Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company's Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.
The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show...
Scenario Overview:
The company is facing performance bottlenecks on both the API servers (EC2 instances) and the database (RDS MySQL DB instance), resulting in high write latency and API server overload. The company is expecting an increase in the number of IoT sensors, and a scalable, cost-efficient solution is required.
Key Factors for the Solution:
- Scalability: The solution must handle future growth as new sensors are added.
- Cost-efficiency: The solution should remain cost-effective as the company grows.
- Resolving Latency and Overload: The solution must address both the database performance and the API server bottleneck.
Option Analysis:
Option A: Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume's IOPS.
- Reason for Rejection: While this might improve the storage capacity, General Purpose SSD (gp2) has a fixed baseline IOPS-to-storage ratio. Increasing the storage size may improve throughput but will not solve high write latency as gp2 is not optimized for high throughput or low latency. This is not a long-term scalable solution for high-write workloads.
Option B: Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas.
- Reason for Selection: Amazon Aurora is a fully managed relational database optimized for high performance, with automatic scaling and greater availability. Aurora is significantly more scalable than MySQL on RDS and can handle high write throughput and low-latency read replicas. This solves the database performance issues and prepares the platform for future growth. Aurora's storage automatically scales as needed, and its high throughput helps handle IoT sensor data more efficiently.
- Additional Benefit: Aurora offers better performance and can easily scale without manual intervention as the sensor count grows.
Option C: Leverage Amazon Kinesis Data Streams and AWS La...
Author: Ava · Last updated Jul 6, 2026
A company is building an electronic document management system in which users upload their documents. The application stack is entirely serverless and runs on AWS in the eu-central-1 Region. The system includes a web application that uses an Amazon CloudFront distribution for delivery with Amazon S3 as the origin. The web application communicates with Amazon API Gateway Regional endpoints. The API Gateway APIs call AWS Lambda functions that store metadata in an Amazon Aurora Serverless database and put the documents into an S3 bu...
To improve latency outside of Europe, we need to focus on optimizing the application's performance globally, ensuring quick access to resources from locations far from the eu-central-1 region. Here's the evaluation of the options based on this need:
A) Enable S3 Transfer Acceleration on the S3 bucket. Ensure that the web application uses the Transfer Acceleration signed URLs.
- Why this option is good: S3 Transfer Acceleration uses Amazon CloudFront's globally distributed edge locations to accelerate data transfers to and from the S3 bucket. This would help improve the upload and download performance for users located far from the European region, which is especially beneficial for large file uploads and access in remote locations.
- Why other options are not ideal: This option addresses the S3 data transfer specifically, making it ideal for improving performance for users globally without overhauling the entire infrastructure. It directly benefits document uploads and downloads.
- Ideal for: Improving S3 performance (uploads and downloads) for global users.
B) Create an accelerator in AWS Global Accelerator. Attach the accelerator to the CloudFront distribution.
- Why this option is good: AWS Global Accelerator improves the performance of your application by routing traffic to the nearest AWS edge location. By using Global Accelerator in combination with CloudFront, the user's requests are optimized for the nearest available endpoint, which reduces latency for users outside Europe. It directs traffic to the optimal CloudFront distribution, speeding up requests.
- Why other options are not ideal: This option focuses on improving the overall performance of CloudFront by optimizing network routing globally. It’s ideal for reducing latency for users accessing the web application.
- Ideal for: Optimizing the delivery of the web application and related content globally.
C) Change the API Gateway Regional endpoints to edge-optimized endpoints.
- Why this option is not ideal: Edge-optimized API Gateway endpoints route traffic through CloudFront, but the primary benefit here is for APIs, and it’s a good fit if the API calls are ...
Author: Aarav · Last updated Jul 6, 2026
An adventure company has launched a new feature on its mobile app. Users can use the feature to upload their hiking and rafting photos and videos anytime. The photos and videos are stored in Amazon S3 Standard storage in an S3 bucket and are served through Amazon CloudFront.
The company needs to optimize the cost of the storage. A solutions architect discovers that most of the uploaded photos and videos are accessed infrequently after 30 days. However, some of the uploaded photos and videos are accessed frequent...
To meet the requirements of optimizing storage costs while maintaining millisecond retrieval availability, let’s analyze each option:
A) Configure S3 Intelligent-Tiering on the S3 bucket.
- Reasoning: S3 Intelligent-Tiering automatically moves objects between two access tiers (frequent and infrequent access) based on usage patterns. For objects that are accessed infrequently (after 30 days), S3 Intelligent-Tiering would move them to the Infrequent Access (IA) tier, while frequently accessed objects remain in the Frequent Access tier. This offers cost optimization while maintaining low-latency access for all objects.
- Use case: This option is well-suited for cases where objects' access patterns change over time, especially when some files are accessed frequently, and others are accessed infrequently.
- Conclusion: This is the most cost-effective solution that allows millisecond retrieval and optimizes storage cost based on usage patterns. The objects are automatically moved between storage classes, maintaining cost efficiency while ensuring that frequently accessed objects are still readily available.
B) Configure an S3 Lifecycle policy to transition image objects and video objects from S3 Standard to S3 Glacier Deep Archive after 30 days.
- Reasoning: Glacier Deep Archive is extremely cost-efficient for long-term storage of rarely accessed data, but the retrieval time can be hours or even longer, making it unsuitable for the required millisecond retrieval time. While it could save on storage costs, it wouldn't provide the low-latency access that is needed.
- Use case: This would be suitable for data that is rarely accessed and can tolerate hours-long retrieval times. However, it is not a good fit for photos and videos that need millisecond retrieval, even if accessed infrequently.
- Conclusion: This option would significantly increase retrieval times and does not meet the requirement for maintaining millisecond retr...
Author: VenomousSerpent42 · Last updated Jul 6, 2026
A company uses Amazon S3 to store files and images in a variety of storage classes. The company's S3 costs have increased substantially during the past year.
A solutions architect needs to review data trends for the past 12 months and ...
Let's evaluate the available options to determine the best solution for analyzing the S3 usage trends and identifying the appropriate storage classes.
A) Download AWS Cost and Usage Reports for the last 12 months of S3 usage. Review AWS Trusted Advisor recommendations for cost savings.
- Reasoning: AWS Cost and Usage Reports can provide detailed information about the costs and usage patterns of AWS services, including S3. However, while this will give you insight into costs, it does not specifically focus on analyzing the access patterns or storage classes of S3 objects. AWS Trusted Advisor offers general recommendations for cost savings, but it does not provide detailed insight into how specific S3 storage classes are being used.
- Use case: This solution can help identify overall cost patterns but lacks the granularity to identify the most appropriate storage class for objects based on access patterns.
- Conclusion: While helpful for high-level cost analysis, it doesn’t address the requirement to review data trends for appropriate storage class selection.
B) Use S3 storage class analysis. Import data trends into an Amazon QuickSight dashboard to analyze storage trends.
- Reasoning: S3 Storage Class Analysis helps identify infrequently accessed objects and determine if transitioning them to more cost-effective storage classes (like S3 Infrequent Access or S3 Glacier) would save costs. This solution gives detailed insights into object access patterns, allowing the company to optimize storage costs by selecting the appropriate storage class based on usage patterns. Importing data into Amazon QuickSight can provide rich visualizations for analyzing the data trends.
- Use case: This is the best approach for identifying trends in data access and selecting the appropriate storage classes based on how often objects are accessed. It's particularly useful for cost optimization in storage.
- Conclusion: This solution directly addresses the need to review access trends and make decisions about the most appropriate S3 storage classes based on usage.
C) Use Amazon ...
Author: Olivia Johnson · Last updated Jul 6, 2026
A company has its cloud infrastructure on AWS. A solutions architect needs to define the infrastructure as code. The infrastructure is currently deployed in one AWS Region. The company's business expansion plan includes deployments in multiple R...
To determine the best solution for defining infrastructure as code and managing deployments across multiple AWS Regions and accounts, let's evaluate each option:
A) Use AWS CloudFormation templates. Add IAM policies to control the various accounts, deploy the templates across the multiple Regions.
- Reasoning: AWS CloudFormation allows you to define infrastructure as code, but managing deployments across multiple accounts and Regions requires a more automated and scalable approach. While IAM policies can be used for access control, manually deploying CloudFormation templates across multiple accounts and Regions would be complex and error-prone without a centralized management solution. This approach lacks the necessary automation for managing deployments at scale.
- Use case: This solution could work for small-scale deployments but is not ideal for managing infrastructure across multiple Regions and accounts in a scalable, automated manner.
- Conclusion: This approach is less efficient for a multi-Region, multi-account deployment scenario and doesn't provide the necessary automation.
B) Use AWS Organizations. Deploy AWS CloudFormation templates from the management account. Use AWS Control Tower to manage deployments across accounts.
- Reasoning: AWS Organizations allows you to manage multiple AWS accounts under a single organization. AWS Control Tower provides governance and best practices for multi-account AWS environments, which includes managing resources across multiple accounts and Regions. However, while Control Tower simplifies governance, it doesn't directly address infrastructure deployment at the scale needed, particularly for defining and deploying infrastructure as code across Regions and accounts.
- Use case: AWS Control Tower is more focused on governance and setting up landing zones for accounts, but it is not primarily focused on automating deployments of infrastructure as code.
- Conclusion: This solution is useful for managing accounts but does not directly meet the requirement of automating infrastructure deployment across multiple Regions.
C) Use AWS Organizations and AWS CloudFormation StackSets. Deploy a CloudF...
Author: Aditya · Last updated Jul 6, 2026
A company has its cloud infrastructure on AWS. A solutions architect needs to define the infrastructure as code. The infrastructure is currently deployed in one AWS Region. The company's business expansion plan includes deployments in multiple R...
Let’s break down the options and choose the best solution for defining infrastructure as code and deploying it across multiple AWS Regions and accounts.
A) Use AWS CloudFormation templates. Add IAM policies to control the various accounts, Deploy the templates across the multiple Regions.
- Reasoning: AWS CloudFormation is a great tool for defining infrastructure as code. However, deploying CloudFormation templates across multiple accounts and Regions manually requires complex IAM policy management, which is error-prone and difficult to scale. Managing access control through IAM policies is cumbersome and does not provide the automation required for large-scale deployments.
- Use case: This solution might work for a single Region and limited accounts but is not scalable or automated enough for multi-Region, multi-account deployments.
- Conclusion: This approach is not ideal because it does not automate deployment across multiple Regions or accounts efficiently.
B) Use AWS Organizations. Deploy AWS CloudFormation templates from the management account. Use AWS Control Tower to manage deployments across accounts.
- Reasoning: AWS Organizations allows you to manage multiple AWS accounts centrally, and AWS Control Tower helps govern AWS environments by setting up landing zones and enforcing best practices. However, while Control Tower is useful for governance, it does not automate the deployment of infrastructure as code (i.e., CloudFormation templates) across multiple Regions and accounts. The focus is on account management, not on deploying infrastructure.
- Use case: AWS Control Tower is beneficial for setting up and managing environments with multiple accounts but does not directly address the infrastructure deployment aspect.
- Conclusion: This solution is useful for governance but does not solve the core requirement of deploying infrastructure as code across multiple accounts and Regions.
C) Use AWS Organizations and AWS CloudFormation StackSets. Deploy a Clo...
Author: Maya · Last updated Jul 6, 2026
A company plans to refactor a monolithic application into a modern application design deployed on AWS. The CI/CD pipeline needs to be upgraded to support the modern design for the application with the following requirements:
* It should allow changes to be released several times ever...
To determine the best solution for refactoring the monolithic application and supporting rapid CI/CD pipeline upgrades, we need to consider several factors:
1. Frequency of Deployment: The pipeline should support multiple deployments per hour. This means we need a solution that minimizes downtime and is efficient at rolling out updates quickly.
2. Rollback Capabilities: Quick rollback is necessary, meaning the solution should allow reverting to a previous version without significant manual intervention or downtime.
3. Scalability and Availability: The solution should ensure minimal disruption to the application’s availability while changes are being deployed.
4. Automation and Simplicity: The CI/CD pipeline should be as automated as possible to reduce manual efforts, and it should fit the modern AWS environment.
Option Analysis:
A) Deploy a CI/CD pipeline that incorporates AMIs to contain the application and their configurations. Deploy the application by replacing Amazon EC2 instances.
- Pros: AMIs (Amazon Machine Images) are good for capturing the entire state of the application and configuration, ensuring consistent deployments.
- Cons: Replacing EC2 instances may introduce significant downtime, as the deployment process is more rigid and might require restarting instances. It’s not ideal for fast, multiple deployments per hour. Rollbacks are possible but not as seamless.
- Reasoning: This approach is less efficient for the rapid deployment and rollback requirements and introduces possible downtime during the instance replacement process.
