amazon Aurora Global Database is required to support sub-second cross-region replication (RPO under 1 minute) and failover/promotion in under 15 minutes (RTO under 15 minutes).

Standard RDS replication or backups (such as a pilot light configuration) do not meet the stringent recovery time and recovery point objectives.

Check the read-scaling capability of standard RDS Multi-AZ deployments.

Determine that standard RDS Multi-AZ standby instances are passive and cannot serve read traffic, which rules out routing read traffic to the standby instance.

Only Aurora Replicas or active RDS Read Replicas can be used to scale read workloads.

Verify cross-account S3 bucket sharing and encryption configuration.

Conclude that an AWS KMS customer managed key (CMK) must be used to encrypt the S3 bucket, with appropriate permissions granted in the KMS key policy to allow cross-account decryption.

AWS-managed KMS keys (like aws/s3) cannot be shared across different AWS accounts as their key policies cannot be modified.

Anahtar Kavram

To meet strict RTO/RPO objectives in multi-region deployments, Amazon Aurora Global Database provides active-passive cross-region physical replication with fast failover. Furthermore, S3 buckets shared across accounts must use Customer Managed Keys (CMKs) to enable decryption by external account principals, as AWS managed keys cannot be shared cross-account.

Soru 1903Soru →

A geospatial satellite image processing company is designing a new multi-region pipeline on AWS. The application will be deployed in VPCs in us-east-1 (Primary) and us-west-2 (Secondary). The workflow orchestration tier runs on Amazon EC2 instances in private subnets that require highly available outbound internet access to ingestion APIs, resilient to any Availability Zone (AZ) failure. The database layer uses Amazon Aurora PostgreSQL to store image metadata. The company requires a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 2 minutes. Additionally, internal EC2 processing nodes in us-west-2 must resolve hostnames in a Route 53 Private Hosted Zone (PHZ) managed in us-east-1. Which TWO architectural configurations must a solutions architect implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Use managed failover to promote the secondary cluster to a write-capable region during disaster recovery.

In both VPCs, deploy a NAT Gateway in each Availability Zone where private EC2 instances reside, and configure the routing tables of each private subnet to direct egress traffic to the local NAT Gateway in its respective Availability Zone.

Use AWS Backup to schedule database snapshots every 12 hours in us-east-1 and copy them to us-west-2 to restore the database in the event of an outage.

Deploy a single NAT Gateway in the primary Availability Zone of each VPC, and configure the routing tables of all private subnets in that VPC to route egress traffic through this NAT Gateway.

Rely on standard VPC Peering DNS resolution settings to allow the instances in us-west-2 to resolve hostnames in the primary VPC's Route 53 Private Hosted Zone without modifying the zone's VPC associations.

Configure Amazon Aurora Auto Scaling in us-west-2 to automatically scale the number of writer nodes to handle database failover and host resolution during a regional outage.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Use managed failover to promote the secondary cluster to a write-capable region during disaster recovery.; In both VPCs, deploy a NAT Gateway in each Availability Zone where private EC2 instances reside, and configure the routing tables of each private subnet to direct egress traffic to the local NAT Gateway in its respective Availability Zone.

Cevap

The correct configurations are to configure an Amazon Aurora Global Database using managed failover, and to deploy NAT Gateways in multiple Availability Zones in each VPC with updated route tables for each private subnet.

Configuring an Amazon Aurora Global Database satisfies the low RTO and RPO limits. Aurora Global Database utilizes fast storage-level replication to achieve an RPO of under 1 second, and its managed failover enables promoting the secondary region to primary within 2 minutes. Additionally, deploying a NAT Gateway in each Availability Zone where private EC2 instances reside ensures outbound internet connection remains available in the event of an Availability Zone outage, since each zone's private route tables route egress traffic independently to the local NAT Gateway.

Adım Adım Çözüm

Evaluate the HA/DR requirements for the database tier to determine the replication mechanism.

Identify that a backup/restore or snapshot replication mechanism cannot meet the 1-minute RPO and 2-minute RTO. Amazon Aurora Global Database replication latency is under 1 second, and its managed failover meets the under 2 minutes RTO requirement.

This establishes the database replication and failover architecture needed for compliance with recovery objectives.

Evaluate the egress internet traffic resilience requirements.

Identify that a single NAT Gateway in a VPC is a single point of failure. Deploying a NAT Gateway in each Availability Zone where EC2 instances reside and updating corresponding route tables maintains internet access if one AZ goes down.

This ensures the outbound connection path remains highly available and AZ-fault tolerant.

Review options to eliminate distractors violating RTO/RPO, AZ resilience, DNS Private Hosted Zone cross-VPC association, or database replica scaling constraints.

Select the correct combination consisting of Aurora Global Database with managed failover, and multi-AZ NAT Gateway deployments.

This guarantees that both database and networking layers fulfill all business constraints.

Anahtar Kavram

Designing multi-region disaster recovery for databases and highly available network paths while managing private DNS resolution across VPCs.

Soru 1904Soru →

An enterprise is designing a secure hybrid and multi-account network topology using AWS Organizations. The environment consists of $50$ spoke VPCs distributed across two AWS regions: `us-east-1` and `us-west-2`. The architecture includes an AWS Transit Gateway (TGW) in each region with inter-region peering established, and a Shared Services VPC in a dedicated Infrastructure account. An on-premises data center is connected via AWS Direct Connect to a Direct Connect Gateway associated with both regional TGWs. The enterprise must meet the following requirements:

1. Spoke VPCs in all accounts must resolve domain names in a Private Hosted Zone (PHZ) named ` $internal.aws$ ` hosted in the Shared Services account.
2. Spoke VPCs must forward DNS queries for the domain ` $onprem.corp$ ` to on-premises DNS servers.
3. Outbound internet traffic from all spoke VPCs must be centrally inspected by AWS Network Firewall endpoints deployed across multiple Availability Zones in a centralized Egress VPC in each region.

Which two actions should the solutions architect take to configure the DNS resolution and traffic routing to meet these requirements?

Geçerli olan tümünü seçin

Configure DNS resolution by creating the `

internal.aws

` PHZ in the Shared Services account. Authorize cross-account VPC associations for the spoke VPCs, and accept the associations in the spoke accounts. Create Route 53 Resolver outbound endpoints in the Shared Services VPC, define a forwarding rule for `

onprem.corp

` pointing to on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the organization, and associate the shared rule with all spoke VPCs.

Configure DNS resolution by creating the `

internal.aws

` PHZ in the Shared Services account and sharing it with the organization using AWS Resource Access Manager (RAM). Associate the shared PHZ with the spoke VPCs in each account. Create Route 53 Resolver inbound endpoints in the spoke VPCs to receive and forward queries for `

onprem.corp

` directly to the on-premises DNS servers.

Configure egress routing by deploying regional AWS Network Firewall endpoints, TGW attachments, and NAT Gateways across multiple Availability Zones in the Egress VPC. In the regional TGW route table associated with the spoke VPCs, add a static default route (`

0.0.0.0/0

`) pointing to the local Egress VPC TGW attachment. In the Egress VPC, configure the TGW subnet route tables to route `

0.0.0.0/0

` to the Network Firewall endpoints, and configure the firewall subnet route tables to route `

0.0.0.0/0

` to the NAT Gateways.

Configure egress routing by deploying a single NAT Gateway and a single AWS Network Firewall endpoint in a centralized subnet within the Egress VPC. In the spoke VPC route tables, add a default route (`

0.0.0.0/0

`) pointing to the Shared Services VPC, and configure the Shared Services TGW route table to propagate the default route to all spokes.

Configure routing by propagating the default route (`

0.0.0.0/0

`) from the Direct Connect Gateway to both regional TGWs. Configure the TGW route tables to route all internet-bound traffic through the Direct Connect Gateway to the on-premises firewall for inspection, and peer the regional TGWs directly to allow spoke VPCs to access the Shared Services VPC across regions.

