Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company has a Windows-based desktop application that is packaged and deployed to the users' Windows machines. The company recently acquired another company that has employees who primarily use machines with a Linux operating system. The acquiring company has decided to migrate and rehost the Windows-based desktop application to AWS.
All employees must be authenticated before they use the application. The acquiring company uses Active Director...
To determine the best solution for migrating and rehosting the Windows-based desktop application to AWS with minimal development effort, we need to consider several key factors: the authentication mechanism, the platform compatibility (Windows vs. Linux), and the user experience.
Let’s evaluate each option:
A) Set up and provision an Amazon Workspaces virtual desktop for every employee. Implement authentication by using Amazon Cognito identity pools. Instruct employees to run the application from their provisioned Workspaces virtual desktops.
- Explanation: Amazon Workspaces provides managed virtual desktops on the AWS cloud. This option would involve provisioning a WorkSpace for each employee, where the application could be installed and used. Authentication could be handled via Amazon Cognito, which can integrate with existing identity providers.
- Rejection Reason: Although this solution could work, it is more resource-intensive as it requires managing a separate virtual desktop for each employee. Workspaces are typically used for more isolated use cases and can be expensive, especially when scaling to a large number of employees. This also doesn't directly solve the need for multi-platform (Windows and Linux) support, as Workspaces would still require users to operate within a Windows environment.
B) Create an Auto Scaling group of Windows-based Amazon EC2 instances. Join each EC2 instance to the company’s Active Directory domain. Implement authentication by using the Active Directory that is running on premises. Instruct employees to run the application by using a Windows remote desktop.
- Explanation: This approach would involve running Windows-based EC2 instances, joining them to the on-premises Active Directory, and using remote desktop access. Authentication could be integrated directly with the existing Active Directory setup.
- Rejection Reason: This option requires setting up and maintaining Windows EC2 instances, which could lead to significant complexity in managing these instances. Moreover, it doesn't address the cross-platform need, as the solution is still Windows-centric. Employees using Linux-based machines would need to rely on Windows remote desktop, which may introduce user experience challenges.
C) Use an Amazon AppStream 2.0 image builder to create an image that includes the application and the required configurations. Provision an AppStream 2.0 On-Demand fleet with dynamic Fleet Auto Scaling policies for running the image. Implement authentication by using AppStream 2.0 user...
Author: Mia · Last updated Jul 6, 2026
A company is collecting a large amount of data from a fleet of IoT devices. Data is stored as Optimized Row Columnar (ORC) files in the Hadoop Distributed File System (HDFS) on a persistent Amazon EMR cluster. The company's data analytics team queries the data by using SQL in Apache Presto deployed on the same EMR cluster. Queries scan large amounts of data, always run for less than 15 minutes, and run only between 5 PM and 10 PM.
The company is concerned about...
To choose the most cost-effective solution, let’s break down the options considering the given constraints:
- Data is stored in ORC format in HDFS on a persistent EMR cluster.
- Queries typically scan large amounts of data but run for less than 15 minutes.
- Queries are only run between 5 PM and 10 PM, suggesting limited periods of activity.
- The company is concerned about the high cost of the current solution.
Option A: Store data in Amazon S3. Use Amazon Redshift Spectrum to query data.
- Storage: Storing the data in Amazon S3 makes it easily accessible and cost-effective, as Amazon S3 provides low-cost storage, especially for large datasets.
- Querying: Redshift Spectrum allows querying of S3 data using SQL, and it can scale to handle large queries. However, this solution requires an Amazon Redshift cluster, which can incur high costs, especially if the queries are intermittent (5 PM to 10 PM).
- Cost Considerations: Even though Redshift Spectrum queries are priced based on the amount of data scanned, maintaining a Redshift cluster (even if only using Spectrum) can still result in higher ongoing costs compared to more serverless options.
- Verdict: The cost of maintaining an Amazon Redshift cluster may not be optimal if query load is intermittent.
Option B: Store data in Amazon S3. Use the AWS Glue Data Catalog and Amazon Athena to query data.
- Storage: Storing data in Amazon S3 offers low-cost, durable storage. S3 is a great fit for large, unstructured datasets like ORC files.
- Querying: Amazon Athena is a serverless query service that directly queries data in S3 using SQL. Athena pricing is based on the amount of data scanned per query, which is cost-effective because there is no need to maintain infrastructure (e.g., no clusters).
- Cost Considerations: Since the data is only queried for a limited time each day, Athena’s pay-per-query model is a good fit because you pay only when you query the data. Additionally, AWS Glue Data Catalog can be used to manage the metadata of the data in S3, which is fully integrated with Athena.
- Verdict: This solution is highly cost-effective since there’s no need to maintain persistent infrastructure and you pay only for the data scanned...
Author: Vikram · Last updated Jul 6, 2026
A large company recently experienced an unexpected increase in Amazon RDS and Amazon DynamoDB costs. The company needs to increase visibility into details of AWS Billing and Cost Management. There are various accounts associated with AWS Organizations, including many development and production accounts. There is no consistent tagging strategy across the organization, but there are guidelines in place that require all infrastructure to be deployed using AWS CloudFormation with consistent taggi...
To meet the company’s requirements of increasing visibility into AWS Billing and Cost Management and ensuring that all resources have consistent tagging for cost center and project ID numbers, let's evaluate each option based on the key factors:
Option A: Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to propagate to existing resources.
- Tagging Existing Resources: Tag Editor is a useful tool for bulk tagging resources, but it requires 24 hours for tags to propagate and be visible in AWS Cost Explorer and billing reports.
- Cost Allocation Tags: This would allow the cost center and project ID to be properly tracked. However, this does not address how to ensure that all future resources are tagged consistently.
- Limitations: The 24-hour propagation delay might not be ideal for quick tracking. Additionally, there is no automatic enforcement to ensure that resources created in the future have these tags.
- Verdict: This approach is helpful for retroactively tagging existing resources, but it doesn’t provide a strategy for enforcing tagging on future resources. It could be a good first step but requires additional measures for future consistency.
Option B: Use an AWS Config rule to alert the team of untagged resources. Create a centralized AWS Lambda-based solution to tag untagged RDS databases and DynamoDB resources every hour using a cross-account role.
- AWS Config Rule: AWS Config can be used to track resource configurations and can alert you when resources are missing tags. However, while alerts are useful, they do not provide automatic enforcement of tagging.
- AWS Lambda Automation: A Lambda-based solution that runs every hour to tag untagged RDS and DynamoDB resources is a proactive approach. This would help with tagging resources that may have been missed. However, it could introduce delays if resources are not tagged immediately upon creation, and it would require complex cross-account roles.
- Limitations: This solution introduces complexity (Lambda automation, cross-account roles), and it still doesn’t stop untagged resources from being created in the first place. It’s reactive rather than preventive.
- Verdict: While this is a practical solution for ongoing tagging, it’s not the most efficient approach since it doesn’t prevent untagged resources from being created in the first place and requires extra automation effort.
Option C: Use Tag Editor to tag existing resources. Create cost allocation tags to define t...
Author: Leo · Last updated Jul 6, 2026
A company wants to send data from its on-premises systems to Amazon S3 buckets. The company created the S3 buckets in three different accounts. The company must send the data privately without the data traveling across the internet. The company has no existing dedicated connec...
To meet the requirement of sending data privately from the on-premises systems to Amazon S3 buckets in different accounts without traversing the internet, the company needs to establish secure and private connectivity to AWS and ensure that the data transfer between the on-premises system and the S3 buckets happens within the AWS network.
Let's analyze each option:
Option A: Establish a networking account in the AWS Cloud. Create a private VPC in the networking account. Set up an AWS Direct Connect connection with a private VIF between the on-premises environment and the private VPC.
- Pros: AWS Direct Connect provides a dedicated network connection from the on-premises environment to AWS, which does not travel over the public internet. A private VIF (Virtual Interface) ensures that the data remains within AWS's private network.
- Cons: While Direct Connect ensures a private connection, it does not directly connect to Amazon S3. The company would need additional configurations such as a VPC endpoint or a VPN to ensure that data flows from the VPC to the S3 buckets across different accounts.
- Scenario Fit: This option is a good starting point, as it ensures private connectivity between on-premises systems and the AWS cloud, but additional steps are required for routing traffic to S3.
Option B: Establish a networking account in the AWS Cloud. Create a private VPC in the networking account. Set up an AWS Direct Connect connection with a public VIF between the on-premises environment and the private VPC.
- Pros: A public VIF provides a connection to AWS public services, including S3.
- Cons: Using a public VIF means the traffic travels over the internet to reach S3. The requirement explicitly states that the company wants to send data privately, which rules out using a public VIF. This does not meet the requirement of private data transfer.
- Scenario Fit: This option is not suitable because it involves internet traffic, which violates the requirement of sending data privately without using the internet.
Option C: Create an Amazon S3 interface endpoint in the networking account.
- Pros: An Amazon S3 interface endpoint provides private connectivity to S3 over AWS’s internal network. Data sent to and from S3 through this endpoint will not traverse the public internet.
- Cons: An S3 interface endpoint allows private communication with S3 but only works for VPCs within the same account. This would require the S3 buckets to be in the same VPC or connected via peering/VPN. However, this might not directly address cross-account access for the S3 buckets.
- Scenario Fit: This option is useful if ...
Author: Maya · Last updated Jul 6, 2026
A company operates quick-service restaurants. The restaurants follow a predictable model with high sales traffic for 4 hours daily. Sales traffic is lower outside of those peak hours.
The point of sale and management platform is deployed in the AWS Cloud and has a backend that is based on Amazon DynamoDB. The database table uses provisioned throughput mode with 100,000 RCUs and 80,000 WCUs to match known peak resource ...
To meet the company's goal of reducing DynamoDB costs while minimizing operational overhead, let’s evaluate each option:
Option A: Reduce the provisioned RCUs and WCUs.
- Scaling Manually: The company’s system has predictable traffic with high sales during peak hours. By manually reducing the provisioned read and write capacity units (RCUs and WCUs) during non-peak hours, the company could save costs. However, this requires regular manual intervention to adjust the capacity according to the traffic pattern.
- Operational Overhead: While this could reduce costs, it creates operational overhead because the capacity would need to be adjusted daily (or periodically), and the company might need to constantly monitor traffic trends to avoid throttling during peak times.
- Verdict: This option is not ideal because of the manual overhead involved in adjusting the capacity frequently, which increases complexity and potential risk of under-provisioning during peak traffic.
Option B: Change the DynamoDB table to use on-demand capacity.
- On-Demand Scaling: In on-demand capacity mode, DynamoDB automatically scales to accommodate the workload. It is ideal for unpredictable workloads where you don’t want to manually adjust the capacity.
- Cost Efficiency: This could be more cost-effective than provisioned capacity because the company would only pay for the actual usage rather than over-provisioning for peak hours.
- Verdict: On-demand capacity is ideal for varying workloads, but in this case, since the sales traffic is predictable with clear peak and off-peak times, it may not be the most cost-effective solution, as it could lead to higher costs during peak hours where the system would still need to scale up quickly.
Option C: Enable DynamoDB auto scaling for the table.
- Auto Scaling: DynamoDB auto scaling adjusts the RCUs and WCUs based on traffic patterns, automatically increasing throughput during high traffic and reducing it during low traffic times. This allows the company to match throughput demand while optimizing cost.
- Cost Efficiency: Auto scaling en...
Author: Suresh · Last updated Jul 6, 2026
A company hosts a blog post application on AWS using Amazon API Gateway, Amazon DynamoDB, and AWS Lambda. The application currently does not use API keys to authorize requests. The API model is as follows:
GET /posts/{postId}: to get post details
GET /users/{userId}: to get user details
GET /comments/{commentId}: to get comments details
The company has noticed users are actively discussing topics in the comments sect...
To reduce comment latency and improve user experience by delivering comments in real-time, let’s evaluate each option:
Option A: Use edge-optimized API with Amazon CloudFront to cache API responses.
- Edge-Optimized API: Edge-optimized APIs in API Gateway use Amazon CloudFront to deliver responses closer to the end-users, which can reduce latency in some cases. However, the caching mechanism is typically useful for static content and would not be ideal for real-time updates.
- Caching Issue: For real-time content like comments, caching is not the best approach, as it would return stale data. API responses need to reflect the most up-to-date information, and caching would delay this.
- Verdict: This is not suitable for real-time updates because caching would interfere with the timely delivery of comments. It’s better for situations where content does not change frequently.
Option B: Modify the blog application code to request GET/comments/{commentId} every 10 seconds.
- Polling: This approach involves the blog application making repeated requests to the API every 10 seconds. While this would update the comments regularly, it introduces inefficiency because:
- API Load: Making requests every 10 seconds creates a constant load on the backend, which could strain the DynamoDB and Lambda functions.
- Latency: Although this reduces comment latency somewhat, it is not ideal for real-time applications, as there’s still a delay of up to 10 seconds, and it doesn't scale well.
- Network Traffic: Constant polling increases network traffic unnecessarily and is inefficient.
- Verdict: While it could work to update comments regularly, this approach is not efficient and can lead to unnecessary load on resources, especially as the number of users grows.
Option C: Use AWS AppSync and leverage WebSockets to deliver comments.
- Real-Time Updates with WebSockets: AWS AppSync is designed to manage real-time applications and can use WebSockets to deliver data updates to clients in real-time. By using AppSync, the blog application can...
Author: ShadowWolf101 · Last updated Jul 6, 2026
A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only ...
To enforce the requirement that S3 access points can only be created within VPCs, we need to evaluate the operational efficiency of each option. Let's break down the options and why one is most suitable.
A) Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
- Pros: This option provides a granular way to control the S3 access point creation at the resource level, ensuring that only VPC-based access points can be created. This is the most direct way to control the action at the S3 resource level.
- Cons: While effective, this may be harder to manage at scale if there are many accounts, as each S3 access point would need a policy applied, and managing multiple policies across hundreds of accounts could become cumbersome.
- Use Case: This option is good for organizations that need highly granular control but may struggle with scalability in large environments with multiple accounts.
B) Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
- Pros: Service Control Policies (SCPs) provide a central mechanism to enforce policies across all accounts in an AWS Organization. This option allows the enforcement of the access point creation rule uniformly at the organizational level, making it scalable and easier to manage. SCPs are powerful and can prevent unwanted behavior across multiple accounts.