B) Specify AWS Elastic Beanstalk to stage in a secondary environment as the deployment target for the CI/CD pipeline of the application. To deploy, swap the staging and production environment URLs.
- Pros: Elastic Beanstalk provides managed deployment and scaling services. It has built-in support for blue/green deployment, allowing for quick swaps between staging and production environments, which is ideal for rapid releases and rollbacks.
- Cons: While it provides excellent automation for many use cases, it may not be flexible enough for very custom requirements or specific monolithic application configurations that don’t fit Elastic Beanstalk's model well.
- Reasoning: This is a good solution for rapid deployment and quick rollback. It's also suitable for ...
Author: Matthew · Last updated Jul 6, 2026
A company has an application that runs on Amazon EC2 instances. A solutions architect is designing VPC infrastructure in an AWS Region where the application needs to access an Amazon Aurora DB Cluster. The EC2 instances are all associated with the same security group. The DB cluster is associated with its own security group.
The solutions architect needs to add rules to the ...
To provide the application running on Amazon EC2 instances with least privilege access to the Amazon Aurora DB Cluster, the solution needs to ensure that the EC2 instances can connect to the DB cluster while adhering to the principle of least privilege. This means we need to carefully control which traffic is allowed based on security group rules, using source and destination security groups in the right way.
Key Factors to Consider:
- Security groups are stateful: Inbound traffic is only allowed if an outbound rule exists to allow the response, and vice versa. This needs to be taken into account when configuring both inbound and outbound rules.
- Aurora DB Cluster Port: Aurora typically uses port 3306 for MySQL-compatible databases and 5432 for PostgreSQL-compatible databases, which is the port we will consider here for establishing the connection between EC2 instances and the Aurora DB Cluster.
- Least privilege: We should only allow access where necessary, meaning the EC2 instances should be allowed to initiate connections to the Aurora DB Cluster, but the DB cluster should not allow inbound traffic from just any source.
Option Analysis:
A) Add an inbound rule to the EC2 instances' security group. Specify the DB cluster's security group as the source over the default Aurora port.
- Pros: This is a correct approach for allowing the EC2 instances to communicate with the Aurora DB Cluster. By specifying the Aurora DB Cluster's security group as the source, the EC2 instances will be able to send traffic to the DB cluster over the default port.
- Cons: The inbound rule is typically associated with the DB cluster's security group, not the EC2 instance’s security group. Adding this rule to the EC2 instances’ security group would not directly control access to the DB cluster.
- Reasoning: This option is not entirely correct because inbound rules on the EC2 instance’s security group don’t control access to the DB cluster directly; those rules should be applied to the DB cluster's security group instead.
B) Add an outbound rule to the EC2 instances' security group. Specify the DB cluster's security group as the destination over the default Aurora port.
- Pros: This option allows the EC2 instances to initiate outbound traffic to the DB cluster over the required port. Security groups are stateful, so an outbound rule here will ensure that the EC2 instances can send traffic to the DB cluster.
- Cons: Outbound rules on EC2 instances are generally not needed unless specific restrictions are required. By default, security groups allow all outbound traffic, so this rule is often redundant unless more restrictive outbound traffi...
Author: Maya · Last updated Jul 6, 2026
A company wants to change its internal cloud billing strategy for each of its business units. Currently, the cloud governance team shares reports for overall cloud spending with the head of each business unit. The company uses AWS Organizations to manage the separate AWS accounts for each business unit. The existing tagging standard in Organizations includes the application, environment, and owner. The cloud governance team wants a centralized solution so each business unit receives m...
To solve the problem of providing business units with centralized reports on cloud spending and notifications when a budget threshold is exceeded, we need to ensure that the solution is cost-effective, centralized, and automated. Let's break down each option to determine which is the best solution.
Key Requirements:
1. Centralized solution: The cloud governance team wants to manage the solution centrally, reducing the administrative overhead of managing separate solutions for each account.
2. Monthly reports: Each business unit needs a report detailing its cloud spending.
3. Budget alerts: Notifications are required for any spending exceeding a set threshold.
4. Cost-effectiveness: The solution should minimize costs while meeting the requirements.
Option Analysis:
A) Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner. Add each business unit to an Amazon SNS topic for each alert. Use Cost Explorer in each account to create monthly reports for each business unit.
- Pros:
- AWS Budgets can be configured in each individual account, which allows for detailed control over spending thresholds by business unit.
- Alerts can be customized using SNS and sent to business unit stakeholders.
- Cost Explorer provides a good reporting tool within each account.
- Cons:
- Managing AWS Budgets and alerts in each individual account can create overhead for the governance team, as it requires setting up and maintaining separate budgets in each account.
- This method does not offer centralized management, which increases administrative burden and complexity.
B) Configure AWS Budgets in the organization's management account and configure budget alerts that are grouped by application, environment, and owner. Add each business unit to an Amazon SNS topic for each alert. Use Cost Explorer in the organization's management account to create monthly reports for each business unit.
- Pros:
- Centralized management: Configuring AWS Budgets in the organization's management account allows for centralized control over all budget settings, reducing administrative overhead.
- Reports and alerts can be customized for each business unit using Cost Explorer and SNS, as each business unit can be added to the appropriate SNS topics.
- Cost Explorer at the management level allows for consolidated reporting across all accounts.
- Cons:
- While c...
Author: John · Last updated Jul 6, 2026
A company is using AWS CloudFormation to deploy its infrastructure. The company is concerned that, if a production CloudFormation stack is deleted, important data stored in Amazon RDS databases or Amazon EBS volumes might al...
The primary concern here is preventing accidental deletion of important data in Amazon RDS databases and Amazon EBS volumes if the production CloudFormation stack is deleted. To address this, the company needs a mechanism to protect these resources from being deleted during stack deletion.
Key Considerations:
- CloudFormation's behavior: By default, when a stack is deleted, it will delete the resources it provisions unless there are protections in place.
- Protection mechanisms: The solution should focus on ensuring that RDS and EBS resources are preserved, even if the associated CloudFormation stack is deleted.
Option Analysis:
A) Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.
- Pros:
- The DeletionPolicy attribute can be set to Retain, which ensures that Amazon RDS and EBS resources are not deleted when the stack is deleted.
- This method directly addresses the concern of accidental deletion during CloudFormation stack deletion by preventing the removal of the resources.
- Cons:
- This solution requires modifying the CloudFormation templates to explicitly define the DeletionPolicy for each resource.
- This works well for resources created through CloudFormation, but doesn't cover cases where resources might be manually created or modified outside of CloudFormation.
B) Configure a stack policy that disallows the deletion of RDS and EBS resources.
- Pros:
- Stack policies are used to control actions that can be performed on the resources within the stack.
- Cons:
- Stack policies typically govern update actions on resources during stack updates, but they don't directly ...
Author: Mia · Last updated Jul 6, 2026
A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.
A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet...
To analyze whether the traffic represents unsolicited inbound connections from the internet, the solutions architect should review VPC flow logs for traffic going through the NAT gateway and reaching the private EC2 instance. Since the VPC CIDR block starts with 203.0, it indicates that the destination IP (private EC2 instance) belongs to the 203.0.0.0/16 range. The incoming traffic is from the public IP 198.51.100.2, so the solutions architect needs to verify if this traffic is legitimate or unsolicited.
Evaluation of Options:
A) Open the AWS CloudTrail console. Select the log group that contains the NAT gateway's elastic network interface and the private instance's elastic network interface. Run a query to filter with the destination address set as "like 203.0" and the source address set as "like 198.51.100.2". Run the stats command to filter the sum of bytes transferred by the source address and the destination address.
- Why rejected: AWS CloudTrail logs are typically used for tracking AWS API calls and events, such as changes to configurations or resource creation. VPC flow logs (rather than CloudTrail logs) would be the appropriate tool for capturing detailed information on network traffic. Therefore, CloudTrail is not suitable for this task.
B) Open the Amazon CloudWatch console. Select the log group that contains the NAT gateway's elastic network interface and the private instance's elastic network interface. Run a query to filter with the destination address set as "like 203.0" and the source address set as "like 198.51.100.2". Run the stats command to filter the sum of bytes transferred by the source address and the destination address.
- Why rejected: Amazon CloudWatch is primarily used for monitoring and logging AWS resources, but VPC flow logs are specifically stored in CloudWatch Logs. However, using the CloudWatch console without explicitly referring to VPC flow logs would be confusing here, as it’s not the most efficient way to search and analyz...
Author: Rohan · Last updated Jul 6, 2026
A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.
Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documen...
To meet the requirement of ensuring encryption at rest for the S3 objects in the most operationally efficient way, let's evaluate each option based on the key factors: operational efficiency, ease of implementation, and compliance with security requirements (SSE-S3 or SSE-KMS).
Option A: Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.
- Explanation: This option enables SSE-S3 encryption for both S3 buckets and uses S3 Batch Operations to copy and re-encrypt existing objects. S3 Batch Operations can be used to process a large number of objects at once and are ideal for cases where there are millions of objects that need to be encrypted.
- Pros:
- Operationally efficient with Batch Operations as it processes many objects at once.
- SSE-S3 encryption is simpler and managed by AWS, reducing the operational overhead.
- No need to manage keys (like in KMS).
- Cons:
- Although efficient, this approach is limited to SSE-S3 encryption. It may not provide the same granular control as KMS, but it's still suitable for the requirement of encrypting documents.
- Best for: A simple encryption solution where key management isn't a concern, and a cost-effective method to encrypt existing objects.
Option B: Create an AWS Key Management Service (AWS KMS) key in each account. Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3 bucket by using the corresponding KMS key in that AWS account. Encrypt the existing objects by using an S3 copy command in the AWS CLI.
- Explanation: This option involves using SSE-KMS, where a KMS key is created and managed in each account. It requires using the AWS CLI to copy and encrypt existing objects.
- Pros:
- SSE-KMS offers better control over encryption keys and additional security features like fine-grained access control, auditing, and automatic key rotation.
- Cons:
- This option requires manual steps for encrypting the existing objects using the AWS CLI, which can be operationally more complex than Batch Operations.
- Requires managing KMS keys in each account, which adds additional overhead.
- Best for: Situations where detailed encryption controls are required, such as for compliance need...
Author: Samuel · Last updated Jul 6, 2026
A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.
The company needs to query and analyze the data. The company does not access data that is more...
To determine the most cost-effective solution that meets the company’s requirements of querying and analyzing data while ensuring compliance with retention policies, let's evaluate each option:
Option A: Use S3 Select to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.
- Explanation: S3 Select allows you to query a subset of data directly from an S3 object using SQL expressions, which is useful for extracting specific data from large objects. Data that is more than 1 year old would be moved to S3 Glacier Deep Archive, which is the lowest-cost storage class for long-term data retention.
- Pros:
- S3 Glacier Deep Archive is the most cost-effective storage option for retaining data that is infrequently accessed, which fits the requirement of storing data indefinitely for compliance.
- S3 Select provides a cost-effective way to query large datasets without retrieving the entire object, reducing costs if only specific portions of the data are needed.
- Cons:
- S3 Select only supports querying data from specific objects or parts of the object, so it might not be ideal if complex queries are required across multiple objects.
- Best for: Use cases where you need to query specific parts of an S3 object but don’t need complex queries or full-scale analytics. This option is suitable for situations where data access patterns are infrequent.
Option B: Use Amazon Redshift Spectrum to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.
- Explanation: Amazon Redshift Spectrum allows querying data stored in Amazon S3 from a Redshift cluster. This option also includes transitioning data older than 1 year to S3 Glacier Deep Archive.
- Pros:
- Redshift Spectrum can query large datasets across multiple files stored in S3, providing more comprehensive analytics compared to S3 Select.
- S3 Glacier Deep Archive offers the lowest-cost storage option for infrequent access data, which meets the compliance requirement for retaining data indefinitely.
- Cons:
- Redshift Spectrum requires setting up an Amazon Redshift cluster, which incurs additional costs for cluster management and compute resources, making this option less cost-effective compared to other alternatives.
- Best for: More complex analytics with larger datasets that require sophisticated querying. However, it may not be cost-effective for purely storage-based compliance requirements.
Option C: Use an AWS Glue Data Catalog and Amazon Athena to query the data. Create an S3 Lifecycle policy to transition data that is more than 1 year old to S3 Glacier Deep Archive.
- Explanati...
Author: Alexander · Last updated Jul 6, 2026
A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.
The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in ...
To determine the most cost-effective and efficient solution for transferring 600 TB of data to AWS within 3 weeks, we need to evaluate each option based on several key factors:
1. Data Transfer Speed and Network Constraints: The company's internet connection has an upload speed of 100 Mbps and is shared by multiple departments, which significantly limits the transfer rate. This constraint makes it impractical to transfer such a large volume of data over the internet directly.