Cevabı ve açıklamayı göster

Cevap: Configure DNS resolution by creating the ` $internal.aws$ ` PHZ in the Shared Services account. Authorize cross-account VPC associations for the spoke VPCs, and accept the associations in the spoke accounts. Create Route 53 Resolver outbound endpoints in the Shared Services VPC, define a forwarding rule for ` $onprem.corp$ ` pointing to on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the organization, and associate the shared rule with all spoke VPCs.; Configure egress routing by deploying regional AWS Network Firewall endpoints, TGW attachments, and NAT Gateways across multiple Availability Zones in the Egress VPC. In the regional TGW route table associated with the spoke VPCs, add a static default route (` $0.0.0.0/0$ `) pointing to the local Egress VPC TGW attachment. In the Egress VPC, configure the TGW subnet route tables to route ` $0.0.0.0/0$ ` to the Network Firewall endpoints, and configure the firewall subnet route tables to route ` $0.0.0.0/0$ ` to the NAT Gateways.

Cevap

Configure DNS resolution using cross-account Private Hosted Zone association and Route 53 Resolver forwarding rules shared via AWS RAM. Configure centralized egress routing using multi-AZ AWS Network Firewall endpoints and NAT Gateways with static default routes in the regional Transit Gateway.

The correct solution involves two main architectures. For hybrid DNS resolution, a Private Hosted Zone cannot be shared directly via AWS RAM; instead, it must be associated with the spoke VPCs using cross-account hosted zone association authorization. The Route 53 Resolver forwarding rule for the on-premises domain is shared via AWS RAM and associated with the spoke VPCs to redirect queries to the outbound endpoints. For centralized egress, high availability requires multi-AZ deployment of Network Firewall endpoints and NAT Gateways in the Egress VPC. Spoke traffic is sent to the Egress VPC via TGW default routing, inspected by the local firewall endpoint, and sent to the NAT Gateway.

Adım Adım Çözüm

Set up DNS resolution for the central Private Hosted Zone across accounts.

Authorized cross-account VPC associations are created for the spoke VPCs, enabling them to associate with and resolve queries within the central `

internal.aws

` PHZ.

Private Hosted Zones are not supported by AWS RAM for cross-account sharing, so API-based cross-account association is required.

Configure hybrid DNS forwarding to the on-premises DNS servers.

A Route 53 Resolver forwarding rule is created for the `

onprem.corp

` domain pointing to the on-premises DNS servers, shared via AWS RAM with the organization, and associated with all spoke VPCs.

This allows centralized outbound DNS resolution while minimizing the cost and management of deploying endpoints in every spoke VPC.

Configure high-availability egress routing path in the Egress VPC.

TGW route tables point `

0.0.0.0/0

` to the Egress VPC attachment. Egress VPC TGW subnets route `

0.0.0.0/0

` to the Network Firewall endpoints, which in turn route to the local NAT Gateways.

This guarantees that all outbound internet traffic is inspected by the AWS Network Firewall without creating a single point of failure.

Anahtar Kavram

Centralized network security routing and cross-account hybrid DNS architecture using AWS Transit Gateway and Route 53 Resolvers.

Tahmini Süre:3m 0s

Soru 1905Soru →

Zephyr Payments is modernizing its on-premises payment processing application by migrating it to AWS. The architecture consists of a frontend web portal and a backend payment API. The Solutions Architect has decided to deploy the backend payment API as containerized tasks using Amazon ECS on AWS Fargate across multiple Availability Zones in a private VPC. The backend API needs to communicate securely and privately with a legacy reporting service deployed in a separate VPC within the same AWS Region. The network architecture must ensure that no traffic between these VPCs passes over the public internet, and the configuration must minimize operational overhead while adhering to Fargate's architectural boundaries. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the ECS task definition for the backend payment API using the awsvpc network mode.

Create an AWS Transit Gateway and attach both the ECS VPC and the legacy reporting VPC to route traffic privately between them.

Configure the ECS task definition for the backend payment API using the bridge network mode to leverage Docker's built-in virtual network mapping.

Create an AWS Direct Connect Gateway and associate it directly with both VPCs to route the VPC-to-VPC traffic transitively.

Create a Route 53 Private Hosted Zone (PHZ) for the legacy reporting service, but associate it only with the legacy reporting VPC to keep the namespace private.

Cevabı ve açıklamayı göster

Cevap: Configure the ECS task definition for the backend payment API using the awsvpc network mode.; Create an AWS Transit Gateway and attach both the ECS VPC and the legacy reporting VPC to route traffic privately between them.

Cevap

The Solutions Architect should configure the ECS task definition for the backend payment API using the awsvpc network mode, and create an AWS Transit Gateway attaching both the ECS VPC and the legacy reporting VPC to route traffic privately between them.

The correct options are configuring the ECS task definition using the awsvpc network mode and routing the traffic using an AWS Transit Gateway. AWS Fargate tasks exclusively support the awsvpc network mode, which registers an Elastic Network Interface (ENI) directly for each task. Private VPC-to-VPC connectivity is securely and scalably managed by attaching both VPCs to an AWS Transit Gateway, which supports transitive routing without sending traffic over the public internet.

Adım Adım Çözüm

Select the correct network mode for AWS Fargate tasks.

The ECS task definition is configured with the awsvpc network mode.

AWS Fargate does not support bridge, host, or none network modes. Tasks must use the awsvpc mode to get their own elastic network interface (ENI).

Establish private inter-VPC network connectivity.

An AWS Transit Gateway is deployed, and both VPCs are attached to it with appropriate route table entries.

Transit Gateway allows private, scalable, and low-latency routing between multiple VPCs without routing traffic over the public internet.

Anahtar Kavram

AWS Fargate task networking configurations and private multi-VPC routing options.

Tahmini Süre:2m 30s

Soru 1906Soru →

A retail corporation is modernizing its on-premises inventory management backend by migrating to Amazon Aurora PostgreSQL. A serverless application using Amazon API Gateway and AWS Lambda will ingest high-frequency updates from partner supply-chain systems. The partner systems connect to the VPC using AWS Direct Connect.

The architecture must meet the following requirements:
- API traffic from partners must remain entirely private without traversing the public internet.
- Partner requests must be authenticated using OAuth2 tokens validated by a Lambda authorizer against an external Identity Provider (IdP) on the public internet.
- Database connection scaling must be managed efficiently.
- High-volume surges in inventory API traffic must not exhaust the regional account concurrency pool, which would throttle other critical applications.
- Credentials must be encrypted using AWS KMS, with the key policy configured to delegate management to a central security team.

Which architecture meets these requirements while aligning with AWS best practices?

Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.

Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets, routing all outbound traffic through a single NAT Gateway in a single Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.

Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Configure Provisioned Concurrency on the inventory Lambda function to handle initial traffic surges, without setting Reserved Concurrency limits. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.

Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone. Encrypt database credentials using the default AWS-managed KMS key (aws/lambda) and modify its key policy to delegate administration to the central security team.

Cevabı ve açıklamayı göster

Cevap: Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.

Cevap

Deploy a Private API Gateway with an Interface VPC Endpoint, use Amazon RDS Proxy for connection pooling, set Reserved Concurrency on the inventory Lambda function, route the Lambda authorizer's outbound traffic through a NAT Gateway in each Availability Zone, and encrypt credentials using a Customer Managed Key (CMK) with a customized key policy.

The correct solution uses a Private API Gateway with a VPC endpoint for private access over Direct Connect. It deploys the inventory Lambda function inside the VPC using Amazon RDS Proxy to safely scale database connections. It establishes a Reserved Concurrency limit to prevent the function from exhausting the account-level concurrency pool, which safeguards other application functions. For authentication, the Lambda authorizer is deployed across multiple private subnets and accesses the public internet IdP via redundant NAT Gateways to avoid a single point of failure. Finally, it uses a Customer Managed Key (CMK) for credential encryption, allowing the customized key policy needed to delegate administrative control to the security team.