- Cons: SCPs can only deny or allow actions at the organizational level, and they can’t apply specific policies to particular AWS resources within those accounts. It also might be too broad if not configured carefully, potentially blocking other S3-related actions.
- Use Case: This option is ideal for centralized control across multiple accounts in an organization, particularly in large organizations where operational efficiency is critical.
C) Use AWS CloudFormation StackSets to create a new IAM policy in each AW...
Author: NightmareDragon2025 · Last updated Jul 6, 2026
A solutions architect must update an application environment within AWS Elastic Beanstalk using a blue/green deployment methodology. The solutions architect creates an environment that is identical to the existing application environment ...
To complete the update using the blue/green deployment methodology within AWS Elastic Beanstalk, we need to transition traffic from the existing (blue) environment to the new (green) environment in a safe and controlled manner. Let's evaluate the available options.
A) Redirect to the new environment using Amazon Route 53.
- Pros: This approach is applicable if the application is using Route 53 for domain name resolution. However, managing DNS records manually can add complexity, and you would need to ensure proper propagation and handling of traffic between environments.
- Cons: Redirecting traffic using Route 53 alone doesn't integrate directly with the Elastic Beanstalk blue/green deployment process. Route 53 changes can introduce delays and require manual intervention in DNS management.
- Use Case: This option is typically used in custom DNS management outside of Elastic Beanstalk's built-in blue/green deployment capabilities.
B) Select the Swap Environment URLs option.
- Pros: This option is part of the Elastic Beanstalk blue/green deployment process. Selecting the "Swap Environment URLs" option allows Elastic Beanstalk to automatically handle the URL swap between the blue and green environments. The existing environment (blue) URL is switched to point to the new environment (green), ensuring a smooth transition of traffic with minimal downtime.
- Cons: This is the most direct, efficient, and operationally integrated way to perform the swap in Elastic Beanstalk. No manual DNS changes are needed, and the transition is automated.
- Use Case: This option is ideal for completing a blue/green deployment, ensuring minimal disruption and maintaining application availability with Elastic Beanstalk's native ...
Author: Ahmed97 · Last updated Jul 6, 2026
A company is building an image service on the web that will allow users to upload and search random photos. At peak usage, up to 10,000 users worldwide will upload their images. The will then overlay text on the uploaded images, which ...
To design a scalable and cost-efficient image service on the web, we need to consider the following factors:
1. Scalability: The service should be able to handle up to 10,000 users uploading images simultaneously, as well as the processing workload.
2. Storage: The uploaded images need to be stored and later processed efficiently.
3. Processing and Workflow: There needs to be an effective mechanism for processing the images (overlaying text and potentially transforming images) after upload.
4. Performance: The service needs to provide fast and reliable access to the processed images.
5. Cost Efficiency: The solution should scale dynamically to meet demand without over-provisioning resources.
A) Store the uploaded images in Amazon Elastic File System (Amazon EFS). Send application log information about each image to Amazon CloudWatch Logs. Create a fleet of Amazon EC2 instances that use CloudWatch Logs to determine which images need to be processed. Place processed images in another directory in Amazon EFS. Enable Amazon CloudFront and configure the origin to be one of the EC2 instances in the fleet.
- Pros:
- EFS provides scalable, shared file storage, which could be useful for storing and accessing images across multiple EC2 instances.
- CloudWatch Logs and EC2 instances are fine for certain workflows, as logs can trigger specific processing actions.
- Cons:
- This solution involves manual scaling of EC2 instances and uses CloudWatch Logs to determine processing, which adds complexity and overhead.
- EFS is expensive compared to Amazon S3, especially for large-scale data like images.
- Using EC2 as the CloudFront origin can lead to higher latency and operational complexity.
- Managing EC2 scaling manually is less efficient than using serverless options like SQS or SNS for queuing.
Use Case: This option could be used for small-scale systems but is not optimal for handling large numbers of concurrent users, especially with cost concerns for EFS and EC2 scaling complexity.
B) Store the uploaded images in an Amazon S3 bucket and configure an S3 bucket event notification to send a message to Amazon Simple Notification Service (Amazon SNS). Create a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) to pull messages from Amazon SNS to process the images and place them in Amazon Elastic File System (Amazon EFS). Use Amazon CloudWatch metrics for the SNS message volume to scale out EC2 instances. Enable Amazon CloudFront and co...
Author: Emily · Last updated Jul 6, 2026
A company has deployed its database on an Amazon RDS for MySQL DB instance in the us-east-1 Region. The company needs to make its data available to customers in Europe. The customers in Europe must have access to the same data as customers in the United States (US) and will not tolerate high application latency or stale data. The customers in Europe and the customers in the...
To meet the company's requirements of minimizing latency and ensuring real-time updates for customers in both the US and Europe while allowing them to write to the database, let's carefully consider each option and how it addresses these key requirements:
Key Requirements:
1. Low Latency: Customers in Europe and the US need to access the database with low latency.
2. Real-time Data Availability: Both regions need to have access to the same data in real time.
3. Bidirectional Writes: Both US and Europe-based customers need to be able to write to the database.
Option A: Create an Amazon Aurora MySQL replica of the RDS for MySQL DB instance. Pause application writes to the RDS DB instance. Promote the Aurora Replica to a standalone DB cluster. Reconfigure the application to use the Aurora database and resume writes. Add eu-west-1 as a secondary Region to the DB cluster. Enable write forwarding on the DB cluster. Deploy the application in eu-west-1. Configure the application to use the Aurora MySQL endpoint in eu-west-1.
- Pros: This option involves creating an Aurora MySQL replica, which can provide automatic failover and replication across regions. Aurora supports cross-Region replication, and using write forwarding between regions would allow writes to be forwarded to the appropriate region and data to be kept in sync.
- Cons: It requires promoting the Aurora replica and reconfiguring the application to use Aurora. There is also a pause in application writes while this migration occurs. This approach may involve additional complexity for ensuring bidirectional writes across regions. The application architecture would need to be refactored, and transitioning to Aurora could require extra resources.
- Scenario Fit: This solution is feasible but involves some complexity in terms of application changes and potential downtime during the migration.
Option B: Add a cross-Region replica in eu-west-1 for the RDS for MySQL DB instance. Configure the replica to replicate write queries back to the primary DB instance. Deploy the application in eu-west-1. Configure the application to use the RDS for MySQL endpoint in eu-west-1.
- Pros: Cross-Region replication between RDS for MySQL DB instances allows data to be replicated across regions. This configuration would ensure that customers in Europe have access to the same data as customers in the US.
- Cons: RDS for MySQL does not support cross-Region replication with bidirectional writes. This means that while the data in Europe could be kept up to date with the US region, writes made in Europe would not automatically be replicated back to the US region in real time.
- Scenario Fit: This option does not meet the requirement of allowing bidirectional writes across regions, which is a critical need for the solution.
Option C: Copy the most recent snapshot from the RDS for MySQL DB instance to eu-west-1. Create a new RDS for MySQL DB instance in eu-west-1 from the ...
Author: Amira99 · Last updated Jul 6, 2026
A company is serving files to its customers through an SFTP server that is accessible over the internet. The SFTP server is running on a single Amazon EC2 instance with an Elastic IP address attached. Customers connect to the SFTP server through its Elastic IP address and use SSH for authentication. The EC2 instance also has an attached security group that allows access from all customer IP addresses.
A solutions architect must implement a solution to improve availability, minimi...
The company needs to improve the availability, minimize infrastructure management complexity, and ensure minimal disruption to customers accessing files while keeping the customer connection process unchanged. Let's evaluate each solution based on these factors:
A) Disassociate the Elastic IP address from the EC2 instance. Create an Amazon S3 bucket to be used for SFTP file hosting. Create an AWS Transfer Family server. Configure the Transfer Family server with a publicly accessible endpoint. Associate the SFTP Elastic IP address with the new endpoint. Point the Transfer Family server to the S3 bucket. Sync all files from the SFTP server to the S3 bucket.
- Pros:
- AWS Transfer Family integrates well with S3 and provides a fully managed SFTP service.
- This solution abstracts away much of the infrastructure management by offloading the complexity of running and maintaining the SFTP server to AWS Transfer Family.
- Files stored in S3 are highly available and can scale automatically.
- Cons:
- This solution introduces a change in how customers connect to the service (i.e., they would now connect to the Transfer Family endpoint rather than the Elastic IP directly). The requirement specified that the connection method should not change.
- Use Case: This option is great for fully managed file hosting on S3, but it doesn’t meet the requirement to keep customer connection methods the same.
B) Disassociate the Elastic IP address from the EC2 instance. Create an Amazon S3 bucket to be used for SFTP file hosting. Create an AWS Transfer Family server. Configure the Transfer Family server with a VPC-hosted, internet-facing endpoint. Associate the SFTP Elastic IP address with the new endpoint. Attach the security group with customer IP addresses to the new endpoint. Point the Transfer Family server to the S3 bucket. Sync all files from the SFTP server to the S3 bucket.
- Pros:
- This solution uses AWS Transfer Family for SFTP hosting with S3, which simplifies infrastructure management and ensures scalability and high availability.
- It allows the use of a VPC-hosted internet-facing endpoint, ensuring secure and controlled access.
- The SFTP Elastic IP address is still retained and associated with the new endpoint, so customer connection methods remain unchanged.
- Cons:
- Similar to option A, while the connection method remains the same, the backend architecture is fully managed and uses Transfer Family, which might require some setup and testing to ensure smooth migration.
- Use Case: This option is highly suitable as it keeps customer connections unchanged while transitioning to a fully managed, scalable solution using Transfer Family and S3.
C) Disassociate the Elastic IP address from the EC2 instance. Create a new Amazon Elastic File System (Amazon EFS) file system to be used for SFTP file hosting. Create an AWS Fargate task definition to run an SFTP server. Specify the EFS file system as a mount in the task definition. Create a Fargate...
Author: Isabella · Last updated Jul 6, 2026
A company ingests and processes streaming market data. The data rate is constant. A nightly process that calculates aggregate statistics takes 4 hours to complete. The statistical analysis is not critical to the business, and data points are processed during the next iteration if a particular run fails.
The current architecture uses a pool of Amazon EC2 Reserved Instances with 1-year reservations. These EC2 instances run full time to ingest and store the streaming data in attached Amazon Elastic Block Store (Amazon EBS) volumes. A scheduled script launches EC2 On-Demand Instances each night to perform the nightly processing. The instances access the stored data from NFS shares on the inge...
To determine the most cost-effective solution, we need to evaluate the benefits and trade-offs of each option based on the following key factors:
1. Cost: The company is looking for the most cost-effective solution, particularly considering that the current Reserved Instances are expiring.
2. Scalability and Flexibility: The solution should scale easily and adapt to varying workloads.
3. Processing Requirements: The nightly process takes 4 hours, and the data analysis is not critical, meaning there's some flexibility in timing.
4. Simplicity of Management: The solution should minimize complexity in deployment and maintenance.
5. Fault Tolerance: The company prefers a design where data points can be reprocessed in case of failure, which aligns with using reliable and fault-tolerant AWS services.
Let’s analyze each option:
Option A:
Update the ingestion process to use Amazon Kinesis Data Firehose to save data to Amazon S3. Use a scheduled script to launch EC2 On-Demand Instances each night to perform the batch processing of the S3 data. Configure the script to terminate the instances when the processing is complete.
- Pros:
- Kinesis Data Firehose is a fully managed service for ingesting and storing data, which simplifies the ingestion process and offloads management.
- EC2 On-Demand Instances provide flexibility in scaling compute resources as needed for the batch processing.
- S3 is a cost-effective storage option, and using it for data storage reduces the complexity of managing NFS shares.
- Cons:
- EC2 On-Demand Instances can be costly for regular use, especially since the nightly processing lasts for 4 hours.
- The scheduled script adds management overhead and complexity.
- There's no cost optimization for the compute resources since On-Demand pricing can be high.
Option B:
Update the ingestion process to use Amazon Kinesis Data Firehose to save data to Amazon S3. Use AWS Batch with Spot Instances to perform nightly processing with a maximum Spot price that is 50% of the On-Demand price.
- Pros:
- AWS Batch is a managed service that simplifies batch processing and can scale the compute resources automatically.
- Spot Instances offer significant cost savings (up to 90% off On-Demand prices), which is ideal for non-critical processes like nightly aggregation that can tolerate interruptions.
- S3 storage is cost-effective and scalable.
- Cons:
- Spot Instances can be interrupted, although AWS Batch can handle this gracefully by resuming jobs, but it might introduce complexity in managing interruptions.
- There might still be some management overhead for configuring AWS Batch.
Option C:
Update the ingestion process to use a fleet of EC2 Reserved Instances with 3-year reservations behind a Network ...
Author: Krishna · Last updated Jul 6, 2026
A company needs to migrate an on-premises SFTP site to AWS. The SFTP site currently runs on a Linux VM. Uploaded files are made available to downstream applications through an NFS share.
As part of the migration to AWS, a solutions architect must implement high availability. The solution must provide external vendors with a set of static public IP addresses that the vendors can allow. The company ha...
To meet the company's requirements of migrating an on-premises SFTP site to AWS while ensuring high availability and providing external vendors with static public IP addresses, let's evaluate the different options based on the key factors involved: high availability, public IP addresses for external vendors, operational overhead, and compatibility with NFS share configuration.
Key Requirements:
1. High Availability: The solution must be able to provide access from multiple availability zones (AZs) to ensure that the SFTP service is highly available.
2. Public IPs for Vendors: External vendors need a set of static public IPs that can be allowed by the vendors.
3. Operational Overhead: The solution should minimize operational overhead and management complexity, as the company is looking for an easy-to-manage setup.
4. NFS Compatibility: The downstream applications that currently access files via an NFS share need to continue to do so after the migration.
Option A: Create an AWS Transfer Family server. Configure an internet-facing VPC endpoint for the Transfer Family server. Specify an Elastic IP address for each subnet. Configure the Transfer Family server to place files into an Amazon Elastic File System (Amazon EFS) file system that is deployed across multiple Availability Zones. Modify the configuration on the downstream applications that access the existing NFS share to mount the EFS endpoint instead.