2. Encryption in Transit: The data must be encrypted in transit, which all the options support, either by default or with proper configuration.
3. Time Constraints: The company needs to complete the transfer within 3 weeks, which is approximately 21 days or 504 hours. Given the network constraints, we must assess which solution can meet this deadline effectively.
Option A: Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console. Configure the devices with a destination S3 bucket. Copy the data to the devices. Ship the devices back to AWS.
- Explanation: AWS Snowball Edge devices are designed for large data transfers. The devices are physically shipped to the company's on-premises location, where the data is copied to the device. Once the data is copied, the devices are shipped back to AWS for uploading to S3.
- Pros:
- Speed: This solution bypasses the limitations of the company's internet connection by using physical devices to transfer large volumes of data. The data is transferred over a high-speed connection inside the device, which makes it ideal for large datasets.
- Encryption: Data is encrypted during transfer by default with Snowball, ensuring security.
- Time: Given that Snowball devices can handle hundreds of terabytes efficiently, this solution is feasible within the 3-week timeline.
- Cost-Effective: While Snowball comes with some cost, it is more cost-effective than setting up a dedicated high-bandwidth internet connection, especially for a one-time transfer.
- Cons:
- Shipping Time: Depending on the shipping time for Snowball devices, this could take a few days. However, Snowball devices are designed for rapid transfer, so this option can still meet the 3-week requirement.
- Best for: Large, one-time data transfers where the network infrastructure is not capable of handling the required speed.
Option B: Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region. Transfer the data over a VPN connection into the Region to store the data in Amazon S3.
- Explanation: AWS Direct Connect establishes a dedicated high-bandwidth network connection between the company’s premises and AWS. In this scenario, a VPN would be used over Direct Connect to transfer the data.
- Pros:
- High-Speed Transfer: With Direct Connect, the company could potentially transfer the data much faster than with the internet connection.
- Cons:
- Cost: Setting up Direct Connect requires significant upfront setup and ongoing costs, including the establishment of a 10 Gbps link....
Author: Jack · Last updated Jul 6, 2026
A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.
When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into an...
Solution Evaluation
To automate the manual processing of forms and meet the requirements of accurate form extraction, minimizing time to market, and minimizing long-term operational overhead, let's evaluate each option:
Option A: Develop custom libraries to perform optical character recognition (OCR) on the forms. Deploy the libraries to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster as an application tier. Use this tier to process the forms when forms are uploaded. Store the output in Amazon S3. Parse this output by extracting the data into an Amazon DynamoDB table. Submit the data to the target system's API.
- Explanation: This option suggests a custom solution where the company develops OCR libraries, hosts them on an EKS cluster, and manually handles data extraction.
- Pros:
- Full control over the process.
- Can integrate with custom workflows.
- Cons:
- Operational Complexity: Developing and managing custom OCR solutions, deploying them on EKS, and integrating with DynamoDB and an external API increases operational overhead.
- Time to Market: The development time for this custom solution can be significant, delaying the time to market.
- Long-Term Maintenance: Managing and maintaining custom OCR libraries and an EKS cluster would require ongoing effort, making it more complex than using managed services.
- Scalability: Although EKS can scale, the complexity of managing the infrastructure for OCR processing might not be the most efficient solution.
- Best for: Scenarios where you need full customization and have the resources to build and maintain the solution long term, but not ideal for rapid deployment and simplicity.
Option B: Extend the system with an application tier that uses AWS Step Functions and AWS Lambda. Configure this tier to use artificial intelligence and machine learning (AI/ML) models that are trained and hosted on an EC2 instance to perform optical character recognition (OCR) on the forms when forms are uploaded. Store the output in Amazon S3. Parse this output by extracting the data that is required within the application tier. Submit the data to the target system's API.
- Explanation: This option proposes using Step Functions and Lambda to integrate AI/ML models for OCR processing on an EC2 instance.
- Pros:
- Step Functions and Lambda provide a serverless architecture, reducing operational overhead.
- Custom AI/ML models can be used for OCR, offering flexibility.
- Scalable: Lambda and Step Functions can scale automatically with traffic.
- Cons:
- EC2 for AI/ML Models: Hosting models on EC2 increases complexity and cost. It would require managing the EC2 instances and ensuring the models are trained, hosted, and scaled.
- Operational Overhead: Managing custom AI/ML models can be more complex than using fully managed services for OCR.
- Best for: Use cases that need custom AI/ML models but may introduce complexity in terms of managing the infrastructure for OCR.
Option C: Host a new application tier on EC2 instances. Use this tier to call endpoints that host artificial intelligence and machine learning (AI/ML) models that are trained and hosted in Amazon SageMaker to perform optical character recognition (OCR) on the forms. Store the output in Amazon ElastiCache. Parse this output...
Author: Maya · Last updated Jul 6, 2026
A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not...
The company is refactoring its on-premises order-processing platform and wants to migrate it to the AWS Cloud with the least operational overhead while keeping the existing architecture relatively unchanged. The company uses a web front end hosted on VMs, RabbitMQ for message queuing, and a Kubernetes cluster to run the backend system. The goal is to make minimal changes while ensuring scalability, manageability, and high availability.
Evaluation of Options:
A) Create an AMI of the web server VM. Create an Amazon EC2 Auto Scaling group that uses the AMI and an Application Load Balancer. Set up Amazon MQ to replace the on-premises messaging queue. Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend.
- Why this option is good:
- The EC2 Auto Scaling group with an Application Load Balancer would help replicate the existing VM-based web server architecture and scale it efficiently in the cloud.
- Amazon MQ is a fully managed service that supports RabbitMQ, replacing the on-premises RabbitMQ and minimizing operational overhead. This makes it easy to move the messaging infrastructure to the cloud without requiring major changes to the application code.
- Amazon EKS (Elastic Kubernetes Service) is a fully managed service that simplifies Kubernetes management and allows the backend containerized system to run without the operational burden of managing Kubernetes clusters manually.
- Why this option is ideal: This solution offers a smooth migration from the on-premises setup while reducing the operational overhead of managing infrastructure components (VMs, RabbitMQ, Kubernetes). It minimizes changes to the architecture and application, thus meeting the requirement of "least operational overhead."
- Ideal for: Companies wanting to keep the existing architecture with minimal changes and leverage managed AWS services for scalability and reliability.
B) Create a custom AWS Lambda runtime to mimic the web server environment. Create an Amazon API Gateway API to replace the front-end web servers. Set up Amazon MQ to replace the on-premises messaging queue. Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend.
- Why rejected: Replacing the web server environment with AWS Lambda and API Gateway is a significant change to the architecture and would require substantial application modifications to accommodate the stateless, event-driven nature of Lambda. The company does not want to make significant changes to the application, so this approach is not suitable for minimizing op...
Author: Sophia Clark · Last updated Jul 6, 2026
A solutions architect needs to implement a client-side encryption mechanism for objects that will be stored in a new Amazon S3 bucket. The solutions architect created a CMK that is stored in AWS Key Management Service (AWS KMS) for this purpose.
The solutions architect created the following IAM policy and attached it to an IAM role:
During tests, the solutions architect was able to successfully get existing test objects in the S3 bucket. However, attempts to...
In this scenario, the solutions architect is trying to implement client-side encryption using a customer-managed key (CMK) stored in AWS Key Management Service (KMS). When a client uploads an object to Amazon S3 with encryption enabled using the CMK, it needs to call the KMS service to generate a data key for the encryption process.
Analyzing the IAM Policy:
For the client-side encryption mechanism to work properly, the solutions architect must ensure that the IAM role used by the client has the appropriate permissions for interacting with AWS KMS to generate a data encryption key. The data key is required for encrypting the object before it is uploaded to S3.
Option Breakdown:
- A) kms:GenerateDataKey:
This permission is required when the client is using AWS KMS to generate a data encryption key for encrypting an object before it is uploaded to S3. The error mentioned in the question suggests the upload is failing due to missing permissions for generating a data key, which is essential for the encryption process. This action allows the client to generate a data key that is used for encrypting the object on the client side before uploading it to S3.
- B) kms:GetKeyPolicy:
This permission allows the IAM role to retrieve the k...
Author: Mia · Last updated Jul 6, 2026
A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affec...
In this scenario, the company wants to improve the security posture of its web application without adversely affecting legitimate traffic. To achieve this, the AWS WAF (Web Application Firewall) rules need to be carefully configured, tested, and adjusted over time.
Analyzing the Options:
A) Set the action of the web ACL rules to Count. Enable AWS WAF logging. Analyze the requests for false positives. Modify the rules to avoid any false positives. Over time, change the action of the web ACL rules from Count to Block.
- Reasoning: The "Count" action is ideal for the testing phase. It allows monitoring the traffic and analyzing how the rules are impacting the requests without actually blocking them. Enabling AWS WAF logging will help in tracking requests that could be mistakenly blocked (false positives). Once the rules are fine-tuned and confirmed to not block legitimate traffic, the action can be switched from "Count" to "Block."
- Why this is selected: This approach ensures minimal disruption to legitimate traffic while allowing the company to fine-tune the WAF rules over time based on the analysis of requests. The phased transition from counting to blocking ensures that false positives are avoided, making it a balanced approach.
B) Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible. Temporarily block all requests that exceed the limit. Define nested rules to narrow the scope of the rate tracking.
- Reasoning: Rate-based rules are useful for mitigating DDoS attacks or other scenarios where an unusual volume of traffic comes from a single source. However, setting the throttle limit "as high as possible" may result in legitimate traffic being unfairly throttled, which can disrupt user experience.
- Why this is rejected: This approach is more aggressive and might block legitimate traffic if not properly configured. The company needs to ensure that the application is not adversely affected, and using rate-based rules with a high throttle limit could disrupt normal usage patterns.
C) Set the action of the web ACL rules to Block. Use only AWS managed rule groups in the web ACLs. Evaluate the rule ...
Author: Alexander · Last updated Jul 6, 2026
A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.
The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company's on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts...
In this scenario, the goal is to manage and distribute a common set of CIDR ranges (an allow list) across many AWS accounts in an organization with minimal operational overhead. The solution should help automate the process of updating security groups in multiple AWS accounts when changes to the allow list are made, without requiring manual intervention by each account owner.
Analyzing the Options:
A) Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account. Deploy an AWS Lambda function in each AWS account. Configure the Lambda function to run every time an SNS topic receives a message. Configure the Lambda function to take an IP address as input and add it to a list of security groups in the account. Instruct the security team to distribute changes by publishing messages to its SNS topic.
- Reasoning: This solution involves setting up an SNS topic for the security team to notify other accounts when changes are made. Each account would have a Lambda function that listens for these notifications and updates the security groups accordingly.
- Why this is rejected: While this solution does automate the process, it creates operational overhead in terms of maintaining individual Lambda functions in each account. This also requires managing event handling and ensuring that each Lambda function works as expected. It can become complex to maintain and scale over time across many accounts.
B) Create new customer-managed prefix lists in each AWS account within the organization. Populate the prefix lists in each account with all internal CIDR ranges. Notify the owner of each AWS account to allow the new customer-managed prefix list IDs in their accounts in their security groups. Instruct the security team to share updates with each AWS account owner.
- Reasoning: This solution involves creating customer-managed prefix lists in each AWS account and having the account owners manually add the new prefix list IDs to their security groups.
- Why this is rejected: This approach requires each account owner to manually update their security groups with new prefix list IDs whenever there are changes. This introduces unnecessary manual intervention and does not automate the process. Additionally, it does not scale well across many accounts and increases the chance of errors.
C) Create a new customer-managed prefix list in the security team's AWS account. Populate the customer-managed prefix list with all internal CIDR ranges. Share the customer-managed prefix list with the organization by using AWS Resource Ac...
Author: SilverBear · Last updated Jul 6, 2026
A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN. The company is hosting internal applications with VPCs in multiple AWS accounts. Currently, the applications are accessible from the company's on-premises office network through an AWS Site-to-Site VPN connection. The VPC in the company's main AWS account has peering connections established with VPCs in other AWS accounts.
...
To design a scalable and cost-effective AWS Client VPN solution for remote employees, we need to focus on minimizing operational overhead, ensuring secure access to internal applications, and managing routing efficiently across multiple AWS accounts.
Analyzing the Options:
A) Create a Client VPN endpoint in each AWS account. Configure required routing that allows access to internal applications.
- Reasoning: This solution involves setting up a separate Client VPN endpoint in each AWS account. Each endpoint will need its own configuration and routing setup. The main issue with this approach is that it increases management complexity by requiring the creation, monitoring, and maintenance of multiple Client VPN endpoints in every account. Additionally, routing across these accounts would require more intricate configuration to ensure seamless access to internal applications.