Adım Adım Çözüm

Expose the API privately over Direct Connect.

A Private API Gateway is set up with an Interface VPC Endpoint in the VPC, allowing partner systems to reach it over Direct Connect without crossing the public internet.

Meets the requirement for private network transit.

Configure backend scaling and protection.

Amazon RDS Proxy is placed between the Lambda functions and the Aurora PostgreSQL database. Reserved Concurrency is configured on the inventory Lambda function.

RDS Proxy prevents database connection exhaustion. Reserved Concurrency limits and guarantees concurrency for the function, preventing it from consuming the entire regional account-level concurrency pool and throttling other workloads.

Set up outbound internet access for the Lambda authorizer.

The Lambda authorizer is deployed to private subnets across multiple Availability Zones. Outbound routes are configured through a NAT Gateway in each Availability Zone.

The authorizer must validate tokens against an external IdP on the public internet. Utilizing multiple NAT Gateways ensures high availability and resilience to AZ outages.

Configure secure credential encryption.

A Customer Managed Key (CMK) is created, and its key policy is configured to delegate management to the central security team.

AWS-managed keys (like aws/lambda) cannot have their key policies modified. A CMK is required to customize the policy for delegation.

Anahtar Kavram

Designing secure, highly available, and scalable serverless workloads with AWS Lambda and Amazon API Gateway integrated with VPC resources and external endpoints.

Soru 1907Soru →

An enterprise is planning to migrate its on-premises VMware vSphere environment containing 80 virtual machines (VMs) to a VMware Cloud on AWS SDDC. The migration has the following technical requirements:

* A critical database cluster of 5 VMs must be migrated with zero downtime during replication and cutover to maintain continuous application availability.
* The remaining 75 application VMs can tolerate a brief service interruption of up to 15 minutes during an off-peak scheduled maintenance window.
* All VMs must retain their existing on-premises IP addresses post-migration to prevent breaking hardcoded application configurations.
* The migration traffic must traverse a private connection using an existing 1 Gbps AWS Direct Connect connection.

Which combination of VMware HCX migration methods and network configurations should the Solutions Architect select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Use VMware HCX Replication Assisted vMotion (RAV) to migrate the database VMs, and use VMware HCX Bulk Migration to migrate the application VMs with a scheduled switchover.

Establish a VMware HCX Layer 2 Network Extension over the Direct Connect connection to stretch the on-premises VLANs to the VMware Cloud on AWS SDDC.

Use VMware HCX Cold Migration for all database and application VMs to optimize migration bandwidth usage on the Direct Connect connection.

Configure a Direct Connect Gateway directly to route the Layer 2 traffic between the on-premises network and the SDDC without deploying an HCX network extension.

Associate a Route 53 Private Hosted Zone with the VMware Cloud on AWS VPC to dynamically update DNS records and translate VM IP addresses during the migration.

Cevabı ve açıklamayı göster

Cevap: Use VMware HCX Replication Assisted vMotion (RAV) to migrate the database VMs, and use VMware HCX Bulk Migration to migrate the application VMs with a scheduled switchover.; Establish a VMware HCX Layer 2 Network Extension over the Direct Connect connection to stretch the on-premises VLANs to the VMware Cloud on AWS SDDC.

Cevap

The correct configurations are using VMware HCX Replication Assisted vMotion (RAV) for database VMs along with Bulk Migration for application VMs, and establishing a VMware HCX Layer 2 Network Extension over the Direct Connect connection.

To satisfy the requirements, the Solutions Architect should select VMware HCX Replication Assisted vMotion (RAV) for the database VMs to ensure zero downtime, use VMware HCX Bulk Migration for the remaining application VMs to allow scheduled parallel switchovers within their 15-minute downtime window, and establish a VMware HCX Layer 2 Network Extension over Direct Connect to preserve IP addresses.

Adım Adım Çözüm

Analyze the downtime tolerance of the workloads.

The database VMs require zero downtime, which mandates HCX Replication Assisted vMotion (RAV). The application VMs can tolerate up to 15 minutes of downtime, making HCX Bulk Migration (which uses replication followed by a scheduled reboot switchover) the most efficient and scalable choice.

Matching migration methods with workload requirements ensures that application availability matches defined objectives.

Determine the network requirements for IP preservation.

To preserve on-premises IP addresses without updating hardcoded application configurations, a Layer 2 network extension must be configured.

Layer 2 extensions stretch VLANs across hybrid environments, preventing IP address changes.

Select the appropriate network path.

The migration traffic must travel over a private connection, so VMware HCX should be configured to run over the Direct Connect Private VIF rather than the public internet.

Direct Connect Private VIF ensures secure, high-throughput, private routing of HCX replication and vMotion traffic.

Anahtar Kavram

Selecting the appropriate VMware HCX migration methods (Replication Assisted vMotion and Bulk Migration) and extending the Layer 2 network over a private Direct Connect path to satisfy workload availability and IP preservation requirements.

Tahmini Süre:2m 0s

Soru 1908Soru →

A financial services company is using AWS Application Migration Service (MGN) to migrate its legacy transaction-processing servers from an on-premises data center to AWS. The network connection is established via an AWS Direct Connect connection terminating at a Transit Gateway, which is associated with a dedicated staging VPC. The solutions architect has installed the AWS Replication Agent on the on-premises servers, but the replication status in the AWS MGN console displays 'Stalled' for all source servers. A network analysis shows that the agents are unable to establish a connection to the replication servers in the staging area subnet. Which of the following actions will resolve the replication connection issue?

Associate a Route 53 Private Hosted Zone with the staging VPC and ensure the on-premises servers can resolve the replication server DNS names.

Update the security group associated with the replication servers in the staging area subnet to allow inbound traffic on TCP port 1500 from the on-premises subnet range.

Deploy a single NAT Gateway in the staging subnet to route all outbound replication traffic to public replication endpoints.

Bypass the Transit Gateway and configure a Direct Connect Gateway directly attached to the staging VPC to support transitive VPC-to-VPC routing for replication.

Cevabı ve açıklamayı göster

Cevap: Update the security group associated with the replication servers in the staging area subnet to allow inbound traffic on TCP port 1500 from the on-premises subnet range.

Cevap

Update the security group associated with the replication servers in the staging area subnet to allow inbound traffic on TCP port 1500 from the on-premises subnet range.

AWS Application Migration Service (MGN) relies on TCP port 1500 to stream replicated blocks from the agent running on the source server to the replication servers in the staging area VPC. Ensuring that the staging area security group permits inbound TCP traffic on port 1500 from the source subnet range allows the replication process to establish connectivity and proceed.

Adım Adım Çözüm

Identify the port required by AWS Application Migration Service (MGN) for data replication.

TCP port 1500 is identified as the dedicated port used by the Replication Agent to send replication data to the replication servers.

Data replication packets are sent directly from the source servers to the staging area replication servers over TCP port 1500.

Analyze the security group and firewall configurations in the staging VPC.

Confirm that the security group attached to the replication servers does not permit inbound TCP port 1500 traffic from the on-premises network range.

By default, security groups block all inbound traffic unless explicitly permitted. If port 1500 is not allowed, the agents will show a status of 'Stalled'.

Update the staging VPC security group to allow inbound TCP port 1500.

Traffic flow is permitted and the Replication Agent establishes connection to the replication servers, resuming the data synchronization.

Allowing the replication port resolves the network block at the staging subnet level.

Anahtar Kavram

Replication data transport in AWS Application Migration Service (MGN) requires TCP port 1500 to be open from the source environment to the replication servers in the staging area.