- Pros:
- The AWS Transfer Family is a managed service designed for SFTP with minimal operational overhead. It integrates with EFS, which supports NFS access and is highly available across multiple AZs.
- Elastic IP addresses (EIPs) can be allocated to the VPC subnets to meet the requirement for static public IPs.
- EFS is a fully managed, scalable, and highly available service that provides NFS compatibility, making it suitable for the downstream applications to access the files.
- Cons:
- Internet-facing VPC endpoint for Transfer Family may require more configuration for controlling access to the endpoint and handling any potential security concerns.
- Configuration changes to the downstream applications to mount EFS may require some effort.
- Scenario Fit: This is a solid option for reducing operational overhead with the AWS Transfer Family and leveraging EFS for high availability and NFS access.
Option B: Create an AWS Transfer Family server. Configure a publicly accessible endpoint for the Transfer Family server. Configure the Transfer Family server to place files into an Amazon Elastic File System (Amazon EFS) file system that is deployed across multiple Availability Zones. Modify the configuration on the downstream applications that access the existing NFS share to mount the EFS endpoint instead.
- Pros:
- Similar to Option A, AWS Transfer Family supports SFTP with minimal management.
- EFS provides high availability across multiple AZs, and supports NFS for downstream applications.
- A publicly accessible endpoint allows for easy access to the SFTP service.
- Cons:
- Publicly accessible endpoint means that the Transfer Family service will have a public IP. Although this simplifies access for vendors, it may not fully meet the security requirement of having static public IPs that vendors can allow. Managing security with this public endpoint could be more challenging.
- Scenario Fit: Alt...
Author: Isabella1 · Last updated Jul 6, 2026
A solutions architect has an operational workload deployed on Amazon EC2 instances in an Auto Scaling group. The VPC architecture spans two Availability Zones (AZ) with a subnet in each that the Auto Scaling group is targeting. The VPC is connected to an on-premises environment and connectivity cannot be interrupted. The maximum size of the Auto Scaling group is 20 instances in service. The VPC IPv4 addressing is as follows:
VPC CIDR: 10.0.0.0/23 -
AZ1 subnet CIDR: 10.0.0.0/24 -
AZ2 subnet CIDR: 10.0.1.0/24 -
Since...
Key Considerations:
- VPC Constraints: The VPC CIDR block (10.0.0.0/23) spans two subnets, each within different AZs (AZ1: 10.0.0.0/24, AZ2: 10.0.1.0/24). Adding a third AZ means the current VPC address space must be restructured to accommodate new subnets, without exceeding the available IPv4 address space and avoiding downtime.
- Auto Scaling Group: The Auto Scaling group spans the two AZs, and we need to adopt the new AZ without interrupting service. This means the Auto Scaling group needs to be carefully updated to avoid downtime or loss of service during the transition.
- Connectivity: The VPC is connected to an on-premises environment, which cannot have its connectivity interrupted.
Let's evaluate the options:
Option A: Update the Auto Scaling group to use the AZ2 subnet only. Delete and re-create the AZ1 subnet using half the previous address space. Adjust the Auto Scaling group to also use the new AZ1 subnet. When the instances are healthy, adjust the Auto Scaling group to use the AZ1 subnet only. Remove the current AZ2 subnet. Create a new AZ2 subnet using the second half of the address space from the original AZ1 subnet. Create a new AZ3 subnet using half the original AZ2 subnet address space, then update the Auto Scaling group to target all three new subnets.
- Pros:
- This method avoids creating a new VPC and only reuses the current VPC CIDR range, making efficient use of existing resources.
- It uses half of the existing address space for the new subnets in AZ1, AZ2, and AZ3.
- Cons:
- The process involves a significant amount of changes, like deleting and recreating subnets, which introduces potential risk and requires careful timing to ensure no downtime.
- Requires updating the Auto Scaling group to target new subnets and ensuring that instances are running before removing old subnets, which adds complexity.
- Scenario Fit: This solution could work but involves significant reconfiguration of subnets, leading to higher complexity and a higher likelihood of operational risk.
Option B: Terminate the EC2 instances in the AZ1 subnet. Delete and re-create the AZ1 subnet using half the address space. Update the Auto Scaling group to use this new subnet. Repeat this for the second AZ. Define a new subnet in AZ3, then update the Auto Scaling group to target all three new subnets.
- Pros:
- Reusing the existing VPC CIDR block is efficient.
- Adding a new subnet in AZ3 meets the requirement of adopting the new AZ.
- Cons:
- Terminating instances in the AZ1 subnet would cause downtime, which violates the requirement of no service disruption.
- The approach involves del...
Author: Sara · Last updated Jul 6, 2026
A company uses an organization in AWS Organizations to manage the company's AWS accounts. The company uses AWS CloudFormation to deploy all infrastructure. A finance team wants to build a chargeback model. The finance team asked each business unit to tag resources by using a predefined list of project values.
When the finance team used the AWS Cost and Usage Report in AWS Cost Explorer and filtered based on project, the ...
Key Requirements:
1. Tag Enforcement: The company wants to enforce the use of specific tags (in this case, project tags) for new resources created through CloudFormation.
2. Chargeback Model: The goal is to ensure that the project tags are used consistently across all resources to enable accurate cost allocation and chargeback models.
3. Minimal Effort: The solution should require the least operational overhead while ensuring compliance with the project tag policy.
Evaluation of Options:
Option A:
Create a tag policy that contains the allowed project tag values in the organization's management account. Create an SCP that denies the `cloudformation:CreateStack` API operation unless a project tag is added. Attach the SCP to each OU.
- Pros:
- Tag Policies in AWS Organizations allow you to centrally define and enforce tag standards (such as allowed project tag values). This ensures that resources are tagged consistently.
- Service Control Policies (SCPs) can be used to enforce the tag requirement by denying the creation of CloudFormation stacks unless the required project tag is present. This helps in ensuring compliance at the organizational level.
- Cons:
- The SCP controls access at a broader level, but it may not be as granular as enforcing tag usage via IAM roles or policies specific to users or resources.
- This approach still depends on applying the SCP to each Organizational Unit (OU), which can be a bit manual, and the enforcement at the API level could potentially cause issues if the tag is missed.
Option B:
Create a tag policy that contains the allowed project tag values in each OU. Create an SCP that denies the `cloudformation:CreateStack` API operation unless a project tag is added. Attach the SCP to each OU.
- Pros:
- Like Option A, this also utilizes Tag Policies to enforce allowed tag values.
- The SCP would enforce the project tag requirement at the API level, ensuring consistency.
- Cons:
- Tag Policies at the OU level can cause redundant configuration if many OUs are involved.
- It is still necessary to apply SCPs to each OU individually, which adds manual effort.
- Similar to Option A, enforcing tags at the API level can create operational friction if a resource is accidentally launched without the required tag.
Option C:
Create a tag policy that contains the allowed project tag values in ...
Author: Max · Last updated Jul 6, 2026
An application is deployed on Amazon EC2 instances that run in an Auto Scaling group. The Auto Scaling group configuration uses only one type of instance.
CPU and memory utilization metrics show that the instances are underutilized. A solutions architect needs to implement a solution to permanently reduce the EC2 cost...
Key Considerations:
- Cost Reduction: The goal is to reduce EC2 costs, which can be achieved by selecting more cost-efficient instance types based on the application's actual resource utilization.
- Utilization Improvement: Increasing resource utilization means choosing instances that align better with the application's CPU and memory demands, ensuring that the resources are fully utilized.
- Simplicity and Future Maintenance: The solution should be simple to implement and minimize the need for frequent future configuration changes.
Evaluating the Options:
Option A: List instance types that have properties that are similar to the properties that the current instances have. Modify the Auto Scaling group's launch template configuration to use multiple instance types from the list.
- Pros:
- Using multiple instance types from a list allows flexibility, as Auto Scaling can choose the most appropriate instance type at any time based on availability and cost.
- It can help improve resource utilization by selecting instances that are better matched to the application’s actual requirements.
- Cons:
- This option still requires future monitoring and potential adjustments to the instance types in the list as workloads change.
- Without detailed monitoring, it's not guaranteed that the multiple instance types will always be the most cost-effective.
- Scenario Fit: This option allows flexibility, but without an exact match to the application’s resource requirements, it may lead to over- or under-utilization at times.
Option B: Use the information about the application's CPU and memory utilization to select an instance type that matches the requirements. Modify the Auto Scaling group's configuration by adding the new instance type. Remove the current instance type from the configuration.
- Pros:
- This option allows for selecting a single instance type that is better aligned with the application's resource needs (based on CPU and memory utilization).
- Simplifies the Auto Scaling group's configuration by using only one instance type, potentially reducing future maintenance.
- Cons:
- It removes flexibility by relying on only one instance type. If the application experiences changes in demand or resource needs, this could lead to overutilization or underutilization, thus reducing cost optimization in the future.
- The instance type could become suboptimal if workload requirements change over time, leading to manual adjustments in the future.
- Scenario Fit: This is a more static approach, and while it could be eff...
Author: Daniel · Last updated Jul 6, 2026
A company implements a containerized application by using Amazon Elastic Container Service (Amazon ECS) and Amazon API Gateway The application data is stored in Amazon Aurora databases and Amazon DynamoDB databases. The company automates infrastructure provisioning by using AWS CloudFormation. The company automates application deployment by using AWS CodePipeline.
A solutions architect need...
To select the most cost-effective disaster recovery (DR) solution that meets the company's requirements (RPO of 2 hours and RTO of 4 hours), let's analyze the given options based on the key factors:
Key Factors:
1. Cost-effectiveness: The solution should minimize costs, considering both infrastructure and management.
2. RPO and RTO compliance: The solution must meet the company's recovery point objective (RPO) of 2 hours and recovery time objective (RTO) of 4 hours.
3. Database replication: The solution should include database replication strategies that meet the RPO and RTO requirements for both Aurora and DynamoDB.
4. Traffic routing during DR: The solution should have a mechanism for directing traffic to the secondary region in the event of a disaster.
5. Operational complexity: The solution should not involve excessive complexity in terms of configuration, maintenance, or ongoing operational overhead.
Evaluation of Each Option:
Option A: Set up an Aurora global database and DynamoDB global tables
- Aurora global database: This feature allows for cross-region replication, enabling low-latency reads and fast failover between regions. It can meet the RPO of 2 hours by continuously replicating data to a secondary region.
- DynamoDB global tables: This feature also replicates data across AWS Regions automatically and can handle cross-region replication, ensuring low RPO.
- API Gateway with Regional endpoints: This requires some management during failover, as a failover mechanism needs to be set up for routing traffic between regions.
- Amazon CloudFront with origin failover: This can be used to direct traffic to the secondary region during a DR scenario, but it may involve additional complexity and cost for managing failover settings.
Cost-effectiveness: Aurora global databases and DynamoDB global tables can be expensive due to the continuous cross-region replication, but they are designed for high availability and low-latency recovery, meeting both RPO and RTO requirements. The use of CloudFront adds some complexity and extra cost.
Rejection Reason: While this option is suitable for meeting the RPO and RTO requirements, the additional use of CloudFront may add unnecessary complexity and cost.
Option B: Use AWS DMS, EventBridge, and Lambda for replication
- AWS DMS (Database Migration Service): DMS is primarily used for migrating databases and can be used for continuous replication of Aurora, but it’s typically slower and more complex to set up for active disaster recovery than Aurora global databases.
- DynamoDB Streams and EventBridge with Lambda: These services could replicate DynamoDB data to the secondary region but would require custom Lambda functions for replication. This introduces hi...
Author: Aarav2020 · Last updated Jul 6, 2026
A company has a complex web application that leverages Amazon CloudFront for global scalability and performance. Over time, users report that the web application is slowing down.
The company's operations team reports that the CloudFront cache hit ratio has been dropping steadily. The cache metrics report indicates that query strings on some URLs are inconsistently ordered and are specified sometimes...
To address the issue of the dropping CloudFront cache hit ratio, we need to find the most effective and immediate solution that optimizes caching by dealing with the inconsistency in query string ordering and casing. Let's evaluate each option based on the problem of inconsistent query string ordering and casing and the goal of improving the cache hit ratio.
Key Considerations:
- CloudFront Cache Behavior: CloudFront caches responses based on the URL and query string parameters. If query strings are inconsistently ordered or mixed case, CloudFront may treat them as different URLs, reducing the cache hit ratio.
- Impact on Cache Hit Ratio: If CloudFront is caching responses for variations of URLs that are essentially the same but have different query string orders or case sensitivity, this leads to unnecessary cache misses.
- Cost and Complexity: We want a solution that addresses the problem directly without introducing unnecessary complexity or operational overhead.
Evaluation of Each Option:
Option A: Deploy a Lambda@Edge function to sort parameters by name and force them to be lowercase. Select the CloudFront viewer request trigger to invoke the function.
- Lambda@Edge: This option involves deploying a Lambda@Edge function that can manipulate the query strings before CloudFront caches the response. The function would standardize the query strings by sorting them and converting them to lowercase.
- Effectiveness: By making the query strings consistent (same order, same case), CloudFront will treat these URLs as identical, improving the cache hit ratio.
- Implementation: This solution addresses the root cause (inconsistent query string formatting) directly and would be effective in resolving the issue quickly. Lambda@Edge functions can be invoked at the viewer request stage, ensuring the query strings are standardized before CloudFront makes caching decisions.
- Cost: Lambda@Edge incurs some additional cost, but it's a targeted solution that should improve cache hit ratios without overhauling the architecture.
Option B: Update the CloudFront distribution to disable caching based on query string parameters.
- Disabling Query String Caching: If caching based on query strings is disabled, CloudFront will no longer consider query strings when determining cache keys. This means that CloudFront will treat all requests for the same URL as identical, regardless of the query string, potentially improving the cache hit ratio.
- Effectiveness: Disabling query string-based caching would increase cache hits for URLs with varying query strings but could also introduce issues where different query strings are meant to produce different content (e.g., user-spe...
Author: NightmareDragon2025 · Last updated Jul 6, 2026
A company runs an ecommerce application in a single AWS Region. The application uses a five-node Amazon Aurora MySQL DB cluster to store information about customers and their recent orders. The DB cluster experiences a large number of write transactions throughout the day.
