Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company runs a processing engine in the AWS Cloud. The engine processes environmental data from logistics centers to calculate a sustainability index. The company has millions of devices in logistics centers that are spread across Europe. The devices send information to the processing engine through a RESTful API.
The API experiences unpredictable bursts of traffic. The company m...
Let's evaluate each option based on the following requirements:
Key Requirements:
1. Handling Unpredictable Bursts of Traffic: The solution must be able to scale efficiently during traffic bursts.
2. Data Loss is Unacceptable: The solution must ensure that no data is lost during processing, even in high-volume situations.
3. Scalability: The solution should automatically scale based on the incoming traffic.
4. Data Integrity and Processing: The solution must process data reliably and quickly.
Analyzing the Options:
- Option A: Create an Application Load Balancer (ALB) for the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create a listener and a target group for the ALB. Add the SQS queue as the target. Use a container that runs in Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to process messages in the queue.
- Why it’s rejected: Although this option uses SQS to handle unpredictable traffic and ECS for processing, it involves more complex infrastructure setup (ALB, ECS, Fargate). The ALB is unnecessary when you already have an API Gateway solution for handling RESTful APIs. This option introduces additional components that could complicate scaling, error handling, and maintenance.
- RTO Impact: The ALB and ECS layers might cause higher operational overhead and are less efficient for handling RESTful APIs compared to alternatives like API Gateway.
- Option B: Create an Amazon API Gateway HTTP API that implements the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create an API Gateway service integration with the SQS queue. Create an AWS Lambda function to process messages in the SQS queue.
- Why it works: This solution provides a highly scalable, fully managed API Gateway for handling RESTful API calls. The integration with Amazon SQS ensures that the data is queued for processing, and AWS Lambda allows for automatic scaling to process the data without worrying about server management. SQS ensures that data is not lost, as it provides durable message storage until Lambda processes it. The Lambda function can scale automatically based on the traffic, ensuring no data loss even during bursts.
- Why it’s the best: This solution is simple, scalable, and r...
Author: Sofia · Last updated Jul 6, 2026
A company is designing its network configuration in the AWS Cloud. The company uses AWS Organizations to manage a multi-account setup. The company has three OUs. Each OU contains more than 100 AWS accounts. Each account has a single VPC, and all the VPCs in each OU are in the same AWS Region.
The CIDR ranges for all the AWS accounts do not overlap. The company needs to implement a solution in which VPCs ...
To solve this problem, the goal is to allow communication between VPCs within the same organizational unit (OU) but restrict communication between VPCs in different OUs. We need to choose a solution that minimizes operational overhead and ensures scalability as the company manages hundreds of accounts across multiple OUs.
Let's analyze each option based on the requirements:
Option A: Create an AWS CloudFormation stack set that establishes VPC peering between accounts in each OU. Provision the stack set in each OU.
- Explanation: This option involves manually establishing VPC peering connections between accounts in each OU using CloudFormation.
- Pros: It is highly customizable and works well for small-scale configurations.
- Cons: With over 100 accounts per OU, this approach would become unmanageable due to the sheer volume of VPC peering connections that would need to be maintained. Each account would require multiple peering connections to other accounts, and managing peering connections at this scale would lead to high operational overhead. Additionally, peering does not inherently scale well across multiple OUs.
- Why Rejected: This solution doesn’t scale well for large numbers of accounts and introduces significant operational complexity.
Option B: In each OU, create a dedicated networking account that has a single VPC. Share this VPC with all the other accounts in the OU by using AWS Resource Access Manager (AWS RAM). Create a VPC peering connection between the networking account and each account in the OU.
- Explanation: This option uses AWS Resource Access Manager (AWS RAM) to share a single VPC in the networking account with the other accounts in the OU. Each account then establishes a VPC peering connection with the networking account.
- Pros: Centralizes the networking in a single account, which simplifies management compared to individual VPC peering. It also...
Author: VioletCheetah55 · Last updated Jul 6, 2026
A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large important documents within the application with the following requirements:
1. The data must be highly durable and available
2. The data must always be encrypted at rest and in transit
3. ...
Let's analyze each option based on the company's requirements:
Key Requirements:
1. Highly durable and available – The solution must provide high availability and durability for the data.
2. Encrypted at rest and in transit – The data must be encrypted both when it is stored and during transmission.
3. Encryption key management – The encryption key must be managed by the company and rotated periodically.
Option A: Deploy the storage gateway to AWS in file gateway mode. Use Amazon EBS volume encryption using an AWS KMS key to encrypt the storage gateway volumes.
- Explanation: In this option, you deploy an AWS Storage Gateway in file gateway mode, which connects on-premises applications to AWS storage. You would use Amazon EBS volumes for the Storage Gateway with EBS encryption enabled.
- Pros: The Storage Gateway offers an on-premises solution to access cloud storage, which is ideal for hybrid environments. EBS volumes can be encrypted with KMS-managed keys.
- Cons: This option introduces complexity because it is more suited for hybrid cloud scenarios, where you need to integrate on-premises data with AWS. It doesn’t provide the most seamless solution for purely cloud-based workloads and doesn't directly address the goal of using fully managed cloud-native services.
- Why Rejected: This option is less suited for purely cloud-native storage needs and doesn't meet the requirement for fully managed services as the company is migrating to AWS.
Option B: Use Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to enforce server-side encryption and AWS KMS for object encryption.
- Explanation: Amazon S3 is a highly durable and available object storage service. You can enforce encryption at rest by enabling server-side encryption with AWS KMS keys, and enforce HTTPS for secure transmission of data.
- Pros: S3 offers high durability (11 9's) and availability, fully managed encryption both at rest and in transit. S3 supports encryption key management via AWS KMS, and you can set bucket policies to enforce encryption and HTTPS. S3 also supports automatic key rotation via KMS.
- Cons: S3 is designed for object storage and might not be optimal for use cases requiring high-performance file storage or complex file systems.
- Why Selected: This solution is fully managed, scalable, and meets all...
Author: Aria · Last updated Jul 6, 2026
A company's public API runs as tasks on Amazon Elastic Container Service (Amazon ECS). The tasks run on AWS Fargate behind an Application Load Balancer (ALB) and are configured with Service Auto Scaling for the tasks based on CPU utilization. This service has been running well for several months.
Recently, API performance slowed down and made the application unusable. The company discovered that a significant number of SQL injection attacks had occurred against the API and that the API service had scaled to its maximum amount.
A solutions archite...
Let's analyze each option in detail, considering the goal of blocking SQL injection attacks while ensuring legitimate traffic can still pass through with minimal operational overhead:
Key Requirements:
1. Prevent SQL injection attacks – The primary goal is to prevent malicious requests from reaching the ECS API service.
2. Allow legitimate traffic – Legitimate users should not be impacted by the solution.
3. Maximize operational efficiency – The solution should be easy to implement, manage, and scale.
Option A: Create a new AWS WAF web ACL to monitor the HTTP requests and HTTPS requests that are forwarded to the ALB in front of the ECS tasks.
- Explanation: AWS WAF (Web Application Firewall) can be used to monitor incoming HTTP and HTTPS requests. A WAF web ACL (Access Control List) can be set up to filter and block suspicious traffic.
- Pros: AWS WAF is a fully managed service, easy to integrate with the ALB, and can block SQL injection attacks with predefined rules or custom rule sets.
- Cons: This option mentions monitoring traffic but doesn't provide specifics on how it will specifically block SQL injection attacks. Monitoring alone will not prevent the attacks effectively. Blocking needs to be part of the solution, and this option lacks clear rules to address the SQL injection vulnerability.
- Why Rejected: Monitoring alone isn’t sufficient; it doesn't actively prevent SQL injection attacks from reaching the ECS tasks.
Option B: Create a new AWS WAF Bot Control implementation. Add a rule in the AWS WAF Bot Control managed rule group to monitor traffic and allow only legitimate traffic to the ALB in front of the ECS tasks.
- Explanation: AWS WAF Bot Control is designed to identify and block bot traffic (e.g., automated scraping or attacks) based on behavior. This would help identify non-legitimate traffic patterns.
- Pros: Bot Control can be effective at blocking malicious bot traffic that might be responsible for SQL injection attacks.
- Cons: Bot Control primarily focuses on blocking bot traffic based on behavior patterns. While it may block some attack traffic, it is not specifically focused on blocking SQL injection attacks, and it may not be as precise as rules tailored to prevent SQL injection specifically.
- Why Rejected: This option is focused on blocking bots, which may not directly address SQL injection attacks, and may miss more sophisticated SQL injection techniques or legitimate non-bot traffic.
Option C: Create a new AWS WAF web ACL. Add a new rule that blocks requests that match the SQL database rule group. Set the web ACL to allow all other traffic that does not match those rules. Attach the w...
Author: Aditya · Last updated Jul 6, 2026
An environmental company is deploying sensors in major cities throughout a country to measure air quality. The sensors connect to AWS IoT Core to ingest timeseries data readings. The company stores the data in Amazon DynamoDB.
For business continuity, the company...
To design a solution that ingests and stores timeseries data in two AWS regions for business continuity, we need to ensure that the data can be reliably ingested from the sensors, stored in DynamoDB, and replicated across regions for high availability and fault tolerance. The solution must address two key aspects:
1. Ingest data from multiple regions – The IoT sensors will need to send data to AWS IoT Core endpoints in both regions.
2. Store and replicate the data across regions – The DynamoDB table needs to be replicated across regions to ensure high availability and business continuity.
Let's go through each option:
Option A: Create an Amazon Route 53 alias failover routing policy with values for AWS IoT Core data endpoints in both Regions. Migrate data to Amazon Aurora global tables.
- Explanation: This solution suggests using a failover routing policy for Route 53 to direct traffic to the IoT Core endpoints based on region availability. It also mentions migrating data to Amazon Aurora global tables.
- Pros: Aurora global tables provide cross-region replication and high availability, but it's a relational database service, not suitable for timeseries data.
- Cons: Aurora is not a good fit for storing timeseries data generated by sensors; DynamoDB is more appropriate for this use case due to its NoSQL nature and scalability. Additionally, using failover routing doesn’t meet the need for active-active data ingestion across regions.
- Why Rejected: Aurora isn’t the ideal storage solution for timeseries data, and the failover routing doesn't allow simultaneous ingestion in both regions. It introduces unnecessary complexity.
Option B: Create a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 latency-based routing policy. Use AWS IoT Core data endpoints in both Regions as values. Migrate the data to Amazon MemoryDB for Redis and configure cross-Region replication.
- Explanation: This option uses latency-based routing to direct traffic to the closest IoT Core data endpoint and suggests using MemoryDB for Redis for data storage with cross-region replication.
- Pros: Latency-based routing can help direct traffic to the closest IoT endpoint, which is good for reducing latency.
- Cons: MemoryDB for Redis is a highly available in-memory data store, but it is not suited for long-term, persistent storage of timeseries data. Additionally, Redis doesn't provide the same level of durability and scalability for timeseries data as DynamoDB does. Using Redis as the data store is not optimal for the business requirements.
- Why Rejected: MemoryDB is not designed for the use case of storing timeseries data and doesn’t offer the durability and...
Author: RadiantPhoenixX · Last updated Jul 6, 2026
A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company's finance team has a data processing application that uses AWS Lambda and Amazon DynamoDB. The company's marketing team wants to access the data that is stored in the DynamoDB table.
The DynamoDB table contains confidential data. The marketing team can have access to only specific attributes of data in the DynamoDB table. The fi...
Let's evaluate each option step by step based on the company's requirements:
Requirements:
- The marketing team needs access to the data stored in DynamoDB, but only specific attributes.
- The marketing team and office team are in separate AWS accounts.
- The data in DynamoDB contains confidential information, so fine-grained access control is required.
Option Analysis:
---
A) Create an SCP to grant the marketing team's AWS account access to the specific attributes of the DynamoDB table. Attach the SCP to the OU of the office team.
- Analysis:
- Service Control Policies (SCPs) are used to define the maximum permissions that accounts in an AWS Organization can have. SCPs are applied at the organizational unit (OU) level and govern account-wide permissions, but they do not allow for fine-grained control over specific attributes within a service like DynamoDB.
- SCPs can't limit access to specific DynamoDB attributes. They only apply to broader permissions (such as "can access DynamoDB"). SCPs cannot control access to specific items or attributes within the table.
- Conclusion: This option is not suitable because SCPs are too broad and cannot enforce attribute-level control.
---
B) Create an IAM role in the office team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access control). Establish trust with the marketing team's account. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the office team's account.
- Analysis:
- IAM roles allow cross-account access, and creating an IAM role in the office team’s account with a policy for fine-grained access control (using condition keys for DynamoDB) would allow the marketing team to assume the role and access specific data attributes.
- This solution uses trust relationships between the accounts, which is the correct approach for cross-account access.
- IAM policy conditions can indeed be used to limit access to specific attributes in DynamoDB, such as using the DynamoDB condition keys for `dynamodb:LeadingKeys` or `dynamodb:Attributes` to limit access to specific data elements.
- Conclusion: This is a valid solution that provides the necessary fine-grained control and uses cross-account access effectively.