Soru 1909Soru →

An online banking consortium is implementing a serverless wire transfer API. The backend logic is hosted on AWS Lambda functions, fronted by Amazon API Gateway. The compliance department mandates that any updates to the transfer Lambda function must undergo automated end-to-end transaction validation in the production environment before any actual user traffic is routed to the new code. If validation succeeds, the new version must be gradually introduced, starting at $5\%$ of live traffic, scaling up by $5\%$ every 10 minutes, until it handles $100\%$ of the workload. If the error rate of the new version exceeds $0.5\%$ or if the validation fails at any point, the system must immediately and automatically roll back to the previous stable version with zero downtime. Which of the following configurations represents the most operationally efficient deployment strategy that meets these requirements?

Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of

5\%

, and a step interval of 10 minutes. In the AppSpec file, define an `AfterAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Associate a CloudWatch Alarm monitoring the Lambda function's error rate with the CodeDeploy deployment group to trigger automatic rollbacks.

Configure Amazon API Gateway with two stages: Production and Canary. Set up a Route 53 weighted routing policy between the two stages, starting with a

5\%

weight on the Canary stage. Use an AWS CodePipeline pipeline to trigger a Lambda function that gradually increases the Route 53 weights by

5\%

every 10 minutes. Define a `BeforeAllowTraffic` hook in the pipeline to execute the validation tests before updating the Route 53 weights.

Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of

5\%

, and a step interval of 10 minutes. In the AppSpec file, define a `BeforeAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Associate a CloudWatch Alarm monitoring the Lambda function's error rate with the CodeDeploy deployment group to trigger automatic rollbacks.

Configure AWS CodeDeploy with the predefined `LambdaLinear10PercentEvery10Minutes` deployment configuration. In the AppSpec file, define a `BeforeAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Configure AWS Lambda alias routing manually via an AWS Step Functions state machine to throttle the traffic shifting rate to

5\%

steps to meet the compliance requirement.

Cevabı ve açıklamayı göster

Cevap: Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of $5\%$ , and a step interval of 10 minutes. In the AppSpec file, define a `BeforeAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Associate a CloudWatch Alarm monitoring the Lambda function's error rate with the CodeDeploy deployment group to trigger automatic rollbacks.

Cevap

Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of

5\%

Defining a custom CodeDeploy deployment configuration with a linear shifting pattern is correct because it matches the requested custom increments of

5\%

every 10 minutes. Using the `BeforeAllowTraffic` hook allows the system to validate the deployment on the new Lambda function version in the target environment before any live user traffic is routed. Linking the deployment group to CloudWatch alarms ensures that any breach of the error rate threshold immediately triggers an automatic, zero-downtime rollback.

Adım Adım Çözüm

Analyze standard versus custom CodeDeploy configurations.

Determine that AWS does not provide a predefined linear deployment configuration matching exactly

5\%

every 10 minutes, meaning a custom configuration must be defined.

Predefined options only cover standard steps like

10\%

increments.

Select the correct lifecycle hook for pre-traffic verification.

Choose the `BeforeAllowTraffic` hook in the AppSpec file to execute the validation Lambda function.

This hook executes before the first traffic shifting step starts, ensuring no production users hit unverified code.

Configure the automated rollback mechanism.

Create and link a CloudWatch Alarm monitoring the Lambda function's error rate to the CodeDeploy deployment group.

This enables automatic rollback to the previous stable version if the error rate exceeds the defined threshold.

Anahtar Kavram

Custom deployment configurations and lifecycle hooks in AWS CodeDeploy for serverless applications.

Soru 1910Soru →

An enterprise has a $600\text{ TB}$ historical dataset stored on an on-premises NFS file system that must be migrated to Amazon S3. The enterprise has a dedicated $200\text{ Mbps}$ internet connection. In addition, the enterprise must establish an ingestion pipeline to receive daily reports totaling $100\text{ GB}$ from external vendors via the SFTP protocol, storing them directly in Amazon S3. The migration of the historical $600\text{ TB}$ dataset must be completed within $20$ days. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Order multiple AWS Snowball Edge Storage Optimized devices, transfer the

600\text{ TB}

dataset locally from the NFS server, and ship the devices back to AWS to import the data into the Amazon S3 bucket using an AWS KMS customer managed key.

Provision an AWS Transfer Family server with an SFTP-enabled public endpoint, map the endpoint to the target Amazon S3 bucket, and configure external vendors to upload their daily reports using the SFTP protocol.

Deploy AWS DataSync agents on-premises, establish a site-to-site VPN connection over the internet, and configure a DataSync task to copy the

600\text{ TB}

NFS dataset directly to Amazon S3.

Order multiple AWS Snowball Edge Storage Optimized devices, transfer the

600\text{ TB}

dataset locally from the NFS server, and configure the import job to encrypt the target Amazon S3 bucket using the default AWS managed key (`aws/s3`).

Establish an AWS Direct Connect connection with a Direct Connect Gateway to route the external vendors' SFTP traffic transitively through an on-premises environment before forwarding it to an AWS Transfer Family server using a private VPC endpoint.

Cevabı ve açıklamayı göster

Cevap: Order multiple AWS Snowball Edge Storage Optimized devices, transfer the $600\text{ TB}$ dataset locally from the NFS server, and ship the devices back to AWS to import the data into the Amazon S3 bucket using an AWS KMS customer managed key.; Provision an AWS Transfer Family server with an SFTP-enabled public endpoint, map the endpoint to the target Amazon S3 bucket, and configure external vendors to upload their daily reports using the SFTP protocol.

Cevap

The correct strategy requires ordering multiple AWS Snowball Edge Storage Optimized devices to migrate the historical

600\text{ TB}

dataset using a customer managed KMS key, and provisioning an AWS Transfer Family SFTP-enabled public endpoint to ingest the daily

100\text{ GB}

vendor reports directly to Amazon S3.

Using AWS Snowball Edge Storage Optimized devices is the only way to meet the migration timeline for the

600\text{ TB}

dataset given the

200\text{ Mbps}

network limit. The import job requires an AWS KMS customer managed key because AWS managed keys do not support the delegation necessary for Snowball. Meanwhile, AWS Transfer Family with an SFTP public endpoint mapped to Amazon S3 offers a native, scalable solution for daily reports from external vendors.

Adım Adım Çözüm

Calculate the network transfer time for the historical dataset to determine if online transfer is feasible.

200\text{ Mbps}

, transferring

600\text{ TB}

takes over

270

days, which is well beyond the

20

-day migration window.

This establishes that a physical offline transfer mechanism (Snowball Edge) is required rather than an online service like DataSync.

Evaluate the encryption requirements for the offline Snowball transfer.

Determine that an AWS KMS customer managed key must be configured because default AWS managed keys (`aws/s3`) do not support external access or cross-service delegation needed by the Snowball import process.

This guarantees compliance with security rules and ensures the Snowball import task succeeds.

Determine the optimal endpoint configuration for the SFTP ingestion pipeline.

Deploy an AWS Transfer Family SFTP-enabled public endpoint backed by Amazon S3 to support external vendors directly without complex transitive routing.

This provides a highly available, simple, and standard method for secure public ingestion.

Anahtar Kavram

Large-scale data migration decisions based on bandwidth limits, execution timelines, and service constraints (Snowball vs DataSync and Transfer Family).

Tahmini Süre:3m 0s

Soru 1911Soru →

A retail company has an AWS Organization with six VPCs in a single AWS Region. The company needs to establish highly available connectivity to its on-premises data center using an existing AWS Direct Connect connection. The design must support transitive routing for VPC-to-VPC traffic as well as connectivity between all VPCs and the on-premises data center, while minimizing administrative overhead and the number of BGP sessions. Which architecture should the solutions architect implement to meet these requirements?

Associate all six VPCs directly to a single AWS Direct Connect Gateway using private virtual interfaces to handle both VPC-to-VPC routing and hybrid connectivity.

Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and associate it with a Direct Connect Gateway using a transit virtual interface to manage both VPC-to-VPC and hybrid traffic.

Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and associate a shared Route 53 Private Hosted Zone with the Transit Gateway to resolve on-premises DNS and route traffic without associating the zone with individual VPCs.

Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and route all outbound internet and hybrid on-premises traffic through a single NAT Gateway located in a centralized shared services VPC.

Cevabı ve açıklamayı göster

Cevap: Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and associate it with a Direct Connect Gateway using a transit virtual interface to manage both VPC-to-VPC and hybrid traffic.

Cevap

Deploying a central AWS Transit Gateway and attaching the VPCs to it allows for scalable, transitive routing between VPCs. Associating the Transit Gateway with a Direct Connect Gateway using a transit virtual interface enables traffic to flow between the VPCs and the on-premises data center over a single consolidated BGP session, satisfying both the transitive routing and administrative overhead constraints.

Adım Adım Çözüm

Analyze the transitive routing requirement between VPCs and the on-premises data center.

Identify that AWS Transit Gateway is required to enable VPC-to-VPC communication as well as consolidated hybrid access, since Direct Connect Gateway alone does not support transitive routing between VPCs.

Establishing a hub-and-spoke model simplifies routing and meets the transitive communication requirements.

Select the appropriate Direct Connect interface type.

A transit virtual interface (Transit VIF) must be configured on the AWS Direct Connect connection to connect to the AWS Transit Gateway via the Direct Connect Gateway.

Private virtual interfaces cannot be associated with Transit Gateways; Transit Gateways require Transit VIFs.

Verify compliance with high availability and administrative overhead constraints.

Associating the Transit Gateway with a single Direct Connect Gateway simplifies BGP session management to a single peer relationship while maintaining scalability.

This avoids the complexity of managing multiple Direct Connect virtual interfaces and BGP sessions per VPC.

Anahtar Kavram

AWS Transit Gateway transitive routing and Direct Connect Gateway integration using Transit VIFs

Tahmini Süre:2m 0s

Soru 1912Soru →

A company manages $30$ member accounts within a single organization in AWS Organizations. The security team is setting up AWS Config in all member accounts and wants to centralize all configuration history files and snapshots into a single Amazon S3 bucket located in a dedicated Security Archive account. They want to encrypt all configuration data in the S3 bucket using a Customer Managed Key (CMK) in AWS KMS. Which configuration combination will allow AWS Config to successfully deliver the files to the S3 bucket?

In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.

In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Configure AWS Config in the member accounts to use the central S3 bucket and select the default AWS-managed KMS key for Amazon S3 (aws/s3) for encryption.

In the Security Archive account, create a KMS CMK and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. Configure the S3 bucket policy to allow the IAM roles associated with AWS Config in each member account to perform s3:PutObject and s3:GetBucketAcl, without allowing the config.amazonaws.com service principal.

Attach a Service Control Policy (SCP) to the organization root that grants s3:PutObject permissions on the central S3 bucket and kms:GenerateDataKey* permissions on the KMS key to the config.amazonaws.com service principal across all accounts. Enable default S3 encryption in the Security Archive account using an AWS-managed key, relying on the SCP to authorize cross-account delivery.

Cevabı ve açıklamayı göster

Cevap: In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.

Cevap

The correct answer configuration successfully authorizes cross-account delivery by targeting the config.amazonaws.com service principal in both the S3 bucket policy and the KMS Customer Managed Key (CMK) policy. Because AWS Config uses the service principal rather than member account IAM roles to perform delivery, and because AWS-managed keys cannot be used for cross-account encryption, a Customer Managed Key (CMK) in the central account with explicit service principal trust is the only valid solution.

Adım Adım Çözüm

Determine key requirements for cross-account KMS encryption.

Identify that a Customer Managed Key (CMK) is mandatory because AWS-managed keys cannot be shared across accounts.

AWS-managed keys have fixed key policies that cannot be modified to grant cross-account permissions.

Configure the resource-based access policy for the central S3 bucket.

Grant s3:PutObject and s3:GetBucketAcl to the config.amazonaws.com service principal.

AWS Config delivers configuration history using the service principal directly rather than assuming the member account's IAM role.

Configure the key policy for the central KMS CMK.

Grant kms:GenerateDataKey* and kms:Decrypt permissions to the config.amazonaws.com service principal.

AWS Config requires these permissions to generate data keys for encrypting the log objects before writing them to the S3 bucket.

Anahtar Kavram

Centralized cross-account resource delivery with AWS Config, S3, and KMS Customer Managed Keys

Tahmini Süre:2m 0s

Soru 1913Soru →

A company is designing a deployment pipeline for a production web application hosted on Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer (ALB). The application requires zero downtime during deployments, and the operations team must have the ability to automatically roll back the deployment if new errors are detected via CloudWatch alarms. The team has decided to use AWS CodeDeploy to manage the deployments.

Which two configuration steps should the solutions architect include in the deployment strategy to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the CodeDeploy deployment group to use a Blue/Green deployment style, and choose the option to copy the existing Auto Scaling group as the replacement environment.

Configure CloudWatch alarms to monitor key application metrics such as HTTP 5xx error rates, and associate these alarms with the CodeDeploy deployment group to trigger an automatic rollback if they enter the ALARM state during the deployment.

Configure the CodeDeploy deployment group to use an In-place deployment style with the CodeDeployDefault.OneAtATime deployment configuration, and configure Amazon Route 53 weighted routing to split traffic between the old and new instances.

Configure the Auto Scaling group's CloudFormation UpdatePolicy to use AutoScalingRollingUpdate with a MinInstancesInService value of 0.

Configure the CodeDeploy deployment group to use a Blue/Green deployment style, and select the CodeDeployDefault.LambdaLinear10PercentEvery3Minutes routing configuration to control the traffic shift.

Cevabı ve açıklamayı göster

Cevap: Configure the CodeDeploy deployment group to use a Blue/Green deployment style, and choose the option to copy the existing Auto Scaling group as the replacement environment.; Configure CloudWatch alarms to monitor key application metrics such as HTTP 5xx error rates, and associate these alarms with the CodeDeploy deployment group to trigger an automatic rollback if they enter the ALARM state during the deployment.

Cevap

To meet the requirements, the solutions architect should configure the CodeDeploy deployment group to use a Blue/Green deployment style that copies the existing Auto Scaling group, and associate CloudWatch alarms with the deployment group to trigger an automatic rollback if they enter the ALARM state.

The correct options recommend configuring a blue/green deployment style by copying the existing Auto Scaling group, and using CloudWatch alarms associated with the CodeDeploy deployment group for automated rollback. Copying the Auto Scaling group ensures a clean replacement environment is provisioned and verified before traffic is shifted, preserving the original environment in case of failure. Associating CloudWatch alarms with the deployment group allows CodeDeploy to monitor the application during and immediately after deployment, triggering an automatic rollback to the original environment if errors exceed defined thresholds.

Adım Adım Çözüm

Select the appropriate deployment style for zero-downtime and clean rollback requirements.

Determine that a blue/green deployment style using CodeDeploy with a copy of the existing Auto Scaling group provides a separate, clean replacement environment for testing before traffic routing.

An in-place deployment runs the risk of downtime or capacity reduction, whereas a blue/green deployment isolates the new version and ensures the old version remains healthy until traffic is shifted.

Select the appropriate mechanism to automate rollback based on post-deployment errors.

Associate CloudWatch alarms monitoring application health and error rates with the CodeDeploy deployment group.

AWS CodeDeploy natively integrates with CloudWatch alarms to monitor deployments. If an alarm fires during the deployment or during the bake time, CodeDeploy will automatically roll back traffic to the blue environment, minimizing the blast radius.