The company needs to replicate the data in the Aurora database to another...
To address the company's disaster recovery (DR) requirements with an RPO of 1 hour and at the lowest cost, we need to carefully evaluate the available options based on cost-effectiveness, ease of implementation, and ability to meet the desired recovery point objective (RPO).
Key Considerations:
1. RPO of 1 hour: The solution must replicate data from the primary Region to another Region and ensure data is no older than 1 hour.
2. Cost: The solution must be cost-effective. Some methods (e.g., Aurora Global Database) can be expensive due to cross-region replication and infrastructure needs.
3. Complexity: The solution should be easy to manage and not add unnecessary complexity.
4. Replication Method: Since the database experiences a high volume of write transactions, we need a solution that can keep up with frequent updates.
Evaluation of Each Option:
Option A: Modify the Aurora database to be an Aurora global database. Create a second Aurora database in another Region.
- Aurora Global Database: This solution allows for cross-region replication with low latency. Aurora Global Database supports continuous replication of writes between two Aurora MySQL databases in different regions and meets the 1-hour RPO.
- Cost: Aurora Global Databases incur additional costs, including charges for cross-region replication and the secondary Aurora database instance. While it meets the RPO requirement, it can be costly for high-write environments due to the replication infrastructure.
- Effectiveness: This is a powerful, fully managed solution that ensures fast, real-time data replication with minimal RPO. However, the cost is higher compared to other options that don't require continuous replication.
- Rejection Reason: While it meets the RPO requirement, the higher operational cost makes it less suitable if minimizing cost is a priority.
Option B: Enable the Backtrack feature for the Aurora database. Create an AWS Lambda function that runs daily to copy the snapshots of the database to a backup Region.
- Backtrack: The Aurora Backtrack feature allows you to move the database to a specific point in time within the past 30 days. However, it does not provide continuous cross-region replication and would not meet the RPO requirement of 1 hour. It’s more of a point-in-time restore mechanism.
- Lambda Function and Snapshots: While Lambda could automate the process of copying database snapshots to another region, snapshots are not real-time and are taken periodically, meaning they cannot meet the 1-hour RPO. Snapshots generally involve a longer recovery time.
- Cost: While Lambda and snapshots might appear cheaper, they would not meet the RPO requirement, and snapshot-based recovery would introduce longer RTO.
- Rejection Reason...
Author: Sophia · Last updated Jul 6, 2026
A company's solutions architect is evaluating an AWS workload that was deployed several years ago. The application tier is stateless and runs on a single large Amazon EC2 instance that was launched from an AMI. The application stores data in a MySQL database that runs on a single EC2 instance.
The CPU utilization on the application server EC2 instance often reaches 100% and causes the application to stop responding. The company manually installs patches...
To meet the company's goal of improving application availability with minimal development effort, we need to focus on scaling the application and database while addressing the manual patching and high CPU utilization issues.
Let’s analyze each solution:
A) Move the application tier to AWS Lambda functions in the existing VPC. Create an Application Load Balancer to distribute traffic across the Lambda functions. Use Amazon GuardDuty to scan the Lambda functions. Migrate the database to Amazon DocumentDB (with MongoDB compatibility).
- Pros:
- AWS Lambda offers automatic scaling and eliminates the need for managing EC2 instances.
- Serverless architecture means no need to worry about CPU utilization or instance health.
- Amazon GuardDuty provides security monitoring.
- Cons:
- Database incompatibility: The application uses MySQL, but DocumentDB is MongoDB-compatible, meaning a significant rewrite of the application would be required to change the database.
- Application rework: Migrating to Lambda functions would require significant re-architecting of the stateless application. This is a significant development effort, which contradicts the requirement of minimal development.
When this is suitable: This option could work for modernizing the application and going serverless, but it requires considerable effort to re-architect the application and change the database. It's not the best solution for minimal development.
B) Change the EC2 instance type to a smaller Graviton-powered instance type. Use the existing AMI to create a launch template for an Auto Scaling group. Create an Application Load Balancer to distribute traffic across the instances in the Auto Scaling group. Set the Auto Scaling group to scale based on CPU utilization. Migrate the database to Amazon DynamoDB.
- Pros:
- Graviton instances offer cost savings and improved performance for certain workloads.
- Using Auto Scaling based on CPU utilization will help automatically scale the application and handle high loads.
- The Application Load Balancer distributes traffic efficiently across the instances.
- Cons:
- Database incompatibility: DynamoDB is a NoSQL database, while the application uses MySQL. Migrating from a relational database to NoSQL would require significant changes to the application’s logic.
- Database scaling: DynamoDB can scale automatically, but it may not be a good fit if the application requires relational database features, such as joins, transactions, or complex queries.
When this is suitable: This solution could be viable for applications designed for NoSQL databases, but it's not a good fit because it requires significant application changes due to the database migration.
C) Move the application tier to containers by using Docker. Run the containers on Amazon Elastic Container Service (Amazon ECS) with EC2 instances. Create an Application Load Balancer to distribute...
Author: Isabella · Last updated Jul 6, 2026
A company is planning to migrate several applications to AWS. The company does not have a good understanding of its entire application estate. The estate consists of a mixture of physical machines and VMs.
One application that the company will migrate has many dependencies that are sensitive to latency. The company is unsure what all the dependencies are. However the company knows that the low-latency communications use a custom IP-based protocol that runs on port 1000. The company wants to migrate the application and these dependencies together to move all the low-latency interfaces to ...
To solve the problem of identifying dependencies for the application migration, particularly focusing on low-latency interfaces using a custom IP-based protocol on port 1000, we need a solution that can discover and identify the relevant servers interacting with the application, specifically based on communication over port 1000.
Key Factors to Consider:
- Application Dependencies: The goal is to identify the servers and dependencies that communicate with the application, particularly those involving low-latency communications over port 1000.
- Data Discovery Tools: AWS provides several tools like Migration Hub, Application Discovery Service, and Network Access Analyzer that help discover and map the application environment.
- Efficiency: The solution should allow for easy identification of communication patterns and dependencies without unnecessary overhead.
Evaluation of Each Option:
Option A: Use AWS Migration Hub and select the servers that host the application. Visualize the network graph to find servers that interact with the application. Turn on data exploration in Amazon Athena. Query the data that is transferred between the servers to identify the servers that communicate on port 1000. Return to Migration Hub. Create a move group that is based on the findings from the Athena queries.
- AWS Migration Hub: Migration Hub provides a centralized location to track and manage migrations. The network graph can help visualize interactions between servers.
- Amazon Athena: Athena allows querying data stored in Amazon S3 using SQL-like queries. By turning on data exploration and querying the transferred data, the company can identify servers communicating over port 1000.
- Effectiveness: This option seems to be highly effective for identifying dependencies based on communication on specific ports (in this case, port 1000). It leverages both Migration Hub and Athena to track and analyze communication patterns.
- Cost and Complexity: While using Athena and Migration Hub adds some complexity, it is a well-suited approach for discovering dependencies based on specific network traffic, and it can be automated for ongoing monitoring.
Option B: Use AWS Application Migration Service and select the servers that host the application. Visualize the network graph to find servers that interact with the application. Configure Application Migration Service to launch test instances for all the servers that interact with the application. Perform acceptance tests on the test instances. If no issues are identified, create a move group that is based on the tested servers.
- AWS Application Migration Service: This service helps with lifting and shifting servers but is more focused on migration and testing after the fact.
- Test Instances: While useful for validating migration, the main goal here is to identify dependencies related to low-latency communica...
Author: Ryan · Last updated Jul 6, 2026
A company is building an application that will run on an AWS Lambda function. Hundreds of customers will use the application. The company wants to give each customer a quota of requests for a specific time period. The quotas must match customer usage patterns. Som...
To determine which solution best meets the requirements of providing each customer with a specific quota of requests for a set time period in an application running on AWS Lambda, let's evaluate each option based on the following factors:
1. Quota Management: Each customer should have a different request quota that matches their usage patterns.
2. Scalability: The solution should scale as the number of customers increases.
3. Customization: The solution should allow for varying time periods and different quotas for different customers.
4. Integration with AWS Lambda: The solution must allow invoking Lambda functions efficiently while managing quotas.
Option Analysis
A) Create an Amazon API Gateway REST API with a proxy integration to invoke the Lambda function. For each customer, configure an API Gateway usage plan that includes an appropriate request quota. Create an API key from the usage plan for each user that the customer needs.
- Pros:
- API Gateway REST API can be used to control access to the Lambda function.
- API Gateway provides a native way to set request quotas through usage plans, making it easy to configure different request limits for each customer.
- API keys can be tied to different customers, providing unique access and quota management.
- Built-in support for rate limiting and usage tracking for each customer.
- Cons:
- This approach may become cumbersome if the number of customers increases substantially, requiring careful management of keys and usage plans.
- API Gateway REST API might be overkill if a simpler API (e.g., HTTP API) is sufficient.
B) Create an Amazon API Gateway HTTP API with a proxy integration to invoke the Lambda function. For each customer configure an API Gateway usage plan that includes an appropriate request quota. Configure route-level throttling for each usage plan. Create an API Key from the usage plan for each user that the customer needs.
- Pros:
- API Gateway HTTP API is a more lightweight and cost-effective option compared to REST API, especially for handling customer quotas.
- It still allows setting quotas and rate limits for different customers using usage plans and API keys.
- Route-level throttling can provide fine-grained control over requests to different API endpoints.
- Cons:
- The customization options for quota management are less advanced compared to the REST API version, but it may be sufficient for simple...
Author: Lina Zhang · Last updated Jul 6, 2026
A company is planning to migrate its on-premises VMware cluster of 120 VMs to AWS. The VMs have many different operating systems and many custom software packages installed. The company also has an on-premises NFS server that is 10 TB in size. The company has set up a 10 Gbps AWS Direct C...
Let's analyze each option:
Option A: Export VMs to S3, Use VM Import/Export, Order Snowball Edge for NFS
- How it works: You would export the on-premises VMs and store them in an S3 bucket. Then, you would use VM Import/Export to convert these VM images into AMIs (Amazon Machine Images). You would also order an AWS Snowball Edge device to copy the 10 TB of NFS data, then restore the NFS data to an EC2 instance with NFS configured.
- Why it works: Snowball Edge is a physical device that allows you to transfer large amounts of data efficiently, reducing the transfer time compared to over-the-wire transfers. VM Import/Export helps migrate on-premises VMs into AWS.
- Cons:
- The process involves multiple steps (e.g., exporting VMs, using VM Import/Export, ordering and using Snowball, restoring NFS data), which can introduce complexity and delays.
- Snowball Edge devices can take time to order, ship, and set up.
- Using S3 as an intermediate step adds an extra layer of complexity and time in the migration.
Option B: Use AWS Application Migration Service, DataSync, EFS
- How it works: The AWS Application Migration Service would be used to replicate VMs from the on-premises VMware cluster directly to AWS. AWS DataSync would copy the 10 TB of NFS data to Amazon EFS over the Direct Connect connection.
- Why it works: AWS Application Migration Service enables continuous replication and minimizes downtime by seamlessly migrating workloads from VMware to AWS. EFS is a fully managed file system that supports NFS, making it ideal for storing the 10 TB of data.
- Pros:
- Continuous replication ensures minimal downtime during the migration.
- Direct Connect allows for faster and more reliable data transfer over the network.
- Using EFS is an efficient choice for an NFS-compatible storage solution that integrates with AWS.
- Cons:
- While Application Migration Service simplifies the migration of VMs, it may still require a bit of manual configuration for all custom software packages.
Option C: Recreate VMs on EC2, FSx for Lustre, DataSync for NFS
- How it works: This option suggests manually recreating the VMs as EC2 instances and installing the necessary software packages. Then, it recommends using FSx for Lustre for the NFS data and using AWS DataSync to copy the 10 TB data.
- Why it works: FSx for Lustre is optimized for high-performance workl...
Author: Michael · Last updated Jul 6, 2026
An online survey company runs its application in the AWS Cloud. The application is distributed and consists of microservices that run in an automatically scaled Amazon Elastic Container Service (Amazon ECS) cluster. The ECS cluster is a target for an Application Load Balancer (ALB). The ALB is a custom origin for an Amazon CloudFront distribution.
The company has a survey that contains sensitive data. The sensitive data must be encrypted whe...
Key Requirements:
1. Sensitive Data Encryption: The sensitive data must be encrypted as it moves through the application.
2. Decryption by Specific Microservice: Only the data-handling microservice should be able to decrypt the data.
Option Evaluation:
A) Create a symmetric AWS Key Management Service (AWS KMS) key that is dedicated to the data-handling microservice. Create a field-level encryption profile and a configuration. Associate the KMS key and the configuration with the CloudFront cache behavior.
- Pros:
- KMS Symmetric Key: AWS KMS is the best service for managing encryption keys and controlling access to them. Symmetric keys allow both encryption and decryption by the same key, which suits the requirement that only the data-handling microservice should decrypt the data.
- CloudFront Integration: CloudFront supports KMS-based encryption through its field-level encryption feature, which can encrypt specific data before it reaches the client, ensuring sensitive data is encrypted in transit.
- Access Control: Using a KMS key tied to the data-handling microservice ensures that only the appropriate service has decryption permissions via AWS IAM roles.
- Cons:
- The solution is clear and aligned with AWS best practices for securing data, especially in transit. No major drawbacks here.
B) Create an RSA key pair that is dedicated to the data-handling microservice. Upload the public key to the CloudFront distribution. Create a field-level encryption profile and a configuration. Add the configuration to the CloudFront cache behavior.
- Pros:
- RSA encryption (asymmetric key encryption) allows for public and private key pairs, and the public key can be used by CloudFront to encrypt data while only the data-handling microservice (with the private key) can decrypt it.
- Cons:
- Complexity: While RSA is an option, managing key pairs (especially at scale) and handling encryption and decryption at multiple points can become cumbersome compared to KMS.
- Performance: RSA encryption is computationally more expensive than symmetric KMS encryption. This can add overhead, especially if the volume of data is large.
- Less Flexibility: KMS provides a more integrated and flexible solution when dealing with encryption in AWS services. RSA-based encryption is more manual and could require additional management.
C) Create a symmetric AWS Key Management Service (AWS KMS) key that is dedicated to the data-handling microservice. Create a Lambda@Edge function. Program the function to ...
Author: Leo · Last updated Jul 6, 2026
A solutions architect is determining the DNS strategy for an existing VPC. The VPC is provisioned to use the 10.24.34.0/24 CIDR block. The VPC also uses Amazon Route 53 Resolver for DNS. New requirements mandate that DNS queries must use private hosted zones. Additionally instances that have public IP addresses must receive corre...
To determine the best DNS strategy, let’s break down the requirements and match them to the options provided.
Key Requirements:
1. Private DNS resolution: DNS queries must be resolved using private hosted zones. This ensures that only internal resources within the VPC can resolve DNS records related to private applications or services.
2. Public hostnames for instances with public IPs: Instances that have public IP addresses should be assigned corresponding public DNS hostnames. This ensures that these instances can be reached publicly using their fully qualified domain names (FQDNs).
Let's break down the options:
Option A: Create a private hosted zone, activate `enableDnsSupport` and `enableDnsHostnames` attributes, update the DHCP options
- What it does: This option suggests creating a private hosted zone and configuring the VPC's DHCP options set with custom DNS (10.24.34.2).
- Why it doesn't fully work: The DNS query resolution for public instances using Amazon-provided DNS is not explicitly stated. The custom DNS server (10.24.34.2) would not automatically allow for public DNS resolution for instances with public IPs. The Amazon-provided DNS would be better for resolving public hostnames, especially when using public IPs.
- Key issue: The use of a custom DNS server like `10.24.34.2` might not ensure proper resolution for both private and public DNS requirements.
Option B: Create a private hosted zone, activate `enableDnsSupport` and `enableDnsHostnames` attributes, and use AmazonProvidedDNS
- What it does: This option configures the VPC with a private hosted zone and associates it with the VPC. It also enables both `enableDnsSupport` and `enableDnsHostnames` for the VPC. The DHCP options are configured to use `AmazonProvidedDNS` (the default DNS resolver provided by AWS).
- Why it works:
- Private hosted zone: This ensures that DNS queries for internal domain names are resolved within the VPC.
- `enableDnsSupport`: This is necessary to allow instanc...
Author: Emily · Last updated Jul 6, 2026
A data analytics company has an Amazon Redshift cluster that consists of several reserved nodes. The cluster is experiencing unexpected bursts of usage because a team of employees is compiling a deep audit analysis report. The queries to generate the report are complex read queries and are CPU intensive.
Business requirements dictate that the cluster must be able to service read and write q...
Key Requirements:
- The Amazon Redshift cluster must be able to handle both read and write queries at all times.
- The cluster must accommodate bursts of usage due to complex, CPU-intensive queries (audit reports).
- The solution must be cost-effective while addressing these bursts in usage.
Analyzing Each Option:
Option A: Provision an Amazon EMR cluster to offload complex data processing tasks
- How it works: Amazon EMR (Elastic MapReduce) is a service for processing large data sets, typically for batch processing or big data workloads. By offloading complex tasks to EMR, the Redshift cluster would not have to handle the intensive queries directly.
- Why it’s not ideal: While EMR is great for processing large-scale data outside Redshift, it introduces additional complexity and cost. Redshift already serves as a powerful analytics platform, and adding EMR would not directly address the need for scaling to handle the query bursts within Redshift itself.
- Cost concern: Using EMR would be more expensive and unnecessary since Redshift has native features that can better handle burst workloads like concurrency scaling.
- When to use: This approach would be appropriate if the workload involved heavy data transformations and processing that couldn't be handled by Redshift alone, but that doesn't seem to be the case here since it's about burst capacity, not data transformation.
Option B: Deploy an AWS Lambda function to add capacity to the Amazon Redshift cluster by using a classic resize operation when the cluster's CPU metrics in Amazon CloudWatch reach 80%
- How it works: This option suggests deploying a Lambda function that triggers a classic resize operation to increase capacity when the CPU usage exceeds 80%.
- Why it’s not ideal: Classic resizing is a manual operation that involves migrating data between nodes and can take considerable time. This is not ideal for burst workloads since resizing can cause significant downtime or delays. Additionally, resizing a cluster is a more permanent change and can be costly if resizing is done frequently in response to burst workloads.
- Cost concern: Classic resizing involves moving data between nodes, and it incurs downtime, which can be detrimental in a production environment where availability is critical.
- When to use: Classic resizing is more suited for long-term capacity changes rather than temporary burst requirements.
Option C: Deploy an AWS Lambda function to add capacity to the Amazon Redshift cluster by using an elastic resize operation when the cluster's CPU metrics in Amazon CloudWatch reach 80%
- How it works: Elastic resizing a...
Author: Olivia · Last updated Jul 6, 2026
A research center is migrating to the AWS Cloud and has moved its on-premises 1 PB object storage to an Amazon S3 bucket. One hundred scientists are using this object storage to store their work-related documents. Each scientist has a personal folder on the object store. All the scientists are members of a single IAM user group.
The research center's compliance officer is worried that scientists will be able to access each other's work. The research center has a strict obligation to report on which scientist accesses which documents. The team tha...
To meet the requirements of the research center, the solutions architect needs to ensure that the following goals are achieved:
1. Prevent scientists from accessing each other's work.
2. Enable reporting on which scientist accesses which documents with minimal operational overhead.
Let's analyze each option:
A) Create an identity policy that grants the user read and write access. Add a condition that specifies that the S3 paths must be prefixed with $(aws:username). Apply the policy on the scientists IAM user group.
- Reasoning: This option will restrict each scientist's access to their personal folder based on the S3 path prefix (i.e., the folder will be named after their IAM username). This ensures that a scientist can only access their folder and not others. However, this does not provide any mechanism for access logging or reporting.
- Rejected: While this option controls access to the data, it does not satisfy the requirement of reporting on access events. This is a valid approach for restricting access but not sufficient on its own for the reporting requirement.
B) Configure a trail with AWS CloudTrail to capture all object-level events in the S3 bucket. Store the trail output in another S3 bucket. Use Amazon Athena to query the logs and generate reports.
- Reasoning: CloudTrail can capture object-level operations (such as uploads, downloads, etc.) in the S3 bucket. Storing these events in an S3 bucket allows the use of Amazon Athena to query and analyze the logs for access reporting. This is a robust, fully-managed solution for tracking access and generating reports with minimal operational overhead.
- Selected: This option is ideal because it meets both the access reporting requirement and minimizes operational overhead. Athena can be used to easily query logs and generate detailed access reports.
C) Enable S3 server access logging. Configure another S3 bucket as the target for log delivery. Use Amazon Athena to query the logs and generate reports.
- Reasoning: S3 server access logging tracks requests to the S3 bucket, including the requester, action type, and more...
Author: Carlos Garcia · Last updated Jul 6, 2026
A company uses AWS Organizations to manage a multi-account structure. The company has hundreds of AWS accounts and expects the number of accounts to increase. The company is building a new application that uses Docker images. The company will push the Docker images to Amazon Elastic Container Registry (Amazon ECR). Only accounts that are within the company's organization should have access to the images.
The company has a CI/CD process that runs frequently. The compan...
Let's analyze each option in terms of how well it meets the requirements of the company, which are to:
1. Restrict access to the Docker images to only accounts within the company's AWS Organization.
2. Retain all tagged images.
3. Retain only the five most recent untagged images.
4. Minimize operational overhead.
A) Create a private repository in Amazon ECR. Create a permissions policy for the repository that allows only required ECR operations. Include a condition to allow the ECR operations if the value of the aws:PrincipalOrgID condition key is equal to the ID of the company’s organization. Add a lifecycle rule to the ECR repository that deletes all untagged images over the count of five.
- Reasoning: This solution is optimal for the following reasons:
- A private ECR repository ensures that only accounts within the AWS Organization can access the images.
- The permissions policy restricts access to only accounts in the AWS Organization using the `aws:PrincipalOrgID` condition.
- The lifecycle rule can be used to manage the retention of images. Specifically, it can delete untagged images older than a certain number, such as retaining only the five most recent untagged images.
- Least operational overhead: This solution fully leverages AWS's built-in lifecycle management for ECR, which minimizes the need for additional services or custom functions (like Lambda) to manage the deletion of untagged images.
- Selected: This option meets all the requirements and ensures minimal operational overhead since ECR's lifecycle policy takes care of the deletion of untagged images without requiring external automation or services.
B) Create a public repository in Amazon ECR. Create an IAM role in the ECR account. Set permissions so that any account can assume the role if the value of the aws:PrincipalOrgID condition key is equal to the ID of the company’s organization. Add a lifecycle rule to the ECR repository that deletes all untagged images over the count of five.
- Reasoning: While this option uses the `aws:PrincipalOrgID` condition to restrict access, it uses a public repository in ECR, which is not suitable for the requirement to restrict access to only accounts in the organization. A public repository would expose the images to anyone with the correct permissions, which contradicts...
Author: Noah Williams · Last updated Jul 6, 2026
A solutions architect is reviewing a company's process for taking snapshots of Amazon RDS DB instances. The company takes automatic snapshots every day and retains the snapshots for 7 days.
The solutions architect needs to recommend a solution that takes snapshots every 6 hours and retains the snapshots for 30 days. The company uses AWS Organizations to manage all of its AWS ac...
Let's analyze the different options based on the company's requirements:
Requirements:
1. Snapshot frequency: Take snapshots every 6 hours.
2. Retention period: Retain snapshots for 30 days.
3. Consolidated view: Need a consolidated view of the health of the RDS snapshots.
4. Minimize operational overhead: The solution should be simple and automated to reduce manual intervention.
A) Turn on the cross-account management feature in AWS Backup. Create a backup plan that specifies the frequency and retention requirements. Add a tag to the DB instances. Apply the backup plan by using tags. Use AWS Backup to monitor the status of the backups.
- Reasoning: AWS Backup supports centralized management of backups across AWS accounts, and it allows you to create backup plans with specific frequency and retention settings. By using tags to apply the backup plan, you can ensure that all RDS DB instances are included in the plan. The centralized monitoring in AWS Backup will allow you to easily view the status of all backups across the organization.
- Selected: This option meets all the requirements, including snapshot frequency, retention, and a consolidated monitoring solution, with minimal operational overhead. AWS Backup’s centralized console is particularly useful for cross-account management, and using tags to apply backup plans across accounts simplifies the management of backup policies.
B) Turn on the cross-account management feature in Amazon RDS. Create a snapshot global policy that specifies the frequency and retention requirements. Use the RDS console in the management account to monitor the status of the backups.
- Reasoning: While RDS provides features for managing automatic backups and snapshots, the ability to create snapshot global policies is limited, and RDS doesn't have built-in features for managing frequent snapshot schedules (e.g., every 6 hours). Additionally, the monitoring capabilities in the RDS console are less centralized when managing backups across multiple accounts, which could increase the operational overhead.
- Rejected: This option doesn't provide as much flexibility as AWS Backup in terms of cross-account management and the ability to create custom snapshot frequencies (e.g., every 6 hours). The monitoring capability in RDS also isn't as consolidated as AWS Backup's.
C) Turn on the cross-account management feat...
Author: Isabella1 · Last updated Jul 6, 2026
A company is using AWS Organizations with a multi-account architecture. The company's current security configuration for the account architecture includes SCPs, resource-based policies, identity-based policies, trust policies, and session policies.
A solutions architect needs to allow an IAM user in Account A t...
To allow an IAM user in Account A to assume a role in Account B, the solutions architect must configure permissions and policies appropriately to ensure the user has the necessary permissions in both accounts. Let's break down the steps needed:
Key Factors to Consider:
1. SCPs (Service Control Policies): SCPs are used to restrict actions at the organizational unit (OU) or account level. They do not grant permissions but rather limit what can be done in an account.
2. Resource-based Policies: These are policies attached to specific AWS resources that control access to those resources. In this case, the IAM role in Account B.
3. Identity-based Policies: These are policies attached to IAM users or roles, defining what actions they can perform on resources.
4. Trust Policies: These policies are associated with roles and define which entities are allowed to assume the role.
5. Session Policies: These define the permissions for the session when a role is assumed.
Required Actions:
A) Configure the SCP for Account A to allow the action.
- Reason: SCPs define the actions that are allowed or denied across the entire AWS account or organization. While they don't directly grant permissions, they must allow the action in Account A (for the IAM user) to assume the role in Account B. If the SCP in Account A denies the action, the user will not be able to proceed, even if other policies permit it.
- Why Rejected: If the SCP in Account A denies the action, no other policy will allow the action, so it is essential to ensure that the SCP allows the action.
B) Configure the resource-based policies to allow the action.
- Reason: A resource-based policy (like the policy attached to the IAM role in Account B) must allow the IAM user from Account A to assume the role in Account B. The role’s policy must explicitly trust and allow users from Account A to assume it.
- Why Rejected: This is not sufficient by itself because the resource-based policy is only relevant for the IAM role in Account B; it doesn't grant permission to the IAM user in Account A.
C) Configure the identity-based policy on the user in Account A to allow the action.
- Reason: The IAM user in Account A needs an identity-based policy that grants permission to a...
Author: Leah · Last updated Jul 6, 2026
A company wants to use Amazon S3 to back up its on-premises file storage solution. The company's on-premises file storage solution supports NFS, and the company wants its new solution to support NFS. The company wants to archive the backup files after 5 days. If the company needs archived files for disaster recovery, the...
To meet the company's requirements, let's break down the options and analyze them:
Requirements:
1. Support for NFS: The solution must support NFS for seamless integration with the company's on-premises file storage.
2. Archiving after 5 days: The company wants to archive the files after 5 days.
3. Disaster recovery readiness: The company is willing to wait a few days for file retrieval from the archive.
4. Cost-effective solution: The solution should minimize costs.
A) Deploy an AWS Storage Gateway file gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the file gateway. Create an S3 Lifecycle rule to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) after 5 days.
- Reasoning: The File Gateway supports NFS, which is required. The files can be moved from the on-premises file system to the S3 bucket, and an S3 Lifecycle policy can automatically move them to S3 Standard-IA after 5 days. S3 Standard-IA is designed for infrequently accessed data and is cost-effective for storing backup files that are not accessed frequently. However, it is not the cheapest option for long-term archiving, as S3 Standard-IA still incurs higher costs compared to Glacier options for long-term archival.
- Rejected: Although it meets the NFS requirement and lifecycle archiving, S3 Standard-IA is not the most cost-effective option for archiving files, especially when considering the company is willing to wait for disaster recovery retrieval (which suggests a deeper storage tier like Glacier might be more cost-efficient).
B) Deploy an AWS Storage Gateway volume gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the volume gateway. Create an S3 Lifecycle rule to move the files to S3 Glacier Deep Archive after 5 days.
- Reasoning: The Volume Gateway uses iSCSI and provides block-level storage rather than file-based storage. It does not natively support NFS, which is a requirement for the company’s on-premises file storage solution. While this solution can archive data to S3 Glacier Deep Archive (which is cost-effective for long-term storage), it doesn't meet the requirement for NFS support.
- Rejected: The Volume Gateway does not support NFS, which is a critical part of the company’s requirement for compatibilit...
Author: Liam · Last updated Jul 6, 2026
A company runs its application on Amazon EC2 instances and AWS Lambda functions. The EC2 instances experience a continuous and stable load. The Lambda functions experience a varied and unpredictable load. The application includes a caching layer that uses an Amazon MemoryDB for Redis cluster.
A solutions...
To determine the best solution for minimizing monthly costs for the company's application, we need to consider the following key factors:
1. EC2 Instances: The EC2 instances experience a continuous and stable load. This means they are predictable in usage and a good candidate for savings plans such as EC2 instance Savings Plans, which offer a discount in exchange for a one- or three-year commitment to specific instance families or types.
2. AWS Lambda: The Lambda functions experience a varied and unpredictable load. This means that the cost is based on the number of invocations and the execution duration, which can fluctuate. A Compute Savings Plan for Lambda could provide savings, but Lambda functions are dynamic and don't have a fixed usage pattern, making it difficult to commit to a predictable consumption level. As a result, Lambda Reserved Concurrency (which locks in a specific amount of concurrency) might not be ideal for unpredictable load because it commits resources that may go unused.
3. MemoryDB for Redis: The MemoryDB cluster used for caching likely has a stable and predictable usage pattern, which makes it a good candidate for reserved nodes. Reserved nodes provide significant cost savings over on-demand pricing.
Now let's evaluate each option based on these considerations:
Option A: Purchase an EC2 instance Savings Plan to cover the EC2 instances. Purchase a Compute Savings Plan for Lambda to cover the minimum expected consumption of the Lambda functions. Purchase reserved nodes to cover the MemoryDB cache nodes.
- EC2 instance Savings Plan: This is a good choice because the EC2 instances experience a stable load, making them ideal for a savings plan.
- Compute Savings Plan for Lambda: While this could save costs, Lambda's unpredictable load makes it hard to predict the minimum expected consumption. A Compute Savings Plan might not be the best for Lambda because it doesn’t accommodate unpredictable traffic as effectively as on-demand scaling.
- Reserved nodes for MemoryDB: This is a good choice, as the MemoryDB cache likely has a predictable load, and reserved nodes would provide cost savings.
Rejection Reasoning for Option A: While the EC2 and MemoryDB recommendations are solid, the Compute Savings Plan for Lambda doesn't work well with the unpredictable nature of Lambda's load. It’s hard to predict the minimum expected consumption, so committing to a plan that covers only the minimum expected usage might lead to either unnecessary costs or a lack of sufficient capacity when demand spikes.
Option B: Purchase a Compute Savings Plan to cover the EC2 instances. Purchase Lambda reserved concurrency to cover the expected Lambda usage. Purchase r...
Author: Kai99 · Last updated Jul 6, 2026
A company is launching a new online game on Amazon EC2 instances. The game must be available globally. The company plans to run the game in three AWS Regions us-east-1, eu-west-1, and ap-southeast-1. The game's leaderboards, player inventory and event status must be available across Regions.
A solutions architect must design a solution that will give any Region the ability to scale to handle the load of all Region...
Let's analyze each option based on the requirements:
Key Requirements:
1. Global Availability: The game needs to be available globally across three AWS Regions: `us-east-1`, `eu-west-1`, and `ap-southeast-1`.
2. Low Latency: Users must automatically connect to the Region that provides the least latency.
3. Metadata Sync Across Regions: Game metadata (leaderboards, player inventory, and event status) must be available across all Regions.
4. Scalability: Any Region should be able to scale to handle the load of all Regions.
5. Operational Overhead: The solution should minimize operational overhead.
Option A: EC2 Spot Fleet + Network Load Balancer (NLB) + AWS Global Accelerator + Amazon RDS for MySQL
- EC2 Spot Fleet: Spot fleets are cost-effective but may introduce instability as EC2 Spot Instances can be interrupted. This could introduce operational complexity and risk in a gaming environment that requires high availability.
- Global Accelerator + NLB: AWS Global Accelerator helps with routing users to the Region with the lowest latency. NLBs are good for distributing traffic, but Global Accelerator does not directly manage data consistency across Regions.
- Amazon RDS for MySQL: MySQL is a relational database that can support read replicas, but it introduces complexities for cross-Region replication and latency. RDS read replicas can provide some global availability, but cross-Region replication may be slower and harder to manage in real-time.
Rejection Reasoning: The use of EC2 Spot Fleet may introduce volatility, and RDS read replicas would require complex management of cross-Region replication. This increases operational overhead.
Option B: Auto Scaling group + Network Load Balancer (NLB) + Amazon Route 53 with Geoproximity Routing + MySQL on EC2
- Auto Scaling: An Auto Scaling group can handle scaling in a specific Region, but this solution is only scaling within a single Region at a time.
- NLB + Route 53 Geoproximity Routing: Geoproximity routing would direct traffic to Regions based on proximity, but it might not give the low-latency routing required for all users (since latency-based routing is typically more effective for gaming).
- MySQL on EC2 + Cross-Region Replication: Using MySQL on EC2 introduces the challenge of managing database replication manually, which can become complex and error-prone in a multi-region setup. Cross-Region replication can cause delays and issues with data consistency.
Rejection Reasoning: This solution involves managing MySQL on EC2 instances, which can introduce operational complexity, es...
Author: Aarav · Last updated Jul 6, 2026
A company is deploying a third-party firewall appliance solution from AWS Marketplace to monitor and protect traffic that leaves the company's AWS environments. The company wants to deploy this appliance into a shared services VPC and route all outbound internet-bound traffic through the appliances.
A solutions architect needs to recommend a deployment method that prioritizes reliability and minimizes failover time between firewall appliances within...
To meet the requirements of deploying a third-party firewall appliance solution that monitors and protects traffic leaving the company's AWS environments, the solutions architect needs to ensure reliability, minimize failover time, and ensure high availability for the firewall appliances. Let’s evaluate each step:
Key Considerations:
- Reliability: To minimize failover time and ensure traffic is always routed through the firewall, redundancy is critical.
- High Availability: Deploying firewall appliances across multiple Availability Zones is important for ensuring high availability and resilience.
- Routing: Proper routing is required to ensure that all outbound internet-bound traffic flows through the firewall appliances.
Option Analysis:
A) Deploy two firewall appliances into the shared services VPC, each in a separate Availability Zone.
- Reasoning: Deploying the firewall appliances in separate Availability Zones (AZs) increases reliability and availability by ensuring that the appliances are distributed across different data centers. If one AZ goes down, the other AZ will continue to function, providing failover protection and reducing the potential for service disruption.
- Why Selected: This is essential for high availability and reliability. If one firewall instance or AZ experiences issues, traffic can still be routed to the second appliance.
B) Create a new Network Load Balancer in the shared services VPC. Create a new target group, and attach it to the new Network Load Balancer. Add each of the firewall appliance instances to the target group.
- Reasoning: A Network Load Balancer (NLB) distributes traffic to instances and is ideal for handling large volumes of TCP traffic. However, the NLB itself is typically used for distributing traffic based on Layer 4 (TCP/UDP). In this case, a Network Load Balancer can help distribute traffic across the firewall appliances, but it doesn’t integrate as seamlessly with the next hop for all outbound traffic.
- Why Rejected: While an NLB can balance traffic, it is better suited for scenarios where you need to balance the traffic for applications or services. For firewall appliances, a Gateway Load Balancer would be more appropriate because it is designed specifically for distributing traffic to security appliances and managing traffic flows in a more secure and controlled manner.
C) Create a new Gateway Load Balancer in the shared services VPC. Create a new target group, and attach it to the new Gateway Load Balancer. Add each of the firewall appliance instances to the target group.
- Reasoning: A Gateway Load Balancer (GLB) is designed for precisely this type of deployment, as it helps distribute traffic to security appliances (like firewall solutions) in a way that is scalable and fault-tolerant. The GLB enables more efficient integration with firewall appliances by providing an automatic failover mechanis...
Author: Aarav · Last updated Jul 6, 2026
A solutions architect needs to migrate an on-premises legacy application to AWS. The application runs on two servers behind a load balancer. The application requires a license file that is associated with the MAC address of the server's network adapter It takes the software vendor 12 hours to send new license files. The application also uses configuration files with a static IP address to access a database server, host names...
To migrate a legacy application that relies on licensing associated with a server's network adapter MAC address and static IP addresses for database access, the solutions architect needs to design a highly available architecture that can handle these constraints while taking advantage of AWS's elasticity and reliability features.
Key Requirements:
1. License File Handling: The application requires a license file tied to the MAC address of the server’s network adapter. Since it takes 12 hours for the software vendor to issue a new license file, solutions that allow for quick recovery without needing to wait for new licenses are important.
2. Static IP for Database Access: The application uses static IP addresses for database access, and host names are not supported.
3. Highly Available Architecture: The solution needs to be highly available, meaning that in the event of a failure, the application should be able to recover quickly without significant downtime.
Option Analysis:
A) Create a pool of ENIs. Request license files from the vendor for the pool, and store the license files in Amazon S3. Create a bootstrap automation script to download a license file and attach the corresponding ENI to an Amazon EC2 instance.
- Reasoning: By creating a pool of Elastic Network Interfaces (ENIs), the solution can pre-allocate the necessary MAC addresses for the application, ensuring that new EC2 instances can inherit these ENIs and use the pre-requested license files stored in Amazon S3. This avoids waiting for new licenses if an instance is terminated or replaced, which helps maintain continuity.
- Why Selected: This solution solves the problem of needing to quickly assign license files to new instances, and the use of ENIs allows the instances to retain consistent MAC addresses, which is essential for the licensing mechanism.
B) Create a pool of ENIs. Request license files from the vendor for the pool, store the license files on an Amazon EC2 instance. Create an AMI from the instance and use this AMI for all future EC2 instances.
- Reasoning: Storing the license files on an EC2 instance and creating an AMI to be used for future instances would simplify the process of deploying new instances with the appropriate license. However, since the application relies on specific MAC addresses for licensing, this approach might not scale well when you need to launch multiple instances with different MAC addresses.
- Why Rejected: The static nature of the MAC address and the license file tied to a specific ENI is a better approach than using AMIs with embedded licenses. This approach could result in a situation where you might need to regenerate the license for each new instance if the MAC address changes.
C) Crea...
Author: Julian · Last updated Jul 6, 2026
A company runs its sales reporting application in an AWS Region in the United States. The application uses an Amazon API Gateway Regional API and AWS Lambda functions to generate on-demand reports from data in an Amazon RDS for MySQL database. The frontend of the application is hosted on Amazon S3 and is accessed by users through an Amazon CloudFront distribution. The company is using Amazon Route 53 as the DNS service for the domain. Route 53 is configured with a simple routing policy to route traffic to the API Gateway API.
In the next 6 months, the company plans to expand operations to Europe. More than 90% of the database...
To design a solution that minimizes latency for users who download reports and ensure high availability of the database traffic in both the U.S. and Europe, we need to take into account the following factors:
Key Requirements:
1. Minimize Latency: The solution should ensure that users from both the U.S. and Europe have fast access to the reports generated by the API Gateway and Lambda functions.
2. Efficient Read-Only Traffic Handling: Since over 90% of the traffic is read-only, the solution should ensure that database reads are handled efficiently with minimal latency.
3. Scalable and Reliable: The architecture should scale seamlessly to support increased traffic from the new Region (Europe) and continue to be reliable in both Regions.
4. Low Operational Overhead: We want a solution that doesn't require extensive management and configuration, particularly for cross-region database replication.
Option Analysis:
A) Use an AWS Database Migration Service (AWS DMS) task with full load to replicate the primary database in the original Region to the database in the new Region. Change the Route 53 record to latency-based routing to connect to the API Gateway API.
- Reasoning: AWS DMS (Database Migration Service) is useful for migrating databases, but using it for full load replication (without continuous replication or CDC) will not handle ongoing data changes efficiently. Additionally, while latency-based routing is useful for directing traffic to the Region with the lowest latency, it doesn't fully address the requirement of reducing latency for database queries, especially since DMS replication may introduce delay.
- Why Rejected: DMS with full load is not an ideal solution for read-heavy workloads because it won't continuously sync changes in near real-time, and there's a risk of inconsistent data replication. This also doesn’t optimize read-only traffic handling.
B) Use an AWS Database Migration Service (AWS DMS) task with full load plus change data capture (CDC) to replicate the primary database in the original Region to the database in the new Region. Change the Route 53 record to geolocation routing to connect to the API Gateway API.
- Reasoning: Using DMS with CDC will replicate the primary database with ongoing changes, ensuring data consistency across Regions. However, geolocation routing would direct users to different Regions based on their geographic location. While this can ensure that European users are routed to the European API Gateway, it doesn’t fully optimize the database replication setup for read-heavy workloads.
- Why Rejected: W...
Author: BlazingPhoenix22 · Last updated Jul 6, 2026
A software company needs to create short-lived test environments to test pull requests as part of its development process. Each test environment consists of a single Amazon EC2 instance that is in an Auto Scaling group.
The test environments must be able to communicate with a central server to report test results. The central server is located in an on-premises data center. A solutions architect must implement a solution so that the company can create and delete test environments...
Let's break down each option to identify the best fit based on the requirements for creating short-lived test environments with minimal operational overhead.
Option A: CloudFormation Template with Transit Gateway and StackSets
- Description: This option involves creating a CloudFormation template that includes a transit gateway attachment and routing configurations, then using CloudFormation StackSets to deploy this template across multiple VPCs, one for each test environment.
- Analysis:
- This option involves creating separate VPCs for each test environment, which can add complexity in managing the infrastructure and the network.
- Each test environment has its own VPC and routing configuration, meaning higher operational overhead for scaling and managing VPCs.
- While this solution provides separation, it also increases costs and complexity because of multiple VPCs and potentially unnecessary networking overhead.
- Since the environments are short-lived, the management of multiple VPCs may become cumbersome.
Option B: Single VPC with Transit Gateway and CloudFormation
- Description: This solution involves creating a single VPC for all the test environments, deploying all environments into that VPC using AWS CloudFormation, along with the necessary transit gateway attachments and routing configurations.
- Analysis:
- Using a single VPC simplifies the setup and management, as there’s only one VPC to configure and maintain.
- The transit gateway attachment and routing configurations would be shared, allowing all test environments to communicate with the on-premises server.
- This reduces the complexity of managing multiple VPCs and ensures that each test environment is isolated by being deployed within different security groups, but all within a shared VPC.
- This option has lower operational overhead compared to creating multiple VPCs as in Option A, making it more efficient for short-lived environments.
- This is a good fit for the requirement of automating and simplifying the creation and deletion of test environments.
Option C: New OU in AWS Organizations with CloudFormation StackSets
- Description: This option involves creating a new organizational unit (OU) in AWS Organizations, and deploying CloudFormation stack...
Author: Kai · Last updated Jul 6, 2026
A company is deploying a new API to AWS. The API uses Amazon API Gateway with a Regional API endpoint and an AWS Lambda function for hosting. The API retrieves data from an external vendor API, stores data in an Amazon DynamoDB global table, and retrieves data from the DynamoDB global table The API key for the vendor's API is stored in AWS Secrets Manager and is encrypted with a customer managed key in AWS Key Management Service (AWS KMS). The company has deployed its own API into a single AWS Region.
A solutions architect needs to change the API c...
Let's break down each option based on the requirements for an active-active configuration across multiple AWS regions for the API, with a focus on minimizing operational overhead.
Option A: Deploy the API to multiple Regions. Configure Amazon Route 53 with custom domain names that route traffic to each Regional API endpoint. Implement a Route 53 multivalue answer routing policy.
- Explanation:
- Deploying the API to multiple Regions is critical for an active-active configuration to ensure availability across different regions.
- Amazon Route 53 can be used to manage traffic between multiple API Gateway endpoints by routing traffic to the nearest available region.
- A multivalue answer routing policy allows for multiple values to be returned for DNS queries, and Route 53 will automatically route traffic to healthy endpoints. This ensures that if one region becomes unavailable, traffic can be routed to another region with minimal downtime.
- This approach meets the requirement of maintaining a multi-Region active-active configuration while being relatively easy to manage.
Option B: Create a new KMS multi-Region customer managed key. Create a new KMS customer managed replica key in each in-scope Region.
- Explanation:
- KMS multi-Region keys enable you to use the same key across multiple regions for encryption operations. This is important for consistency in key management across multiple regions.
- The use of a multi-Region key allows the API to access encrypted secrets (such as the vendor API key in Secrets Manager) from any region while using the same encryption method.
- By creating a replica key in each region, you ensure that encryption and decryption of secrets are handled locally within the region without requiring cross-region calls, reducing latency.
- This change is necessary for keeping the encryption consistent and ensures minimal operational overhead by leveraging KMS capabilities across regions.
Option C: Replicate the existing Secrets Manager secret to other Regions. For each in-scope Region's replicated secret, select the appropriate KMS key.
- Explanation:
- Replicating Secrets Manager secrets across regions ensures that each region has access to the necessary credentials (like the API key for the vendor API) without the need to rely on cross-region access, which can introduce latency or operational complexity.
- Selecting the appropriate KMS key ensures that the encryption used in each region aligns with the multi-Region KMS configuration (from Option B), further reducing any potential issues with key management and ensuring a consistent and secure solution across regions.
- This is an efficient solution for ensuring that secrets are available across all regions without having to create new secrets for each region manually.
Option D: Create a new A...
Author: Olivia Johnson · Last updated Jul 6, 2026
An online retail company hosts its stateful web-based application and MySQL database in an on-premises data center on a single server. The company wants to increase its customer base by conducting more marketing campaigns and promotions. In preparation, the company wants to migrate its application and ...
To determine the solution that provides the highest level of reliability for the online retail company, we must evaluate key factors such as high availability, scalability, performance, and redundancy. Let’s break down each option in detail:
Option A: Migrate the database to an Amazon RDS MySQL Multi-AZ DB instance. Deploy the application in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer. Store sessions in Amazon Neptune.
- Explanation:
- Amazon RDS MySQL Multi-AZ provides high availability for the database by automatically replicating data across two Availability Zones (AZs) for failover capabilities.
- Auto Scaling with EC2 instances ensures the application scales dynamically based on traffic, and the Application Load Balancer (ALB) provides load balancing to distribute traffic evenly across instances.
- Amazon Neptune is a graph database and may not be suitable for storing sessions, which are typically better handled by a key-value store like Redis or Memcached.
- Why rejected: While the database and application setup provide reliability, using Neptune for sessions is not ideal. Neptune is optimized for graph data models, not session management, so it is inappropriate for this use case.
Option B: Migrate the database to Amazon Aurora MySQL. Deploy the application in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer. Store sessions in an Amazon ElastiCache for Redis replication group.
- Explanation:
- Amazon Aurora MySQL is a highly available, fault-tolerant relational database service that offers automatic replication across multiple AZs and auto-failover, providing higher reliability than standard MySQL.
- Auto Scaling with EC2 instances behind an Application Load Balancer ensures that the application can scale to handle high traffic and maintain availability.
- ElastiCache for Redis is an in-memory data store that supports replication, persistence, and high availability, making it ideal for session management.
- Why selected: Aurora provides superior availability and performance compared to MySQL, and Redis is highly optimized for session storage with fast data retrieval, making this configuration very reliable and scalable.
Option C: Migrate the database to Amazon DocumentDB (with MongoDB compatibility). Deploy the application in an Auto Scaling group on Amazon EC2 ...
Author: CrystalWolfX · Last updated Jul 6, 2026
A company's solutions architect needs to provide secure Remote Desktop connectivity to users for Amazon EC2 Windows instances that are hosted in a VPC. The solution must integrate centralized user management with the company's on-premises Active Directory. Connectivity to the VPC is through the internet. The company has hard...
Let's analyze each option to determine which solution is the most cost-effective and meets the requirements of secure Remote Desktop connectivity with centralized user management through Active Directory.
Option A: Deploy a managed Active Directory by using AWS Directory Service for Microsoft Active Directory. Establish a trust with the on-premises Active Directory. Deploy an EC2 instance as a bastion host in the VPC. Ensure that the EC2 instance is joined to the domain. Use the bastion host to access the target instances through RDP.
- Explanation:
- This option involves setting up AWS Directory Service for Microsoft Active Directory (AWS Managed AD) to integrate with the on-premises Active Directory.
- A bastion host is deployed in the VPC to access the target instances via RDP.
- Why rejected: While this solution works, deploying a bastion host introduces additional operational complexity and cost. Maintaining an EC2 bastion host requires patching, scaling, and ensuring high availability, which increases management overhead. Additionally, it may not be as secure as other options, as it exposes the bastion host to the internet.
Option B: Configure AWS IAM Identity Center (AWS Single Sign-On) to integrate with the on-premises Active Directory by using the AWS Directory Service for Microsoft Active Directory AD Connector. Configure permission sets against user groups for access to AWS Systems Manager. Use Systems Manager Fleet Manager to access the target instances through RDP.
- Explanation:
- This option integrates AWS IAM Identity Center (AWS SSO) with the on-premises Active Directory using AWS Directory Service AD Connector.
- Systems Manager Fleet Manager is used to access EC2 Windows instances through RDP.
- Why selected: This solution is cost-effective and secure because it eliminates the need for additional infrastructure like bastion hosts or VPNs. Systems Manager allows for secure, agent-based access to the Windows instances without requiring direct exposure to the internet. It also simplifies centralized user management, integrates seamlessly with AWS IAM Identity Center, and leverages existing Active Directory credentials.
- It provides a modern approach for securely managing RDP access without introducing additional maintenance overhead.
Option C: Implement a VPN between the on-premises environment and the target VPC. Ensure that the t...
Author: Sam · Last updated Jul 6, 2026
A company's compliance audit reveals that some Amazon Elastic Block Store (Amazon EBS) volumes that were created in an AWS account were not encrypted. A solutions architect must implement a solution to encrypt all ...
To meet the requirement of encrypting all new Amazon Elastic Block Store (Amazon EBS) volumes at rest with the least effort, we need a solution that applies encryption by default to all new volumes without requiring manual intervention.
Option A: Create an Amazon EventBridge rule to detect the creation of unencrypted EBS volumes. Invoke an AWS Lambda function to delete noncompliant volumes.
- Explanation:
- This solution involves creating an EventBridge rule to detect when unencrypted EBS volumes are created and then triggering an AWS Lambda function to delete the noncompliant volumes.
- Why rejected: While this solution could technically ensure compliance, it is not ideal because it involves deleting unencrypted volumes, which would result in data loss unless additional steps are taken to back up data before deletion. Additionally, it does not prevent the creation of unencrypted volumes in the first place; it only reacts after the volume is created. This introduces unnecessary complexity and operational overhead.
Option B: Use AWS Audit Manager with data encryption.
- Explanation:
- AWS Audit Manager is used for continuous compliance auditing and reporting. While it can be useful for tracking compliance, it does not provide a way to automatically enforce encryption for EBS volumes.
- Why rejected: This option does not meet the requirement of automatically encrypting EBS volumes at creation. AWS Audit Manager is useful for compliance reporting but not for actively enforcing encryption.
Option C: Create an AWS Config rule to detect the creation of a new EBS volume. E...
Author: Ethan · Last updated Jul 6, 2026
A research company is running daily simulations in the AWS Cloud to meet high demand. The simulations run on several hundred Amazon EC2 instances that are based on Amazon Linux 2. Occasionally, a simulation gets stuck and requires a cloud operations engineer to solve the problem by connecting to an EC2 instance through SSH.
Company policy states that no ...
In this scenario, a solutions architect needs to address several key requirements:
1. No shared SSH key: Each EC2 instance must have a unique SSH key.
2. Logging of connections in AWS CloudTrail: All connections must be logged to meet the company’s compliance standards.
3. Ability for cloud operations engineers to connect to instances: Engineers need to be able to connect to instances when simulations get stuck.
Let's analyze each option:
Option A:
- Launch new EC2 instances and generate an individual SSH key for each instance: This solution requires storing the SSH key in AWS Secrets Manager. Engineers would retrieve the SSH key from Secrets Manager and use it to connect through any SSH client.
- Why it’s rejected: This option does meet the requirement of unique SSH keys for each EC2 instance and allows logging via AWS CloudTrail (Secrets Manager access will be logged). However, retrieving SSH keys from Secrets Manager manually introduces additional operational complexity. It requires engineers to manually fetch the key each time they need to connect, which is inefficient for handling large numbers of EC2 instances.
Option B:
- Create an AWS Systems Manager document to set a new unique SSH key on EC2 instances: This approach uses Systems Manager to update SSH keys on EC2 instances. The engineers can execute a Systems Manager document to set the SSH key and connect via SSH.
- Why it’s rejected: While this solution can provide unique SSH keys and be automated, it introduces unnecessary complexity. The requirement is to ensure that cloud operations engineers can easily connect to instances when needed, but managing SSH keys using Systems Manager adds an extra step. Moreover, SSH key management this way doesn’t inherently involve logging connections in CloudTrail.
Option C:
- Launch EC2 instances without SSH keys and use ...
Author: Henry · Last updated Jul 6, 2026
A company is migrating mobile banking applications to run on Amazon EC2 instances in a VPC. Backend service applications run in an on-premises data center. The data center has an AWS Direct Connect connection into AWS. The applications that run in the VPC need to resolve DNS requests to an on-premises Active ...
In this case, the company needs to ensure that EC2 instances within the VPC can resolve DNS requests to an on-premises Active Directory domain that resides in the data center. The solution should have minimal administrative overhead while ensuring proper DNS resolution and integration with the on-premises domain. Let's analyze the options:
Option A: Provision EC2 instances as caching DNS servers
- Description: This solution involves provisioning EC2 instances across two Availability Zones in the VPC to act as DNS servers that cache DNS queries for the application servers in the VPC.
- Why it’s rejected:
- While this solution could technically work by caching DNS queries, it introduces unnecessary complexity and administrative overhead. You would need to configure, maintain, and manage the EC2 instances as DNS servers, including ensuring high availability, monitoring, patching, and scaling. This adds more operational burden, which is not ideal given that the goal is to minimize administrative overhead.
- Furthermore, this option does not directly address the integration with the on-premises Active Directory DNS.
Option B: Provision an Amazon Route 53 private hosted zone and configure NS records
- Description: This involves creating a private hosted zone in Amazon Route 53 and adding NS records that point to the on-premises DNS servers for domain resolution.
- Why it’s rejected:
- While a private hosted zone in Route 53 can be used for DNS resolution within the VPC, this option doesn’t easily facilitate communication between the VPC and the on-premises DNS servers. You would need to configure routing and ensure the DNS traffic from the VPC reaches the on-premises DNS servers, which could be more complicated and would require additional manual configurations.
- This approach might work for simpler DNS use cases, but integrating it with an Active Directory domain, especially with the need to resolve Active Directory-specific records (such as SRV records), would be cumbersome and require custom configurations.
Option C: Create DNS endpoints with Amazon Route 53 Resolver
- Description: This option uses Amazon Route 53 Resolver to create DNS endpoints for resolving DNS queries between the VPC and the on-premises data center. It allows for the configuration of conditional forwarding rules that direct DNS queri...
Author: Olivia · Last updated Jul 6, 2026
A company processes environmental data. The company has set up sensors to provide a continuous stream of data from different areas in a city. The data is available in JSON format.
The company wants to use an AWS solution to send the data to a database that does not r...
The company processes environmental data in JSON format, which needs to be sent to a database that does not require fixed schemas for storage and requires real-time processing. Let's examine each option in detail to find the most suitable solution.
Option A: Use Amazon Kinesis Data Firehose to send the data to Amazon Redshift
- Explanation: Kinesis Data Firehose is a fully managed service that automatically delivers data streams to destinations like Amazon Redshift. Redshift, however, is a data warehouse that requires structured schema definitions for its tables.
- Why it’s rejected: Amazon Redshift is not schema-less, and it requires defined schemas for its tables. This contradicts the requirement of using a database that does not require fixed schemas. Also, Kinesis Data Firehose is typically used for structured or semi-structured data and may not be ideal for storing data in a completely flexible, schema-less manner.
Option B: Use Amazon Kinesis Data Streams to send the data to Amazon DynamoDB
- Explanation: Kinesis Data Streams is a service for real-time data streaming. Data can be processed in real-time and sent to various destinations, including Amazon DynamoDB. DynamoDB is a NoSQL database that is highly scalable and does not require fixed schemas, allowing for flexible storage of JSON data.
- Why it’s selected: DynamoDB is a schema-less, NoSQL database that allows for storing unstructured or semi-structured data like JSON. This fits the requirement of handling real-time data without a fixed schema. Additionally, Kinesis Data Streams is well-suited for real-time data ingestion, making this...
Author: Aarav2020 · Last updated Jul 6, 2026
A company is migrating a legacy application from an on-premises data center to AWS. The application uses MongoDB as a key-value database. According to the company's technical guidelines, all Amazon EC2 instances must be hosted in a private subnet without an internet connection. In addition, all connectivity between applic...
Key Requirements:
- Private Subnet: EC2 instances must be hosted in a private subnet without internet access.
- Encrypted Connectivity: All communication between the applications and databases must be encrypted.
- Scalability: The database must be able to scale based on demand.
Let's evaluate each option based on the above requirements:
A) Create new Amazon DocumentDB (with MongoDB compatibility) tables for the application with Provisioned IOPS volumes. Use the instance endpoint to connect to Amazon DocumentDB.
- Pros:
- Amazon DocumentDB (with MongoDB compatibility) is designed for applications that use MongoDB. It supports automatic scaling, making it a good option for workloads that need to scale based on demand.
- Encryption: DocumentDB supports encryption in transit (via TLS) and at rest, meeting the encryption requirement.
- Private Subnet: You can place DocumentDB instances in a private subnet by using VPC peering or VPC endpoints for connectivity, ensuring the EC2 instances are not exposed to the internet.
- Cons:
- Use of Instance Endpoint: Connecting via the instance endpoint is generally suitable for development or testing but not recommended for production environments. For production, it is preferable to connect via a cluster endpoint to ensure high availability and automatic failover.
B) Create new Amazon DynamoDB tables for the application with on-demand capacity. Use a gateway VPC endpoint for DynamoDB to connect to the DynamoDB tables.
- Pros:
- Amazon DynamoDB is a fully managed NoSQL database that scales automatically, fitting the scalability requirement.
- Gateway VPC Endpoint: A gateway VPC endpoint for DynamoDB provides private connectivity from within your VPC to DynamoDB, ensuring that communication happens within the private network.
- Cons:
- MongoDB Compatibility: The legacy application uses MongoDB, and DynamoDB is not a drop-in replacement for MongoDB. DynamoDB is a key-value store, but it has a different structure and query model, which might require significant changes to the application.
- Encryption: DynamoDB supports encryption at rest, but the encryption in transit must be handled using SSL/TLS, which DynamoDB supports by default.
C) Create new Amazon DynamoDB tables for the application with on-demand capacity. Use an interface VPC endpoint for DynamoDB to connect to the DynamoDB tables.
- Pros:
- Scalab...
Author: Mia · Last updated Jul 6, 2026
A company is running an application on Amazon EC2 instances in the AWS Cloud. The application is using a MongoDB database with a replica set as its data tier. The MongoDB database is installed on systems in the company's on-premises data center and is accessible through an AWS Direct Connect connection to the data center environment.
A solutions architect must migrate the ...
The company is migrating an on-premises MongoDB database (with a replica set) to Amazon DocumentDB, which is compatible with MongoDB. The goal is to choose a strategy that ensures a smooth, efficient, and minimal-downtime migration while maintaining compatibility with MongoDB. Let’s review each option to determine the best solution.
Option A: Create a fleet of EC2 instances, install MongoDB Community Edition on the EC2 instances, and configure continuous synchronous replication with the on-premises database.
- Explanation: This solution involves setting up a fleet of EC2 instances with MongoDB and configuring continuous replication from the on-premises MongoDB to the new MongoDB instances on EC2.
- Why it’s rejected:
- This approach involves managing MongoDB instances on EC2, which adds significant complexity to the migration process.
- The solution requires manual setup, maintenance, and scaling of MongoDB on EC2, leading to additional administrative overhead.
- Synchronous replication is more complex to manage and might not be the best fit when transitioning to a fully managed service like Amazon DocumentDB.
- Amazon DocumentDB does not use MongoDB’s native replication protocol, so this approach is not directly applicable to migrating to Amazon DocumentDB.
Option B: Create an AWS Database Migration Service (AWS DMS) replication instance. Create a source endpoint for the on-premises MongoDB database using change data capture (CDC). Create a target endpoint for Amazon DocumentDB. Create and run a DMS migration task.
- Explanation: AWS Database Migration Service (DMS) can migrate data from MongoDB to Amazon DocumentDB using change data capture (CDC) to replicate data in real-time. DMS manages the migration and can handle schema conversion and data synchronization between MongoDB and Amazon DocumentDB.
- Why it’s selected:
- Minimal downtime: DMS can perform continuous data replication from the on-premises MongoDB database to Amazon DocumentDB with low latency, ensuring the application can continue to function while the migration happens in the background.
- Managed service: DMS is a fully managed service, meaning AWS handles scaling, monitoring, and maintenance of the replication instance, reducing administrative overhead.
- MongoDB compatibility: DMS supports MongoDB to Amazon DocumentDB migrations, and CDC ensures that the changes...
Author: Ethan Smith · Last updated Jul 6, 2026
A company is rearchitecting its applications to run on AWS. The company's infrastructure includes multiple Amazon EC2 instances. The company's development team needs different levels of access. The company wants to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS. The company also wants to implement enhanced security p...
To address the company's needs, we must evaluate the options based on the requirements, such as Active Directory integration, multi-factor authentication (MFA), and leveraging AWS managed services.
Key Considerations:
1. Active Directory Integration: The company needs to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS. For this, an AWS Directory Service solution is essential.
2. MFA: The company wants to implement enhanced security processes such as MFA. AWS Directory Service supports integration with MFA through Active Directory, particularly using AWS Multi-Factor Authentication (MFA), which would apply to users authenticating to AWS resources.
3. Managed Services: The company wants to use managed services wherever possible. The solution should minimize the management overhead for Active Directory infrastructure.
4. Amazon Workspaces vs. EC2: Workspaces are a fully managed, secure desktop environment while EC2 instances require more manual setup and management. For domain security tasks, AWS Directory Service integrates directly with EC2 instances, and using Workspaces adds another layer of complexity without specific benefits in this scenario.
Option-by-Option Breakdown:
A) Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an Amazon Workspace. Connect to and use the Workspace for domain security configuration tasks.
- Rejection Reason: Amazon Workspaces are useful for managed desktop environments but are unnecessary for domain configuration tasks. Using a Workspace does not directly address the domain management or Active Directory configuration tasks. Additionally, this involves unnecessary complexity compared to using EC2 instances.
B) Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an EC2 instance. Connect to and use t...
Author: Isabella · Last updated Jul 6, 2026
A company wants to migrate its on-premises application to AWS. The database for the application stores structured product data and temporary user session data. The company needs to decouple the product data from the user session data. The company also needs to implement replication...
Key Requirements:
- Decouple Product Data from User Session Data: The company needs to store product data separately from user session data.
- Disaster Recovery: Replication of data in another AWS Region is needed for disaster recovery purposes.
- Highest Performance: The solution must offer high performance, likely meaning low latency and scalable performance.
Let's evaluate each option based on these requirements:
A) Create an Amazon RDS DB instance with separate schemas to host the product data and the user session data. Configure a read replica for the DB instance in another Region.
- Pros:
- Amazon RDS provides managed relational databases with automatic backups, patching, and scaling.
- Read Replica in another region helps with disaster recovery and ensures that the database can scale in terms of read operations.
- Cons:
- Mixed Schema: Storing both product data and user session data in separate schemas of a single RDS instance might not be ideal. User session data is typically high-velocity and transient, whereas product data is more stable and could require different storage optimizations (e.g., caching or key-value store).
- Performance: While RDS can handle both types of data, it might not be optimized for handling the high-throughput and low-latency requirements of user session data, especially considering RDS might not scale as efficiently for this type of workload as other specialized solutions (e.g., DynamoDB).
B) Create an Amazon RDS DB instance to host the product data. Configure a read replica for the DB instance in another Region. Create a global datastore in Amazon ElastiCache for Memcached to host the user session data.
- Pros:
- Amazon RDS is good for structured data like product data.
- ElastiCache for Memcached is ideal for fast, in-memory storage of session data, offering high performance with low latency, and it supports replication across regions (via global datastores), making it suitable for user session data.
- This approach would separate the product data and session data properly, allowing each to be optimized for its specific needs (RDS for product data and ElastiCache for session data).
- Cons:
- Integration Complexity: Using both RDS and ElastiCache for Memcached introduces additional complexity in terms of architecture management and data consistency between the two systems. It might require extra logic to ensure that the data in ElastiCache is properly synced with the application and not lost.
C) Create two Amazon DynamoDB global tables. Use one global table to host the product data. Use the other global table to host the user session data. Use DynamoDB Accelerator (DAX) for caching.
- Pros:
- DynamoDB Global Tables: This is a fully managed, highly available, and scalable solution for multi-region replication, ensuring disaster recovery withou...
Author: NebulaEagle11 · Last updated Jul 6, 2026
A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for development accounts that developers use to experiment on AWS. The company has hundreds of developers, and each developer has an individual development account.
The company wants to optimize costs in these development accounts. Amazon EC2 instances and Amazon RDS i...
Key Requirements:
- Optimize Costs: The development accounts should only use burstable Amazon EC2 instances (e.g., t3, t3a, or t2 instances), which are cost-effective for workloads with low to moderate CPU performance requirements.
- Disallow Other Services: Only relevant services (EC2 and RDS) should be allowed in the development accounts, and all irrelevant services must be disallowed.
- Multi-Account Structure: The solution must work within the multi-account environment orchestrated by AWS Control Tower and integrate with AWS Organizations.
Option Analysis:
A) Create a custom SCP in AWS Organizations to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the SCP to the development OU.
- Pros:
- Service Control Policies (SCPs) are an effective way to centrally manage permissions across multiple accounts within AWS Organizations. With SCPs, you can enforce restrictions such as limiting the types of EC2 instances (e.g., burstable types) and disallowing non-relevant services across the entire OU.
- Scalability: SCPs are applied at the organization level and automatically apply to all accounts in the OU, making them ideal for large-scale, multi-account environments.
- Cost Optimization: By restricting the use of non-burstable EC2 instances, costs are optimized.
- Cons:
- SCPs are primarily for defining what actions are allowed or denied at a high level. While they can restrict actions, they don't provide enforcement of service-specific configurations like ensuring that only burstable EC2 instances are used. SCPs are more about managing permissions rather than managing resource configurations.
B) Create a custom detective control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
- Pros:
- Detective controls (guardrails) in AWS Control Tower are useful for monitoring and detecting violations of policies. They can provide insights into non-compliant activities across multiple accounts in an OU.
- Can help in identifying which services are being used and flagging any deviations from the defined policies.
- Cons:
- Detective controls only detect non-compliance; they do not enforce compliance. This means that the company would still need to rely on manual intervention or other processes to stop the usage of non-compliant services, which does not fully meet the requirement for enforcement.
- Therefore, while useful for monitoring, it won't restrict developers from deploying non-burstable instances directly.
C) Create a custom preventive control (guardrail) in AWS Control Tower. Configure the co...
Author: Rohan · Last updated Jul 6, 2026
A financial services company runs a complex, multi-tier application on Amazon EC2 instances and AWS Lambda functions. The application stores temporary data in Amazon S3. The S3 objects are valid for only 45 minutes and are deleted after 24 hours.
The company deploys each version of the application by launching an AWS CloudFormation stack. The stack creates all resources that are required to run the application. When the company deploys and validates a new application version, the company deletes the CloudFormation stack of the old version.
The company recently tried to delete the CloudFormation stack of an old applicatio...
To resolve the issue where CloudFormation fails to delete the S3 bucket due to the presence of objects that prevent its deletion, we need to choose a solution that can clean up the objects in the S3 bucket before the deletion of the bucket. Let's evaluate each option to determine the best approach:
Key Requirements:
- Temporary S3 Objects: The S3 objects are valid for only 45 minutes and are deleted after 24 hours.
- CloudFormation Stack Deletion Issue: The operation fails to delete the S3 bucket because there are objects still present.
- No Major Changes: The solution should not require significant changes to the application's architecture.
Option-by-Option Breakdown:
A) Implement a Lambda function that deletes all files from a given S3 bucket. Integrate this Lambda function as a custom resource into the CloudFormation stack. Ensure that the custom resource has a DependsOn attribute that points to the S3 bucket's resource.
- Selected Option: This is a practical solution. By implementing a Lambda function that deletes all files in the S3 bucket, you ensure that the bucket is emptied before CloudFormation attempts to delete it. Using a custom resource in CloudFormation to trigger this Lambda function is a good approach, and the DependsOn attribute ensures that the Lambda function is executed after the S3 bucket is created, but before CloudFormation tries to delete the bucket. This ensures the objects are removed and prevents the deletion failure.
B) Modify the CloudFormation template to provision an Amazon Elastic File System (Amazon EFS) file system to store the temporary files there instead of in Amazon S3. Configure the Lambda functions to run in the same VPC as the file system. Mount the file system to the EC2 instances and Lambda functions.
- Rejection Reason: This option involves a major change to the architecture by replacing Amazon S3...