- Why this is rejected: While this solution can provide remote access to each account’s internal applications, it introduces higher operational overhead. Each account would need its own VPN endpoint and configuration, which complicates management and makes the solution less cost-effective.
B) Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.
- Reasoning: This solution involves creating a single Client VPN endpoint in the main AWS account. You would need to configure routing from the Client VPN endpoint to the internal applications in the other AWS accounts. This approach reduces the number of VPN endpoints to manage and centralizes the VPN connection. However, since the VPCs are peered, additional routing configurations would be required to ensure employees can access resources across multiple accounts.
- Why this is selected: This is the most cost-effective and straightforward solution because it uses a single VPN endpoint to manage all remote employee connections. It leverages VPC peering to ensure access to resources in other AWS accounts, reducing complexity and cost by avoiding multiple VPN endpoints. The routing setup can be managed efficiently within the main AWS account, making this solution scalable and manageable.
C) C...
Author: IceDragon2023 · Last updated Jul 6, 2026
A company is running an application in the AWS Cloud. Recent application metrics show inconsistent response times and a significant increase in error rates. Calls to third-party services are causing the delays. Currently, the application calls third-party services synchronously by directly invoking an AWS Lambda function.
A solutions architect n...
In this scenario, the company’s application is experiencing delays and errors due to synchronous third-party service calls. The goal is to decouple these calls, ensuring that they are processed asynchronously and reliably, and that they eventually complete without impacting application performance.
Analyzing the Options:
A) Use an Amazon Simple Queue Service (Amazon SQS) queue to store events and invoke the Lambda function.
- Reasoning: Amazon SQS is a fully managed message queue that decouples the components of an application. In this solution, events (such as calls to third-party services) can be stored in an SQS queue. AWS Lambda can then process these events asynchronously by pulling messages from the queue. This ensures that the Lambda function will process each event even if there are delays or issues with the third-party services, and it can handle retries and dead-letter queues in case of failures.
- Why this is selected: Using Amazon SQS allows for decoupling the third-party service calls and ensures that they will be eventually processed. This also provides reliable message delivery and allows the Lambda function to process events at its own pace. It handles retries automatically in case of failures, making it a robust and scalable solution for managing external service calls asynchronously.
B) Use an AWS Step Functions state machine to pass events to the Lambda function.
- Reasoning: AWS Step Functions allows you to coordinate multiple AWS services in a workflow, and it can invoke Lambda functions. It is more suitable when you need to manage complex workflows or a series of tasks in sequence. It supports retries, error handling, and orchestrating multiple steps. However, using Step Functions for simple decoupling of third-party service calls adds unnecessary complexity and overhead for this scenario, where a simple message queue would suffice.
- Why this is rejected: While Step Functions is powerful for orchestrating complex workflows, it is overkill for this use case, where the main goal is to decouple and asynchronously process third-party service calls. SQS provides a more lightweight and cost-effective solution for ...
Author: Julian · Last updated Jul 6, 2026
A company is running applications on AWS in a multi-account environment. The company's sales team and marketing team use separate AWS accounts in AWS Organizations.
The sales team stores petabytes of data in an Amazon S3 bucket. The marketing team uses Amazon QuickSight for data visualizations. The marketing team needs access to data that the sates team stores in the S3 bucket. The company has encrypted the S3 bucket with an AWS Key Management Service (AWS KMS) key. The marketing team has already created the IAM service role for QuickSight to provide Q...
To address the requirement of providing the marketing team access to the S3 data securely across AWS accounts with the least operational overhead, let's evaluate the options.
Option A: Create a new S3 bucket in the marketing account and replicate data
- Pros:
- Enables access to the S3 data in the marketing account directly, which could simplify access control and QuickSight permissions.
- Cons:
- Operational Overhead: Creating a replication rule introduces additional maintenance overhead. Each time data is added or modified in the sales account, it needs to be replicated to the marketing account. This is not ideal because it increases complexity and introduces delays in data replication. Furthermore, replication involves managing cross-account permissions and potentially dealing with larger data volumes (petabytes), which could add strain and cost.
- Redundancy: Storing the same data in both accounts results in unnecessary data duplication, which increases storage costs and management complexity.
Option B: Create an SCP to grant access to the S3 bucket, and share KMS key via AWS RAM
- Pros:
- Allows fine-grained control via the service control policy (SCP) and KMS key sharing.
- AWS RAM (Resource Access Manager) provides a streamlined way to share resources such as the KMS key between accounts, reducing the operational burden of manually managing permissions.
- Cons:
- Complexity: This option involves using SCPs, which are more often used for enforcing governance and control within AWS Organizations, but they might not be the most straightforward solution for simple cross-account access.
- Permissions Management: SCPs are typically used to control what actions are allowed within accounts, not directly for data access, so managing permissions for the specific use case (QuickSight accessing the S3 bucket) might add complexity.
Option C: Update the S3 bucket policy in the marketing account, create KMS grant
- Pros:
- Least Operational Overhead: This approach directly s...
Author: Aria · Last updated Jul 6, 2026
A company is planning to migrate its business-critical applications from an on-premises data center to AWS. The company has an on-premises installation of a Microsoft SQL Server Always On cluster. The company wants to migrate to an AWS managed database service. A soluti...
To migrate a business-critical Microsoft SQL Server Always On cluster from an on-premises data center to AWS, while ensuring a heterogeneous database migration (i.e., migrating to a different database engine), it is important to consider the tools that facilitate this process with minimal downtime and maximum reliability. Let's evaluate each option:
Option A: Migrate the SQL Server databases to Amazon RDS for MySQL by using backup and restore utilities.
- Analysis: Migrating from Microsoft SQL Server to Amazon RDS for MySQL requires converting both the schema and the data. Backup and restore utilities can be used for transferring the database, but they would not handle schema translation between SQL Server and MySQL, which is a significant hurdle. Additionally, using backup and restore will likely result in a prolonged downtime, as this process is not optimized for high availability or minimal disruption during migration.
- Why Rejected: This option doesn’t address the need for schema conversion between SQL Server and MySQL and would involve more manual effort, causing longer downtime. It is not the most efficient solution for heterogeneous database migration.
Option B: Use an AWS Snowball Edge Storage Optimized device to transfer data to Amazon S3. Set up Amazon RDS for MySQL. Use S3 integration with SQL Server features, such as BULK INSERT.
- Analysis: Using AWS Snowball Edge to transfer data is a good option for moving large volumes of data to AWS, but it doesn’t address the need for schema conversion between SQL Server and MySQL. Additionally, while BULK INSERT could help with transferring data, it doesn't address the overall migration of the database schema or the consistency of the migration, especially with a production database.
- Why Rejected: This option doesn't provide an integrated solution for translating the schema or handling live data migration, and the bulk data transfer through Snowball Edge might not align well with the need for minimal downtime or automation.
Option C: Use the AWS Schema Conversion Tool to translate the d...
Author: William · Last updated Jul 6, 2026
A publishing company's design team updates the icons and other static assets that an ecommerce web application uses. The company serves the icons and assets from an Amazon S3 bucket that is hosted in the company's production account. The company also uses a development account that members of the design team can access.
After the design team tests the static assets in the development account, the design team needs to load the assets into the S3 bucket in the production account. A solutions architect must p...
To meet the requirements, the design team needs access to the Amazon S3 bucket in the production account without exposing other parts of the application to unwanted changes. The design team should be able to upload static assets to the production S3 bucket, but access should be controlled with the least privilege.
Let's evaluate the options:
Option A: In the production account, create a new IAM policy that allows read and write access to the S3 bucket.
- Analysis: While creating an IAM policy in the production account that allows read and write access to the S3 bucket would be a necessary step, this policy alone would not give the design team access to the production account. The policy would need to be associated with a role in the production account that the design team can assume from the development account.
- Why Rejected: This step is only part of the solution. The IAM policy in the production account is essential but must be paired with a role and trusted relationships to allow the design team in the development account to assume the role.
Option B: In the development account, create a new IAM policy that allows read and write access to the S3 bucket.
- Analysis: This approach would give users in the development account direct access to the production S3 bucket. However, giving users direct access to the S3 bucket in the production account would expose the production account to more risk than necessary. It's better to use a role-based approach where the design team can assume a role that grants access to the production resources.
- Why Rejected: This would grant broader access than needed and expose the production account to unnecessary risks. It’s better to use roles for secure cross-account access.
Option C: In the production account, create a role. Attach the new policy to the role. Define the development account as a trusted entity.
- Analysis: This is the correct approach to securely allow users in the development account to access resources in the production account. By creating a role in the production account and defining the development account as a trusted entity, the design team can assume the role and gain the necessary access to the S3 bucket in the production account.
- Why Selected: This option ensures least privilege access by using an IAM role in the production account that is trusted by the development account, allowing only the necessary access.
Option D: In the development account, create a role. Attach the new policy to the role. Define the production account as a trusted entity.
- Analysis: This wou...
Author: Ethan · Last updated Jul 6, 2026
A company developed a pilot application by using AWS Elastic Beanstalk and Java. To save costs during development, the company's development team deployed the application into a single-instance environment. Recent tests indicate that the application consumes more CPU than expected. CPU utilization is regularly greater than 85%, which causes some performance bottlenecks.
A solutions architect must ...
To address the performance bottlenecks caused by high CPU utilization in the single-instance AWS Elastic Beanstalk environment, the company needs a scalable solution that can dynamically adjust resources to meet the application's demands without adding excessive operational overhead. Let's break down each option:
Option A: Create a new Elastic Beanstalk application. Select a load-balanced environment type. Select all Availability Zones. Add a scale-out rule that will run if the maximum CPU utilization is over 85% for 5 minutes.
- Analysis: This option proposes creating a new Elastic Beanstalk application with a load-balanced environment. While a load-balanced environment could help distribute traffic and manage higher CPU utilization, this involves setting up a new application from scratch, which would require additional work and may be unnecessary if the current application can be modified to meet the needs. Also, it suggests setting the maximum CPU utilization, which could result in unnecessary scaling as it is based on individual instance utilization rather than the overall average.
- Why Rejected: This option involves setting up a completely new application, which introduces unnecessary complexity. Moreover, scaling based on maximum CPU utilization is not as efficient as scaling based on average CPU utilization.
Option B: Create a second Elastic Beanstalk environment. Apply the traffic-splitting deployment policy. Specify a percentage of incoming traffic to direct to the new environment if the average CPU utilization is over 85% for 5 minutes.
- Analysis: This option involves creating a second Elastic Beanstalk environment and using traffic splitting. While this can help distribute traffic between environments, it introduces additional complexity and operational overhead, as managing two environments (one for development and one for production) requires more monitoring and management. It also does not solve the immediate problem of high CPU utilization in the current environment.
- Why Rejected: This solution introduces unnecessary complexity and operational overhead without directly addressing the performance bottlenecks in the current environment. Traffic splitting isn't an optimal solution for mitigating CPU bottlenecks.
Option C: Modify the existing environment's capacity configuration to u...
Author: NebulaEagle11 · Last updated Jul 6, 2026
A finance company is running its business-critical application on current-generation Linux EC2 instances. The application includes a self-managed MySQL database performing heavy I/O operations. The application is working fine to handle a moderate amount of traffic during the month. However, it slows down during the final three days of each month due to month-end reporting, even though the company is using Elastic Load Balancers and Auto ...
To address the performance issues with the database during the month-end reporting period, the key factor is finding a solution that can handle heavy I/O operations with minimal disruption and impact on performance. Let's analyze the options:
Option A: Pre-warming Elastic Load Balancers, using a bigger instance type, changing all Amazon EBS volumes to GP2 volumes.
- Analysis: Pre-warming Elastic Load Balancers is typically used to address cold start issues, but it is unlikely to solve the database's I/O performance issues. Increasing the instance type of the EC2 instances could help with application performance but does not directly address the database bottleneck. Changing all Amazon EBS volumes to GP2 could improve throughput and performance, but for high I/O workloads like databases, General Purpose SSD (GP2) volumes are not as high-performing as provisioned IOPS (io1) volumes. This solution does not focus specifically on the database bottleneck.
- Why Rejected: While the application scaling might help, this option doesn't focus on the underlying database I/O problem. The use of GP2 volumes may not be sufficient for handling heavy database I/O, and changing instance types without directly addressing the database might not deliver the expected results.
Option B: Performing a one-time migration of the database cluster to Amazon RDS, and creating several additional read replicas to handle the load during end of month.
- Analysis: Amazon RDS is a managed database service that can offload database management tasks and automatically scale with features like read replicas. Migrating the self-managed MySQL database to RDS would offload management overhead and benefit from better scaling and performance optimization. Creating additional read replicas would improve read performance during heavy load periods, like month-end reporting, as read queries could be offloaded to replicas. This would mitigate the I/O issues by distributing the load more effectively across multiple instances.