Exclude incompatible configuration settings.

Identify that the LambdaLinear deployment configuration is invalid for EC2 deployments, and that setting MinInstancesInService to 0 causes complete application downtime.

Only deployment configurations compatible with EC2/On-premises can be used, and the minimum instances in service must be maintained to satisfy the zero-downtime mandate.

Anahtar Kavram

Designing a reliable blue/green deployment strategy for Amazon EC2 Auto Scaling groups using AWS CodeDeploy, including automated rollbacks via CloudWatch alarms.

Soru 1914Soru →

A telecommunications company is designing a new real-time network fault monitoring system on AWS. The application will be deployed across two AWS Regions: `us-west-2` (Primary) and `us-east-1` (Secondary). The architecture requires an active-passive disaster recovery strategy with a Recovery Time Objective (RTO) of $\leq 5$ minutes and a Recovery Point Objective (RPO) of $\leq 1$ minute. The application runs on Amazon EC2 instances in private subnets, which must regularly connect to external diagnostic probes on the internet. For internal service communication, microservices rely on a shared Route 53 Private Hosted Zone named `corp.internal`. Which of the following architectures meets these requirements while minimizing regional failover time and ensuring high availability within each Region?

Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. In each VPC, deploy a single NAT Gateway in one Availability Zone to optimize costs, and route all outbound private subnet traffic through it. Associate the Route 53 Private Hosted Zone corp.internal with the VPCs in both Regions. Use Route 53 Application Recovery Controller (ARC) routing controls to manage regional traffic failover.

Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. In both VPCs, deploy a NAT Gateway in each Availability Zone. Associate the Route 53 Private Hosted Zone corp.internal with the VPCs in both Regions. Use Route 53 Application Recovery Controller (ARC) routing controls to manage traffic redirection between Regions.

Deploy Amazon RDS PostgreSQL Multi-AZ in us-west-2 with a cross-region read replica in us-east-1. In both VPCs, deploy a NAT Gateway in each Availability Zone. Associate the Route 53 Private Hosted Zone corp.internal with both VPCs. Use Route 53 Failover routing policies to route traffic. During a regional outage, manually promote the read replica to a standalone database and update Route 53.

Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. In both VPCs, deploy a NAT Gateway in each Availability Zone. Create the Route 53 Private Hosted Zone corp.internal and associate it only with the us-west-2 VPC. Use Route 53 Application Recovery Controller (ARC) routing controls to manage regional traffic failover.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. In both VPCs, deploy a NAT Gateway in each Availability Zone. Associate the Route 53 Private Hosted Zone corp.internal with the VPCs in both Regions. Use Route 53 Application Recovery Controller (ARC) routing controls to manage traffic redirection between Regions.

Cevap

The correct architecture uses Amazon Aurora Global Database for database replication, deploys a NAT Gateway in each Availability Zone of both VPCs, associates the Route 53 Private Hosted Zone corp.internal with both VPCs, and implements Route 53 Application Recovery Controller (ARC) routing controls for multi-region failover.

The correct architecture leverages Amazon Aurora Global Database, which replicates data with sub-second latency to meet the

1

-minute RPO and can be promoted via managed failover in under a minute to satisfy the

5

-minute RTO. A NAT Gateway in each Availability Zone of both VPCs guarantees redundant internet egress, and associating the Route 53 Private Hosted Zone corp.internal with both VPCs ensures that internal services can resolve names before and after a regional failover. Route 53 ARC controls allow for rapid, deterministic routing changes.

Adım Adım Çözüm

Evaluate the database replication strategy against RTO and RPO constraints.

Amazon Aurora Global Database provides typical replication lag of less than

1

second (satisfying the

1

-minute RPO) and supports managed failover that promotes the secondary region in less than

1

minute (satisfying the

5

-minute RTO). Amazon RDS with manual read replica promotion cannot reliably meet the

5

-minute RTO.

Choosing the correct disaster recovery pattern is critical to meet the strict RTO and RPO targets.

Examine internal DNS configuration across VPCs.

A Route 53 Private Hosted Zone (PHZ) must be explicitly associated with the VPCs in both Regions to allow resources in either Region to resolve the internal domain names.

Failing to associate the PHZ with the secondary VPC results in name resolution failures when traffic shifts to the secondary region.

Ensure outbound connectivity redundancy within each Region.

Deploying a NAT Gateway in each Availability Zone of both VPCs prevents a single AZ outage from interrupting outbound internet communication to the diagnostic probes.

Using a single NAT Gateway per Region creates a single point of failure, violating local high-availability requirements.

Anahtar Kavram

High Availability and Disaster Recovery Design for Multi-Region Architectures

Soru 1915Soru →

An enterprise is migrating its legacy on-premises VMware vSphere workloads to a Multi-AZ VMware Cloud on AWS (VMC on AWS) SDDC. The SDDC is connected to the on-premises data center via AWS Direct Connect using a Direct Connect Gateway (DXGW) attached to a VMware Transit Connect (vTGW). The enterprise is using VMware HCX to extend several on-premises L2 VLANs to the SDDC.

During the migration, virtual machines (VMs) are moved using HCX Replication-Assisted vMotion (RAV). A set of migrated VMs on an extended network segment needs to communicate with database servers remaining on-premises that reside on a non-extended subnet. The network team reports that traffic from the migrated VMs to the on-premises database servers is experiencing high latency and routing loops. Diagnostics show that packets from the migrated VMs are traversing the HCX Network Extension (L2 path) back to the on-premises default gateway and then to the database servers, while return traffic is routing over the Direct Connect path.

Which solution will resolve the routing inefficiency and ensure optimal bidirectional path routing between the migrated VMs and the on-premises database servers?

Create a Route 53 Private Hosted Zone (PHZ) containing the database domain names and associate it with both the VMC on AWS SDDC VPC and the customer-managed VPC. Configure Route 53 Inbound and Outbound Resolvers to route database traffic directly over the Direct Connect connection.

Create an AWS Transit Gateway in the customer-managed AWS account, attach it to the VMware Transit Connect using a Transit Gateway Peering attachment, and configure static routing on the DXGW to forward the /32 host routes of the migrated VMs to the on-premises router.

Enable Proximity Routing in the HCX Network Extension configuration. In the VMware Cloud on AWS console, configure Route Redistribution under the Transit Connect settings to enable the redistribution of HCX host routes (/32) to the Direct Connect Gateway. Ensure that the on-premises router is configured to accept and prioritize these host routes over the extended network's summary route.

Configure a policy-based VPN between the HCX appliances to bypass the Direct Connect connection for data replication and live migration traffic. Implement an active-passive DNS routing policy using Route 53 to redirect database queries to a replicated standby database in a native AWS VPC.

Cevabı ve açıklamayı göster

Cevap: Enable Proximity Routing in the HCX Network Extension configuration. In the VMware Cloud on AWS console, configure Route Redistribution under the Transit Connect settings to enable the redistribution of HCX host routes (/32) to the Direct Connect Gateway. Ensure that the on-premises router is configured to accept and prioritize these host routes over the extended network's summary route.

Cevap

The correct solution is to enable Proximity Routing in the HCX Network Extension configuration, and configure Route Redistribution under the Transit Connect settings in the VMware Cloud on AWS console to enable the redistribution of HCX host routes (/32) to the Direct Connect Gateway.

The correct solution involves enabling Proximity Routing in the HCX Network Extension. When Proximity Routing is enabled, the HCX appliance in the SDDC intercepts traffic from migrated VMs destined for non-extended subnets and redirects it to the SDDC routing path. To ensure bidirectional routing, the SDDC Tier-0 router must advertise /32 host routes of the migrated VMs to the on-premises router. This requires configuring Route Redistribution under the Transit Connect settings in the VMware Cloud on AWS console to propagate HCX host routes to the Direct Connect Gateway, and ensuring that the on-premises router prioritizes these specific host routes.