---
C) Create a resource-based IAM policy that includes conditions for specific DynamoDB attributes (fine-grained access control). Attach the policy to the DynamoDB table. In the marketing team's account, create an IAM role that has permissions to access the DynamoDB table in the off...
Author: Emma · Last updated Jul 6, 2026
A solutions architect is creating an application that stores objects in an Amazon S3 bucket. The solutions architect must deploy the application in two AWS Regions that will be used simultaneously. The objects in the two S3 buckets must remain synchronized with each ot...
To meet the requirement of synchronizing objects between two Amazon S3 buckets in two AWS Regions with the least operational overhead, the best combination of options should ensure automatic synchronization while reducing the need for manual intervention or complex configurations.
Let's analyze each option:
A) Create an S3 Multi-Region Access Point and change the application to refer to the Multi-Region Access Point
- Reasoning: This option is highly suitable for applications that require access to multiple S3 buckets across regions but want the operational simplicity of managing a single endpoint. With Multi-Region Access Points, AWS automatically handles the routing of requests to the closest region. However, this does not replicate objects between the regions. It's a good choice for access optimization but does not meet the synchronization requirement.
- Conclusion: While beneficial for reducing complexity in accessing objects across regions, it does not solve the synchronization issue between the two S3 buckets.
B) Configure two-way S3 Cross-Region Replication (CRR) between the two S3 buckets
- Reasoning: Cross-Region Replication (CRR) allows the automatic replication of objects between two S3 buckets in different regions. Two-way replication ensures that updates in either bucket are synchronized to the other. This meets the synchronization requirement with minimal overhead and automation. It’s efficient, and once set up, it requires no further manual intervention.
- Conclusion: This is a perfect fit for the requirement to synchronize objects in both buckets automatically.
C) Modify the application to store objects in each S3 bucket
- Reasoning: Modifying the application to store objects in both S3 buckets means the application would directly upload objects to both regions. This introduces manual complexity and operational overhead because the application must manage the storage logic and handle the failure or availability issues in each region. This does not provid...
Author: Matthew · Last updated Jul 6, 2026
A company has an IoT platform that runs in an on-premises environment. The platform consists of a server that connects to IoT devices by using the MQTT protocol. The platform collects telemetry data from the devices at least once every 5 minutes. The platform also stores device metadata in a MongoDB cluster.
An application that is installed on an on-premises machine runs periodic jobs to aggregate and transform the telemetry and device metadata. The application creates reports that users view by using another web application that runs on the same on-premises machine. The periodic jobs take 120-600 seconds to...
To meet the company's requirements of moving the IoT platform to AWS while reducing operational overhead, we need to carefully choose solutions that are scalable, managed, and minimize maintenance efforts. Let's analyze each option:
A) Use AWS Lambda functions to connect to the IoT devices
- Reasoning: AWS Lambda functions are serverless, meaning they don't require the user to manage infrastructure. However, using Lambda to directly connect to IoT devices might not be the most optimal solution. Lambda is typically designed to respond to events (such as an S3 upload or an IoT Core message) rather than to maintain a persistent connection to IoT devices using MQTT. Maintaining persistent MQTT connections from Lambda could result in operational overhead and complexity.
- Conclusion: This approach is not ideal because Lambda is not designed for long-lived connections to IoT devices and might introduce unnecessary complexity.
B) Configure the IoT devices to publish to AWS IoT Core
- Reasoning: AWS IoT Core is a fully managed service that allows IoT devices to connect and securely transmit data to the cloud using MQTT, HTTP, or WebSockets. By configuring the IoT devices to publish directly to AWS IoT Core, the company can offload much of the management associated with maintaining connections to the devices, reducing operational overhead. IoT Core can then trigger actions such as storing data in other AWS services.
- Conclusion: This option is ideal because it simplifies the connection and communication with IoT devices, leveraging AWS's managed service that reduces operational complexity.
C) Write the metadata to a self-managed MongoDB database on an Amazon EC2 instance
- Reasoning: Managing a MongoDB database on an EC2 instance adds significant operational overhead. The company would have to manage the provisioning, patching, scaling, and availability of the MongoDB database. This increases the complexity and management burden compared to using a fully managed solution.
- Conclusion: This option is not ideal due to the high operational overhead involved in maintaining a self-managed database.
D) Write the metadata to ...
Author: Ethan · Last updated Jul 6, 2026
A global manufacturing company plans to migrate the majority of its applications to AWS. However, the company is concerned about applications that need to remain within a specific country or in the company's central on-premises data center because of data regulatory requirements or requirements for latency of single-digit milliseconds. The company also is concerned about the applications that it hosts in some of its factory sites, where limited network infrastructure exists.
The company wants a consistent developer experience so that its developers can build applications once a...
To meet the company's requirements for a consistent hybrid experience while addressing concerns about data regulatory requirements, latency, and limited network infrastructure in factory sites, the solution needs to allow the company to maintain applications both on-premises and in AWS. The solution should provide seamless tools, APIs, and services, ensuring a unified experience across on-premises, cloud, and hybrid environments.
Let's analyze each option:
A) Migrate all applications to the closest AWS Region that is compliant. Set up an AWS Direct Connect connection between the central on-premises data center and AWS. Deploy a Direct Connect gateway.
- Reasoning: AWS Direct Connect provides a dedicated network connection from on-premises data centers to AWS, reducing latency and improving bandwidth. However, this solution requires all applications to be migrated to AWS, which may not meet the requirement for applications that must remain in specific countries due to data regulatory requirements. It also doesn’t address the needs of applications in factory sites with limited network infrastructure.
- Conclusion: This option does not fully meet the requirement because it does not support applications that need to remain on-premises or in specific countries, nor does it solve the challenges of factory sites with limited infrastructure.
B) Use AWS Snowball Edge Storage Optimized devices for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Retain the devices on premises. Deploy AWS Wavelength to host the workloads in the factory sites.
- Reasoning: AWS Snowball Edge Storage Optimized devices are useful for local data storage and can run compute workloads with limited network connectivity, making them ideal for factory sites with limited infrastructure. However, Snowball Edge Storage Optimized devices are primarily for edge storage and do not offer the flexibility required for running complex applications that need low-latency compute. AWS Wavelength, which extends AWS infrastructure to telecom networks, is a good solution for low-latency applications in specific geographical locations, especially for factory sites.
- Conclusion: While Snowball...
Author: Emily · Last updated Jul 6, 2026
A company is updating an application that customers use to make online orders. The number of attacks on the application by bad actors has increased recently.
The company will host the updated application on an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use Amazon DynamoDB to store application data. A public Application Load Balancer (ALB) will provide end users with access to the application. The company must prevent ...
To meet the company's requirements of preventing attacks, ensuring business continuity, and minimizing service interruptions during an ongoing attack, we need to implement cost-effective, scalable, and secure measures. Let's go over each option and its reasoning:
A) Create an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and random value on the CloudFront domain. Configure the ALB to conditionally forward traffic if the header and value match.
- Reasoning: CloudFront, a Content Delivery Network (CDN), can provide additional security by acting as a reverse proxy for the ALB, offering DDoS protection (via AWS Shield). Adding custom headers and conditional forwarding can help ensure that only legitimate traffic is passed to the ALB. However, this solution adds complexity to the architecture by introducing custom headers and conditional logic, which may not be necessary for basic security protection.
- Conclusion: While useful for enhancing security, this approach introduces additional complexity and does not directly address the core need for protecting the application during an attack in a straightforward manner.
B) Deploy the application in two AWS Regions. Configure Amazon Route 53 to route to both Regions with equal weight.
- Reasoning: Deploying the application in two regions can enhance availability and redundancy, ensuring business continuity in case one region becomes unavailable due to an attack or other issues. However, this approach significantly increases costs because it involves running duplicate infrastructure in multiple regions, which may not be necessary if we can protect the application more effectively with other services.
- Conclusion: While this improves availability, it introduces higher operational and cost complexity, and is likely an over-engineered solution to meet the company's needs. This is not the most cost-effective option for handling attacks and ensuring business continuity.
C) Configure auto scaling for Amazon ECS tasks. Create a DynamoDB Accelerator (DAX) cluster.
- Reasoning: Auto scaling ECS tasks ensures that the application can handle fl...
Author: Rohan · Last updated Jul 6, 2026
A company runs a web application on AWS. The web application delivers static content from an Amazon S3 bucket that is behind an Amazon CloudFront distribution. The application serves dynamic content by using an Application Load Balancer (ALB) that distributes requests to a fleet of Amazon EC2 instances in Auto Scaling groups. The application uses a domain name setup in Amazon Route 53.
Some users reported occasional issues when the users attempted to access the website during peak hours. An operations team found that the ALB sometimes returned HTTP 503 Service U...
To meet the company's requirements of displaying a custom error message page when an HTTP 503 Service Unavailable error occurs, and to do so with minimal operational overhead, we need to consider solutions that efficiently integrate with the existing architecture without adding complexity or requiring significant changes.
Let's analyze each option:
A) Set up a Route 53 failover routing policy. Configure a health check to determine the status of the ALB endpoint and to fail over to the failover S3 bucket endpoint.
- Reasoning: This solution involves setting up a failover routing policy in Route 53 that would reroute traffic to a secondary S3 bucket if the ALB is unhealthy. This could work, but it introduces unnecessary complexity in routing traffic away from the ALB entirely during failures. Moreover, it does not provide the ability to display the custom error page immediately after a 503 error, as it would require routing all traffic to the secondary bucket, which might not be necessary.
- Conclusion: This option is more complex and introduces unnecessary failover logic, and it does not directly address the custom error page requirement. It is not the most efficient or low-overhead solution.
B) Create a second CloudFront distribution and an S3 static website to host the custom error page. Set up a Route 53 failover routing policy. Use an active-passive configuration between the two distributions.
- Reasoning: This solution involves creating a second CloudFront distribution with an S3 bucket to host the custom error page and setting up a failover routing policy. While this might work, it involves creating an entire secondary CloudFront distribution and managing the failover process, which is complex and requires ongoing maintenance. This solution also may not be necessary, as the primary CloudFront distribution could already handle errors.
- Conclusion: This solution introduces significant additional complexity and operational overhead for hosting and managing multiple distributions. It is not the most cost-effective or low-overhead solution.
C) Create a CloudFront origin group...
Author: Kunal · Last updated Jul 6, 2026
A company is planning to migrate an application to AWS. The application runs as a Docker container and uses an NFS version 4 file share.
A solutions architect must design a secure and scalable containerized solution that does not require pro...
To design a secure and scalable containerized solution without managing infrastructure, the following key factors should be considered:
1. No infrastructure management: The solution must avoid manual provisioning or management of servers or storage.
2. Secure and scalable storage: The storage solution must be secure and scalable, particularly since the application uses NFS.
3. Container orchestration: The solution must use a container service that supports orchestration, scaling, and easy management of Docker containers.
Let’s evaluate each option:
Option A: Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon Elastic File System (Amazon EFS) for shared storage.
- Amazon ECS with Fargate allows serverless deployment where there is no need to provision or manage underlying EC2 instances. Fargate automatically handles the infrastructure for you.
- Amazon EFS is a fully managed, scalable, and highly available NFS file system that can be easily mounted to Fargate tasks. It supports NFS version 4, which aligns with the requirements of the application’s file share.
- This option fits the requirement for secure and scalable containerization without manual infrastructure management.
Option B: Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon FSx for Lustre for shared storage.
- Amazon FSx for Lustre is a high-performance file system, optimized for workloads like machine learning or big data. It is not typically used for NFS workloads unless there's a specific need for high-performance computing.
- While FSx for Lustre offers scalable storage, it is not the ideal choice for typical containerized applications that need standard f...
Author: ElectricLionX · Last updated Jul 6, 2026
A company is running an application in the AWS Cloud. The core business logic is running on a set of Amazon EC2 instances in an Auto Scaling group. An Application Load Balancer (ALB) distributes traffic to the EC2 instances. Amazon Route 53 record api.example.com is pointing to the ALB.
The company's development team makes major updates to the business logic. The company has a rule that when changes are deployed, only 10% of customers can receive t...
To deploy updates to the application while adhering to the rule of directing only 10% of customers to the new logic during the testing window, we need to focus on controlling how traffic is routed to the updated EC2 instances running the new business logic. We must also ensure that a customer consistently uses the same version of the business logic during their session.
Let's evaluate each option:
Option A: Create a second ALB, and deploy the new logic to a set of EC2 instances in a new Auto Scaling group. Configure the ALB to distribute traffic to the EC2 instances. Update the Route 53 record to use weighted routing, and point the record to both of the ALBs.
- Explanation: This approach involves creating a second ALB, deploying the updated logic to a new set of EC2 instances, and using Route 53 weighted routing to distribute traffic between the two ALBs.
- Drawbacks:
- Using two ALBs could lead to increased complexity and cost.
- Managing multiple ALBs for this simple scenario can add unnecessary overhead.
- While weighted routing with Route 53 is feasible for splitting traffic, it's not the best fit for ensuring session stickiness.
- Rejection reason: The use of two ALBs is more complex than necessary, and it does not address session consistency effectively.