- Why Selected: This option addresses the root cause by utilizing a managed database solution (Amazon RDS) with read replicas to scale read operations. It reduces the management burden and provides a solution that can scale automatically and handle increased traffic with minimal impact on performance. RDS is optimized for heavy I/O workloads, ...
Author: Ella · Last updated Jul 6, 2026
A company runs a Java application that has complex dependencies on VMs that are in the company's data center. The application is stable. but the company wants to modernize the technology stack. The company wants to migrate the application to AWS and minimize the adminis...
To determine the most suitable solution for migrating the application to AWS with the least code changes, let's analyze the options based on the provided requirements:
Key Requirements:
1. Minimize Administrative Overhead: The company wants to reduce the burden of managing servers.
2. Modernization of the Tech Stack: The company wants to modernize, but the application is stable, implying that large changes to the code are to be avoided.
3. Maintain Stability: The application must remain stable during the transition.
Option Breakdown:
Option A: Migrate the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using AWS App2Container.
- Amazon ECS on AWS Fargate is a serverless compute engine for containers, which means there is no need to manage the underlying EC2 instances (minimizing administrative overhead).
- AWS App2Container helps containerize the existing application with minimal changes, allowing migration without extensive code rewrites.
- Elastic Container Registry (ECR) stores the container images.
- Application Load Balancer (ALB) can be configured to distribute traffic to the ECS tasks (containers).
- Advantages: It minimizes administrative overhead (serverless compute), uses the existing containerization tools (App2Container), and only requires changes related to containerization (no major code changes).
- Disadvantages: The complexity of containers may require some adjustments to the application's networking, but overall, this is a lightweight transition.
Option B: Migrate the application code to a container that runs in AWS Lambda with Amazon API Gateway.
- AWS Lambda is serverless and abstracts infrastructure management, which meets the requirement for reducing administrative overhead.
- However, Lambda functions are best suited for stateless workloads, and existing stateful or complex applications may not fit well into the Lambda model.
- Lambda functions also have resource and time limitations (maximum execution time of 15 minutes), making this solution impractical for long-running or resource-intensive applications.
- API Gateway could route requests to the Lambda functions, but the complexity of adapting the entire application to fit Lambda’s mod...
Author: MoonlitPantherX · Last updated Jul 6, 2026
A company has an asynchronous HTTP application that is hosted as an AWS Lambda function. A public Amazon API Gateway endpoint invokes the Lambda function. The Lambda function and the API Gateway endpoint reside in the us-east-1 Region. A solutions architect needs to ...
To address the requirement of supporting failover to another AWS Region for the asynchronous HTTP application hosted in AWS Lambda, we need a solution that enables routing traffic between two regions in case of failure in the primary region. Let's break down each option based on this goal:
Key Considerations:
1. Failover: The solution needs to ensure that traffic can be rerouted to a backup region in case the primary region (us-east-1) becomes unavailable.
2. Asynchronous Processing: The Lambda function processes requests asynchronously, meaning it doesn’t necessarily need to process immediately or synchronously for failover.
3. Minimizing Downtime: The failover strategy should minimize downtime, ensuring the application is still available when the primary region fails.
Option Breakdown:
Option A: Create an API Gateway endpoint in the us-west-2 Region to direct traffic to the Lambda function in us-east-1. Configure Amazon Route 53 to use a failover routing policy to route traffic for the two API Gateway endpoints.
- This option introduces an API Gateway in us-west-2 and uses Route 53 for failover routing between us-east-1 and us-west-2.
- Pros:
- The failover routing policy in Route 53 can automatically reroute traffic to the backup region (us-west-2) if the primary region (us-east-1) fails.
- Minimal changes are required to the existing Lambda function, as the traffic redirection is handled at the API Gateway and Route 53 level.
- Cons:
- There is still a single Lambda function running in us-east-1, so traffic is routed to a Lambda that might not be available in a failover scenario unless both Lambda functions are kept in sync.
- This solution lacks a self-contained Lambda in us-west-2, which is required for full resilience.
Option B: Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure API Gateway to direct traffic to the SQS queue instead of to the Lambda function. Configure the Lambda function to pull messages from the queue for processing.
- This option involves modifying the architecture to use SQS for message queuing, with Lambda pulling messages from the queue for processing.
- Pros:
- SQS can act as a buffer, allowing Lambda to process messages asynchronously and potentially from multiple regions.
- It is a good solution for decoupling components and can add durability to the application.
- Cons:
- While SQS can help with asynchronous processing, this option doesn’t directly solve the issue of failover to another region. Failover would still require a complex setup for region-speci...
Author: GlowingTiger · Last updated Jul 6, 2026
A retail company has structured its AWS accounts to be part of an organization in AWS Organizations. The company has set up consolidated billing and has mapped its departments to the following OUs: Finance, Sales, Human Resources (HR), Marketing, and Operations. Each OU has multiple AWS accounts, one for each environment within a department. These environments are development, test, pre-production, and production.
The HR department is releasing a new system that will launch in 3 months. In preparation, the HR department has purchased several Reserved Instances...
Evaluation of the Options:
The HR department wants to prevent other departments from sharing Reserved Instance (RI) discounts. The company's accounts are part of an AWS Organization with consolidated billing enabled, which means that RI discounts can be shared across all accounts in the organization by default.
Let's go over the options in detail:
Option A: Turn off RI sharing for the HR department's production account in the AWS Billing and Cost Management console
- Pros:
- Direct Control: Turning off RI sharing for the HR department's production account ensures that RI discounts are not shared with any other accounts.
- Cons:
- Limitations of Account-Level Control: While this directly affects the HR department's production account, it may not be the most flexible approach if the department needs to retain RI sharing for certain use cases. Additionally, it only applies at the account level, and the settings in consolidated billing for the entire organization might need to be adjusted to be fully effective.
- Account-specific Change: This might not provide a holistic approach for managing RI sharing across different departments and AWS accounts in the organization.
Option B: Remove the HR department's production AWS account from the organization and add the account only to the consolidated billing configuration
- Pros:
- Isolation: This approach isolates the HR production account from the rest of the organization, which would prevent any sharing of RIs.
- Cons:
- Operational Overhead: Removing the account from the organization introduces significant complexity. The HR account will no longer be part of the organization, meaning it would lose consolidated billing benefits such as volume discounts and other cross-account pricing benefits.
- Loss of Consolidated Billing: This option undermines the organization's ability to benefit from consolidated billing, which is one of the key benefits of using AWS Organizations.
- Not Scalable: This is an impractical solution because the organization would lose the efficiency of consolidated billing across all its departments.
Option C: Use the AWS Billing and Cost Management console in the organization's management account to turn off RI sharing for the HR department's producti...
Author: Manish · Last updated Jul 6, 2026
A large company is running a popular web application. The application runs on several Amazon EC2 Linux instances in an Auto Scaling group in a private subnet. An Application Load Balancer is targeting the instances in the Auto Scaling group in the private subnet. AWS Systems Manager Session Manager is configured, and AWS Systems Manager Agent is running on all the EC2 instances.
The company recently released a new version of the application. Some EC2 instances are now being marked as unhealthy and are being terminated. As a result, the application is running at reduced capacity. A so...
To troubleshoot the issue of unhealthy EC2 instances being terminated in the Auto Scaling group, the solutions architect needs to access one of the affected EC2 instances. Given the context, let's evaluate the options:
Key Considerations:
1. Accessing the EC2 Instance: The main goal is to log in to an EC2 instance marked as unhealthy to determine the root cause.
2. Preventing Immediate Termination: Since the EC2 instances are being terminated automatically due to their unhealthy state, the solutions architect needs to prevent termination temporarily to troubleshoot.
3. Using Session Manager: Since AWS Systems Manager Session Manager is already configured, it provides a way to log into EC2 instances without needing SSH access.
Option Breakdown:
Option A: Suspend the Auto Scaling group's HealthCheck scaling process. Use Session Manager to log in to an instance that is marked as unhealthy.
- Pros:
- Suspending the HealthCheck scaling process will stop the Auto Scaling group from terminating instances based on their health status, which allows time to troubleshoot.
- After suspending the scaling process, the solutions architect can use Session Manager to log in to the unhealthy instance.
- Cons:
- This option does not directly stop the instance termination process; it suspends the Auto Scaling group's health check logic, which could leave the application running in reduced capacity temporarily.
- The health check suspension might not fully prevent the termination of unhealthy instances if other factors trigger the Auto Scaling process.
- Conclusion: This is a good option, as it allows access to the instance using Session Manager without affecting the instance's protection from termination.
Option B: Enable EC2 instance termination protection. Use Session Manager to log in to an instance that is marked as unhealthy.
- Pros:
- Instance termination protection prevents the EC2 instance from being terminated manually, which can provide a safety net during troubleshooting.
- Cons:
- Termination protection only prevents manual termination and does not prevent the Auto Scaling group from terminating unhealthy instances if it deems them necessary. The Auto Scaling group still considers the instance unhealthy and will attempt to replace it.
- Session Manager can still be used to log in to the instance, but this approach alone will not prevent the Auto Scaling group from terminat...
Author: Ava · Last updated Jul 6, 2026
A company wants to deploy an AWS WAF solution to manage AWS WAF rules across multiple AWS accounts. The accounts are managed under different OUs in AWS Organizations.
Administrators must be able to add or remove accounts or OUs from managed AWS WAF rule sets as needed. Administrators also must have the ability to automatically update a...
Key Considerations:
1. Ease of Management: The solution should allow administrators to efficiently manage AWS WAF rules across multiple accounts and Organizational Units (OUs) within AWS Organizations, with minimal operational overhead.
2. Scalability: The solution should scale as more accounts and OUs are added or removed, without requiring significant manual intervention or maintenance.
3. Automated Remediation: Noncompliant resources should be automatically identified and remediated without requiring additional manual steps.
4. Account and OU Management: Administrators must be able to easily add or remove accounts or OUs from the managed AWS WAF rule sets.
Option Breakdown:
Option A: Use AWS Firewall Manager to manage AWS WAF rules across accounts in the organization. Use an AWS Systems Manager Parameter Store parameter to store account numbers and OUs to manage. Update the parameter as needed to add or remove accounts or OUs. Use an Amazon EventBridge rule to identify any changes to the parameter and invoke an AWS Lambda function to update the security policy in the Firewall Manager administrative account.
- Pros:
- AWS Firewall Manager is designed to centrally manage AWS WAF rules across multiple accounts and Organizational Units in AWS Organizations, making it a natural fit for the use case.
- AWS Firewall Manager allows for automatic updates and remediations, which minimizes operational overhead.
- The use of EventBridge and Lambda to dynamically manage changes to account numbers and OUs is flexible and allows for automation.
- Cons:
- The solution adds some complexity by requiring the setup of an EventBridge rule and Lambda function to update security policies.
- The overhead of managing parameters and the Lambda function might increase operational complexity slightly, though it's still manageable.
- Conclusion: This solution is effective and can be automated well, but the Lambda function to manage updates adds a slight layer of complexity.
Option B: Deploy an organization-wide AWS Config rule that requires all resources in the selected OUs to associate the AWS WAF rules. Deploy automated remediation actions by using AWS Lambda to fix noncompliant resources. Deploy AWS WAF rules by using an AWS CloudFormation stack set to target the same OUs where the AWS Config rule is applied.
- Pros:
- AWS Config provides a detailed compliance view, and remediation actions via Lambda can fix noncompliant resources.
- CloudFormation StackSets allow for deployment of AWS WAF rules across multiple accounts and OUs.
- Cons:
- The solution introduces additional complexity with managing AWS Config, CloudFormation, and Lambda functions for remediation.
- While AWS Config and CloudFormation are powerful, they increase the complexity of the setup compared to a more centralized solution like AWS Firewall Manager.
- Conclusion: Although...
Author: Rahul · Last updated Jul 6, 2026
A solutions architect is auditing the security setup or an AWS Lambda function for a company. The Lambda function retrieves, the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function.
The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not...
Let's break down each option and evaluate it in relation to the given requirements:
Requirements:
1. Minimize the impact of compromised credentials: If the credentials are compromised, we need a solution that will quickly mitigate any damage and ensure the credentials can be rotated securely.
2. Data must not travel across the Internet: The data must stay within the VPC, not travel over the open internet.
3. Lambda function retrieves credentials securely: We want to ensure that Lambda retrieves the credentials securely and that they are rotated regularly to minimize the impact of potential compromise.
4. Security of database access: The solution should allow secure access to the Aurora database without exposing credentials in environment variables.
Evaluating Options:
Option A: Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
- IAM Database Authentication: This is a secure way to authenticate Lambda to Aurora without hardcoding credentials in the Lambda environment variables. It provides security by using temporary IAM credentials for access.