Adım Adım Çözüm

Analyze the traffic flow and routing behavior between the migrated VMs (on the extended network) and the on-premises database servers (on a non-extended network).

Identify that outgoing traffic is hairpining through the L2 extended network, while return traffic is using the Direct Connect routed path, causing asymmetrical routing and high latency.

By default, the migrated VMs use their on-premises default gateway for all off-subnet traffic, which pulls packets back across the L2 extended network.

Enable HCX Proximity Routing on the extended network segment.

The SDDC HCX Network Extension appliance intercepts outgoing traffic destined for non-extended subnets and forwards it locally to the SDDC Tier-1/Tier-0 routing path.

Proximity Routing redirects traffic locally so that outgoing packets can utilize the low-latency Direct Connect routed path instead of crossing the L2 extension.

Configure Route Redistribution in the VMware Cloud on AWS SDDC console for Transit Connect.

Enable the redistribution of HCX host routes (/32) to propagate the individual host routes of migrated VMs to the Direct Connect Gateway (DXGW) and the on-premises router.

The on-premises router must receive these /32 host routes to know that the migrated VMs are located in the SDDC, ensuring return traffic is routed back via Direct Connect instead of the L2 extended network.

Anahtar Kavram

Ensuring optimal bidirectional routing for VMs migrated to VMware Cloud on AWS on extended L2 segments using HCX Proximity Routing and VMC route redistribution.

Soru 1916Soru →

A utility enterprise is modernizing its legacy smart meter telemetry ingestion backend to a serverless architecture on AWS. The solution must ingest bursty, real-time meter readings via an Amazon API Gateway endpoint and process them using an AWS Lambda function. The API Gateway endpoint must only be accessible privately from the enterprise's on-premises network via an AWS Direct Connect connection. The processed data is then stored in an Amazon RDS for PostgreSQL database in a private subnet. The database requires highly resilient connection management to prevent connection exhaustion during peak traffic times. Additionally, the ingestion workload must be configured so that it does not exhaust the regional execution pool and throttle critical downstream customer billing and payment Lambda functions. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy a private API Gateway endpoint using an interface VPC endpoint, and configure an Amazon RDS Proxy between the telemetry processing Lambda function and the RDS for PostgreSQL database.

Configure reserved concurrency on the telemetry processing Lambda function to limit its maximum concurrent executions, preventing it from consuming the entire regional concurrency pool.

Configure the telemetry processing Lambda function inside a private subnet, and route all outbound database traffic through a single NAT Gateway deployed in a single Availability Zone.

Store the database credentials in AWS Secrets Manager, encrypt them using the default AWS-managed KMS key, and configure the KMS key policy to grant decryption permissions to the Lambda function's IAM role.

Increase the default unreserved concurrency limit of the AWS account and configure provisioned concurrency on the customer billing and payment Lambda functions to absorb telemetry-induced bursts.

Cevabı ve açıklamayı göster

Cevap: Deploy a private API Gateway endpoint using an interface VPC endpoint, and configure an Amazon RDS Proxy between the telemetry processing Lambda function and the RDS for PostgreSQL database.; Configure reserved concurrency on the telemetry processing Lambda function to limit its maximum concurrent executions, preventing it from consuming the entire regional concurrency pool.

Cevap

Deploy a private API Gateway endpoint using an interface VPC endpoint, configure an Amazon RDS Proxy between the telemetry processing Lambda function and the RDS database, and configure reserved concurrency on the telemetry processing Lambda function to limit its execution rate.

The correct answer combination involves deploying a private API Gateway with an interface VPC endpoint and RDS Proxy, and setting reserved concurrency on the telemetry function. The private API Gateway ensures that traffic from the on-premises network via AWS Direct Connect remains private. Amazon RDS Proxy pools connections to prevent connection exhaustion at the database layer. Configuring reserved concurrency on the telemetry Lambda function sets a concurrency ceiling, guaranteeing that the remaining regional concurrency is preserved for downstream payment and billing functions.

Adım Adım Çözüm

Analyze private API connectivity requirements.

Identify that a private API Gateway combined with an interface VPC endpoint (AWS PrivateLink) allows the on-premises network to securely route traffic to API Gateway via AWS Direct Connect without traversing the public internet.

Meets the requirement for the API Gateway endpoint to be privately accessible from the corporate network.

Address database connection resiliency.

Determine that Amazon RDS Proxy should be placed between the Lambda function and the PostgreSQL database to pool and share database connections.

Prevents connection exhaustion on the RDS instance caused by highly concurrent Lambda scale-out events.

Design concurrency controls to protect neighboring workloads.

Apply reserved concurrency to the high-volume, bursty telemetry Lambda function.

Configuring reserved concurrency isolates the function's scale-out capacity, leaving the remaining regional account pool available for other critical functions like payment and billing.

Anahtar Kavram

Serverless architectural integration patterns using API Gateway private endpoints, RDS database connection pooling via RDS Proxy, and concurrency isolation via Lambda reserved concurrency.

Soru 1917Soru →

A financial institution is launching a new mobile banking application. During a scheduled national marketing campaign, the application expects a sudden, massive spike in traffic, transitioning from a baseline of $3,000$ requests per second (RPS) to a peak of $120,000$ RPS within a few minutes. The application's backend runs on Amazon ECS tasks using AWS Fargate, and uses an Amazon Aurora PostgreSQL database for transaction history. Which two actions should a solutions architect recommend to ensure the platform scales and maintains performance during the launch? (Select TWO.)

Geçerli olan tümünü seçin

Contact AWS Support to pre-warm the Application Load Balancer to the expected traffic volume of

120,000

RPS.

Configure scheduled scaling policies for the Amazon ECS service to scale out Fargate tasks to the anticipated peak capacity before the campaign begins.

Rely on the Application Load Balancer's automatic scaling to absorb the initial spike, and configure ECS target tracking policies based on CPU utilization to handle task scaling.

Configure Aurora Auto Scaling to dynamically add reader instances during the traffic spike to handle the surge in write transactions.

Enable Aurora Multi-AZ standby replication and configure the application to load-balance write operations between the primary instance and the standby instance.

Cevabı ve açıklamayı göster

Cevap: Contact AWS Support to pre-warm the Application Load Balancer to the expected traffic volume of $120,000$ RPS.; Configure scheduled scaling policies for the Amazon ECS service to scale out Fargate tasks to the anticipated peak capacity before the campaign begins.

Cevap

Contact AWS Support to pre-warm the Application Load Balancer to the expected traffic volume, and configure scheduled scaling policies for the Amazon ECS service to scale out Fargate tasks to the anticipated peak capacity before the campaign begins.

For predictable flash traffic spikes of this magnitude, standard reactive scaling is insufficient. The Application Load Balancer must be pre-warmed by contacting AWS Support to prevent dropped connections during the rapid increase. Similarly, the Amazon ECS service must use scheduled scaling policies to pre-provision Fargate tasks ahead of time, ensuring sufficient compute capacity is online when the traffic arrives.

Adım Adım Çözüm

Analyze the traffic profile and determine the scaling requirements.

The traffic increases from 3,000 RPS to 120,000 RPS (a 40x increase) in a few minutes, which constitutes flash traffic.

Standard reactive scaling mechanisms for ALBs and ECS tasks are too slow to cope with this rate of increase.

Address the entry point scaling (Load Balancing).

Requesting ELB pre-warming from AWS Support ensures the ALB is pre-provisioned with the capacity to handle 120,000 RPS.

Without pre-warming, the ALB will drop connections while attempting to scale out reactively.

Address the compute layer scaling (ECS/Fargate).

Create scheduled scaling policies to scale the ECS service's task count to the anticipated peak level before the event starts.