Option B: Create a second target group that is referenced by the ALB. Deploy the new logic to EC2 instances in this new target group. Update the ALB listener rule to use weighted target groups. Configure ALB target group stickiness.
- Explanation: This option adds a second target group to the existing ALB, and updates the listener rule to distribute traffic based on weights. It also ensures stickiness, meaning a user will always be directed to the same version of the application during their session.
- Advantages:
- This approach uses a single ALB, which is simpler and more cost-effective than using multiple ALBs.
- Weighted routing via target groups allows control over how much traffic goes to the new version.
- Stickiness ensures that a customer consistently uses the same version of the application during the testing window.
- Why this option works: This option allows for controlled traffic distribution (10% to the new...
Author: VenomousSerpent42 · Last updated Jul 6, 2026
A large education company recently introduced Amazon Workspaces to provide access to internal applications across multiple universities. The company is storing user profiles on an Amazon FSx for Windows File Server file system. The file system is configured with a DNS alias and is connected to a self-managed Active Directory. As more users begin to use the Workspaces, login time increases to unacceptable levels.
An investigation reveals a degradation in performance of the file system. The company created the file system on HDD storage with a...
To address the issue of increasing login times and performance degradation of the file system, the solution must focus on improving the storage type (from HDD to SSD) and throughput (from 16 MBps to 32 MBps). The main goal is to improve file system performance with the least administrative effort while minimizing user disruption. Let’s evaluate each option:
Option A: Use AWS Backup to create a point-in-time backup of the file system. Restore the backup to a new FSx for Windows File Server file system. Select SSD as the storage type. Select 32 MBps as the throughput capacity. When the backup and restore process is completed, adjust the DNS alias accordingly. Delete the original file system.
- Explanation: This option creates a backup of the current file system, restores it to a new file system with SSD storage and increased throughput, and then adjusts the DNS alias.
- Advantages:
- It allows you to maintain the current file system while the new system is being prepared.
- The backup and restore approach ensures no data is lost during the transition.
- Drawbacks:
- Backup and restore introduces additional steps and potential delays. It also requires a new file system to be created, which can involve extra administrative tasks.
- There could be some downtime required for DNS propagation and making the final switch, which could affect users.
- Rejection reason: While this option works, it involves creating an entirely new file system and restoring data, which might require more administrative effort compared to simply modifying the existing file system.
Option B: Disconnect users from the file system. In the Amazon FSx console, update the throughput capacity to 32 MBps. Update the storage type to SSD. Reconnect users to the file system.
- Explanation: This option simply involves modifying the existing file system to increase throughput and change the storage type to SSD.
- Advantages:
- Minimal effort: You can make the changes directly on the existing file system without needing to create new file systems or restore backups.
- No data migration: No need to move data to another file system, and the changes can be made during the maintenance window.
- Drawbacks:
- Requires disconnecting users, which could affect their work if the downtime is not scheduled properly.
- There could be a slight risk of issues during the modification, though this is minimal.
- Why this works: This is the simplest and most efficient option as it improves the performance of the existing file system without requiring the creation of a new file system. It mee...
Author: Liam · Last updated Jul 6, 2026
A company hosts an application on AWS. The application reads and writes objects that are stored in a single Amazon S3 bucket. The company must modify the application to deploy the application in two AWS Reg...
To meet the requirements of deploying an application across two AWS Regions with minimal operational overhead while managing objects in an S3 bucket, we need to consider options that allow the application to seamlessly access and modify objects stored in a centralized location, while minimizing complexity and manual management. Let’s evaluate each option:
Option A: Set up an Amazon CloudFront distribution with the S3 bucket as an origin. Deploy the application to a second Region. Modify the application to use the CloudFront distribution. Use AWS Global Accelerator to access the data in the S3 bucket.
- Explanation: This approach uses CloudFront as a CDN to distribute the S3 bucket contents and AWS Global Accelerator to optimize global access. The application in each region accesses data via CloudFront, with Global Accelerator improving performance and availability.
- Drawbacks:
- This solution requires additional components such as CloudFront and Global Accelerator, which can add complexity to the architecture.
- CloudFront caches content, which is ideal for read-heavy applications but may not be well-suited for applications that frequently write or modify data, as the cache might not immediately reflect changes made to the S3 bucket.
- This option adds operational overhead to manage CloudFront and Global Accelerator configurations, especially for write-heavy workloads.
- Rejection reason: While this option improves access performance, it introduces additional complexity and may not be the best solution for applications that require frequent writes to the S3 bucket.
Option B: Create a new S3 bucket in a second Region. Set up bidirectional S3 Cross-Region Replication (CRR) between the original S3 bucket and the new S3 bucket. Configure an S3 Multi-Region Access Point that uses both S3 buckets. Deploy a modified application to both Regions.
- Explanation: This solution involves using S3 Cross-Region Replication (CRR) to replicate objects between two S3 buckets across different Regions. Then, an S3 Multi-Region Access Point is configured to seamlessly access objects from both buckets in the application.
- Advantages:
- S3 Multi-Region Access Point simplifies managing objects across multiple Regions and provides seamless access to data from the closest bucket in each Region.
- CRR ensures data consistency and replication between the S3 buckets across Regions.
- This solution ensures the application can access and modify data in a high-availability manner with minimal operational effort.
- Why this works: It provides a highly scalable and resilient solution with low operational overhead. The app...
Author: David · Last updated Jul 6, 2026
An online gaming company needs to rehost its gaming platform on AWS. The company's gaming application requires high performance computing (HPC) processing and has a leaderboard that changes frequently. An Ubuntu instance that is optimized for compute generation hosts a Node.js application for game display. Game state is tracked in an on-premis...
The gaming company needs to rehost its platform with a solution that supports high performance computing (HPC) and maintains the leaderboard efficiently. The solution should optimize application performance, particularly for the real-time leaderboard, which changes frequently.
Option A: Create an Auto Scaling group of m5.large Amazon EC2 Spot Instances behind an Application Load Balancer. Use an Amazon ElastiCache for Redis cluster to maintain the leaderboard.
- Explanation:
- The m5.large EC2 instances are optimized for general-purpose compute, but they may not offer the best performance for HPC workloads, which require high computational power.
- Spot instances are cost-effective but may be terminated by AWS, which could lead to potential disruptions in a gaming environment, especially when handling real-time game state.
- ElastiCache for Redis is a good choice for a real-time, high-speed leaderboard since Redis is an in-memory data store designed for low-latency access.
- Drawbacks:
- Spot instances are not ideal for workloads requiring consistent, high performance due to potential instance terminations.
- m5.large instances are not the best for HPC workloads.
Option B: Create an Auto Scaling group of c5.large Amazon EC2 Spot Instances behind an Application Load Balancer. Use an Amazon OpenSearch Service cluster to maintain the leaderboard.
- Explanation:
- The c5.large EC2 instances are optimized for compute-intensive workloads (HPC), which is suitable for gaming applications requiring high performance.
- OpenSearch Service is a search and analytics engine, more suited for full-text search, logging, and indexing rather than real-time data like a leaderboard.
- Drawbacks:
- OpenSearch is not designed for low-latency, in-memory key-value stores like Redis, making it a poor fit for the real-time leaderboard requirements.
- The use of Spot instances still introduces potential risks due to termination, as discussed earlier.
Option C: Create an Auto Scaling group of c5.large Amazon EC2 On-Demand Instances behind an Applic...
Author: Henry · Last updated Jul 6, 2026
A solutions architect is designing an application to accept timesheet entries from employees on their mobile devices. Timesheets will be submitted weekly, with most of the submissions occurring on Friday. The data must be stored in a format that allows payroll administrators to run monthly reports. The infrastructure must be highly available and scale to match t...
Reasoning:
To meet the requirements of high availability, scalability, and minimal operational overhead, we should focus on services that handle scaling automatically, reduce management overhead, and integrate well with serverless or managed services. Additionally, considering the timing of the application’s peak load (high volume on Fridays), it is important to design a solution that can scale dynamically and efficiently.
Analyzing each option:
A) Deploy the application to Amazon EC2 On-Demand Instances with load balancing across multiple Availability Zones. Use scheduled Amazon EC2 Auto Scaling to add capacity before the high volume of submissions on Fridays.
- Rejected: This option requires the management of EC2 instances, which involves more operational overhead (e.g., patching, scaling configurations, and instance monitoring). While it could handle scaling during peak times with Auto Scaling, it still requires more manual management compared to serverless options, which is not ideal for minimizing overhead.
B) Deploy the application in a container using Amazon Elastic Container Service (Amazon ECS) with load balancing across multiple Availability Zones. Use scheduled Service Auto Scaling to add capacity before the high volume of submissions on Fridays.
- Rejected: While ECS can scale and provides a flexible containerized approach, it still requires managing container orchestration. Containers can be useful for high traffic, but they still introduce overhead in terms of maintaining the containers, scaling configurations, and resource management. For reducing operational complexity, fully managed serverless options are better suited.
C) Deploy the application front end to an Amazon S3 bucket served by Amazon CloudFront. Deploy the application backend using Amazon API Gateway with an AWS Lambda proxy integration.
- Selected: This solution uses serverless componen...
Author: MoonlitPantherX · Last updated Jul 6, 2026
A company is storing sensitive data in an Amazon S3 bucket. The company must log all activities for objects in the S3 bucket and must keep the logs for 5 years. The company's security team also must receive an email notification every time there is an attempt to delete dat...
Reasoning:
To meet the requirements of logging S3 activities, storing logs for 5 years, and notifying the security team when data is deleted, the solution needs to address the following:
1. Logging all object activities (specifically deletions) in S3.
2. Storing the logs for 5 years.
3. Providing notifications for deletion events.
4. Doing this in a cost-effective manner, minimizing both complexity and cost.
Analyzing each option:
A) Configure AWS CloudTrail to log S3 data events.
- Selected: AWS CloudTrail logs S3 data events and is a great fit for logging object-level activity, such as the deletion of files. CloudTrail records these events, which can be kept for an extended period, and are easily searchable for auditing purposes. CloudTrail is also tightly integrated with other AWS services like Amazon SNS for notifications, making it both highly effective and cost-efficient for this use case.
B) Configure S3 server access logging for the S3 bucket.
- Rejected: While S3 server access logging records request-level activity (such as object creation, retrieval, and deletion), it does not capture detailed data-level events. For example, it may not log every individual delete request or the specific user responsible for the deletion. It's also not ideal for meeting the 5-year log retention requirement because it requires additional manual processes to ensure proper lifecycle management and storage of logs for that long.
C) Configure Amazon S3 to send object deletion events to Amazon Simple Email Service (Amazon SES).
- Rejected: While SES can be used to send email notifications, it is not the best fit for triggering actions based on S3 events. S3 does not directly support sending object del...
Author: GlowingTiger · Last updated Jul 6, 2026
A company is building a hybrid environment that includes servers in an on-premises data center and in the AWS Cloud. The company has deployed Amazon EC2 instances in three VPCs. Each VPC is in a different AWS Region. The company has established an AWS Direct. Connect connection to the data center from the Region that is closest to the data center.
The company needs the servers in the on-premises data center to have access to the EC2 instances in al...
Requirements:
1. Access to EC2 instances in three VPCs across different AWS Regions from the on-premises data center.
2. Access to AWS public services from the on-premises servers.
3. Cost minimization: The solution should be cost-effective.
Let's evaluate each option based on these requirements.
---
A) Create a Direct Connect gateway in the Region that is closest to the data center. Attach the Direct Connect connection to the Direct Connect gateway. Use the Direct Connect gateway to connect the VPCs in the other two Regions.
- Analysis:
- Direct Connect Gateway allows a single Direct Connect connection to be used across multiple VPCs, even if they are in different AWS Regions. This is the most efficient way to connect VPCs across regions without setting up multiple Direct Connect connections.
- By using a Direct Connect gateway, the data center can connect to all three VPCs in different regions with one connection.
- This approach avoids additional costs associated with creating separate Direct Connect connections to other regions.
- Conclusion: This is a cost-effective solution and is ideal for cross-region connectivity without needing separate connections.
---
B) Set up additional Direct Connect connections from the on-premises data center to the other two Regions.
- Analysis:
- Setting up additional Direct Connect connections for each region incurs additional costs for each new connection.
- This would not be cost-effective because the company already has a Direct Connect connection in the closest region and can utilize a Direct Connect Gateway to connect to other regions.
- Conclusion: This option is more expensive and less optimal than option A, as it involves extra connections and higher costs.
---
C) Create a private VIF. Establish an AWS Site-to-Site VPN connection over the private VIF to the VPCs in the other two Regions.
- Analysis:
- A private Virtual Interface (VIF) provides a dedicated connection between the on-premises data center and AWS. However, Site-to-Site VPN is generally used for backup or additional secure communication over the internet and introduces additional costs and complexity for maintaining VPN tunnels.
- A VPN over Direct Connect does not provide the same bandwidth or reliability as using Direct Connect itself, and usin...
Author: Liam · Last updated Jul 6, 2026
A company is using an organization in AWS Organizations to manage hundreds of AWS accounts. A solutions architect is working on a solution to provide baseline protection for the Open Web Application Security Project (OWASP) top 10 web application vulnerabilities. The solutions architect is using AWS WAF for all existing and new Amazon CloudFront distributions tha...
Reasoning:
The company is looking to provide baseline protection for the OWASP Top 10 vulnerabilities across all its AWS accounts using AWS WAF in Amazon CloudFront distributions. The solution should be designed to automatically deploy and enforce these protections while minimizing operational overhead and ensuring consistency across the organization.
Analyzing each option:
A) Enable AWS Config in all accounts.
- Rejected: AWS Config is useful for tracking configurations and compliance across AWS resources, but it is not directly related to deploying or enforcing WAF rules. While it can be used for auditing and ensuring compliance, it does not address the deployment of AWS WAF protections for the CloudFront distributions or mitigate web application vulnerabilities like the OWASP Top 10.
B) Enable Amazon GuardDuty in all accounts.
- Rejected: Amazon GuardDuty is a threat detection service that provides continuous monitoring for malicious or unauthorized activity in AWS accounts, but it does not directly address the OWASP Top 10 vulnerabilities or enforce WAF protections. GuardDuty can detect some types of malicious activity, but it is not specifically focused on application-layer vulnerabilities, which AWS WAF is designed to handle.
C) Enable all features for the organization.
- Rejected: This option is too vague and lacks specificity. Enabling "all features" in AWS Organizations could refer to a broad range of services that may not be directly related to deploying AWS WAF rules for CloudFront distributions. While enabling features could help with management, it doesn't specifically provide the baseline protection for web application vulnerabilities.
D) Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions.
- Selected: AWS Firewall Manager is a security management service that simplifies the administration of AWS WAF rul...
Author: Emma · Last updated Jul 6, 2026
A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web po...
Reasoning:
In a federated identity setup using SAML 2.0 with AWS, the solution architect needs to ensure that all elements are configured correctly to allow authenticated access to AWS resources. The issue arises because the test users can authenticate successfully through the web portal, but they are unable to access the AWS environment. The solution architect needs to investigate several areas that could potentially be misconfigured. Below is the analysis of each option.
Analyzing each option:
A) The IAM user's permissions policy has allowed the use of SAML federation for that user.
- Rejected: IAM users do not typically have specific permissions for SAML federation. Instead, the federation configuration relies on IAM roles that are assumed via the SAML assertion. The IAM role should trust the SAML identity provider (IdP), and the permissions are granted via those roles. The problem is likely not with the IAM user's permissions policy but with the configuration of the IAM roles or trust policies.
B) The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal.
- Selected: The IAM role's trust policy must correctly reference the SAML provider as a trusted entity. If the test users cannot access AWS, this could be due to a misconfiguration in the IAM role's trust policy, where the SAML provider is not properly set as the principal. The role should allow the federated user to assume it, and this is governed by the trust relationship between the IAM role and the SAML IdP.
C) The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP.
- Selected: The AssumeRoleWithSAML API must be called correctly for the federation to work. This API requires the SAML assertion provided by the ...
Author: Vikram · Last updated Jul 6, 2026
A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application's operations insert records into the database. The application currently stores credentials in a text-based configuration file.
The solutions architect needs to implement a solution so that the application can handle the current connec...
To address the requirements in the scenario, let's break down each option and the reasons behind selecting or rejecting them.
A) Deploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager.
- Amazon RDS Proxy helps manage database connections efficiently by pooling and reusing connections. This reduces the load on the database and ensures that the application can scale better under high connection demand. Using RDS Proxy addresses the problem of "overloaded connections" by improving the application's ability to handle a high number of concurrent connections without overwhelming the Aurora MySQL DB instance.
- AWS Secrets Manager is a robust solution for managing and rotating credentials securely. It can automatically rotate credentials, which is an essential requirement in this case to meet security and compliance needs.
- Why it's selected: This option solves both issues—overloaded connections and insecure storage of credentials. The use of RDS Proxy addresses the load on the database, while storing credentials securely and automating their rotation through Secrets Manager ensures security.
B) Deploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials in AWS Systems Manager Parameter Store.
- AWS Systems Manager Parameter Store can store sensitive information securely, but it does not natively support automatic credential rotation as seamlessly as Secrets Manager does. While you can use Lambda functions to rotate credentials manually, it’s not as automated and integrated as with Secrets Manager.
- Why rejected: While it addresses the connection overload issue, storing credentials in Sy...
Author: Aarav2020 · Last updated Jul 6, 2026
A company needs to build a disaster recovery (DR) solution for its ecommerce website. The web application is hosted on a fleet of t3.large Amazon EC2 instances and uses an Amazon RDS for MySQL DB instance. The EC2 instances are in an Auto Scaling group that extends across multiple Availability Zones.
In the event of a disaster, the web application must fail...
To determine the most cost-effective and suitable disaster recovery (DR) solution, let’s analyze each option based on the requirements and the associated cost, RPO, and RTO.
A) Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up a backup plan in AWS Backup to create cross-Region backups for the EC2 instances and the DB instance. Create a cron expression to back up the EC2 instances and the DB instance every 30 seconds to the DR Region. Recover the EC2 instances from the latest EC2 backup. Use an Amazon Route 53 geolocation routing policy to automatically fail over to the DR Region in the event of a disaster.
- Cost Considerations: This option involves setting up backups for EC2 instances and RDS, which can result in storage costs, but there are no continuous replication mechanisms like AWS Elastic Disaster Recovery or Aurora global databases, so it is relatively cost-effective.
- RPO and RTO Considerations: The cron-based backup plan for EC2 and DB instances every 30 seconds is a potential challenge. AWS Backup does not natively support near-real-time replication or automatic failover in the event of a disaster. Restoring backups every 30 seconds might not meet the strict 30-second RPO, and restoring EC2 instances from backup would typically take more than 10 minutes, potentially breaching the 10-minute RTO.
- Why rejected: The solution's approach of using periodic backups and manual recovery does not meet the RPO and RTO requirements effectively.
B) Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the EC2 instances at the minimum capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster.
- Cost Considerations: This option uses AWS Elastic Disaster Recovery (AWS DRS) for continuous replication, which might involve higher costs due to replication and storage in the DR region, as well as the cost of running EC2 instances at minimum capacity in the DR Region.
- RPO and RTO Considerations: Elastic Disaster Recovery replicates EC2 instances with minimal lag and enables the instances to be up and running quickly in the DR Region. Running EC2 instances at minimum capacity in the DR Region ensures that the infrastructure is ready to scale immediately in case of failover, which meets the 10-minute RTO requirement. Using a read replica for the DB ensures that the data is continuously replicated and readily available, achieving the desired 30-second RPO.
- Why it's selected: This option uses AWS DRS for efficient continuous replication and ensures ...
Author: Ella · Last updated Jul 6, 2026
A company is planning a one-time migration of an on-premises MySQL database to Amazon Aurora MySQL in the us-east-1 Region. The company's current internet connection has limited bandwidth. The on-premises MySQL database is 60 TB in size. The company estimates that it will take a month to transfer the data to AWS over the current internet connection. The...
Let's evaluate the options based on the requirement to migrate a 60 TB MySQL database quickly while considering the bandwidth constraints and the best use of AWS services for large data transfers.
A) Request a 1 Gbps AWS Direct Connect connection between the on-premises data center and AWS. Use AWS Database Migration Service (AWS DMS) to migrate the on-premises MySQL database to Aurora MySQL.
- Bandwidth Consideration: A 1 Gbps Direct Connect connection would provide 1 Gbps of transfer speed. The total data size is 60 TB. To transfer 60 TB at 1 Gbps would take a long time, around 4.5 days (60 TB / (1 Gbps 60 seconds per minute 60 minutes per hour 24 hours per day)).
- AWS DMS Consideration: AWS DMS helps in migrating the database, but it is limited by the bandwidth of the connection, which in this case is 1 Gbps. Given the large size of the database, the time required for transfer remains significant, and using DMS for this migration may still not meet the required speed compared to physical data transfer solutions.
- Why rejected: While AWS Direct Connect offers a stable connection, the transfer time of 4+ days is still far from ideal, and it may still take weeks depending on the sustained throughput.
B) Use AWS DataSync with the current internet connection to accelerate the data transfer between the on-premises data center and AWS. Use AWS Application Migration Service to migrate the on-premises MySQL database to Aurora MySQL.
- DataSync Consideration: AWS DataSync accelerates data transfer between on-premises and AWS, but it still relies on the current internet connection. If the internet connection is the bottleneck, DataSync would not significantly improve the transfer speed compared to the previous solution, since it can't overcome the bandwidth limitations.
- AWS Application Migration Service Consideration: Application Migration Service is more suited for large-scale server migrations, but it is not specifically designed for databases. It is better for full server migrations, not for database-specific workloads like MySQL migration.
- Why rejected: Using the current internet connection, even with DataSync, will still be limited by bandwidth constraints and will not provide the speed needed to migrate 60 TB in a reasonable time frame.
C) Order an AWS Snowball Edge device. Load the data into an Amazon S3 bucket by using the S3 interface. Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazo...
Author: Ethan Smith · Last updated Jul 6, 2026
A company has an application in the AWS Cloud. The application runs on a fleet of 20 Amazon EC2 instances. The EC2 instances are persistent and store data on multiple attached Amazon Elastic Block Store (Amazon EBS) volumes.
The company must maintain backups in a separate AWS Region. The company must be able to recover the EC2 instances and their configuration within 1 business day, with loss of no more than 1 day's worth of data. The company has limited staff and needs a backup solution that optimize...
To determine the best solution for maintaining backups of EC2 instances and meeting the recovery objectives of 1 business day and no more than 1 day's worth of data loss, let's analyze each option based on operational efficiency, cost, and feasibility.
A) Create a second CloudFormation template that can recreate the EC2 instances in the secondary Region. Run daily multivolume snapshots by using AWS Systems Manager Automation runbooks. Copy the snapshots to the secondary Region. In the event of a failure, launch the CloudFormation templates, restore the EBS volumes from snapshots, and transfer usage to the secondary Region.
- Operational Efficiency: The use of AWS Systems Manager Automation runbooks and snapshots is operationally intensive, requiring manual steps to ensure snapshots are copied to the secondary Region. Managing the CloudFormation templates for both EC2 instance recreation and EBS volume restoration requires significant overhead and complexity, especially with large fleets of EC2 instances.
- Cost: While snapshots are a cost-effective storage solution, the overhead of managing multiple CloudFormation templates and automation runbooks may result in higher operational costs and complexity, especially if frequent updates or changes are required.
- Why rejected: This approach is relatively complex and requires more manual effort, which is not ideal for a company with limited staff. The solution also involves multiple moving parts (CloudFormation, Automation runbooks, snapshots) that could result in higher operational overhead.
B) Use Amazon Data Lifecycle Manager (Amazon DLM) to create daily multivolume snapshots of the EBS volumes. In the event of a failure, launch the CloudFormation template and use Amazon DLM to restore the EBS volumes and transfer usage to the secondary Region.
- Operational Efficiency: Amazon DLM simplifies snapshot management and automates the process of taking and retaining EBS snapshots. It can be configured to automatically copy the snapshots to the secondary Region. While DLM helps automate backup processes, manual intervention is still required to launch the CloudFormation template and restore volumes in the event of a failure.
- Cost: Amazon DLM is a low-cost solution for managing EBS snapshots, and copying snapshots across regions is cost-effective for large datasets.
- Why rejected: While DLM improves efficiency, manual intervention to launch CloudFormation templates and restore volumes in the secondary Region may still introduce complexity. It lacks the seamless integration with automated recovery that could further reduce operational overhead.
C) Use AWS Backup to create a scheduled daily backup plan for the EC2 instances. Configure the backup task to copy the backups to a vault in the secondary Region....
Author: Krishna · Last updated Jul 6, 2026
A company is designing a new website that hosts static content. The website will give users the ability to upload and download large files. According to company requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by usi...
Goal: The company requires encryption in both transit and at rest for their website, which uses Amazon S3 and Amazon CloudFront for static content hosting. We need to ensure that the solution meets these encryption requirements while optimizing security and compliance.
Let’s break down the requirements and evaluate each option.
A) Turn on S3 server-side encryption for the S3 bucket that the web application uses.
- Encryption at Rest: This option ensures that data stored in Amazon S3 is encrypted when it's at rest. Enabling S3 server-side encryption (SSE) provides this encryption and supports different methods (e.g., SSE-S3, SSE-KMS, or SSE-C).
- Why selected: This option directly addresses the encryption-at-rest requirement, ensuring the files uploaded to the S3 bucket are encrypted when stored, which meets the company's encryption requirement.
- Explanation: Using server-side encryption for S3 is essential for compliance with encryption-at-rest requirements, and this approach is highly scalable and easy to implement.
B) Add a policy attribute of "aws:SecureTransport": "true" for read and write operations in the S3 ACLs.
- Encryption in Transit: This policy ensures that data is transferred securely by requiring all requests to use HTTPS (secure transport). However, adding "aws:SecureTransport": "true" to the S3 ACLs (Access Control Lists) is not a typical way to enforce HTTPS.
- Why rejected: It is not a recommended practice to use ACLs for enforcing secure transport. Instead, this is typically done through bucket policies, not ACLs. Therefore, this option does not fully satisfy the requirement of enforcing encryption in transit in a proper and scalable manner.
C) Create a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses.
- Encryption at Rest: This option ensures that any operation that does not meet encryption standards (like uploading unencrypted files) is denied by the bucket policy. This prevents any data from being uploaded to S3 without encryption.
- Why selected: This is a strong security measure. It directly enforces the encryption-at-rest requirement, ensuring that only encrypted files are allowed to be uploaded to the S3 bucket. This helps prevent accidental or malicious uploads of unencrypted data.
- Explanation: A bucket policy is the correct way to enforce encryption for operations in S3, especially for compliance and security purposes. It gives full control over what happens to data in the S3 bucket.
D) Configure encryption at rest on CloudFront by using server-side encryption with AWS KMS keys (SSE-KMS)....
Author: VenomousSerpent42 · Last updated Jul 6, 2026
A company is implementing a serverless architecture by using AWS Lambda functions that need to access a Microsoft SQL Server DB instance on Amazon RDS. The company has separate environments for development and production, including a clone of the database system.
The company's developers are allowed to access the credentials for the development database. However, the credentials for the production database must be encrypted with a key that only member...
To implement a secure solution for managing the production database credentials and meeting the company's requirements, let's analyze each option in detail based on the requirements provided:
Option A: Store the database credentials in AWS Systems Manager Parameter Store by using a SecureString parameter that is encrypted by an AWS Key Management Service (AWS KMS) customer managed key. Attach a role to each Lambda function to provide access to the SecureString parameter. Restrict access to the SecureString parameter and the customer managed key so that only the IT security team can access the parameter and the key.
- Pros:
- Encryption with KMS key: This option uses KMS to encrypt the database credentials, ensuring secure storage.
- Granular access control: The KMS key can be restricted to specific users or groups (in this case, only the IT security team).
- Access via Lambda role: The Lambda function can access the credentials securely through IAM role-based access, adhering to the principle of least privilege.
- Cons:
- Complexity: Using Systems Manager Parameter Store adds complexity when compared to Secrets Manager. It requires additional configuration to securely store and retrieve credentials from the parameter store.
- Rotation and auditing: While parameter store supports automatic rotation of some parameters, managing credential rotation manually might be cumbersome compared to Secrets Manager, which is more tailored for secrets management.
- Best suited for: If the organization is comfortable with managing secrets through Parameter Store and requires a low-cost solution with tight access control.
Option B: Encrypt the database credentials by using the AWS Key Management Service (AWS KMS) default Lambda key. Store the credentials in the environment variables of each Lambda function. Load the credentials from the environment variables in the Lambda code. Restrict access to the KMS key so that only the IT security team can access the key.
- Pros:
- Simple implementation: Storing credentials in Lambda environment variables is easy to implement and requires minimal setup.
- Encryption using KMS: The credentials would be encrypted with KMS, ensuring they are protected.
- Cons:
- No automatic rotation: Environment variables don't support automatic rotation or auditing features, unlike AWS Secrets Manager.
- Not ideal for sensitive information: Storing credentials in environment variables is generally considered less secure because it makes it harder to manage and audit access. It is not a best practice for sensitive data like database credentials.
- Limited security controls: Environment variables can be exposed in some logs or error messages, increasing the risk of exposure.
- Best suited for: Quick or temporary solutions, but it is not recommended for production-grade environmen...
Author: Michael · Last updated Jul 6, 2026
An online retail company is migrating its legacy on-premises .NET application to AWS. The application runs on load-balanced frontend web servers, load-balanced application servers, and a Microsoft SQL Server database.
The company wants to use AWS managed services where possible and does not want to rewrite the application. A solutions architect needs to implement a ...
To meet the requirements of migrating a legacy .NET application to AWS with a focus on scaling, minimizing licensing costs, and leveraging AWS managed services while not requiring a complete rewrite of the application, let's evaluate the options in detail:
Option A: Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SQL Server database.
- Pros:
- Auto Scaling: Using EC2 instances in an Auto Scaling group allows the application to scale dynamically based on demand, addressing scaling issues.
- Amazon Aurora with Babelfish: Babelfish enables compatibility with SQL Server, which allows for minimal changes to the application code and schema while migrating to Aurora PostgreSQL. Aurora is a fully managed database, which minimizes operational overhead compared to managing an on-premises SQL Server database.
- Cost Efficiency: Aurora offers performance and scalability benefits over traditional SQL Server on EC2 instances, and it can reduce licensing costs by using PostgreSQL with Babelfish instead of SQL Server.
- Cons:
- Potential complexity in replatforming: While Babelfish helps with compatibility, there might still be some challenges in ensuring full compatibility with the legacy SQL Server features.
- Best suited for: Companies looking to migrate and scale their .NET application without completely rewriting it, while reducing licensing costs by switching from SQL Server to PostgreSQL with Babelfish.
Option B: Create images of all the servers by using AWS Database Migration Service (AWS DMS). Deploy Amazon EC2 instances that are based on the on-premises imports. Deploy the instances in an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon DynamoDB as the database tier.
- Pros:
- AWS DMS: AWS Database Migration Service helps migrate the database but is typically used for straightforward migrations of database data rather than replatforming or replacing the database with a non-SQL solution.
- DynamoDB: A NoSQL database that is highly scalable and fully managed, making it great for certain types of applications.
- Cons:
- Database mismatch: Migrating from a relational SQL Server database to a NoSQL database like DynamoDB would likely require significant changes to the application code, as SQL Server is relational, while DynamoDB is key-value based. This would go against the requirement of not rewriting the application.
- Complexity: The approach introduces unnecessary complexity, including modifying the database layer extensively and using a Network Load Balancer, which isn't typically used for web applications in the same way an Application Load Balancer would be.
- Best suited for: Use cases where the application is designed to work with NoSQL and can be fully refactored to take advantage of DynamoDB's features.
Option C: Containerize the web frontend tier and the application tier. Provision an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Create an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon RDS for SQL Server to hos...
Author: Ahmed97 · Last updated Jul 6, 2026
A software-as-a-service (SaaS) provider exposes APIs through an Application Load Balancer (ALB). The ALB connects to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that is deployed in the us-east-1 Region. The exposed APIs contain usage of a few non-standard REST methods: LINK, UNLINK, LOCK, and UNLOCK.
Users outside the United States are reporting long and inconsistent response ...
Problem Analysis:
- Users outside the United States are experiencing long and inconsistent response times.
- The Application Load Balancer (ALB) connects to an Amazon EKS cluster in us-east-1.
- The APIs contain non-standard REST methods (LINK, UNLINK, LOCK, UNLOCK), which could be causing some issues with standard HTTP request handling, particularly with caching or latency-related problems in regions far from us-east-1.
Goal:
The solution should reduce latency and minimize operational overhead.
Option Evaluation:
---
A) Add an Amazon CloudFront distribution. Configure the ALB as the origin.
- Analysis:
- Amazon CloudFront is a Content Delivery Network (CDN) that can help reduce latency by caching content at edge locations around the world, ensuring faster access for users regardless of their location.
- CloudFront can cache responses from the ALB and reduce the load on the backend infrastructure.
- However, CloudFront works by caching standard HTTP responses, and caching non-standard REST methods (LINK, UNLINK, LOCK, UNLOCK) may be problematic. CloudFront may not cache these non-standard methods effectively, potentially leading to performance degradation.
- Conclusion: While CloudFront could improve response times for cacheable data, it might not be optimal for handling non-standard HTTP methods because caching may not work effectively for all REST methods.
---
B) Add an Amazon API Gateway edge-optimized API endpoint to expose the APIs. Configure the ALB as the target.
- Analysis:
- Amazon API Gateway (edge-optimized) is designed to provide low-latency access to APIs by caching and distributing the API endpoints across AWS edge locations globally.
- API Gateway supports custom REST methods, so the non-standard methods (LINK, UNLINK, LOCK, UNLOCK) can be handled correctly.
- API Gateway can route requests to the ALB, but introducing it would add a layer of complexity and potentially increase operational overhead.
- Conclusion: This approach would resolve the issue with global access and custom methods, but it adds complexity with an extra layer (API Gateway), which may increase operational overhead compared to other solutions.
...
Author: Alexander · Last updated Jul 6, 2026
A company runs an IoT application in the AWS Cloud. The company has millions of sensors that collect data from houses in the United States. The sensors use the MQTT protocol to connect and send data to a custom MQTT broker. The MQTT broker stores the data on a single Amazon EC2 instance. The sensors connect to the broker through the domain named iot.example.com. The company uses Amazon Route 53 as its DNS service. The company stores the data in Amazon DynamoDB.
On severa...
The problem presented involves an IoT application where millions of sensors are sending data to an MQTT broker hosted on a single EC2 instance. The application is experiencing reliability issues due to the MQTT broker being overloaded, which results in lost sensor data. The goal is to improve the reliability of the solution.
Let's evaluate the proposed solutions:
Option A: Create an Application Load Balancer (ALB) and an Auto Scaling group for the MQTT broker. Use the Auto Scaling group as the target for the ALB. Update the DNS record in Route 53 to an alias record. Point the alias record to the ALB. Use the MQTT broker to store the data.
- Pros:
- Auto Scaling: The Auto Scaling group ensures that additional EC2 instances are spun up as needed to handle high traffic, potentially addressing the scalability issue.
- ALB: The ALB can distribute incoming connections to multiple EC2 instances in the Auto Scaling group, improving the availability and reliability of the MQTT broker.
- Cons:
- Not designed for MQTT: The ALB is not ideal for handling the MQTT protocol, as it is designed for HTTP/HTTPS traffic. MQTT uses long-lived TCP connections and requires persistent sessions, which ALB does not support natively.
- Overcomplicating the setup: The solution adds complexity by using an ALB and EC2 instances, but it still doesn't fully address the inherent issues with using a custom MQTT broker in the cloud.
- Best suited for: Applications that use HTTP-based protocols but not ideal for IoT protocols like MQTT.
Option B: Set up AWS IoT Core to receive the sensor data. Create and configure a custom domain to connect to AWS IoT Core. Update the DNS record in Route 53 to point to the AWS IoT Core Data-ATS endpoint. Configure an AWS IoT rule to store the data.
- Pros:
- Fully managed IoT service: AWS IoT Core is a fully managed service designed specifically for handling IoT device connections, including support for MQTT. This would significantly improve the scalability, reliability, and availability of the system.
- Built-in reliability: AWS IoT Core is highly reliable, scales automatically, and supports MQTT natively. It also provides built-in features like message buffering, message persistence, and automatic retries, which are essential for IoT applications.
- Simple integration with DynamoDB: AWS IoT rules can be configured to automatically store data in DynamoDB, eliminating the need for custom broker and storage logic.
- Cons:
- Custom domain setup: Configuring a custom domain might take some initial setup time, but it’s a manageable task.
- Best suited for: IoT applications that need scalability, reliability, and efficient handling of MQTT messages. AWS IoT Core is specifically designed to solve the issues mentioned in the question.
Option C: Create a Network Load Balancer (NLB). Set the MQTT broker as the target. Create an AWS Global Accelerator accelerator. Set the NLB as the end...
Author: Arjun · Last updated Jul 6, 2026
A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH key pairs. Each machine requires a unique EC2 key pair.
The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the keys in a securely en...
Let's go through each option in detail to evaluate which one meets the requirements for key rotation, securely storing keys, and minimizing downtime during the rotation process.
Requirements:
1. Automatic EC2 Key Pair Rotation: The EC2 key pairs must be rotated automatically upon request.
2. Secure Key Storage: Keys must be stored securely and encrypted.
3. Downtime of less than 1 minute: The solution must ensure minimal downtime (less than 1 minute) during the key rotation.
Option Evaluation:
---
A) Store all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Secrets Manager.
- Analysis:
- AWS Secrets Manager is a service designed to securely store and manage secrets, such as API keys, passwords, and in this case, private EC2 key pairs.
- Secrets Manager's built-in rotation functionality can be used to automatically rotate secrets, including EC2 key pairs, by invoking a Lambda function to generate new key pairs. The public keys would be replaced on the EC2 instances, and the private keys would be updated in Secrets Manager.
- This solution can be automated to meet the key rotation requirements.
- Minimal Downtime: The rotation process can be executed via a Lambda function, and the downtime can be minimized by carefully managing the instance's SSH sessions during key updates.
- Conclusion: This is a highly secure, automated solution that integrates with EC2 and supports key rotation with minimal downtime.
---
B) Store all the keys in Parameter Store, a capability of AWS Systems Manager, as a string. Define a Systems Manager maintenance window to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Parameter Store.
- Analysis:
- AWS Systems Manager Parameter Store can securely store secrets, but it does not natively support automatic key rotation.
- A maintenance window could be used to trigger a Lambda function to generate new EC2 key pairs, but Parameter Store lacks the native integration and automated key rotation features provided by Secrets Manager.
- This approach would require manual management and more complex handling of key rotation.
- Downtime Management: While downtime could be minimized with a maintenance window, the lack of native rotation support would require more manual intervention and could lead to higher risks of error.
- Conclusion: This option is viable but less...
Author: Sophia Clark · Last updated Jul 6, 2026
A company wants to migrate to AWS. The company is running thousands of VMs in a VMware ESXi environment. The company has no configuration management database and has little knowledge about the utilization of the VMware portfolio.
A solutions architect must provide the company with an accurate inventory so that ...
Let's break down each option and analyze which one best suits the company's needs with the least operational overhead:
Option A: Use AWS Systems Manager Patch Manager to deploy Migration Evaluator to each VM. Review the collected data in Amazon QuickSight. Identify servers that have high utilization. Remove the servers that have high utilization from the migration list. Import the data to AWS Migration Hub.
- Analysis:
- AWS Systems Manager Patch Manager is used for patch management, not specifically for VM migration or inventory management.
- Migration Evaluator helps in assessing migration needs, but deploying it via Patch Manager may involve unnecessary complexity, especially since Patch Manager is not optimized for this task.
- Reviewing data in QuickSight is useful for visualization but doesn’t align with automated inventory collection or migration planning.
- High-utilization servers may require more effort to migrate, but identifying this manually adds operational overhead.
- Why it's rejected: Using Patch Manager is an indirect approach for migration inventory and adds unnecessary operational overhead. Migration Evaluator does not need to be deployed via Patch Manager, and manual analysis in QuickSight further increases complexity.
Option B: Export the VMware portfolio to a .csv file. Check the disk utilization for each server. Remove servers that have high utilization. Export the data to AWS Application Migration Service. Use AWS Server Migration Service (AWS SMS) to migrate the remaining servers.
- Analysis:
- Exporting data from VMware manually (to .csv) and then reviewing disk utilization requires significant manual effort and expertise.
- Identifying high-utilization servers manually adds complexity.
- While AWS SMS is effective for migrating VMs, this option doesn't streamline the initial inventory process.
- Why it's rejected: The manual process of exporting, checking utilization, and handling the data in .csv format adds a lot of operational overhead. The solution is not automated and would require substantial effort to manage accurately.
Option C: Deploy the Migration Evaluator agentless...
Author: Ishaan · Last updated Jul 6, 2026
A company runs a microservice as an AWS Lambda function. The microservice writes data to an on-premises SQL database that supports a limited number of concurrent connections. When the number of Lambda function invocations is too high, the database crashes and causes application downtime. The company has an AWS Direct Connect connection between the ...
Problem Analysis:
- Microservice with Lambda: The company is using AWS Lambda to run a microservice that writes to an on-premises SQL database.
- Database constraints: The on-premises SQL database has a limited number of concurrent connections, and when Lambda invocations exceed that limit, the database crashes.
- Direct Connect: The company has AWS Direct Connect, which provides a high-bandwidth, low-latency connection between the VPC and the on-premises data center.
The goal is to prevent database crashes caused by too many concurrent connections by controlling Lambda's concurrency and introducing a mechanism to handle database connections more efficiently.
Option Evaluation:
---
A) Write the data to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to read from the queue and write to the existing database. Set a reserved concurrency limit on the Lambda function that is less than the number of connections that the database supports.
- Analysis:
- SQS serves as a buffer, ensuring that the Lambda function only processes requests at a manageable rate.
- Setting a reserved concurrency limit on the Lambda function ensures that the number of concurrent Lambda invocations doesn't exceed the database's connection limit.
- This solution is simple, utilizes native AWS services (SQS), and gives control over the Lambda concurrency.
- The SQS queue ensures that requests are not lost and that they are processed sequentially, avoiding overwhelming the database.
- Conclusion: This is an efficient and low-cost solution that meets the requirements. It controls Lambda's concurrency, prevents database overload, and ensures smooth operations.
---
B) Create a new Amazon Aurora Serverless DB cluster. Use AWS DataSync to migrate the data from the existing database to Aurora Serverless. Reconfigure the Lambda function to write to Aurora.
- Analysis:
- Amazon Aurora Serverless automatically scales up and down based on demand, which could prevent database crashes due to overload. However, this solution involves migrating the data from the on-premises database to a cloud database, which could be time-consuming and introduce significant changes to the architecture.
- The existing application would need to be reconfigured to use Aurora, and the migration of data could be complex, depending on the size of the database and the schema.
- Conclusion: While Aurora Serverless could solve the scalability issue, it is not ...
Author: Lucas · Last updated Jul 6, 2026
A company uses a Grafana data visualization solution that runs on a single Amazon EC2 instance to monitor the health of the company's AWS workloads. The company has invested time and effort to create dashboards that the company wants to preserve. The dashboards need to be highly available and cannot be down for longer than 10 m...
Let’s analyze each option to find the one that best meets the company’s requirements for high availability, preservation of dashboards, and minimizing ongoing maintenance.
Option A: Migrate to Amazon CloudWatch dashboards. Recreate the dashboards to match the existing Grafana dashboards. Use automatic dashboards where possible.
- Analysis:
- CloudWatch dashboards are a native AWS solution for visualizing metrics, but they are different from Grafana in terms of functionality and flexibility.
- Recreating the dashboards would require significant effort and time, which contradicts the goal of minimizing operational overhead.
- While CloudWatch dashboards are highly available and fully managed, migrating to them would mean abandoning Grafana's flexibility and customizability, which could lead to a loss of key features that the company may rely on in Grafana.
- The company would still need to manually recreate and configure the dashboards.
- Why it's rejected: This option involves manual migration, significant effort to recreate dashboards, and the potential loss of Grafana’s advanced features. It does not minimize operational overhead, especially for the company’s existing investment in Grafana.
Option B: Create an Amazon Managed Grafana workspace. Configure a new Amazon CloudWatch data source. Export dashboards from the existing Grafana instance. Import the dashboards into the new workspace.
- Analysis:
- Amazon Managed Grafana provides a fully managed Grafana service with built-in support for CloudWatch and other data sources, which reduces maintenance overhead.
- Migrating dashboards from the existing EC2-hosted Grafana instance to Amazon Managed Grafana is relatively straightforward and preserves the company’s investment in Grafana.
- Managed Grafana is highly available and integrates with multiple AWS services (e.g., CloudWatch, Amazon RDS, etc.), providing a scalable, resilient solution.
- The migration process can be automated to some extent, reducing operational overhead in the long term.
- Why it's selected: This option preserves the company's existing Grafana dashboards, minimizes operational overhead, and ensures high availability by using a fully managed service. It’s also highly scalable and integrates seamlessly with AWS services.
Option C: Create an AMI that has Grafana pre-installed. Store the existing dashboards in Amazon Elastic File System (Amazon EFS). Create...
Author: Elijah · Last updated Jul 6, 2026
A company needs to migrate its customer transactions database from on premises to AWS. The database resides on an Oracle DB instance that runs on a Linux server. According to a new security requirement, the company must rotate the database ...
Let’s analyze each option and determine which solution best meets the company's needs for migrating the database, ensuring security, and minimizing operational overhead.
Option A: Convert the database to Amazon DynamoDB by using the AWS Schema Conversion Tool (AWS SCT). Store the password in AWS Systems Manager Parameter Store. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.
- Analysis:
- DynamoDB is a NoSQL database, whereas the company’s existing database is an Oracle database, which requires relational database features that DynamoDB doesn't support. Migrating from a relational database like Oracle to a NoSQL solution like DynamoDB would require substantial changes to the application and database schema.
- AWS Systems Manager Parameter Store can store the password, but creating a CloudWatch alarm to invoke Lambda for password rotation adds complexity and operational overhead.
- The migration to DynamoDB is not ideal in this case because it would require significant application changes and isn’t suitable for the company’s current relational Oracle database.
- Why it's rejected: The migration to DynamoDB is unsuitable for the company’s use case, as it involves a non-relational database that doesn't match the current system’s requirements.
Option B: Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation. Configure a yearly rotation schedule.
- Analysis:
- Amazon RDS for Oracle is a managed relational database service that fully supports Oracle databases. It provides a simple, scalable solution for running Oracle workloads on AWS, which minimizes management overhead.
- AWS Secrets Manager supports automatic password rotation, which means the database password can be automatically rotated on a configurable schedule (in this case, yearly) with minimal operational overhead.
- This approach leverages AWS managed services that automate password management and reduce the complexity of manual interventions, providing a highly scalable and low-maintenance solution.
- Why it's selected: This solution provides the least operational overhead by using a fully managed RDS service for Oracle and automating password rotation with Secrets Manager. It meets the security requirement for rotating th...
Author: Kai · Last updated Jul 6, 2026
A solutions architect is designing an AWS account structure for a company that consists of multiple teams. All the teams will work in the same AWS Region. The company needs a VPC that is connected to the on-premises network. The company expects less than 50 Mbps of total traffic to and f...
Let's break down each of the options and evaluate them based on the requirements of the company:
Requirements:
1. Multiple teams working in the same AWS Region.
2. A VPC that is connected to the on-premises network.
3. Less than 50 Mbps of total traffic to and from the on-premises network (which indicates relatively low bandwidth requirements).
4. Cost-effectiveness is a priority.
Option Evaluation:
---
A) Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to each AWS account.
- Analysis:
- AWS CloudFormation can automate the creation of infrastructure, including VPCs and subnets, which helps in standardizing and scaling the environment for multiple accounts.
- Deploying the template to each AWS account could work well if the company uses separate accounts for different teams and needs each team to have its own VPC.
- However, the cost-effective solution may be to centralize some services rather than deploying VPCs across each team’s account. In this case, this approach might not be the most cost-efficient because of duplicated resources and complexity in managing multiple VPCs.
- Conclusion: This option is useful in some scenarios but could be more costly and less efficient in terms of management and centralization.
---
B) Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to a shared services account. Share the subnets by using AWS Resource Access Manager.
- Analysis:
- This approach involves creating the VPC in a shared services account and then using AWS Resource Access Manager (RAM) to share the subnets with other accounts.
- This approach is cost-effective because it allows the company to maintain a centralized VPC while enabling other teams to use the same VPC and subnets without duplicating resources.
- By sharing the subnets, the company can centralize the connectivity to the on-premises network, which could be more manageable and scalable. This also ensures better security and resource control.
- Conclusion: This is a highly cost-effective approach, as it centralizes infrastructure while allowing access for multiple teams.
---
C) Use AWS Transit Gateway along with an AWS Site-to-Site VPN for connectivity to the on-premises network. Share the transit gateway by using AWS Resource Access Manager.
- Analysis:
- AWS Transit Gateway is typically used in scenarios where multiple VPCs need to communicate with each other o...
Author: Samuel · Last updated Jul 6, 2026
A solutions architect at a large company needs to set up network security for outbound traffic to the internet from all AWS accounts within an organization in AWS Organizations. The organization has more than 100 AWS accounts, and the accounts route to each other by using a centralized AWS Transit Gateway. Each account has both an internet gateway and a NAT gateway for outbound traffic to the internet. The company deploys resources only into a single AWS Region.
The company needs the ability to add centrally managed rule...
To meet the requirement of centrally managing rule-based filtering for outbound traffic from all AWS accounts in the organization, let's evaluate each option:
A) Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Create an Auto Scaling group of Amazon EC2 instances that run an open-source internet proxy for rule-based filtering across all Availability Zones in the Region. Modify all default routes to point to the proxy's Auto Scaling group.
- Pros: This solution involves creating a new VPC for outbound traffic and using EC2 instances running an open-source proxy for rule-based filtering. This could offer flexibility in filtering outbound traffic.
- Cons: Managing EC2 instances as proxies requires a significant operational overhead, such as scaling, patching, and maintaining the open-source software. This solution could lead to complexities in scaling to handle the traffic load, especially considering the peak load of 25 Gbps in each Availability Zone.
- Scalability Issues: EC2 instances are not an ideal choice for handling large amounts of outbound traffic (especially 25 Gbps per AZ) because EC2 instances might not be optimized for that level of traffic. Additionally, managing EC2 instances for high throughput can be cumbersome.
- Maintenance Overhead: Using an open-source proxy solution would require constant updates and monitoring for security vulnerabilities, making this a less reliable long-term solution.
B) Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Use an AWS Network Firewall firewall for rule-based filtering. Create Network Firewall endpoints in each Availability Zone. Modify all default routes to point to the Network Firewall endpoints.
- Pros: AWS Network Firewall is a fully managed service that provides centralized rule-based filtering for outbound traffic. It is scalable and can handle high traffic loads. It integrates well with the AWS environment and supports automatic scaling.
- Scalability: AWS Network Firewall endpoints are designed to scale efficiently across Availability Zones, and with traffic peaks of 25 Gbps per AZ, it would handle the load effectively.
- C...
Author: Ethan · Last updated Jul 6, 2026
A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements:
* Inbound requests must be filtered for common vulnerability attacks.
* Rejected reque...
Let's break down the requirements and evaluate the solutions:
Requirements:
1. Inbound requests must be filtered for common vulnerability attacks: This implies that AWS WAF (Web Application Firewall) is needed to filter and block common attacks like SQL injection, cross-site scripting (XSS), etc.
2. Rejected requests must be sent to a third-party auditing application: Rejected requests should be logged and forwarded to a third-party system for auditing.
3. All resources should be highly available: This suggests the need for multi-AZ deployment to ensure high availability and avoid single points of failure.
Option Evaluation:
---
A) Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.
- Analysis:
- Multi-AZ Auto Scaling is a good choice for high availability.
- Amazon Inspector is useful for finding vulnerabilities in EC2 instances, but it's not specifically designed for filtering inbound web traffic or rejecting malicious requests. It’s more suited for assessing EC2 instance security.
- AWS WAF with web ACL is correctly used to filter malicious inbound requests.
- However, the use of Amazon Inspector for auditing is not optimal. WAF logs (or CloudWatch Logs) would be more efficient for capturing rejected requests, rather than relying on Amazon Inspector, which is not intended for this purpose.
- Conclusion: This option does not provide the most direct and efficient solution for forwarding rejected requests to the third-party auditing application.
---
B) Configure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.
- Analysis:
- ALB and WAF are used correctly for filtering and securing inbound traffic.
- Enabling CloudWatch Logs for AWS WAF is a solid choice because these logs will capture information about rejected requests, which can then be forwarded to the third-party auditing application.
- Using an AWS Lambda function to push logs to the third-party auditing application is a practical solution to meet the auditing requirement.
- This solution meets all the requirements, ensuring both security filtering and logging, while maintaining simplicity and efficiency.
- Conclusion: This is a strong and cost-effective solution that meets all the requirements.
---
C) Config...
Author: Jack · Last updated Jul 6, 2026
A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new REST API that was implemented in Amazon API Gateway. Some of the older microservices that run on EC2 instances need to call this new API.
The company does not want the API...
The company needs a solution that allows its EC2-based microservices to securely access the new REST API in Amazon API Gateway without exposing the API to the public internet. Let's evaluate each of the options:
A) Create an AWS Site-to-Site VPN connection between the VPC and the API Gateway. Use API Gateway to generate a unique API Key for each microservice. Configure the API methods to require the key.
- Pros:
- Using a VPN connection would securely connect the VPC to the API Gateway, ensuring that traffic between the EC2 instances and the API does not traverse the public internet.
- Cons:
- This option involves additional overhead in setting up and maintaining the Site-to-Site VPN connection.
- While the API key can help authenticate microservices, using VPN connections with API Gateway isn't the most efficient or AWS-recommended approach. VPN connections are more suited for extending on-premises networks into AWS, not necessarily for communication between VPCs and API Gateway.
- This solution would be more complex and require manual management of VPN configurations.
B) Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
- Pros:
- Private API Gateway: This solution uses a private API Gateway endpoint that is not exposed to the public internet. The VPC endpoint ensures that traffic between the EC2 instances in the VPC and API Gateway is routed privately within the AWS network.
- Security: The solution uses both an endpoint policy and a resource policy to limit access to only the specific API, ensuring that no other services can access it.
- Best Practice: This is the recommended approach for keeping the API secure and private while allowing internal access. It avoids the use of public IP addresses for communication and makes use of AWS's native VPC features for secure communication.
- ...
Author: Sofia · Last updated Jul 6, 2026
A company has set up its entire infrastructure on AWS. The company uses Amazon EC2 instances to host its ecommerce website and uses Amazon S3 to store static data. Three engineers at the company handle the cloud administration and development through one AWS account. Occasionally, an engineer alters an EC2 security group configuration of another engineer and causes noncompliance issues in the environment.
A solutions architect must set up a system that tracks changes that the engineer...
To meet the requirements of tracking and alerting on noncompliant changes to EC2 security groups, let's evaluate the options based on their ability to monitor changes and provide quick alerts, while ensuring compliance.
Option A: Set up AWS Organizations for the company. Apply SCPs to govern and track noncompliant security group changes that are made to the AWS account.
- Pros:
- Service Control Policies (SCPs) in AWS Organizations can be used to define restrictions on actions across AWS accounts.
- SCPs could prevent certain changes to security group configurations if defined correctly.
- Cons:
- SCPs are primarily used to limit the ability to make specific changes, not for tracking or alerting on changes. They prevent actions, but they don’t provide the kind of detailed logging and alerting functionality that the scenario requires.
- SCPs cannot track or log changes made to security groups. They only restrict actions.
Option B: Enable AWS CloudTrail to capture the changes to EC2 security groups. Enable Amazon CloudWatch rules to provide alerts when noncompliant security settings are detected.
- Pros:
- AWS CloudTrail logs API calls and captures changes made to resources, such as EC2 security group configurations. This allows you to track who made changes, what was changed, and when the change occurred.
- You can set up Amazon CloudWatch rules to trigger alerts based on specific events captured by CloudTrail. This is a fast and effective way to detect noncompliant changes and notify engineers or administrators.
- Cons:
- While effective in tracking changes and sending alerts, this solution doesn’t explicitly address compliance checks; you'd need to build custom logic to identify "noncompliant" changes (e.g., comparing security group settings to a baseline).
Option C: Enable SCPs on the AWS account to provide a...
Author: Sofia2021 · Last updated Jul 6, 2026
A company has IoT sensors that monitor traffic patterns throughout a large city. The company wants to read and collect data from the sensors and perform aggregations on the data.
A solutions architect designs a solution in which the IoT devices are streaming to Amazon Kinesis Data Streams. Several applications are reading from the stream. However, several consumers are experiencing throttli...
The problem in the scenario involves throttling and the `ReadProvisionedThroughputExceeded` error in Amazon Kinesis Data Streams. This error typically occurs when the consumer applications exceed the allowed read throughput limits for the stream. To resolve this, several actions can be taken to optimize the performance and reduce throttling.
Option A: Reshard the stream to increase the number of shards in the stream.
- Pros:
- Increasing the number of shards will provide more read throughput capacity and allow for higher parallelism in processing the stream, which directly addresses throttling issues caused by high traffic or a high volume of consumers.
- Resharding increases both the read and write capacity for the stream by increasing the number of shards.
- Cons:
- While this option addresses throughput limits, resharding can increase cost, as each additional shard incurs a charge. It also introduces operational complexity as the number of shards increases, so it should be done carefully after monitoring the current throughput usage.
Option B: Use the Kinesis Producer Library (KPL). Adjust the polling frequency.
- Pros:
- The Kinesis Producer Library (KPL) helps optimize the production of data by batch writing records to Kinesis, which can improve the overall write efficiency. However, this doesn’t directly solve read throughput issues caused by consumers throttling.
- Cons:
- Adjusting the polling frequency and using the KPL optimizes data production but does not directly address the read throttling issue that consumers are encountering. Therefore, it is not the most effective solution for the problem described.
Option C: Use consumers with the enhanced fan-out feature.
- Pros:
- The enhanced fan-out feature allows each consumer to receive its own read throughput capacity (up to 2 MB per second per consumer), independent of other consumers. This prevents throttling when multiple consumers are reading from the stream simultaneously.
- It is an ideal solution for high-throughput scenarios with many consumers, as it eliminates the contention for shared read throughput.
- Cons:
- Enhanced fan-out incurs additional costs for each consumer that uses it. It’s necessary to evaluate whether th...
Author: Aria · Last updated Jul 6, 2026
A company uses AWS Organizations to manage its AWS accounts. The company needs a list of all its Amazon EC2 instances that have underutilized CPU or memory usage. The company also needs recommendations for how to downsize the...
Let's analyze each option in the context of meeting the company's requirements—listing all underutilized EC2 instances and providing recommendations for downsizing with minimal effort:
A) Install a CPU and memory monitoring tool from AWS Marketplace on all the EC2 instances. Store the findings in Amazon S3. Implement a Python script to identify underutilized instances. Reference EC2 instance pricing information for recommendations about downsizing options.
- Pros:
- This solution provides flexibility in monitoring, as the company can select a custom tool from AWS Marketplace.
- Storing findings in S3 gives easy access to data.
- The Python script can be customized to meet specific business needs.
- Cons:
- It requires significant manual setup: you need to install the tool, write and maintain the Python script, and manage the data.
- It's labor-intensive and might take more time to implement than using AWS managed services like CloudWatch.
- EC2 pricing reference for recommendations would need to be manually handled, requiring updates and maintenance.
Reason for rejection: Although flexible, this option involves too much manual setup and maintenance, leading to higher operational overhead compared to automated solutions.
B) Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager. Retrieve the resource optimization recommendations from AWS Cost Explorer in the organizations management account. Use the recommendations to downsize underutilized instances in all accounts of the organization.
- Pros:
- The CloudWatch agent can automatically collect CPU and memory metrics, which is simple to set up using Systems Manager.
- AWS Cost Explorer provides easy-to-use recommendations for optimization, which can help in identifying underutilized instances and potential cost savings.
- The solution supports centralized management through the organization's management account, allowing for easier coordination across accounts.
- Cons:
- CloudWatch doesn't provide specific memory usage metrics by default for EC2 instances, and you need to install the CloudWatch agent manually for full metrics, which could require extra configuration.
Reason for rejection: While this is a good solution, it might not fully address memory usage unless the CloudWatch agent is explicitly set up for memory, which may involve some additional configuration.
C) Install the Amazon CloudWatch agent on all the EC2 instances by using AWS System...
Author: William · Last updated Jul 6, 2026
A company wants to run a custom network analysis software package to inspect traffic as traffic leaves and enters a VPC. The company has deployed the solution by using AWS CloudFormation on three Amazon EC2 instances in an Auto Scaling group. All network routing has been established to direct traffic to the EC2 instances.
Whenever the analysis software stops working, the Auto Scaling gr...
To resolve the issue of the network routes not being updated when an instance is replaced by the Auto Scaling group, we need to address both the replacement process and the update of the routing configuration. Let’s evaluate each option and determine which steps should be taken:
Option A: Create alarms based on EC2 status check metrics that will cause the Auto Scaling group to replace the failed instance.
- Evaluation: This step ensures that the Auto Scaling group will replace an EC2 instance if it fails, but it doesn't address the issue of updating the network routes when an instance is replaced. It helps ensure that a failed instance is replaced, but additional steps are needed to manage the routing configuration.
- Reason for Rejection: While useful for monitoring EC2 instance health, this step alone does not address the routing issue.
Option B: Update the CloudFormation template to install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to send process metrics for the application.
- Evaluation: Installing the CloudWatch agent to monitor application-level metrics is useful for tracking the health of the software running on the EC2 instances, but it doesn’t directly impact network routing or automatically trigger routing updates when an instance is replaced.
- Reason for Rejection: This step is useful for monitoring but doesn’t directly solve the routing issue after an instance replacement.
Option C: Update the CloudFormation template to install AWS Systems Manager Agent on the EC2 instances. Configure Systems Manager Agent to send process metrics for the application.
- Evaluation: AWS Systems Manager is a powerful tool for managing EC2 instances and running commands remotely. However, just sending process metrics with Systems Manager doesn’t solve the problem of network routes not being updated when an instance is replaced.
- Reason for Rejection: Although AWS Systems Manager is useful for managing instances and performing actions like updating configurations, it doesn’t solve the issue of routing.
Option D: Create an alarm for the custom metric in Amazon CloudWatch for the failure scenarios. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
- Evaluation: This step can help detect failure scenarios and alert administrato...
Author: Vikram · Last updated Jul 6, 2026
A company is developing a new on-demand video application that is based on microservices. The application will have 5 million users at launch and will have 30 million users after 6 months. The company has deployed the application on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The company developed the application by using ECS services that use the HTTPS protocol.
A solutions architect needs to implement updates to the application by using blue/green deployments. The solution must...
Let's evaluate each option based on the requirements:
Requirements Breakdown:
1. Blue/Green Deployment: The solution must support blue/green deployment for easy application updates and rollback.
2. HTTPS Traffic: The application uses the HTTPS protocol, so the solution must be capable of handling secure traffic.
3. Load Balancer: The traffic to each ECS service must be distributed through a load balancer.
4. Automatic Scaling: The number of tasks (containers) must automatically adjust in response to a CloudWatch alarm, indicating that Auto Scaling is required.
Option A: Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Request increases to the service quota for tasks per service to meet the demand.
- Evaluation:
- The Network Load Balancer (NLB) operates at the network layer (Layer 4) and is primarily used for TCP/UDP traffic. While it can handle high throughput, it doesn’t support SSL/TLS termination for HTTPS traffic, which the application requires.
- Requesting increases to the service quota for tasks per service is a reactive measure and doesn’t directly address the scaling needs with CloudWatch alarms or automatic adjustments.
- Reason for Rejection: The Network Load Balancer doesn’t support HTTPS termination, making it unsuitable for this application, which uses HTTPS.
Option B: Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Implement Auto Scaling group for each ECS service by using the Cluster Autoscaler.
- Evaluation:
- Again, the Network Load Balancer is not suitable for handling HTTPS traffic because it works at the transport layer and doesn’t manage SSL/TLS termination.
- The Cluster Autoscaler is not a native AWS service for ECS; it is generally used with Amazon EKS (Elastic Kubernetes Service) to manage node scaling, not for ECS task-level scaling.
- Reason for Rejection: The use of a Network Load Balancer and Cluster Autoscaler would not meet the HTTPS requirement and would add unnecessary complexity to the solution.
Option C: Configure the ECS services to use the blue/green deployment type and an Application Load Balancer. Implement an Aut...
Author: Sofia · Last updated Jul 6, 2026
A company is running a containerized application in the AWS Cloud. The application is running by using Amazon Elastic Container Service (Amazon ECS) on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group.
The company uses Amazon Elastic Container Registry (Amazon ECR) to store its container images. When a new image version is uploaded, the new image version receives a unique tag.
The company needs a solution that inspects new image versions for common vulnerabilities and exposures. ...
Requirements Breakdown:
1. Vulnerability Scanning: The solution must scan container images for vulnerabilities and exposures, particularly focusing on Critical and High severity issues.
2. Automatic Deletion of Image Tags: If vulnerabilities with Critical or High severity are found, the solution must automatically delete the image tags associated with those images.
3. Notification to Development Team: The development team must be notified when such deletions occur.
Evaluation of Each Option:
Option A:
- Description: Configure scan on push for the repository. Use Amazon EventBridge to invoke an AWS Step Functions state machine when a scan is complete for images with Critical or High severity findings. The state machine deletes the image tag and notifies the team via Amazon SNS.
- Evaluation:
- Scan on Push: This is a good solution, as it ensures every time a new image is pushed to Amazon ECR, it is automatically scanned for vulnerabilities.
- EventBridge and Step Functions: Amazon EventBridge is a powerful event-driven architecture service that can detect when a scan completes, and AWS Step Functions provides a robust way to orchestrate multiple tasks (like deleting image tags and sending notifications).
- SNS for Notifications: Amazon SNS is an excellent choice for notifying the development team in real-time.
- Reason for Selection: This solution is a fully automated and scalable workflow. It uses native AWS services to inspect images, delete vulnerable tags, and notify the team. Event-driven architecture is suitable for the use case, as it allows seamless triggering of actions when a scan result is available.
Option B:
- Description: Configure scan on push. Send scan results to an SQS queue, then invoke a Lambda function to delete the image tag and notify the development team via Amazon SES.
- Evaluation:
- Scan on Push: This is good for ensuring that newly pushed images are scanned for vulnerabilities.
- SQS for Results: Using an SQS queue to store scan results is viable, but it introduces extra steps compared to using EventBridge, which is a more direct integration for handling events.
- Lambda Function: The Lambda function is responsible for deleting image tags and notifying the development team. While this is feasible, SES (Simple Email Service) might be overcomplicated for notifications. SNS would...
Author: NightmareDragon2025 · Last updated Jul 6, 2026
A company runs many workloads on AWS and uses AWS Organizations to manage its accounts. The workloads are hosted on Amazon EC2. AWS Fargate. and AWS Lambda. Some of the workloads have unpredictable demand. Accounts record high usage in some months and low usage in other months.
The company wants to optimize its compute costs over the next 3 years. A solutions architect obtains a 6-month a...
Let's evaluate each option in terms of cost savings potential and scalability across multiple accounts and services, considering the given scenario where workloads are hosted on EC2, AWS Fargate, and AWS Lambda, with unpredictable demand.
Key Factors:
1. Compute Usage: The organization uses a combination of EC2 instances, AWS Fargate, and AWS Lambda, each with potentially different billing models and usage patterns.
2. Unpredictable Demand: Some workloads have unpredictable demand, which can make it difficult to accurately forecast long-term usage for specific EC2 instance types or sizes.
3. Organization-wide Savings: The solution should optimize costs for the entire organization, which is managed under AWS Organizations, and should provide flexibility to accommodate fluctuating usage across accounts.
Option A: Purchase Reserved Instances for the organization to match the size and number of the most common EC2 instances from the member accounts.
- Evaluation:
- Reserved Instances (RIs) are beneficial for workloads with predictable, steady usage, but they are tied to specific instance types and sizes, which makes them inflexible.
- Since the company has unpredictable demand, it might not be able to accurately predict which EC2 instances will be most commonly used in the future.
- RIs are also linked to specific Availability Zones, which may not be optimal in a dynamic environment with fluctuating demand.
- Reason for Rejection: Purchasing Reserved Instances based on the most common EC2 instance types might not be cost-effective in the face of fluctuating or unpredictable demand. Additionally, RIs are less flexible and don’t apply to other services like AWS Fargate or Lambda.
Option B: Purchase a Compute Savings Plan for the organization from the management account by using the recommendation at the management account level.
- Evaluation:
- Compute Savings Plans provide flexibility as they apply to a wide range of services, including EC2 (both On-Demand and Reserved Instances), AWS Fargate, and Lambda.
- This option allows the company to commit to a certain level of compute usage over a 1- or 3-year period while benefiting from significant cost savings, without being tied to specific instance types or sizes. This is ideal for unpredictable workloads and varying service usage across multiple accounts.
- Compute Savings Plans are applicable at the organization level, so purchasing one from the management account will apply to all member ...
Author: RadiantJaguar56 · Last updated Jul 6, 2026
A company has hundreds of AWS accounts. The company uses an organization in AWS Organizations to manage all the accounts. The company has turned on all features.
A finance team has allocated a daily budget for AWS costs. The finance team must receive an email notification if the organization's AWS costs exceed 80% of the allocated budget. A...
Let's analyze each of the proposed solutions:
Option A: AWS Budgets with SNS notifications
- Explanation: AWS Budgets is designed for setting custom cost and usage budgets. You can create a daily budget and set an alert threshold (like 80%) when the budget is exceeded. It integrates with Amazon SNS to send notifications to a specific email address or a list of recipients.
- Key Benefits:
- Directly aligns with the requirement to track costs and send notifications based on a set threshold.
- Simple to implement as AWS Budgets is a dedicated tool for this task.
- Can be configured at the organization level (management account) to apply across all accounts.
- Rejection Reason: No significant reasons to reject here. This is a straightforward solution and is designed to handle budget alerts.
Option B: AWS Trusted Advisor with Organizational View for Cost Optimization
- Explanation: AWS Trusted Advisor helps to monitor AWS best practices, including cost optimization. It offers reports and alerts on various areas, including cost optimization, but it’s not specifically designed for custom budget thresholds.
- Key Benefits:
- Trusted Advisor can alert on cost optimization issues and resource utilization.
- Rejection Reason:
- Not a budget tracking tool: Trusted Advisor isn't specifically built for tracking and notifying based on a predefined budget threshold (like 80% of the budget), which is the core requirement.
- Limited to specific insights: It focuses more on recommendations and best practices rather than actively managing and notifying about predefined cost thresholds.
Option C: AWS Control Tower with cost control guardrail
- Explanation: AWS Control Tower is used for governance and central management of multi-account environments, and it includes optional guar...
Author: Zara · Last updated Jul 6, 2026
A company provides auction services for artwork and has users across North America and Europe. The company hosts its application in Amazon EC2 instances in the us-east-1 Region. Artists upload photos of their work as large-size. high-resolution image files from their mobile phones to a centralized Amazon S3 bucket created in the us-east-1 Region. The user...
Let's analyze each option for improving the performance of the image upload process for users in Europe:
Option A: Redeploy the application to use S3 Multipart Uploads
- Explanation: S3 Multipart Uploads enable users to upload large files by splitting them into smaller parts, which can be uploaded in parallel. Once all parts are uploaded, they are combined into a single file. This can significantly speed up the upload process for large files and improve reliability (if a part fails, only that part needs to be re-uploaded).
- Key Benefits:
- Multipart uploads are beneficial for handling large files as they increase throughput and reduce the time required to upload large images.
- Rejection Reason:
- Doesn't address regional performance: While multipart uploads improve file upload efficiency, it doesn't specifically solve the issue of slow uploads for users in Europe, who might experience latency due to the distance between them and the S3 bucket in the US East region. Multipart uploads won't reduce this geographical latency.
Option B: Create an Amazon CloudFront distribution and point to the application as a custom origin
- Explanation: CloudFront is a content delivery network (CDN) that can cache content at edge locations closer to end users. If CloudFront is used as a CDN with S3 as the origin, it can accelerate read operations (like downloading images) but not directly improve upload performance.
- Key Benefits:
- Useful for reducing latency for users when downloading or retrieving files that are cached in CloudFront’s edge locations.
- Rejection Reason:
- Doesn't improve upload performance: CloudFront speeds up read operations but doesn't enhance the performance of uploading files, as the CDN is primarily designed to accelerate content delivery rather than upload processes. Therefore, CloudFront isn't the solution for improving image upload performance.
Option C: Configure the buckets to use S3 Transfer Accelera...
Author: Ming88 · Last updated Jul 6, 2026
A company wants to containerize a multi-tier web application and move the application from an on-premises data center to AWS. The application includes web. application, and database tiers. The company needs to make the application fault tolerant and scalable. Some frequently accessed data must always be available across application servers. Frontend web servers nee...
To meet the requirements of fault tolerance, scalability, and reduced operational overhead, let's analyze each solution and see how well it addresses the company's needs:
Requirements:
1. Fault Tolerance & Scalability: The application must scale to meet increased traffic and handle failures gracefully.
2. Frequent Data Availability: Some data must always be accessible across application servers.
3. Session Persistence: The frontend web servers need session persistence to maintain user session state.
4. Minimal Operational Overhead: The solution should require the least ongoing management after deployment.
A) Run the application on Amazon ECS on AWS Fargate. Use Amazon EFS for data that is frequently accessed between the web and application tiers. Store the frontend web server session data in Amazon Simple Queue Service (Amazon SQS).
- Pros:
- AWS Fargate abstracts infrastructure management, so you don't need to manage EC2 instances, which reduces operational overhead.
- Amazon EFS provides a managed file system that can be mounted across multiple containers, making it easy to share frequently accessed data between the web and application tiers.
- Cons:
- Amazon SQS is not an ideal choice for session persistence. SQS is a messaging service, not designed to store session data, which could lead to complexity and inefficiency.
- While Fargate offers scalability, the use of SQS for session persistence is a poor design choice for session data that needs to be frequently accessed and kept alive across requests.
Reason for rejection: While Fargate simplifies management, SQS is not suitable for session persistence, and the overall solution might not be as efficient or aligned with the application's needs.
B) Run the application on Amazon ECS on Amazon EC2. Use Amazon ElastiCache for Redis to cache frontend web server session data. Use Amazon EBS with Multi-Attach on EC2 instances that are distributed across multiple Availability Zones.
- Pros:
- Amazon ElastiCache for Redis is a perfect fit for session persistence, providing fast in-memory storage for session data that can be shared across multiple web servers.
- EBS Multi-Attach enables sharing block storage across multiple EC2 instances, providing a shared volume for frequently accessed data.
- Cons:
- Running ECS on EC2 requires you to manage EC2 instances, which adds operational overhead compared to Fargate. This solution involves managing EC2 instances, scaling groups, and load balancers.
- EBS Multi-Attach does not allow you to easily scale the underlying storage solution without more complex management.
Reason for rejection: While ElastiCache for Redis is a good choice for session persistence, managing EC2 instances increases operational overhead. The solution could be simpler with...
Author: FrostFalcon88 · Last updated Jul 6, 2026
A solutions architect is planning to migrate critical Microsoft SQL Server databases to AWS. Because the databases are legacy systems, the solutions architect will move the databases to a modern data architecture. The solutions archite...
Requirements:
- Near-zero downtime: The migration must minimize or eliminate downtime during the transition.
- Modern data architecture: The solution should migrate the legacy Microsoft SQL Server database to a modern AWS service.
- Legacy system consideration: Since this is a legacy system, the migration should support SQL Server's specific features, ensuring compatibility during the transition.
A) Use AWS Application Migration Service and the AWS Schema Conversion Tool (AWS SCT). Perform an in-place upgrade before the migration. Export the migrated data to Amazon Aurora Serverless after cutover. Repoint the applications to Amazon Aurora.
- Pros:
- AWS Application Migration Service helps with lift-and-shift migrations with minimal downtime.
- AWS SCT can convert the database schema for Aurora, making it easier to migrate from SQL Server to Aurora.
- Aurora Serverless is scalable and can reduce infrastructure management overhead.
- Cons:
- The migration to Amazon Aurora involves moving from SQL Server to a different database engine, which might introduce compatibility issues.
- Performing an in-place upgrade before migration could lead to unnecessary complexity and potential downtime during the upgrade.
- This option does not meet the requirement of near-zero downtime, as the database will need to be fully migrated, cut over, and repointed, which can involve downtime.
Reason for rejection: Migrating to Aurora from SQL Server introduces complexity with potential compatibility issues, and the overall migration process is not optimized for near-zero downtime.
B) Use AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance.
- Pros:
- AWS DMS enables near-zero downtime migration by using Change Data Capture (CDC), which continuously replicates data between the source and target databases while the source system is still operational.
- This allows the application to continue running without major disruption.
- Amazon RDS for SQL Server is fully managed, so ongoing maintenance and scaling are simplified.
- Cons:
- Loading data from Amazon S3 into RDS after CDC replication may require extra steps and some manual processes.
- RDS migration may not fully leverage the original SQL Server setup, but the core migration strategy supports near-zero downtime.
Reason for rejection: While AWS DMS is a good tool for migration, the added complexity of ...