- VPC Endpoint for S3: Ensures that data between Lambda and S3 doesn't travel over the internet. This is required as per the given scenario to ensure data does not leave the VPC.
- Missing Credentials Management: However, this solution doesn't address how to securely handle the database credentials if IAM authentication is not available (e.g., for non-IAM use cases) or how to rotate the credentials. Therefore, this option doesn't meet the requirement of minimizing the impact of credential compromise in the case where IAM DB authentication is not available.
Option B: Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Enforce HTTPS on the connection to Amazon S3 during data transfers.
- IAM Database Authentication: As discussed, this is a secure method for Lambda to authenticate to Aurora.
- Enforcing HTTPS for S3: While this ensures encrypted communication between Lambda and S3, it doesn't address credential management or minimize the impact of a compromised credential.
- Missing Gateway VPC Endpoint for S3: The data could still potentially leave the VPC and travel over the internet, depending on the configuration. The requirement to prevent this is not fully addressed here.
Option C: Save the database credentials in AWS Systems Manager Parameter Store. Set ...
Author: Maya2022 · Last updated Jul 6, 2026
A large mobile gaming company has successfully migrated all of its on-premises infrastructure to the AWS Cloud. A solutions architect is reviewing the environment to ensure that it was built according to the design and that it is running in alignment with the Well-Architected Framework.
While reviewing previous monthly costs in Cost Explorer, the solutions architect notices that the creation and subsequent termination of several large instance types account for a high proportion of the costs. The solutions architect finds out that the company's developers are launching new Amazon EC2 instances as part...
To address the situation where developers are launching EC2 instances with inappropriate instance types, the solution must effectively enforce limits on the instance types they are allowed to launch. Let's analyze each option in detail:
Option A: Create a desired-instance-type managed rule in AWS Config. Configure the rule with the instance types that are allowed. Attach the rule to an event to run each time a new EC2 instance is launched.
- AWS Config: This is a service that provides a detailed inventory of AWS resources and their configuration, and it can evaluate whether resources are compliant with specified rules.
- Desired-Instance-Type Managed Rule: This AWS Config managed rule can check if EC2 instances are launched with specific types and can trigger compliance evaluations.
- Why it's a good fit: This solution would allow enforcement of an allowed list for instance types. However, while AWS Config can evaluate compliance, it doesn't directly prevent the launching of instances outside the allowed list. Instead, it reports non-compliant resources after they are launched. This means that while useful for auditing, it wouldn't immediately prevent the developers from launching unauthorized instances.
Option B: In the EC2 console, create a launch template that specifies the instance types that are allowed. Assign the launch template to the developers' IAM accounts.
- Launch Template: This defines configurations for launching EC2 instances, including instance types, AMIs, and other configurations. It could restrict developers to certain instance types if set up properly.
- Why it's rejected: While a launch template could be used to standardize instance launches, it does not limit the developers' permissions directly. Developers could still manually override the launch template settings and choose instance types not specified in the template. Therefore, this solution does not offer the control required to strictly enforce instance typ...
Author: NightmareDragon2025 · Last updated Jul 6, 2026
A company is developing and hosting several projects in the AWS Cloud. The projects are developed across multiple AWS accounts under the same organization in AWS Organizations. The company requires the cost for cloud infrastructure to be allocated to the owning project. The team responsible for all of the AWS accounts has discovered that several Amazon EC2 instances are lacking the Proj...
To resolve the issue of missing "Project" tags on EC2 instances across multiple AWS accounts and prevent it from happening in the future, we need to focus on enforcement and monitoring strategies. Let's go through each option to evaluate its effectiveness and suitability for this scenario.
Option A: Create an AWS Config rule in each account to find resources with missing tags.
- AWS Config: This service allows you to monitor and evaluate the configuration of AWS resources. You can create custom rules that assess whether resources meet specific criteria, such as having required tags.
- Why it's a good fit: This option provides a way to monitor compliance and automatically identify instances that lack the "Project" tag. However, this approach only helps with identifying non-compliant resources and does not prevent the creation of new resources without the tag.
- Why it's selected: While not a preventive measure by itself, AWS Config helps in ensuring ongoing compliance and tracking where issues arise. This can be part of a broader solution to identify and manage missing tags.
Option B: Create an SCP in the organization with a deny action for `ec2:RunInstances` if the Project tag is missing.
- Service Control Policies (SCPs): SCPs are used within AWS Organizations to control what actions can be performed across accounts. A deny action for EC2 instance creation based on the absence of a tag could prevent instances from being launched without the "Project" tag.
- Why it's a good fit: This is a very effective preventative measure. SCPs are applied at the organizational level, and by denying the creation of EC2 instances unless the required "Project" tag is present, it ensures that no instances are launched without the appropriate tagging from the start.
- Why it's selected: SCPs prevent the root cause of the issue (launching instances without the required tag), ensuring that resources are tagged correctly before they can be created. This is the strongest enforcement mechanism to prevent the problem from happening again in the future.
Option C: Use Amazon Inspector in the organization to find resources with missing tags.
- Amazon Inspector: Amazon Inspector is a security assessment service that helps identify security vulnerabilities and deviations from best practices. However, it is not designed for monitoring or enforcing resource tagging.
- Why it's rejected: Amazon Inspector focuses on security assessments, not resource tagging. It does not help with monitoring or enforcing tags and is not appropriate for this specific use case.
Option D: Create an IAM policy in each ac...
Author: Ahmed · Last updated Jul 6, 2026
A company has an on-premises monitoring solution using a PostgreSQL database for persistence of events. The database is unable to scale due to heavy ingestion and it frequently runs out of storage.
The company wants to create a hybrid solution and has already set up a VPN connection between its network and AWS. The solution should include the following attributes:
* Managed AWS services to minimize operational complexity.
* A buffer that automatically scales to match the throughput of data and requires no ongoing administration.
* A visualization tool to create dash...
To design a hybrid solution that scales, buffers events, and provides near-real-time visualization, we need to focus on managed AWS services that minimize operational complexity, automatically scale to handle throughput, and support the required data formats (semi-structured JSON). Let's evaluate each option in detail.
Option A: Use Amazon Kinesis Data Firehose to buffer events. Create an AWS Lambda function to process and transform events.
- Amazon Kinesis Data Firehose: Kinesis Data Firehose is a fully managed service that buffers and delivers streaming data to destinations like Amazon S3, Amazon Redshift, Amazon Elasticsearch Service (Amazon ES), and more. It automatically scales to handle varying data throughput without the need for manual intervention.
- AWS Lambda: Lambda can be used to process and transform events in real-time, making it a good fit for dynamically handling semi-structured JSON data.
- Why it's a good fit: This solution aligns with the requirements for a managed service, automatic scaling, and minimal operational complexity. Firehose automatically scales and buffers data, and Lambda can be used to process and transform semi-structured data.
- Why it's selected: This option provides a fully managed solution for buffering and transforming data, which meets the need for scalability and low operational overhead. Additionally, it is flexible in terms of destination and allows for further customization through Lambda.
Option B: Create an Amazon Kinesis data stream to buffer events. Create an AWS Lambda function to process and transform events.
- Amazon Kinesis Data Streams: Kinesis Data Streams allows real-time streaming of data and provides more fine-grained control over data processing compared to Kinesis Firehose. However, it requires more management for scaling and throughput, as you need to manage shards and consumer applications.
- AWS Lambda: Similar to option A, Lambda can process and transform events, supporting semi-structured JSON data.
- Why it's rejected: While Kinesis Data Streams is a valid choice for buffering data, it introduces more operational complexity compared to Firehose. Specifically, you need to manage shard scaling and consumers, which could add overhead that the company wants to avoid.
Option C: Configure an Amazon Aurora PostgreSQL DB cluster to receive events. Use Amazon QuickSight to read from the database and create near-real-time visualizations and dashboards.
- Amazon Aurora PostgreSQL: While Aurora is a managed relational database service, it is not designed for handling high-throughput event ingestion efficiently, especially for semi-structured JSON data. Relational databases like Aurora are better suited for transactional ...
Author: Ava · Last updated Jul 6, 2026
A team collects and routes behavioral data for an entire company. The company runs a Multi-AZ VPC environment with public subnets, private subnets, and in internet gateway. Each public subnet also contains a NAT gateway. Most of the company's applications read from and write to Amazon Kinesis Data Streams. Most of the workloads run in private subnets.
A solutions architect must review the infrastructure. The solution architect needs to reduce costs and maintain the function of the applications. The solutions architect uses Cost Explorer and notic...
The issue at hand is the increasing costs related to NAT Gateway traffic, specifically the NATGateway-Bytes charges. This is a common problem when workloads in private subnets need to communicate with external services, such as Kinesis Data Streams, and the traffic is routed through the NAT Gateway. The high cost in the EC2-Other category, due to the NAT Gateway, can be reduced by minimizing the need for the traffic to traverse the NAT Gateway.
Option A: Enable VPC Flow Logs. Use Amazon Athena to analyze the logs for traffic that can be removed. Ensure that security groups are blocking traffic that is responsible for high costs.
- VPC Flow Logs: This helps capture network traffic metadata, which could assist in identifying unnecessary traffic or sources of high-cost data. However, VPC Flow Logs do not directly reduce NAT Gateway traffic or resolve the root cause (the traffic routing through the NAT Gateway).
- Athena: Athena can be used to query flow logs for further analysis, but this still requires manual intervention and analysis to identify unnecessary traffic.
- Why it's rejected: While VPC Flow Logs and Athena can help monitor traffic, this option is reactive and doesn't directly address the core issue of the increasing NATGateway-Bytes charges. Additionally, it would require manual configuration and analysis, making it less efficient than a more automated solution like an interface VPC endpoint.
Option B: Add an interface VPC endpoint for Kinesis Data Streams to the VPC. Ensure that applications have the correct IAM permissions to use the interface VPC endpoint.
- Interface VPC Endpoint: An Interface VPC endpoint for Kinesis Data Streams allows traffic to flow directly between the VPC and Kinesis over the AWS private network, bypassing the NAT Gateway. This would reduce the cost of NATGateway-Bytes, as traffic between applications and Kinesis would no longer need to go through the NAT Gateway.
- Why it's a good fit: This solution directly addresses the issue of high NATGateway-Bytes charges. By routing traffic to Kinesis through an interface endpoint, the need for internet-bound traffic via the NAT Gateway is minimized, significantly reducing costs.
- Why it's selected: Adding an interface V...
Author: Ava · Last updated Jul 6, 2026
A retail company has an on-premises data center in Europe. The company also has a multi-Region AWS presence that includes the eu-west-1 and us-east-1 Regions. The company wants to be able to route network traffic from its on-premises infrastructure into VPCs in either of those Regions. The company also needs to support traffic that is routed directly between VPCs in those Regions. No single points of failure can exist on the network.
The company already has created two 1 Gbps AWS Direct Connect connections from its on-premises data center. Each connection goes into a separate Direct Connect loc...
To meet the requirements of high availability, cross-Region routing, and no single points of failure, we need to analyze each option with respect to the given scenario. The key factors to focus on are:
- High availability: Each connection must be fault-tolerant, meaning if one connection or gateway fails, the other should seamlessly take over.
- Cross-Region routing: There needs to be a way to route traffic between VPCs in different Regions (eu-west-1 and us-east-1) and from the on-premises data center into those Regions.
- No single points of failure: The solution must have redundancy in all components, including the Direct Connect connections, Direct Connect gateways, and Transit Gateways.
Let's go through the options one by one:
A) Create a private VIF from the DX-A connection into a Direct Connect gateway. Create a private VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-1 and us-east-1 transit gateways with the Direct Connect gateway. Peer the transit gateways with each other to support cross-Region routing.
- Private VIFs (Virtual Interfaces) are typically used for direct, private communication between on-premises data centers and AWS services. However, associating both transit gateways (for two Regions) with the same Direct Connect gateway can work for cross-Region routing.
- Peer the transit gateways: While peering the Transit Gateways could work, Direct Connect gateways typically don't support the direct peering of Transit Gateways for inter-Region traffic. This option has an architectural limitation, as the Direct Connect Gateway doesn’t route traffic between the two transit gateways.
- Conclusion: This option doesn't provide a scalable solution for routing traffic between Regions via Direct Connect in the way the requirement expects.
B) Create a transit VIF from the DX-A connection into a Direct Connect gateway. Associate the eu-west-1 transit gateway with this Direct Connect gateway. Create a transit VIF from the DX-B connection into a separate Direct Connect gateway. Associate the us-east-1 transit gateway with this separate Direct Connect gateway. Peer the Direct Connect gateways with each other to support high availability and cross-Region routing.
- Transit VIFs are used for more complex routing, such as connecting to a Transit Gateway. This allows for greater flexibility and scalability.
- Separate Direct Connect gateways for each Region: Using two Dire...
Author: Julian · Last updated Jul 6, 2026
A company is running an application in the AWS Cloud. The company's security team must approve the creation of all new IAM users. When a new IAM user is created, all access for the user must be removed automatically. The security team must then receive a notification to approve the user. The company has ...
Key Factors to Consider:
- IAM User Creation Notification: The primary requirement is to notify the security team when a new IAM user is created.
- Access Removal on Creation: When an IAM user is created, the user must not have any access until the security team approves it.
- Automatic Workflow: The solution needs to be automated to trigger actions based on the creation of an IAM user.
- Use of AWS Services: The company already has AWS CloudTrail, and we need to use other AWS services (like EventBridge, SNS, and possibly AWS Step Functions) to automate the workflow.
Option-by-Option Breakdown:
A) Create an Amazon EventBridge (Amazon CloudWatch Events) rule. Define a pattern with the detail-type value set to AWS API Call via CloudTrail and an eventName of CreateUser.
- Correct: EventBridge (formerly CloudWatch Events) can be used to capture specific API calls made in AWS services, such as `CreateUser`. This solution listens for the `CreateUser` event from AWS CloudTrail, and this event will be triggered when a new IAM user is created. EventBridge can then send this event to a target for further processing (e.g., a Lambda function to disable the user or an SNS topic for notifications). This step is crucial in automating the flow based on user creation.
B) Configure CloudTrail to send a notification for the CreateUser event to an Amazon Simple Notification Service (Amazon SNS) topic.
- Problem: While CloudTrail records events and can log the creation of an IAM user, it doesn't directly send notifications. CloudTrail itself doesn’t natively send notifications for individual events. The notifications are handled by EventBridge or other event-driven services. So, this step is not directly suitable on its own.
C) Invoke a container that runs in Amazon Elastic Container Service (Amazon ECS) with AWS Fargate technology to remove access.
- Problem: Using ECS wi...
Author: Maya · Last updated Jul 6, 2026
A company wants to migrate to AWS. The company wants to use a multi-account structure with centrally managed access to all accounts and applications. The company also wants to keep the traffic on a private network. Multi-factor authentication (MFA) is required at login, and specific roles are assigned to user groups.
The company must create separate accounts for development. staging, production, and shared network. The production account and the shared network account must have connectiv...
Key Factors to Consider:
- Multi-Account Structure: The company needs to manage multiple accounts with different access requirements (e.g., development, staging, production, shared network).
- Network Traffic Privacy: Traffic should remain on a private network, ensuring no exposure to the public internet.
- Centralized Access Management: Centralized access management with proper role assignments for user groups.
- Multi-Factor Authentication (MFA): MFA should be required at login for all users accessing the AWS environment.
- Account Connectivity Requirements: Connectivity between specific accounts needs to be configured (e.g., production and shared network have access to all accounts, development and staging only have access to each other).
Option-by-Option Breakdown:
A) Deploy a landing zone environment by using AWS Control Tower. Enroll accounts and invite existing accounts into the resulting organization in AWS Organizations.
- Correct: AWS Control Tower is designed for managing multi-account AWS environments and can automate the setup of a secure and compliant landing zone. It integrates with AWS Organizations to enroll and manage accounts centrally. It ensures that policies, access controls, and security measures (such as MFA) are enforced across all accounts, which aligns with the company’s goal of centralized management and private networking.
- Why other options are rejected: AWS Control Tower simplifies the management of multiple AWS accounts, so it makes sense to use it here rather than trying to manage each account manually or with more complex solutions like IAM users and groups.
B) Enable AWS Security Hub in all accounts to manage cross-account access. Collect findings through AWS CloudTrail to force MFA login.
- Problem: AWS Security Hub is primarily used for aggregating security findings across accounts and doesn't directly manage MFA login or cross-account access in the way required here. It's not a solution for centralized account management or role-based access control (RBAC). While useful for security, this doesn't address the core requirements of managing access and network connectivity.
C) Create transit gateways and transit gateway VPC attachments in each account. Configure appropriate route tables.
- Problem: While AWS Transit Gateway is a powerful tool for interconnecting VPCs across multiple accounts, the requirement here is more about managing access control and multi-account stru...
Author: IronLion88 · Last updated Jul 6, 2026
A company runs its application in the eu-west-1 Region and has one account for each of its environments: development, testing, and production. All the environments are running 24 hours a day, 7 days a week by using stateful Amazon EC2 instances and Amazon RDS for MySQL databases. The databases are between 500 GB and 800 GB in size.
The development team and testing team work on business days during business hours, but the production environment operates 24 hours a day, 7 days a week. The company want...
Key Factors to Consider:
1. Cost Optimization: The company is looking to reduce costs for environments that do not need to run 24/7, especially the development and testing environments, while still ensuring that the production environment remains available at all times.
2. Operational Effort: The solution should minimize manual intervention and be as automated as possible, ideally without needing complex setups or constant monitoring.
3. Environments with Different Schedules: The development and testing environments are only used during business hours, while the production environment needs to remain operational 24/7. This distinction will help in deciding when to start or stop resources.
4. Tagging: Resources are tagged with environment tags (development, testing, production), which should be leveraged to identify which instances to stop or start.
Option-by-Option Breakdown:
A) Create an Amazon EventBridge rule that runs once every day. Configure the rule to invoke one AWS Lambda function that starts or stops instances based on the tag, day, and time.
- Problem: This approach doesn't take into account the business hours or the precise timing for starting or stopping instances. It only runs once a day, which means that instances would be started or stopped at a fixed time, potentially causing unnecessary downtime or continued operation during non-business hours. Additionally, stopping instances for the development and testing environments might interfere with unexpected testing needs.
B) Create an Amazon EventBridge rule that runs every business day in the evening. Configure the rule to invoke an AWS Lambda function that stops instances based on the tag. Create a second EventBridge rule that runs every business day in the morning. Configure the second rule to invoke another Lambda function that starts instances based on the tag.
- Correct: This approach is the most effective and automated. The first EventBridge rule stops the development and testing instances in the evening (after business hours), while the second rule starts them in the morning (before business hours). This minimizes operational costs by ensu...
Author: Manish · Last updated Jul 6, 2026
A company is building a software-as-a-service (SaaS) solution on AWS. The company has deployed an Amazon API Gateway REST API with AWS Lambda integration in multiple AWS Regions and in the same production account.
The company offers tiered pricing that gives customers the ability to pay for the capacity to make a certain number of API calls per second. The premium tier offers up to 3,000 calls per second, and customers are identified by a unique API key. Several premium tier customers in various Regions report that they...
To determine the cause of the error messages (429 Too Many Requests), we need to analyze the situation carefully. The key points are:
1. Error Code 429 - Too Many Requests: This typically indicates that the API Gateway is receiving more requests than it is able to handle at the given time, which can occur if the rate limit for the API is exceeded.
2. Lambda Function Not Invoked: The logs indicate that the Lambda function is not being invoked, which implies that the request is being throttled before it even reaches the Lambda function. This suggests the issue lies within API Gateway, not the Lambda function itself.
3. Premium Tier with Up to 3,000 Calls Per Second: This is important because the company is offering a tiered pricing model based on the number of API calls per second, meaning the customers are supposed to be able to make up to 3,000 calls per second, but they are experiencing throttling.
Now, let's evaluate the options based on this information:
A) The Lambda function reached its concurrency limit.
- Why it’s unlikely: The error code (429 Too Many Requests) indicates that the requests are being throttled at a point before the Lambda function is invoked. If the Lambda concurrency limit were reached, the error would typically be related to Lambda invocation failures, not throttling at the API Gateway level. Since the Lambda function is never invoked (as per the logs), this option is unlikely.
B) The Lambda function hit its Region limit for concurrency.
- Why it’s unlikely: Similar to Option A, if the Lambda concurrency limit was hit, we would expect an error related to Lambda throttling, such as "Rate Exceeded" errors in the...
Author: John · Last updated Jul 6, 2026
A financial company is planning to migrate its web application from on premises to AWS. The company uses a third-party security tool to monitor the inbound traffic to the application. The company has used the security tool for the last 15 years, and the tool has no cloud solutions available from its vendor. The company's security team is concerned about how to integrate the security tool with AWS technology.
The company plans to deploy the application migration to AWS on Amazon EC2 instances. The EC2 instances will run in an Auto Scaling group in a dedicated VPC. The company needs to use the security tool to inspect all packets that come in and out of the VPC. This inspectio...
To design a highly available and scalable architecture on AWS while integrating the third-party security tool with the web application, the solutions architect must focus on ensuring packet inspection without impacting performance, real-time traffic processing, and maintaining high availability within the AWS Region.
Here’s an analysis of each option:
A) Deploy the security tool on EC2 instances in a new Auto Scaling group in the existing VPC:
- Deploying the security tool on EC2 instances would allow the security tool to inspect traffic. However, this approach does not automatically scale or provide the most efficient packet inspection solution for high-performance environments.
- Auto Scaling helps with scaling EC2 instances, but this would still require complex configurations to ensure real-time inspection without affecting application performance.
- This option could be a component of the solution but does not directly address real-time packet inspection or the load balancing of the traffic.
B) Deploy the web application behind a Network Load Balancer (NLB):
- A Network Load Balancer operates at the connection level (Layer 4) and is highly suitable for handling large amounts of traffic with low latency. However, it would not directly integrate the third-party security tool into the inspection process.
- While the NLB is suitable for routing traffic to instances, it doesn't help integrate the security tool, which is needed for packet inspection. Thus, this option does not fully meet the requirement.
C) Deploy an Application Load Balancer in front of the security tool instances:
- An Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS), making it ideal for routing web traffic, but it is not intended for real-time, low-latency network traffic inspection.
- The security tool requires real-time packet inspection, which is best done at the network layer rather than at the application layer. This means using an ALB may introduce latency and isn't suitab...
Author: IronLion88 · Last updated Jul 6, 2026
A company has purchased appliances from different vendors. The appliances all have IoT sensors. The sensors send status information in the vendors' proprietary formats to a legacy application that parses the information into JSON. The parsing is simple, but each vendor has a unique format. Once daily, the application parses all the JSON records and stores the records in a relational databa...
To address the company's requirements for faster data analysis and cost optimization, it's essential to choose a solution that improves scalability, reduces complexity, and minimizes operational overhead. Let’s break down the options:
A) Connect the IoT sensors to AWS IoT Core. Set a rule to invoke an AWS Lambda function to parse the information and save a .csv file to Amazon S3. Use AWS Glue to catalog the files. Use Amazon Athena and Amazon QuickSight for analysis.
- Why it's a good choice:
- AWS IoT Core allows seamless integration with IoT devices, offering scalable and secure device communication.
- AWS Lambda can be triggered to process and parse the incoming IoT data in real-time. This removes the need for the legacy application and allows for more responsive, serverless processing.
- Amazon S3 is cost-effective for storing raw data and parsed files, and it can scale easily to handle large volumes of data.
- AWS Glue provides serverless ETL (Extract, Transform, Load) capabilities to catalog and prepare the data for analysis without needing complex infrastructure management.
- Amazon Athena allows you to run SQL queries directly on the data in S3 without having to move or transform it into a traditional database.
- Amazon QuickSight provides a simple, scalable BI (business intelligence) solution to analyze and visualize the data.
This solution is highly scalable, cost-effective, and leverages serverless components to minimize operational overhead, making it an optimal choice for faster data analysis.
B) Migrate the application server to AWS Fargate, which will receive the information from IoT sensors and parse the information into a relational format. Save the parsed information to Amazon Redshift for analysis.
- Why it's less optimal:
- AWS Fargate is a good option for running containerized applications, but in this case, it's unnecessary to deploy containers just to parse data. It adds complexity compared to serverless solutions like AWS Lambda.
- Amazon Redshift is a data warehouse and typically used for large-scale analytical workloads, but it's more expensive and requires management for scaling and maintenance, which could lead to higher costs compared to using a ...
Author: MoonlitPantherX · Last updated Jul 6, 2026
A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account.
The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate ...
To meet the requirements outlined, we need to ensure that:
1. The corporate network can access AWS resources seamlessly, which means integrating on-premises resources with multiple VPCs and AWS services.
2. The cloud resources should be routed to the internet through the on-premises data center for outbound traffic.
3. There must be a scalable solution to accommodate the expected large number of AWS accounts and VPCs.
Let's evaluate each option carefully based on these requirements:
A) Create a Direct Connect gateway in the central account. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway.
- Why it could work: A Direct Connect gateway enables you to connect multiple VPCs in different regions to your on-premises network through Direct Connect. The central network account can manage the Direct Connect gateway, and other accounts can associate their virtual private gateways (VGWs) with it.
- Why it's not sufficient: While this will allow communication between the corporate network and the VPCs, it doesn’t directly solve routing internet traffic through the on-premises data center. This approach does not address the need to route internet traffic through the corporate data center.
B) Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
- Why it works: The combination of a Direct Connect gateway and a Transit Gateway is a highly scalable solution. The Direct Connect gateway provides connectivity to the on-premises network, and the Transit Gateway facilitates inter-VPC communication across accounts and VPCs, offering a centralized management approach.
- Why it’s ideal: This solution enables a seamless network architecture that can scale as more accounts and VPCs are added. The Transit Gateway can be shared across accounts, and the Direct Connect gateway ensures all traffic flows securely between the on-premises network and AWS.
C) Provision an internet gateway. Attach the internet gateway to subnets. Allow internet traffic through the gateway.
- Why it’s not sufficient: An internet gateway is necessary for enabling direct internet access for VPCs, but in this case, the company requires routing internet traffic through its on-premises data center (not directly through AWS). So, this step would not meet the requirement of routing outbound traffic through the on-premises data center.
D) Share...
Author: Elijah · Last updated Jul 6, 2026
A company has hundreds of AWS accounts. The company recently implemented a centralized internal process for purchasing new Reserved Instances and modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement. Previously, business units directly purchased or modified Reserved Instances in their own respective AWS accounts autonomously.
...
To meet the company's requirements of enforcing a centralized process for purchasing or modifying Reserved Instances (RIs) securely, the solutions architect needs to design a solution that ensures that only the dedicated procurement team can perform these actions while preventing unauthorized accounts or business units from doing so. The solution must leverage AWS security features to enforce this restriction across hundreds of AWS accounts.
Let’s evaluate the options:
A) Ensure that all AWS accounts are part of an organization in AWS Organizations with all features enabled.
- Why this is selected:
- AWS Organizations allows you to manage multiple AWS accounts centrally. Enabling all features provides enhanced control over account permissions, such as using Service Control Policies (SCPs) to restrict actions across accounts.
- This approach is ideal for centralizing governance and enforcing policies across multiple accounts, making it easier to implement organization-wide restrictions on Reserved Instances actions.
B) Use AWS Config to report on the attachment of an IAM policy that denies access to the `ec2:PurchaseReservedInstancesOffering` action and the `ec2:ModifyReservedInstances` action.
- Why this is rejected:
- AWS Config can track configuration changes, but it doesn't enforce policies. It only provides visibility into whether the desired state is being adhered to. While it can report on non-compliant resources, it cannot prevent actions from being performed.
- For a solution that enforces restrictions (rather than just reporting), AWS Organizations and SCPs are more appropriate.
C) In each AWS account, create an IAM policy that denies the `ec2:PurchaseReservedInstancesOffering` action and the `ec2:ModifyReservedInstances` action.
- Why this is rejected:
- While creating individual IAM policies within each account can restrict actions, it requires manual effort in each account and could become difficult to manage at scale (especially with hundreds of accounts).
- This approach lacks centralization, making...
Author: Samuel · Last updated Jul 6, 2026
A company is running a critical application that uses an Amazon RDS for MySQL database to store data. The RDS DB instance is deployed in Multi-AZ mode.
A recent RDS database failover test caused a 40-second outage to the application. A solutions architect needs to design a solution to reduce the outage time ...
To address the requirement of reducing the downtime during an RDS failover event to less than 20 seconds, we need to focus on reducing the failover time and improving the application's availability during the transition between the primary and standby database instances. Let's analyze each option in terms of its potential to meet these requirements.
A) Use Amazon ElastiCache for Memcached in front of the database
- Why it’s not ideal: ElastiCache for Memcached can help with caching read-heavy workloads and reduce database load by storing frequently accessed data in memory. However, it does not directly reduce the RDS failover time or mitigate the application downtime caused during failover events. Since the failover involves transitioning the database instance from primary to standby, ElastiCache would not address this issue.
- Why rejected: While caching can improve performance, it does not directly impact the failover process or reduce downtime caused by RDS failover.
B) Use Amazon ElastiCache for Redis in front of the database
- Why it’s not ideal: Like Memcached, ElastiCache for Redis can be used for caching, which can reduce load on the database and provide fast data access. However, it doesn't directly address the RDS failover issue. It is primarily a caching solution, and it won't help reduce the database failover time or improve the failover process in RDS.
- Why rejected: While Redis can improve application performance, it doesn't reduce downtime during RDS failover events.
C) Use RDS Proxy in front of the database
- Why this works: RDS Proxy is a fully managed, highly available database proxy that sits between the application and the RDS database. It can help reduce failover time by maintaining persistent connections to the database and automatically redirecting traffic to the new primary instance after a failover occurs. It helps improve the application’s resilience by allowing it to continue making requests to the proxy without needing to reconnect to the new DB instance after failover.
- Why selected: RDS Proxy improves the application’s availability and minimizes downtime during failover by reducing connection retries and handling the failover process more smoothly. This solution directly addresses the requirement of reducing failover time.
D) Migrate the database to Amazon Aurora MySQL
- Why it could work: Amazon Aurora MySQL is designed for high availability and fault tolerance, with automatic failover between the primary instance and the replica....
Author: Julian · Last updated Jul 6, 2026
An AWS partner company is building a service in AWS Organizations using its organization named org1. This service requires the partner company to have access to AWS resources in a customer account, which is in a separate organization named org2. The company must establish least privilege security access ...
To establish secure, least-privilege access from the partner company (org1) to the customer account (org2) using AWS Organizations, the options must be evaluated based on security best practices and ease of management.
A) The customer should provide the partner company with their AWS account access keys to log in and perform the required tasks.
- Reasoning: Providing AWS access keys directly to the partner company is a poor security practice. It exposes the customer’s account credentials to external parties, which increases the risk of misuse or accidental exposure. Additionally, it is difficult to audit and manage these credentials at scale. This option does not align with least privilege principles and would be difficult to rotate or revoke if necessary.
- Rejected because: It does not align with best security practices for controlled, temporary, and auditable access.
B) The customer should create an IAM user and assign the required permissions to the IAM user. The customer should then provide the credentials to the partner company to log in and perform the required tasks.
- Reasoning: While creating an IAM user allows more control over permissions than using access keys directly, providing IAM credentials to a third party is still a risky practice. It can result in issues with credential rotation, auditing, and the potential for misuse. IAM users are also typically not ideal for cross-account access scenarios, as they are intended for users within a specific account.
- Rejected because: This option still exposes credentials to a third party and doesn't scale well for cross-account access in AWS Organizations.
C) The customer should create an IAM role and assign th...
Author: FlamePhoenix2025 · Last updated Jul 6, 2026
A delivery company needs to migrate its third-party route planning application to AWS. The third party supplies a supported Docker image from a public registry. The image can run in as many containers as required to generate the route map.
The company has divided the delivery area into sections with supply hubs so that delivery drivers travel the shortest distance possible from the hubs to the customers. To reduce the time necessary to generate route maps, each section uses its own set of Docker containers with a custom configuration that proce...
Let's evaluate each option based on the given requirements:
Key Considerations:
- Operational overhead: The solution should minimize manual management, automation, and scaling for container workloads.
- Cost-effectiveness: The solution must be able to scale resources efficiently based on demand.
- Custom configuration for each section: Each section will have its own set of containers, implying some degree of isolation or customization.
- Resource allocation: The solution should be flexible enough to allocate resources as containers are spun up or down.
A) Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2. Use the Amazon EKS CLI to launch the planning application in pods by using the --tags option to assign a custom tag to the pod.
- Reasoning: While EKS can provide robust container orchestration, it requires managing EC2 instances and configuring the Kubernetes environment, leading to increased operational overhead. Kubernetes also requires more setup and maintenance than ECS, and the manual management of EC2 instances could be a bottleneck.
- Rejected because: This approach introduces unnecessary complexity and operational overhead for the use case. Kubernetes with EC2 is more suited for large-scale, multi-cluster operations, which is not ideal here.
B) Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on AWS Fargate. Use the Amazon EKS CLI to launch the planning application. Use the AWS CLI tag-resource API call to assign a custom tag to the pod.
- Reasoning: Running EKS on Fargate removes the need to manage the underlying EC2 instances, which reduces operational overhead compared to the EC2 approach. However, Kubernetes still introduces complexity with management and configuration, which may not be ideal for this scenario. The use of `tag-resource` through the AWS CLI adds complexity that might not be necessary for the task.
- Rejected because: Although it reduces infrastructure management, it still carries...
Author: Elijah · Last updated Jul 6, 2026
A software company hosts an application on AWS with resources in multiple AWS accounts and Regions. The application runs on a group of Amazon EC2 instances in an application VPC located in the us-east-1 Region with an IPv4 CIDR block of 10.10.0.0/16. In a different AWS account, a shared services VPC is located in the us-east-2 Region with an IPv4 CIDR block of 10.10.10.0/24. When a cloud engineer uses AWS CloudF...
To understand the factors causing the error when attempting to peer the VPCs, let's analyze the situation step by step. The VPCs in question are located in different AWS accounts and Regions. The error message suggests that the peering attempt failed due to some misconfiguration. Here’s how each option might play a role in this issue:
A) The IPv4 CIDR ranges of the two VPCs overlap
- Why it could cause the error: VPC peering is not allowed if the IPv4 CIDR blocks of the two VPCs overlap. In the provided scenario, the application VPC has a CIDR block of 10.10.0.0/16, and the shared services VPC has a CIDR block of 10.10.10.0/24. The 10.10.0.0/16 block includes 10.10.10.0/24, which means the two CIDR blocks overlap.
- Why selected: This overlap causes the peering attempt to fail because AWS cannot establish a peering connection between VPCs with overlapping IP ranges. This is a fundamental constraint for VPC peering, so this is a valid reason for the failure.
B) The VPCs are not in the same Region
- Why it could cause the error: VPC peering can be established between VPCs in different regions (known as Inter-Region VPC Peering), but the error message does not necessarily indicate an issue with the Region. Peering between us-east-1 and us-east-2 is allowed as long as the VPCs meet the other requirements.
- Why rejected: The fact that the VPCs are in different regions (us-east-1 and us-east-2) should not cause the peering failure in this case, because AWS supports inter-region VPC peering. The error is more likely related to CIDR overlap or other configuration issues.
C) One or both accounts do not have access to an Internet gateway
- Why it’s not relevant: An Internet Gateway is used to allow VPCs to communicate with the public internet. However, VPC peering does not require an Internet gateway. The peering connection is about estab...
Author: Lucas Carter · Last updated Jul 6, 2026
An external audit of a company's serverless application reveals IAM policies that grant too many permissions. These policies are attached to the company's AWS Lambda execution roles. Hundreds of the company's Lambda functions have broad access permissions such as full access to Amazon S3 buckets and Amazon DynamoDB tables. The company wants each function to have only the minimum permissions that the function needs to complete its tas...
The goal is to reduce the overly broad IAM permissions attached to AWS Lambda execution roles by ensuring each Lambda function only has the permissions it requires for its specific tasks. We need a solution that minimizes effort while also being accurate and secure.
Key Requirements:
- Least amount of effort: The solution should minimize manual work and automate the identification of required permissions.
- Correct permissions: The solution must ensure the Lambda functions only have the necessary permissions for their tasks.
- Accurate assessment: The solution should accurately determine what API calls each Lambda function makes so that we can create more restrictive policies.
Option A: Set up Amazon CodeGuru to profile the Lambda functions and search for AWS API calls. Create an inventory of the required API calls and resources for each Lambda function. Create new IAM access policies for each Lambda function. Review the new policies to ensure that they meet the company's business requirements.
- Reasoning: Amazon CodeGuru is primarily used for application code analysis, especially for identifying performance bottlenecks and security vulnerabilities in application code. While it might provide some insights into API calls made by the Lambda functions, it is not the most effective tool for determining the exact permissions required by the Lambda execution roles. It does not directly analyze the IAM policies or API calls in the context of AWS service interactions.
- Rejected because: While CodeGuru is useful for application profiling, it does not directly help with identifying AWS service permissions or analyzing CloudTrail logs for Lambda-specific permissions.
Option B: Turn on AWS CloudTrail logging for the AWS account. Use AWS Identity and Access Management (IAM) Access Analyzer to generate IAM access policies based on the activity recorded in the CloudTrail log. Review the generated policies to ensure that they meet the company's business requirements.
- Reasoning: IAM Access Analyzer analyzes CloudTrail logs to help identify the permissions that have been used in the account. It is designed to help you identify the resources that are being accessed by specific entities, including Lambda execution roles. Using Access Analyzer with CloudTrail logs is an efficient way to generate permissions, but these generated policies might still need to be reviewed manually for compliance with business requirements.
- Selected because: This approach directly levera...