Scheduled scaling ensures compute capacity is ready immediately when the campaign begins, avoiding cold-start latency and delayed reaction times of target tracking policies.

Anahtar Kavram

Handling sudden, predictable flash traffic spikes requires proactive pre-provisioning (ELB pre-warming and scheduled scaling for compute layers) rather than relying on reactive auto-scaling.

Tahmini Süre:2m 0s

Soru 1918Soru →

A solutions architect is designing a new high-frequency transaction processing application that requires a relational database. The database must support an unpredictable read workload that surges during marketing campaigns, needing auto-scaling read capacity. Additionally, the system must achieve high availability with an automatic failover recovery time objective (RTO) of less than 30 seconds. Which database and storage strategy meets these requirements with the least operational overhead?

Deploy an Amazon Aurora PostgreSQL DB cluster with a primary instance and an Aurora Replica in a different Availability Zone. Configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ deployment. Configure the standby DB instance to serve read traffic during high CPU utilization, and enable RDS storage auto-scaling.

Deploy a Single-AZ Amazon RDS for PostgreSQL DB instance. Configure cross-Region read replicas, and implement a script that manually promotes a replica to primary and updates application connection strings when the primary instance fails.

Deploy an Amazon Aurora PostgreSQL DB cluster in a Multi-AZ configuration encrypted with the AWS-managed KMS key (aws/rds). Share the database snapshots with a separate security audit account by modifying the key policy of the AWS-managed KMS key to delegate cross-account access.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora PostgreSQL DB cluster with a primary instance and an Aurora Replica in a different Availability Zone. Configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Cevap

The correct strategy uses Amazon Aurora PostgreSQL with an Aurora Replica in another Availability Zone. This architecture ensures high availability with automatic failover (typically completed within 30 seconds) and scales read operations dynamically using Aurora Auto Scaling based on target CPU utilization metrics.

Adım Adım Çözüm

Analyze high availability and failover requirements.

An RTO of less than 30 seconds requires an automated failover mechanism. Amazon Aurora DB clusters automatically fail over to an existing replica in a different Availability Zone within 30 seconds, whereas Amazon RDS Multi-AZ failovers can take 1-2 minutes.

Ensures the database strategy matches the strict RTO target.

Analyze read scaling requirements.

Unpredictable read workloads require horizontal read scaling. Aurora Replicas can handle read queries, and Aurora Auto Scaling dynamically provisions and terminates replicas based on CPU utilization target tracking.

Allows the architecture to handle surges in read traffic automatically.

Validate security and integration constraints.

The correct strategy must utilize Customer Managed Keys (CMKs) if cross-account sharing is needed, but for the basic setup, deploying Aurora with Aurora Auto Scaling is the only choice that satisfies both high availability failover and dynamic read scaling without custom scripting.

Confirms the operational feasibility and compliance of the chosen option.

Anahtar Kavram

Amazon Aurora provides rapid automated failover to replicas and supports dynamic horizontal scaling of read capacity via Aurora Auto Scaling, whereas standard RDS standby instances cannot serve read traffic.

Tahmini Süre:2m 0s

Soru 1919Soru →

An enterprise manages multiple AWS accounts under AWS Organizations and has configured federation with an on-premises SAML 2.0 Identity Provider (IdP). Internal database administrators (DBAs) successfully authenticate with the IdP but receive an access denied error when attempting to assume the cross-account DBA role in target member accounts. A review of the configuration shows that the SAML provider object has been created in each target account. What configuration modification must the Solutions Architect apply to the target accounts to resolve this issue?

Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRole' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.

Create and attach a Service Control Policy (SCP) to the target accounts' Organizational Unit that explicitly grants 'sts:AssumeRole' permission to the SAML provider ARN.

Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.

Update the IAM role trust policy in the target accounts to specify 'sts:AssumeRoleWithWebIdentity' as the Action and use the identity provider's external metadata URL directly in the Principal block.

Cevabı ve açıklamayı göster

Cevap: Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.

Cevap

The correct configuration for SAML 2.0 federation requires the IAM role trust policy in the target account to list the SAML provider's ARN as the federated principal, specify the 'sts:AssumeRoleWithSAML' action, and validate the audience attribute ('SAML:aud') to point to the AWS SAML endpoint.

Adım Adım Çözüm

Identify the authentication and authorization mechanism in use.

The scenario describes SAML 2.0 federation where users authenticate at an external IdP and receive a SAML assertion to assume an IAM role in target AWS accounts.

This establishes that the target role's trust policy must allow federation via SAML.

Determine the required API action and principal for SAML 2.0 federation trust policies.

SAML-based federation requires the 'sts:AssumeRoleWithSAML' action and must trust the SAML provider ARN created in the target account.

Standard 'sts:AssumeRole' is for AWS IAM principals, and 'sts:AssumeRoleWithWebIdentity' is for OIDC providers.

Validate required conditions for SAML trust relationships.

A condition block must verify that the 'SAML:aud' (audience) attribute matches the AWS SAML endpoint 'https://signin.aws.amazon.com/saml'.

This prevents unauthorized endpoints from initiating session requests using the SAML assertion.

Anahtar Kavram

SAML 2.0 Multi-Account Federation IAM Trust Policies

Tahmini Süre:2m 0s

Soru 1920Soru →

A software-as-a-service (SaaS) provider is migrating its multi-tier backend application from an on-premises hypervisor to AWS using AWS Application Migration Service (MGN). The hybrid network architecture includes a $1\text{ Gbps}$ AWS Direct Connect connection that terminates at an AWS Transit Gateway in a shared services account. The replication staging area is set up in a dedicated VPC. After installing the AWS MGN Replication Agent on the on-premises source servers, the network administrator reports that while the control plane communication over HTTPS (port 443) is successful, the replication status remains permanently stalled. Which of the following is the most likely cause of this issue?

The Route 53 Private Hosted Zone for the MGN service endpoints has not been associated with the staging area VPC, causing the replication agents to fail to resolve the target replication server DNS names.

The Transit Gateway route tables lack a route for the staging area subnet's CIDR block pointing back to the customer gateway, preventing the return path for the replication traffic.

The security group associated with the replication servers in the staging area subnet does not permit inbound traffic on TCP port 1500 from the on-premises network range.

The staging area VPC routes outbound replication data through a non-redundant NAT Gateway in a single Availability Zone, which has failed and terminated the replication channel.

Cevabı ve açıklamayı göster

Cevap: The security group associated with the replication servers in the staging area subnet does not permit inbound traffic on TCP port 1500 from the on-premises network range.

Cevap

The security group associated with the replication servers in the staging area subnet does not permit inbound traffic on TCP port 1500 from the on-premises network range.

The correct option is correct because AWS Application Migration Service (MGN) uses TCP port 1500 for replication data transit. While the control plane uses HTTPS (port 443) for management, the actual block-level replication stream requires TCP port 1500 to be open from the source replication agent to the replication servers in the staging area. Blocking this port prevents replication from initiating.

Adım Adım Çözüm

Analyze the network configuration and ports used by AWS Application Migration Service (MGN).

Identify that MGN uses two primary communication channels: HTTPS (port 443) for control plane orchestration, and TCP port 1500 for block-level data replication.

To determine which port failure aligns with the symptom of successful control plane traffic but stalled data replication.

Evaluate the current network connectivity status described in the scenario.

Control plane communication is functional over HTTPS (port 443), proving that general routing, DNS, and Transit Gateway connectivity are operational.

To rule out complete routing issues or basic DNS resolution failures.

Diagnose the cause of the stalled data replication.

The block-level replication traffic over TCP port 1500 is blocked at the staging area's security groups or firewall, preventing the replication servers from receiving data.

To identify the specific security group misconfiguration blocking TCP port 1500.

Anahtar Kavram

AWS MGN Data Replication Port Requirements

Tahmini Süre:2m 0s

ÖncekiSayfa 96 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram