Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company has developed a mobile game. The backend for the game runs on several virtual machines located in an on-premises data center. The business logic is exposed using a REST API with multiple functions. Player session data is stored in central file storage. Backend services use different API keys for throttling and to distinguish between live and test traffic.
The load on the game backend varies throughout the day. During peak hours, the server capacity is not sufficient. There are also latency issues when fetching player session dat...
To determine the best solution for the mobile game's backend infrastructure, we need to consider the following key requirements:
1. Variable Load Handling: The system must be able to scale efficiently to handle varying load throughout the day, particularly during peak hours.
2. Low Latency for Player Session Data: Latency issues must be addressed, especially when fetching player session data.
3. No Change to API Model: The existing REST API model must remain in place.
4. Throttling and Differentiating Traffic: The ability to differentiate between live and test traffic and apply throttling needs to be maintained.
5. Cloud-Native Benefits: The solution should leverage cloud services for scalability, flexibility, and performance.
Let’s evaluate each option:
Option A: Network Load Balancer (NLB), EC2 Instances, and Aurora Serverless
- NLB: Provides low-latency load balancing but is typically used for TCP/UDP traffic rather than HTTP(S) traffic (which is used for REST APIs). It's not the most ideal choice for REST APIs.
- EC2 Instances: Running the business logic on EC2 instances provides full control but requires manual management of scaling. This doesn't align well with the dynamic nature of the game’s load.
- Aurora Serverless: Can automatically scale based on demand, which is a positive, but Aurora has higher latencies compared to NoSQL databases like DynamoDB and may not provide the best performance for low-latency, high-throughput workloads like player session data.
Option B: Application Load Balancer (ALB), AWS Lambda, and DynamoDB with On-Demand Capacity
- ALB: ALB is well-suited for HTTP(S) traffic and can handle REST APIs efficiently. It also supports advanced routing features and load balancing based on URL paths or hostnames.
- AWS Lambda: Lambda is highly scalable, handles varying loads effectively, and requires no server management. This fits well with the requirement for handling varying load.
- DynamoDB with On-Demand Capacity: DynamoDB is a fast NoSQL database designed for lo...
Author: Liam · Last updated Jul 6, 2026
A company is migrating an application to the AWS Cloud. The application runs in an on-premises data center and writes thousands of images into a mounted NFS file system each night. After the company migrates the application, the company will host the application on an Amazon EC2 instance with a mounted Amazon Elastic File System (Amazon EFS) file system.
The company has established an AWS Direct Connect connection to AWS. Before the migration cutover,...
To select the most operationally efficient solution for replicating the images from an on-premises file system to an Amazon EFS file system, let's evaluate each of the provided options based on operational efficiency, complexity, and alignment with the use case of the migration.
Option A: Use AWS S3 and Lambda
- Process: Configure a periodic process using the `aws s3 sync` command to sync the on-premises file system to Amazon S3. Then, configure an AWS Lambda function to trigger on S3 event notifications to copy the images from S3 to EFS.
- Pros:
- S3 is highly available and durable, and Lambda offers a serverless approach with minimal operational overhead.
- The use of event notifications to trigger Lambda is automated.
- Cons:
- This introduces an extra layer of complexity with the need for Lambda functions to copy files from S3 to EFS.
- Lambda might not be ideal for high-throughput or large datasets (like images) due to execution time limits (currently 15 minutes per function).
- An additional step (synchronizing to S3 first) might be unnecessary if the goal is to directly write to EFS.
- Suitability: While this is an interesting approach, the need for S3 in the middle adds complexity and operational overhead. It may be more suited for cases where S3 is the destination and EFS is used as a secondary storage.
Option B: Use AWS Storage Gateway (File Gateway)
- Process: Deploy an AWS Storage Gateway File Gateway with an NFS mount point and periodically copy the images from the on-premises system to the file gateway.
- Pros:
- This option provides an NFS interface for integration with on-premises servers, which is seamless for applications designed to use NFS.
- The AWS Storage Gateway is simple to deploy and configure, with minimal maintenance and is optimized for hybrid cloud storage solutions.
- Cons:
- The file gateway stores data in Amazon S3, which then can be accessed via EFS. This adds an unnecessary extra step.
- This might add complexity when the goal is to directly move data to EFS instead of relying on S3.
- Suitability: While this could work, it introduces additional layers (e.g., storing data in S3 first), making it less efficient than other options.
Option C:...
Author: GlowingTiger · Last updated Jul 6, 2026
A company recently migrated a web application from an on-premises data center to the AWS Cloud. The web application infrastructure consists of an Amazon CloudFront distribution that routes to an Application Load Balancer (ALB), with Amazon Elastic Container Service (Amazon ECS) to process requests. A recent security audit revealed that the web application is accessible by using both CloudFront and ALB endpoints. However,...
Let's break down each option to determine the most efficient way to restrict access to the web application via CloudFront only, while ensuring minimal effort and operational complexity.
Option A: Create a new security group and attach it to the CloudFront distribution. Update the ALB security group ingress to allow access only from the CloudFront security group.
- Process: You would create a new security group for CloudFront and attach it to the CloudFront distribution. Then, you'd modify the ALB's security group to allow access only from the newly created CloudFront security group.
- Pros:
- This is a straightforward solution using security groups and minimizes external dependencies.
- It's relatively easy to implement since it uses existing AWS features (security groups) and CloudFront.
- Cons:
- Security groups are not directly associated with CloudFront distributions, so this would not work out-of-the-box. You can't directly attach a security group to CloudFront, meaning you’d need to use other methods (like whitelisting IPs).
- Suitability: This option is not valid because security groups cannot be directly assigned to CloudFront.
Option B: Update ALB security group ingress to allow access only from the com.amazonaws.global.cloudfront.origin-facing CloudFront managed prefix list.
- Process: This option suggests using AWS managed prefix lists specifically designed for CloudFront. You would update the ALB security group to allow access only from the CloudFront IPs listed in the "com.amazonaws.global.cloudfront.origin-facing" prefix list.
- Pros:
- This is an efficient and AWS-native solution to allow access only from CloudFront by using a managed list of CloudFront IP ranges.
- It simplifies the setup as AWS manages the IP list and automatically updates it when needed.
- Cons:
- Requires the use of a security group for ALB, but otherwise, the setup is straightforward.
- Suitability: This is a valid and highly efficient solution for restricting access to the ALB only from CloudFront, and it is simple to implement with minimal operational overhead.
Option C: Create ...
Author: Liam · Last updated Jul 6, 2026
A company hosts a community forum site using an Application Load Balancer (ALB) and a Docker application hosted in an Amazon ECS cluster. The site data is stored in Amazon RDS for MySQL and the container image is stored in ECR. The company needs to provide their customers with a disaster recovery SLA with an RTO of no more...
Key Requirements:
- RTO (Recovery Time Objective) of no more than 24 hours: This means that the company should be able to recover the application and data within 24 hours in the event of a disaster.
- RPO (Recovery Point Objective) of no more than 8 hours: This means that the company can tolerate a maximum of 8 hours of data loss, meaning data must be backed up or replicated at least every 8 hours.
Option Analysis:
A) Use AWS CloudFormation to deploy identical ALB, EC2, ECS, and RDS resources in two regions. Schedule RDS snapshots every 8 hours. Use RDS multi-region replication to update the secondary region's copy of the database. In the event of a failure, restore from the latest snapshot, and use an Amazon Route 53 DNS failover policy to automatically redirect customers to the ALB in the secondary region.
- Pros:
- RDS Multi-Region Replication would help with maintaining up-to-date copies of the database in the secondary region, ensuring the RPO requirement is met.
- CloudFormation ensures consistent and automated infrastructure deployment across regions.
- Route 53 DNS failover can quickly redirect traffic to the secondary region.
- Cons:
- Cost: Multi-region replication for RDS is typically more expensive than cross-region snapshots because it requires continuous replication and may involve higher network and data storage costs.
- Restoring from snapshots can exceed the 24-hour RTO, especially if you need to restore large databases. It doesn't guarantee an efficient recovery process as multi-region replication could potentially provide faster recovery.
- Complexity: Managing infrastructure across two regions, ensuring all resources (ALB, EC2, ECS, RDS) are correctly replicated and synchronized could be complicated and result in higher operational overhead.
B) Store the Docker image in ECR in two regions. Schedule RDS snapshots every 8 hours with snapshots copied to the secondary region. In the event of a failure, use AWS CloudFormation to deploy the ALB, EC2, ECS, and RDS resources in the secondary region, restore from the latest snapshot, and update the DNS record to point to the ALB in the secondary region.
- Pros:
- Storing Docker images in ECR across two regions ensures quick access to the container image in case of failure.
- RDS snapshots every 8 hours meet the RPO requirement, and the snapshots are copied to the secondary region for fast recovery.
- Cons:
- RTO concerns: Deploying infrastructure using CloudFormation, restoring RDS snapshots, and redeploying ECS containers could take significant time, likely exceeding the 24-hour RTO requirement.
- Manual Effort: This approach requires manual intervention for restoring and redeploying infrastructure, which could result in slow recovery times during a disaster.
C) Use AWS CloudFormation to deploy identical ALB, EC2, ECS, and RDS resources in a secondary region. Schedule hourly RDS MySQL backups ...
Author: Kunal · Last updated Jul 6, 2026
A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment.
A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution a...
Let's analyze each of the options provided to determine the most suitable solution that meets the company's requirements of compliance, security, multi-account management, and integration with the on-premises Active Directory Federation Services (AD FS) with the least operational overhead.
Option A: Create an organization in AWS Organizations. Create a single SCP for least privilege access across all accounts. Create a single OU for all accounts. Configure an IAM identity provider for federation with the on-premises AD FS server. Configure a central logging account with a defined process for log-generating services to send log events to the central account. Enable AWS Config in the central account with conformance packs for all accounts.
- Pros:
- This solution sets up a centralized management structure using AWS Organizations, which is a good foundation for multi-account environments.
- A single SCP provides uniform access controls across all accounts.
- A central logging account and AWS Config enable centralized monitoring and compliance management.
- Cons:
- The use of a single SCP and a single OU for all accounts may not allow sufficient flexibility for the various compliance requirements of different projects. Different regulatory standards may require different security and management controls for different accounts.
- Using IAM Identity Federation instead of AWS IAM Identity Center could add complexity in the long term and make user management less scalable, especially as the number of accounts and users grows.
- Suitability: This option is a good start, but it lacks the flexibility needed to address different compliance standards across various accounts. The operational overhead of managing IAM identity federation with AD FS could also be higher over time.
Option B: Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Add OUs as necessary. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server.
- Pros:
- AWS Control Tower simplifies the process of setting up and managing a multi-account environment by automatically applying security best practices through its built-in guardrails.
- The integration of AWS IAM Identity Center with AD FS allows seamless single sign-on (SSO) for users, minimizing the operational overhead of managing identities manually.
- The flexibility to add organizational units (OUs) as necessary allows for customization based on different regulatory requirements.
- Cons:
- AWS Control Tower enforces specific guardrails that may not align perfectly with all regulatory requirements, and customizing guardrails to fit complex compliance needs might require additional effort.
- Some compliance requirements may need specific AWS Config rules or integrations that aren't fully addressed by the default guardrails.
- Suitability: This is a strong choice because it leverages AWS Control Tower for easy setup and ongoing management of multi-account environments with a flexible identity management system (AWS IAM Identity Center). However, the built-in guardrails might not cover every unique compliance requirement, and additional customization could...
Author: David · Last updated Jul 6, 2026
An online magazine will launch its latest edition this month. This edition will be the first to be distributed globally. The magazine's dynamic website currently uses an Application Load Balancer in front of the web tier, a fleet of Amazon EC2 instances for web and application servers, and Amazon Aurora MySQL. Portions of the website include static content and almost all traffic is read-only.
The magazine is expecting a significant spike in internet traffic when the new edition is lau...
Let’s evaluate each option to find the best approach to optimize performance for a global audience and reduce system response times for the online magazine launch.
Option A: Use logical cross-Region replication to replicate the Aurora MySQL database to a secondary Region. Replace the web servers with Amazon S3. Deploy S3 buckets in cross-Region replication mode.
- Pros:
- Cross-Region replication for Aurora MySQL ensures that the database is available in another Region for failover and faster read operations.
- Using S3 for static content can reduce load on the web servers and improve the delivery of static content globally.
- Cons:
- Replacing the web servers with S3 is not practical since the website is dynamic, and S3 is only suitable for serving static content. The application logic and dynamic portions of the site cannot be served from S3.
- Cross-Region replication for S3 adds complexity, and while it helps with static content, it doesn’t address application server scalability for dynamic content.
- Suitability: While cross-Region database replication and S3 for static content are helpful, replacing web servers with S3 does not meet the needs for dynamic content or optimal performance during traffic spikes.
Option B: Ensure the web and application tiers are each in Auto Scaling groups. Introduce an AWS Direct Connect connection. Deploy the web and application tiers in Regions across the world.
- Pros:
- Auto Scaling for the web and application tiers ensures that the infrastructure can dynamically scale to handle traffic spikes.
- Introducing AWS Direct Connect could provide a dedicated, reliable network connection between on-premises data centers and AWS, but it's less relevant for optimizing global traffic in this case.
- Cons:
- Direct Connect is useful for connecting on-premises infrastructure to AWS, but it doesn’t address the need for improving performance for a global audience. The performance benefit is primarily for specific on-premises to cloud use cases, not global web traffic.
- Deploying across multiple Regions helps, but it’s not enough by itself without optimizing routing and edge caching for a global audience.
- Suitability: While Auto Scaling is a good practice, Direct Connect doesn’t significantly improve the response times for a global audience, and this option lacks global traffic optimization like edge caching and routing.
Option C: Migrate the database from Amazon Aurora to Amazon RDS for MySQL. Ensure all three of the application tiers – web, application, and database – are in private subnets.
- Pros:
- Moving to Amazon RDS for MySQL doesn’t provide any immediate performance gains over Aurora for read-heavy workloads and could reduce availability and scalability.
- Keeping application tiers in private subnets improves security, but it doesn’t address performance optimization for global traffic.
- Cons:
- Aurora offers better scalability, performance, and durability than RDS for MySQL, especially for large-scale read-heavy applications like this one. Migrations to RDS for MySQL would likely be a step backward in terms of perf...
Author: Max · Last updated Jul 6, 2026
An online gaming company needs to optimize the cost of its workloads on AWS. The company uses a dedicated account to host the production environment for its online gaming application and an analytics application.
Amazon EC2 instances host the gaming application and must always be available. The EC2 instances run all year. The analytics application uses data that is st...
Let's analyze each of the options in light of the cost optimization and workload requirements described.
Key factors:
1. Online gaming application (must always be available): This requires instances that are always up and running.
2. Analytics application (can be interrupted and resumed): This is flexible, so it can use cheaper, interruptible instances like Spot Instances.
Option Analysis:
A) Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use On-Demand Instances for the analytics application.
- Why not?:
- Online gaming: Purchasing an EC2 Instance Savings Plan is a good option here because these instances run year-round and will benefit from a long-term commitment (1 or 3 years), offering a substantial discount over On-Demand pricing.
- Analytics application: Using On-Demand Instances for the analytics application isn’t cost-effective, as the analytics app can tolerate interruptions. On-Demand pricing is typically the highest cost option and would not make sense for a workload that can be interrupted.
- Why rejected?: The analytics app can use Spot Instances, which would save more money than On-Demand Instances.
B) Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use Spot Instances for the analytics application.
- Why not?:
- Online gaming: An EC2 Instance Savings Plan is ideal for this use case because it ensures the online gaming application is always available and the plan offers a discount.
- Analytics application: Using Spot Instances for the analytics application is a great choice since the app can be interrupted, and Spot Instances are significantly cheaper than On-Demand instances.
- Why selected?: This option optimizes cost effectively, making full use of the available cost-sav...
Author: Evelyn · Last updated Jul 6, 2026
A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup.
The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient ...
To address the requirement of ensuring that backups are resilient to breaches of privileged-user credentials in production accounts, we need to consider approaches that secure backup data from being tampered with or deleted, even if an attacker compromises privileged accounts.
Key factors:
1. Ransomware resilience: Ensuring that backups are protected against unauthorized modifications or deletions, especially in the case of compromised privileged accounts.
2. Cross-account backup: Keeping backup data in accounts separate from production accounts to minimize the risk of a breach affecting both production resources and backups.
3. Backup integrity: Using features like Backup Vault Lock and S3 Object Lock to make backups immutable and secure from tampering.
4. Least privilege access: Restricting access to backups to prevent unnecessary permissions that could potentially be exploited by an attacker.
Option Analysis:
A) Implement cross-account backup with AWS Backup vaults in designated non-production accounts.
- Why selected?:
- Storing backups in separate non-production accounts protects them from being compromised if a production account is breached. Cross-account backup ensures that even if privileged credentials are compromised in production, the backup data remains secure and isolated in a different account.
- Why rejected?: This is a good choice, and there’s no direct reason to reject it. It's part of a well-rounded strategy for ensuring backup resilience.
B) Add an SCP that restricts the modification of AWS Backup vaults.
- Why selected?:
- Service Control Policies (SCPs) can be used within AWS Organizations to restrict or deny certain actions across accounts, including the modification of AWS Backup vaults. By ensuring that no one (even with privileged access) can modify or delete backups, this adds an important layer of protection against accidental or malicious alterations to backup data.
- Why rejected?: This option is ideal because it strengthens the security of backups in all accounts, especial...
Author: Rohan · Last updated Jul 6, 2026
A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing.
A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale...
To address the company's requirements for aggregating and processing logs from multiple AWS accounts into a central logging account, the solution must ensure scalability, log data retention in the same region as creation, and meet performance demands during peak hours. Here's an analysis of the selected and rejected options.
Key Factors:
1. Centralized logging: Logs should be collected into one central account but remain in the same AWS region as their creation.
2. Scalability: The solution must handle varying volumes of logs, especially during peak business hours.
3. Processing and normalization: Once logs are aggregated, they must be normalized and processed for security tools.
4. Use of AWS Control Tower: AWS Control Tower is used to manage multi-account logging.
Option Analysis:
A) Create a destination Amazon Kinesis data stream in the central logging account.
- Why selected?:
- Kinesis is an ideal choice for handling high-throughput log data streams because it can scale to handle large volumes of log data and provides real-time processing capabilities. This aligns with the company’s need to scale and process log data efficiently.
- Kinesis also supports integration with AWS Lambda for processing logs, making it suitable for this use case.
- Why rejected?: There's no direct reason to reject Kinesis. It’s a good fit for handling log data at scale and fits the overall design well.
B) Create a destination Amazon Simple Queue Service (Amazon SQS) queue in the central logging account.
- Why not?:
- SQS is a messaging service primarily used for decoupling application components and does not natively scale or process large volumes of data as efficiently as Kinesis. SQS would add more complexity for handling large-scale log ingestion and processing compared to Kinesis, especially in real-time data streaming.
- Why rejected?: Kinesis is a better choice for real-time streaming and scalability of large log volumes, whereas SQS is better suited for message queuing, which isn't optimized for continuous data streaming.
C) Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Kinesis data stream. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a subscription filter for each log group to send data to the Kinesis data stream.
- Why selected?:
- This option leverages CloudWatch Logs subscriptions, allowing logs from multiple accounts to be forwarded to the Kinesis stream. The IAM role ensures that CloudWatch Logs has permission to push logs into Kinesis. By creating subscription filters in each account, the logs from each account are routed to the central logging account.
- Why rejected?: This is the correct solution for centralizing logs and scaling the ingestion of log data. This step is essential for collecting logs across multiple accou...
Author: Aarav · Last updated Jul 6, 2026
A company is migrating a legacy application from an on-premises data center to AWS. The application consists of a single application server and a Microsoft SQL Server database server. Each server is deployed on a VMware VM that consumes 500 TB of data across multiple attached volumes.
The company has established a 10 Gbps AWS Direct Connect connection from the closest AWS Region to its on-premises data center. The Direct Connect conn...
Key Considerations:
- Migration Goal: Migrate a legacy application consisting of two VMware VMs (application server and SQL Server database server) to AWS with minimal downtime.
- Existing Direct Connect Connection: The company has a 10 Gbps AWS Direct Connect connection, which should be leveraged for high-speed data transfer.
- Large Data Volume: The SQL Server database server consumes 500 TB of data across multiple attached volumes, so the solution should be able to handle such a large volume efficiently.
Option Analysis:
A) Use an AWS Server Migration Service (AWS SMS) replication job to migrate the database server VM to AWS.
- Pros:
- AWS SMS is designed for migrating on-premises VMs to AWS with minimal downtime by enabling replication of the source VM to an EC2 instance. This approach is particularly effective when migrating entire workloads (like the database server VM) with minimal impact on application availability.
- Incremental replication: AWS SMS replicates changes made to the source VM, ensuring that the database server can be migrated with minimal disruption to the ongoing operation.
- Suitability: This method would be suitable for migrating the database server since it directly supports VMware VM migrations and minimizes downtime.
- Cons:
- Time required: Since it is focused on VMs and databases, large amounts of data (500 TB) could still take time to replicate, depending on the network and the size of changes.
B) Use VM Import/Export to import the application server VM.
- Pros:
- VM Import/Export can import on-premises VMware VMs to Amazon EC2 instances, preserving the VM’s configuration and data.
- Useful for migrating VMs that are not heavily customized.
- Cons:
- Downtime concerns: VM Import/Export is a one-time process and does not support ongoing replication. Thus, the downtime during the migration could be substantial because the VM has to be shut down for export and import, leading to more downtime than AWS SMS.
- Large data transfer: Importing 500 TB via VM Import/Export could be a lengthy process, making it unsuitable for applications requiring minimal downtime.
C) Export the VM images to an AWS Snowball Edge Storage Optimized device.
- Pros:
- AWS Snowball Edge can transfer large amounts of data offline, which would be ideal for migrating a large database (500 TB).
- It’s a good solution when network bandwidth is insufficient or when minimizing Direct Connect utilization is a priority.
- Cons:
- Longer downtime: The Snowball Edge method involves physically shipping a device to AWS, copying data to it, and then uploading it to the cloud, which could take several days to complete. This would result in significant downtime during the migration process.
- Not ideal for ac...
Author: Ahmed97 · Last updated Jul 6, 2026
A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to contro...
To meet the company's need to control which VPCs can communicate with each other while keeping the solution operationally efficient, we must leverage a scalable and centralized approach. Given that the company already has Site-to-Site VPN connections and operates a large number of VPCs, using a transit gateway provides an effective solution to manage traffic flow between VPCs and the on-premises network.
Key factors:
1. Centralized control: The solution should allow for centralized management of connections between multiple VPCs, which will simplify the control of network traffic.
2. Least operational effort: We need to choose the most efficient options in terms of long-term management and scalability without requiring complex manual configurations for each VPC.
3. Security and isolation: The solution should also ensure proper segmentation, ensuring that only specific VPCs can communicate with others or with the on-premises network.
Option Analysis:
A) Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).
- Why selected?:
- The transit gateway is the optimal solution for managing communication between multiple VPCs and external networks (like the on-premises network). AWS Resource Access Manager (RAM) allows sharing the transit gateway across AWS accounts, enabling centralized management of VPC connections.
- This approach simplifies the management of routing, reducing the need to configure each VPC individually and ensuring centralized control over which VPCs can communicate with each other.
- Why rejected?: This is the most efficient and scalable way to handle inter-VPC communication and is preferred over alternatives like peering or configuring separate route tables for each VPC.
B) Configure attachments to all VPCs and VPNs.
- Why selected?:
- Attachments allow VPCs and VPNs to connect to the transit gateway. By attaching all VPCs to the transit gateway, we can simplify routing between VPCs and the on-premises network. This ensures that the company has granular control over which VPCs communicate with others and the on-premises network.
- Why rejected?: This is a necessary step for using the transit gateway but by itself, it doesn't provide enough context for complete control over traffic. It needs to be used in conjunction with route tables and route configurations.
C) Setup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
- Why selected?:
- Transit gateway route ta...
Author: Max · Last updated Jul 6, 2026
A company needs to optimize the cost of its application on AWS. The application uses AWS Lambda functions and Amazon Elastic Container Service (Amazon ECS) containers that run on AWS Fargate. The application is write-heavy and stores data in an Amazon Aurora MySQL database.
The load on the application is not consistent. The application experiences long periods of no usage, followed by sudden and significant increases and decreases in traffic. The database runs on a memory optimiz...
To determine the most cost-effective solution for optimizing the cost of the application on AWS, we need to consider key factors such as scalability, cost optimization, and handling the traffic pattern (write-heavy, sudden and significant spikes, and periods of low usage). Here's the analysis for each option:
A) Add additional read replicas to the database. Purchase Instance Savings Plans and RDS Reserved Instances.
- Pros: Adding read replicas helps offload read traffic and can increase read throughput.
- Cons: The issue mentioned is the database cannot handle the load, which implies it may not scale efficiently for both read and write traffic. Read replicas only help for read scaling, not for writes. Purchasing reserved instances or savings plans for database instances (RDS Reserved Instances and Instance Savings Plans) does not solve the problem of scaling with fluctuating traffic demands.
- Best for: Scenarios with mostly read-heavy workloads, where read replicas can offload traffic from the primary database.
- Rejected because: The issue at hand is more about write scaling, and read replicas alone won’t solve the problem for a write-heavy application with fluctuating load. Additionally, Reserved Instances may not be flexible enough for unpredictable traffic patterns.
B) Migrate the database to an Aurora DB cluster that has multiple writer instances. Purchase Instance Savings Plans.
- Pros: Aurora with multiple writer instances can scale writes more effectively. This is good for write-heavy workloads and high availability.
- Cons: The database still needs to be manually scaled (adding and removing writer instances), which can incur high costs for periods of low usage. Purchasing instance savings plans for this setup may not be cost-effective for the unpredictable traffic patterns (since savings plans commit to a certain level of capacity).
- Best for: Applications with consistent and predictable traffic that require high availability and consistent write performance.
- Rejected because: The unpredictable traffic patterns (with periods of low usage) would lead to over-provisioning of resources during idle periods, making this option less cost-effective.
C) Migrate the database to an Aurora global database. Purchase Compute Savings Plans and RDS Reserved instances.
...
Author: Alexander · Last updated Jul 6, 2026
A company migrated an application to the AWS Cloud. The application runs on two Amazon EC2 instances behind an Application Load Balancer (ALB).
Application data is stored in a MySQL database that runs on an additional EC2 instance. The application's use of the database is read-heavy.
The application loads static content from Amazon Elastic Block Store (Amazon EBS) volumes that are attached to each EC2 instance. The static content is updated frequently and must be copied to each EBS volume.
The load on the application changes throughou...
To determine the most suitable solution for improving the reliability of the application, we must consider the following factors:
- Scalability and Load Balancing: The application must handle varying traffic loads, especially during peak hours. The solution should be able to scale dynamically to meet these demands.
- Database Performance: The application’s database cannot handle the read load during peak hours, so a solution must address this by improving database scalability and performance.
- Static Content Handling: Static content needs to be updated frequently, and it must be accessible by the application, but the process of copying it to EBS volumes is inefficient.
Let’s analyze each option:
A) Migrate the application to a set of AWS Lambda functions. Set the Lambda functions as targets for the ALB. Create a new single EBS volume for the static content. Configure the Lambda functions to read from the new EBS volume. Migrate the database to an Amazon RDS for MySQL Multi-AZ DB cluster.
- Pros: Lambda provides auto-scaling and can help with burst traffic. RDS for MySQL Multi-AZ offers high availability and read scalability.
- Cons: AWS Lambda is not ideal for running stateful applications that need to manage static content on EBS volumes, as Lambda is stateless. Mounting an EBS volume directly to Lambda is not feasible, and having a new single EBS volume for static content would not be scalable in a Lambda environment. The architecture is not suitable for frequent updates to static content.
- Best for: Stateless, event-driven applications where scaling based on individual requests is essential. However, this doesn't fit the application's need to store and serve frequently updated static content.
- Rejected because: Lambda is not suitable for applications requiring persistent state and frequent content updates stored on EBS volumes.
B) Migrate the application to a set of AWS Step Functions state machines. Set the state machines as targets for the ALB. Create an Amazon Elastic File System (Amazon EFS) file system for the static content. Configure the state machines to read from the EFS file system. Migrate the database to Amazon Aurora MySQL Serverless v2 with a reader DB instance.
- Pros: Amazon EFS is highly scalable and can be used to serve static content across multiple instances, and Aurora MySQL Serverless v2 can automatically scale database capacity based on demand. Step Functions can orchestrate workflows but are not designed to handle web traffic efficiently.
- Cons: AWS Step Functions are used for orchestration of workflows, not for serving web traffic. Using Step Functions as targets for an ALB is not the correct architecture for this type of application. This design would overcomplicate the solution and is not a fit for web traffic and content delivery.
- Best for: Complex workflows where multiple services need to interact in a sequence. However, this doesn't match the requirements for serving web traffic and static content.
- Rejected because: Step Functions are not designed to serve as targets fo...
Author: Zara1234 · Last updated Jul 6, 2026
A solutions architect wants to make sure that only AWS users or roles with suitable permissions can access a new Amazon API Gateway endpoint. The solutions architect wants an end-to-end view of each request to analyze the latency of the request and create servic...
To determine the best approach for API Gateway access control and request inspection, let's break down the key factors:
1. Access Control: The API Gateway needs to ensure that only authorized AWS users or roles can access the endpoint.
2. Request Inspection and Latency Analysis: We need to trace requests end-to-end and analyze latency, possibly through service maps.
A) For the API Gateway method, set the authorization to AWS_IAM. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Enable the API caller to sign requests with AWS Signature when accessing the endpoint. Use AWS X-Ray to trace and analyze user requests to API Gateway.
- Pros:
- IAM-based authorization ensures that only users or roles with appropriate permissions can invoke the API. This is a secure method for controlling access and is commonly used in AWS environments.
- AWS X-Ray is a great tool for tracing and analyzing the latency of requests, providing end-to-end visibility into requests as they flow through the API Gateway and other AWS services.
- Cons:
- IAM-based authorization requires the API client to sign requests with AWS Signature, which may be more complex for some client applications. However, this can be automated using AWS SDKs.
- Best for:
- This solution is ideal for controlling access using AWS native security and permissions (IAM) while also providing detailed tracing with X-Ray, which meets the requirement for latency analysis and service maps.
- Selected because: This approach combines the benefits of robust access control through IAM with detailed request inspection using AWS X-Ray.
B) For the API Gateway resource, set CORS to enabled and only return the company's domain in Access-Control-Allow-Origin headers. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Use Amazon CloudWatch to trace and analyze user requests to API Gateway.
- Pros:
- CORS is useful for allowing or restricting access based on the domain making the request, commonly used for browser-based security. The IAM permissions control access.
- CloudWatch can monitor API calls, but it doesn't provide the same level of detailed tracing and latency analysis that X-Ray does.
- Cons:
- CORS primarily targets web browsers for cross-origin resource sharing and is not a comprehensive access control mechanism for API Gateway.
- CloudWatch lacks the deep tracing and end-to-end request visibility that X-Ray provides.
- Best for:
- This solution is more suited for basic web-based applications where CORS controls are needed but doesn't provide the fine-grained request tracing required for latency analysis.
- ...
Author: Liam · Last updated Jul 6, 2026
A company is using AWS CodePipeline for the CI/CD of an application to an Amazon EC2 Auto Scaling group. All AWS resources are defined in AWS CloudFormation templates. The application artifacts are stored in an Amazon S3 bucket and deployed to the Auto Scaling group using instance user data scripts. As the application has become more complex, recent resource changes in the CloudFormation template...
To reduce the likelihood that changes in the CloudFormation templates will cause unplanned downtime in the CI/CD pipeline, we need to focus on improving deployment safety and introducing validation mechanisms. Let's break down the key factors for each option:
A) Adapt the deployment scripts to detect and report CloudFormation error conditions when performing deployments. Write test plans for a testing team to run in a non-production environment before approving the change for production.
- Pros:
- Error detection and reporting: Detecting CloudFormation errors early can help prevent deployment issues.
- Testing in non-production: Running tests in a non-production environment can reduce the risk of deploying problematic changes to production.
- Cons:
- Manual testing: Writing test plans and relying on manual execution introduces human error and delay. It is also resource-intensive and does not scale well for automated workflows.
- No automated rollback: This approach does not have automatic rollback or validation features that can help mitigate downtime in production in case of failures.
- Best for: Scenarios where manual validation can work, but it is not ideal for high-efficiency or large-scale systems where automation is needed for quicker response times.
- Rejected because: The reliance on manual testing is a drawback, and it doesn't provide the level of automation required to reduce downtime effectively.
B) Implement automated testing using AWS CodeBuild in a test environment. Use CloudFormation change sets to evaluate changes before deployment. Use AWS CodeDeploy to leverage blue/green deployment patterns to allow evaluations and the ability to revert changes, if needed.
- Pros:
- Automated testing: Automating the testing process with CodeBuild ensures that only validated changes are deployed, reducing human error.
- CloudFormation change sets: These allow you to preview and evaluate changes before applying them, reducing the risk of unwanted changes.
- Blue/green deployment with CodeDeploy: Blue/green deployment allows you to test changes on a separate environment (blue) before making them live (green). This reduces downtime and allows for easy rollback if something goes wrong.
- Cons:
- Complexity: This approach adds complexity in terms of managing multiple environments and automating blue/green deployments, which may require additional configuration and resources.
- Best for: Large-scale, critical applications where minimizing downtime and ensuring changes are safely deployed is paramount. The use of blue/green deployment provides flexibility in testing and rolling back changes.
- Selected because: This approach provides a comprehensive, automated way to prevent downtime, offering pre-deployment testing, safe deployment strategies, and rollback mechanisms.
C) Use plugins for the integrated develo...
Author: Evelyn · Last updated Jul 6, 2026
A North American company with headquarters on the East Coast is deploying a new web application running on Amazon EC2 in the us-east-1 Region. The application should dynamically scale to meet user demand and maintain resiliency. Additionally, the application must have disaster recovery capabilities in an active-passiv...
Key Requirements:
1. Dynamic Scaling: The application must scale to meet user demand, which implies using AWS services that support Auto Scaling.
2. Resiliency: The application needs to remain resilient, so it should be deployed across multiple Availability Zones (AZs) to ensure fault tolerance.
3. Disaster Recovery (Active-Passive Configuration): The application should have disaster recovery capabilities in an active-passive configuration across two regions (us-east-1 and us-west-1).
Option Analysis:
A) Create a VPC in the us-west-1 Region. Use inter-Region VPC peering to connect both VPCs. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs in each Region as part of an Auto Scaling group spanning both VPCs and served by the ALB.
- Issues:
- Inter-Region VPC Peering: While inter-region VPC peering is useful for connecting VPCs in different regions, it does not support traffic between instances behind an ALB across regions. The ALB cannot span multiple regions, so this configuration would not work for load balancing across us-east-1 and us-west-1.
- ALB Limitations: An ALB can only route traffic to resources within the same region. This approach doesn’t meet the requirement for an active-passive disaster recovery setup across regions.
B) Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs as part of an Auto Scaling group served by the ALB. Deploy the same solution to the us-west-1 Region. Create an Amazon Route 53 record set with a failover routing policy and health checks enabled to provide high availability across both Regions.
- Pros:
- This solution sets up the required active-passive disaster recovery using Route 53 failover routing policy, which ensures traffic is routed to the primary region (us-east-1) under normal conditions, and to the secondary region (us-west-1) in case of failure.
- ALB in each region: Both regions have their own ALB, ensuring that traffic is only routed to resources within the same region.
- Route 53 health checks: This ensures that Route 53 can automatically fail over traffic based on health check results, which aligns with the disaster recovery goals.
- Cons:
- Active-Passive configurat...
Author: Stella · Last updated Jul 6, 2026
A company has a legacy application that runs on multiple NET Framework components. The components share the same Microsoft SQL Server database and communicate with each other asynchronously by using Microsoft Message Queueing (MSMQ).
The company is starting a migration to containerized .NET Core components and wants to refactor the application to run on AWS. The .NET Core components require complex orchestration....
Option Evaluation:
To select the appropriate solution, we need to carefully consider the requirements mentioned:
1. Migration to containerized .NET Core components: This requires a solution that can orchestrate .NET Core components effectively.
2. Full control over networking and host configuration: This implies that we need a service that offers a significant level of control over the infrastructure and configuration, meaning fully managed services like App Runner may not be suitable due to their abstraction.
3. Relational database model: Since the database model is strongly relational, the solution must support this type of database, and it should be compatible with SQL Server (as the current application relies on Microsoft SQL Server).
4. Asynchronous communication: The solution must also support asynchronous messaging, such as queues or event-driven architectures.
Option A: AWS App Runner, RDS for SQL Server, and EventBridge
- App Runner: AWS App Runner abstracts container orchestration, making it easier to deploy containers but provides limited control over networking and host configurations, which contradicts the requirement for full control.
- RDS for SQL Server: This is a good option for the database since the application already uses SQL Server, and RDS for SQL Server is a managed service.
- EventBridge for asynchronous messaging: EventBridge is more event-driven and generally used for modern, event-based architectures. It's not specifically tailored for queuing and is less suitable for traditional MSMQ-style messaging.
Why rejected: While RDS for SQL Server is a good choice for the database, the lack of control over the networking and host configuration from App Runner makes this solution unsuitable. EventBridge isn't the best choice for replacing MSMQ in this context.
Option B: ECS with Fargate, DynamoDB, and SNS
- ECS with Fargate: Fargate is a serverless compute engine for containers, which is convenient but doesn't give the full control over networking and host configuration that the requirement specifies.
- DynamoDB: DynamoDB is a NoSQL database, which doesn't fit the requirement for a strongly relational database. The legacy system uses SQL Server, so a relational database would be more appropriate.
- SNS for asynchronous messaging: SNS is suitable for simple messaging but is not designed for queuing in the same way MSMQ or SQS is. It is more event-driven and less appropriate for this legacy system's asynchronou...
Author: Ming88 · Last updated Jul 6, 2026
A solutions architect has launched multiple Amazon EC2 instances in a placement group within a single Availability Zone. Because of additional load on the system, the solutions architect attempts to add new instances to the placement group. However, the solutions arch...
Key Points:
- The insufficient capacity error occurs when the AWS infrastructure cannot accommodate additional instances in the placement group due to capacity constraints within the Availability Zone.
- The placement group type is likely a cluster placement group, which places instances in close proximity for low latency and high throughput, but there is a limited amount of capacity available for new instances in the same Availability Zone.
Option Analysis:
A) Use a spread placement group. Set a minimum of eight instances for each Availability Zone.
- Reasoning: A spread placement group is designed to place instances across distinct underlying hardware to reduce correlated failures. However, the problem here is capacity in the cluster placement group, which does not directly relate to the use of a spread placement group.
- Why rejected: This option doesn't solve the specific problem of insufficient capacity in the original placement group. Changing the placement group type won't address the lack of capacity for the new instances in the cluster placement group.
- When to use: Spread placement groups are useful for ensuring fault tolerance and are suitable when you need to place instances on distinct hardware, but it doesn't solve the capacity issue for cluster placement groups.
B) Stop and start all the instances in the placement group. Try the launch again.
- Reasoning: Stopping and starting instances can sometimes help by releasing the capacity they were using, allowing for new instances to be placed in the same placement group. However, this solution may not be effective in overcoming the insufficient capacity issue because it doesn’t address the underlying capacity limits of the Availability Zone or the placement group itself.
- Why rejected: While this might allow for instances to be redistributed, it doesn’t guarantee that the capacity issue will be resolved, especially if the Availability Zone is at capacity.
- When to use: This can work in some scenarios where you want to refresh the placement of exis...
Author: FlamePhoenix2025 · Last updated Jul 6, 2026
A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years.
The company's business has grown rapidly in the past few months. In response, the company's operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running.
The most recent security update required a reboot. As a re...
Option Evaluation:
The key problem in this scenario is that when the security update required a reboot, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances, leading to a loss of patches. We need to ensure that the instances can be updated without causing Auto Scaling to replace them or, if replacements are necessary, that they are patched correctly.
Option A: Modify the Auto Scaling group by setting the Update policy to target the oldest launch configuration for replacement.
- Update Policy and Launch Configuration: The update policy in Auto Scaling groups determines how instances are replaced. While setting the update policy to replace the oldest launch configuration ensures that the oldest instances are replaced first, it does not directly address the issue of patching the instances or ensuring the instances are patched before being terminated and replaced.
- Why rejected: This option does not address the need to apply patches before replacement or to manage patching on existing instances. It merely controls which instances are replaced and does not provide a robust mechanism for security updates.
Option B: Create a new Auto Scaling group before the next patch maintenance. During the maintenance window, patch both groups and reboot the instances.
- New Auto Scaling Group: Creating a new Auto Scaling group for maintenance can allow for patching to be done without affecting the live Auto Scaling group. However, this approach requires careful management of the two groups, and it could lead to complexities in traffic distribution and scaling. Additionally, manual patching of both groups is labor-intensive and doesn’t leverage automation effectively.
- Why rejected: While this approach provides a workaround for managing patching without disrupting traffic, it is cumbersome and inefficient. It adds complexity and doesn’t fully address the need for automated patching and proper instance management in the Auto Scaling group.
Option C: Create an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to ensure that target group health checks return healthy after the Auto Scaling group replaces the terminated instances.
- Elastic Load Balancer (ELB): While creating an ELB helps distribute traffic among healthy instances, it does not prevent the Auto Scaling group from replacing instances or ensur...
Author: Leah · Last updated Jul 6, 2026
A team of data scientists is using Amazon SageMaker instances and SageMaker APIs to train machine learning (ML) models. The SageMaker instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs.
Occasionally, the data scientists require access to the Python Package Index (PyPI) repository to update Python packages that they use as ...
Option Evaluation:
The goal is to provide internet access to SageMaker instances for accessing the Python Package Index (PyPI) repository, while ensuring that these instances remain isolated from the internet otherwise. The solution must meet these conditions efficiently and securely.
Option A: Create an AWS CodeCommit repository for each package that the data scientists need to access. Configure code synchronization between the PyPI repository and the CodeCommit repository. Create a VPC endpoint for CodeCommit.
- CodeCommit as a Sync Solution: CodeCommit is a fully managed source control service and is not designed to host or sync public repositories like PyPI. Synchronizing the entire PyPI repository with CodeCommit is impractical due to the large size of the repository and the need for frequent updates.
- Why rejected: This approach is inefficient and overly complex. It requires manual or scripted synchronization between PyPI and CodeCommit, which is not ideal for regularly updating Python packages. Additionally, it doesn’t fully leverage AWS services designed for handling public repositories like PyPI.
Option B: Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a network ACL that allows access to only the PyPI repository endpoint.
- NAT Gateway: A NAT gateway would provide access to the internet for the SageMaker instances, but it would bypass the requirement for the instances to remain isolated from the internet. Even though the network ACL could restrict access to specific endpoints like PyPI, the NAT gateway itself opens up broader access to the internet, which violates the principle of keeping the SageMaker instances isolated.
- Why rejected: While it technically allows access to PyPI, it compromises the security model by providing full internet access through the NAT gateway. This makes the SageMaker instances no longer isolated from the internet, which goes against the...
Author: Olivia · Last updated Jul 6, 2026
A solutions architect works for a government agency that has strict disaster recovery requirements. All Amazon Elastic Block Store (Amazon EBS) snapshots are required to be saved in at least two additional AWS Regions. The agency also is re...
Key Requirements:
- Disaster Recovery: EBS snapshots need to be copied to at least two additional AWS Regions.
- Operational Overhead: The solution should minimize the operational effort for ongoing management.
- Solution Flexibility: The solution should meet the strict disaster recovery requirements while maintaining minimal complexity.
Option Analysis:
A) Configure a policy in Amazon Data Lifecycle Manager (Amazon DLM) to run once daily to copy the EBS snapshots to the additional Regions.
- Reasoning: Amazon DLM allows for the automation of EBS snapshot management, but it does not natively support cross-region replication. While DLM is effective for creating and managing snapshots, it cannot directly copy those snapshots across regions.
- Why rejected: Although DLM can automate snapshot creation, it cannot meet the requirement of copying snapshots to multiple regions without additional configuration, such as using Lambda or custom scripts.
- When to use: DLM is excellent for managing snapshots within a single region but falls short of cross-region replication.
B) Use Amazon EventBridge to schedule an AWS Lambda function to copy the EBS snapshots to the additional Regions.
- Reasoning: This approach can be configured to automate the process of copying EBS snapshots across regions using Lambda and EventBridge. However, this requires custom Lambda code to handle the copying, which introduces additional operational overhead and complexity. Managing this solution could become cumbersome over time, especially if there are many snapshots or regions to handle.
- Why rejected: While this solution meets the requirements, it involves more custom development, ongoing maintenance, and operational overhead than other alternatives. This goes against the requirement for low operational overhead.
- When to use: This is suitable for cases where custom automation is needed but may increase operational complexity over time.
C) Set up AWS Backup to create the EBS snapshots. Configure Amazon S3 Cross-Region Replication to copy the EBS snapshots to the additional Regions.
- Reasoning: AWS Backup ...
Author: Vivaan · Last updated Jul 6, 2026
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the p...
To meet the requirements of limiting the EC2 instances to only t3.small in the us-east-2 region, we need to focus on controlling the types of EC2 instances that developers can launch and restricting the Region to us-east-2. Let’s evaluate each option:
A) Create a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add the account to the company's organization in AWS Organizations. Enforce a tagging policy that denotes Region affinity.
- Reasoning: This option introduces unnecessary complexity. Creating a new account and enforcing a tagging policy adds overhead without directly addressing the requirements. Adding the account to the AWS Organization could violate the restriction of keeping the project outside the corporate IT environment.
- Rejected: This option doesn't provide a direct and simple solution to limit the instance types and region. It adds unnecessary steps, like account migration and organization involvement.
B) Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-east-2. Attach the SCP to the project's account.
- Reasoning: Service Control Policies (SCPs) can restrict actions at the AWS Organization level, but in this case, the project's account cannot be part of the company's AWS Organization due to policy restrictions. This option would require moving the project into AWS Organizations, which contradicts the original requirement of keeping the project outside the corporate IT structure.
- Rejected: This option would only work if the account was part of AWS Organizations, which is explicitly proh...
Author: Samuel · Last updated Jul 6, 2026
A scientific company needs to process text and image data from an Amazon S3 bucket. The data is collected from several radar stations during a live, time-critical phase of a deep space mission. The radar stations upload the data to the source S3 bucket. The data is prefixed by radar station identification number.
The company created a destination S3 bucket in a second account. Data must be copied from the source S3 bucket to the destination S3 bucket to meet a compliance objective. This replication occurs through the use of an S3 replication rule to cover all objects in the source S3 bucket.
One specific radar station is...
Option A: Setup an AWS DataSync agent to replicate the prefixed data from the source S3 bucket to the destination S3 bucket. Select to use all available bandwidth on the task, and monitor the task to ensure that it is in the TRANSFERRING status. Create an Amazon EventBridge rule to initiate an alert if this status changes.
- Reasoning: AWS DataSync is typically used for large-scale data migrations or recurring data transfers, not for replicating small changes in S3 objects or handling time-sensitive replication. DataSync is a powerful tool, but it is more appropriate for use cases where large amounts of data need to be transferred between storage systems, such as between on-premises and AWS, or between AWS storage services. This approach is not well-suited for continuous and real-time monitoring of S3 replication.
- Rejected: While DataSync is a great tool for large-scale data transfers, it's not designed for S3-to-S3 replication and real-time monitoring of object-level replication events.
Option B: In the second account, create another S3 bucket to receive data from the radar station with the most accurate data. Set up a new replication rule for this new S3 bucket to separate the replication from the other radar stations. Monitor the maximum replication time to the destination. Create an Amazon EventBridge rule to initiate an alert when the time exceeds the desired threshold.
- Reasoning: Creating a separate bucket for data from the radar station with the most accurate data could help isolate the replication, but it introduces additional complexity in managing another S3 bucket and replication rule. The solution doesn’t directly guarantee timely replication within 30 minutes for this specific radar station. S3 replication can take longer than 30 minutes depending on data size, and the alerting setup does not directly address real-time monitoring and resolution of replication delay for this specific station’s data.
- Rejected: The complexity of managing multiple buckets for specific radar stations doesn't directly meet the time-sensitive requirement, and the monitoring does not guarantee a 30-minute replication window.
Option C: Enable Amazon S3 Transfer Acceleration on the...
Author: Emma Brown · Last updated Jul 6, 2026
A company wants to migrate its on-premises data center to the AWS Cloud. This includes thousands of virtualized Linux and Microsoft Windows servers, SAN storage, Java and PHP applications with MySQL, and Oracle databases. There are many dependent services hosted either in the same data center or externally. The technical documentation is incomplete and outdated. A solutions architect needs to understand the curren...
To plan the cloud migration for the company’s on-premises data center, a solutions architect needs to assess the current environment, understand dependencies, estimate resource costs, and plan for a smooth migration. Let’s evaluate the options:
A) AWS Application Discovery Service
- Reasoning: AWS Application Discovery Service helps in discovering and understanding the existing infrastructure, including servers, applications, and dependencies. This service is particularly valuable when there is incomplete or outdated documentation, as it can automatically collect data about on-premises environments, including server configurations, utilization, and interdependencies. It helps with planning the migration by providing detailed insights into the existing IT infrastructure.
- Selected: This is a key tool to assess the current environment and dependencies, which is critical for migrating the data center effectively.
B) AWS SMS (Server Migration Service)
- Reasoning: AWS Server Migration Service (SMS) automates the process of migrating on-premises servers to AWS. It simplifies the migration of virtualized servers by replicating them to AWS, but it does not help with assessing the current environment or understanding dependencies. SMS focuses more on the migration phase, and while it’s useful for actually migrating servers, it doesn’t assist in the initial planning phase, such as gathering data or estimating costs.
- Rejected: AWS SMS is more useful for actual server migration but does not aid in discovery or cost estimation. It’s not ideal for the initial planning and assessment required in this scenario.
C) AWS X-Ray
- Reasoning: AWS X-Ray is a tool used for analyzing and debugging applications, especially microservices-based applications in AWS. It helps trace requests and visualize performance bottlenecks in cloud-based applications. While it is valuable for application monitoring and troubleshooting in AWS, it is not intended for discovering on-premises infrastructure or estimating migration costs.
- Rejected: AWS X-Ray is designed for application performance monitoring and not for planning or discovering on-premises environments.
D) AWS Cloud Adoption Readiness Tool (CART)
- Reasoning: AWS Cloud Adoption Readiness Tool (CART) helps organizations asse...
Author: Ella · Last updated Jul 6, 2026
A solutions architect is reviewing an application's resilience before launch. The application runs on an Amazon EC2 instance that is deployed in a private subnet of a VPC. The EC2 instance is provisioned by an Auto Scaling group that has a minimum capacity of 1 and a maximum capacity of 1. The application stores data on an Amazon RDS for MySQL DB instance. The VPC has subnets configured in three Availability Zones and is configured with a single N...
To ensure that the application will operate across multiple Availability Zones (AZs), we need to address both the EC2 instance and the RDS instance configurations while ensuring the application remains resilient and available. Let’s evaluate the options:
A) Deploy an additional NAT gateway in the other Availability Zones. Update the route tables with appropriate routes. Modify the RDS for MySQL DB instance to a Multi-AZ configuration. Configure the Auto Scaling group to launch the instances across Availability Zones. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
- Reasoning:
- NAT Gateway: Adding a NAT gateway in other Availability Zones ensures that the EC2 instances in private subnets can access the internet, even if one AZ becomes unavailable. This improves resilience.
- Multi-AZ RDS: Enabling Multi-AZ for RDS ensures that the database is replicated across multiple Availability Zones for failover support, making it highly available.
- Auto Scaling Group: Configuring the Auto Scaling group to launch instances across Availability Zones improves availability and fault tolerance.
- Capacity Adjustment: Setting the Auto Scaling group’s minimum and maximum capacity to 3 ensures that there are enough instances to handle potential traffic spikes and maintain high availability.
- Selected: This option addresses both application and database availability and provides the necessary resilience across multiple AZs.
B) Replace the NAT gateway with a virtual private gateway. Replace the RDS for MySQL DB instance with an Amazon Aurora MySQL DB cluster. Configure the Auto Scaling group to launch instances across all subnets in the VPC. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
- Reasoning:
- Virtual Private Gateway: A Virtual Private Gateway is typically used to connect an on-premises network to an AWS VPC, but it does not help in increasing the resilience of the application or its internet access in this case.
- Amazon Aurora: Aurora MySQL is a highly available and scalable database service. However, the current application is using RDS for MySQL, and migrating to Aurora might not be necessary unless there are specific needs like improved performance and scalability.
- Auto Scaling Group: Launching instances across all subnets in the VPC is a good approach to ensure multi-AZ deployments, but the use of a Virtual Private Gateway does not add value here.
- Rejected: The replacement of the NAT gateway with a Virtual Private Gateway is unnecessary for this specific scenario and introduces complexity. Aurora, while power...
Author: Sofia · Last updated Jul 6, 2026
A company is planning to migrate its on-premises transaction-processing application to AWS. The application runs inside Docker containers that are hosted on VMs in the company's data center. The Docker containers have shared storage where the application records transaction data.
The transactions are time sensitive. The volume of transactions inside the application is unpredictable. The company must implement a low-latency storage solution that will automatically scale throughput to meet incr...
The goal is to migrate the company's transaction-processing application to AWS while addressing the need for low-latency, scalable storage that can automatically scale throughput to meet increased demand. The company also needs to eliminate the need to continue administering the Docker hosting environment and cannot develop the application further. Let’s evaluate each option:
A) Migrate the containers that run the application to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon S3 to store the transaction data that the containers share.
- Reasoning:
- Amazon EKS: Amazon EKS can be used to run Docker containers in a managed Kubernetes environment. However, Kubernetes introduces complexity, especially for companies that do not want to continue administering the Docker hosting environment. Kubernetes requires ongoing maintenance and management, which is against the requirement to simplify operations.
- Amazon S3: While Amazon S3 is a scalable storage service, it is not a good fit for time-sensitive transactional data. S3 is designed for object storage and is not optimized for low-latency, high-performance access required by transaction-processing applications.
- Rejected: This option is not suitable because EKS introduces unnecessary complexity, and S3 is not ideal for low-latency transactional storage.
B) Migrate the containers that run the application to AWS Fargate for Amazon Elastic Container Service (Amazon ECS). Create an Amazon Elastic File System (Amazon EFS) file system. Create a Fargate task definition. Add a volume to the task definition to point to the EFS file system.
- Reasoning:
- AWS Fargate: Fargate is a serverless compute engine that can run containers without the need to manage the underlying infrastructure, making it a good choice for the company’s requirement to eliminate administration overhead.
- Amazon EFS: Amazon Elastic File System (EFS) is a scalable, low-latency file system that can be mounted across multiple instances. It scales automatically based on usage and provides a shared file system that can be accessed by multiple containers. EFS supports high throughput and is well-suited for applications that require low-latency file access, such as the transaction-processing application described.
- Scalability: EFS automatically scales in throughput as data grows, meeting the requirement for unpredictable tr...
Author: Vivaan · Last updated Jul 6, 2026
A company is planning to migrate to the AWS Cloud. The company hosts many applications on Windows servers and Linux servers. Some of the servers are physical, and some of the servers are virtual. The company uses several types of databases in its on-premises environment. The company does not have an accurate inventory of its on-premises servers and applications.
The company wants to rightsize its resources during migration. A solutions architect needs to obtain information about the network connections and the application r...
To choose the most appropriate solution for the company’s migration assessment, the solutions architect needs to understand the network connections, application relationships, and details of the current infrastructure. Let’s evaluate the options based on these requirements:
Option A: Use Migration Evaluator to request an evaluation of the environment from AWS. Use the AWS Application Discovery Service Agentless Collector to import the details into a Migration Evaluator Quick Insights report.
- Pros:
- Migration Evaluator helps with cost analysis and resource optimization for the migration.
- The Agentless Collector provides a lightweight way to gather server and application data without installing agents.
- This option is good for high-level insights into the infrastructure.
- Cons:
- It focuses more on cost optimization and inventorying the environment for analysis, but it does not provide in-depth relationship mapping of applications and network connections.
- This might not be enough for detailed application dependencies or complex migration planning.
Why rejected: While useful for high-level insights, this option may lack the deeper application relationship and network connection analysis needed for migration planning.
Option B: Use AWS Migration Hub and install the AWS Application Discovery Agent on the servers. Deploy the Migration Hub Strategy Recommendations application data collector. Generate a report by using Migration Hub Strategy Recommendations.
- Pros:
- AWS Application Discovery Agent provides detailed insights into on-premises servers, applications, and their dependencies.
- It helps gather real-time performance metrics and network connections for migration.
- The Migration Hub Strategy Recommendations tool uses this data to provide detailed migration recommendations, including rightsizing suggestions.
- Cons:
- Installing agents on all the servers requires more effort and may not be ideal if the company’s environment includes physical or non-standard systems.
- It can take time to gather and process the data, especially in large environments.
Why rejected: While this is a comprehensive approach, the need for agent installation on all servers might not be feasible, especially for physical systems or where minimal interruption is critical.
Option C: Use AWS Migration Hub and run the AWS Application Discovery Servic...
Author: IronLion88 · Last updated Jul 6, 2026
A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are managed in an organization in AWS Organizations. The SaaS platform uses many AWS resources globally.
For regulatory compliance, all API calls to AWS resources must be a...
To meet the requirements of auditing, tracking changes, and storing logs in a secure and durable manner for the SaaS platform running on AWS, we need a solution that minimizes operational overhead and meets the regulatory compliance needs. Let's evaluate the options based on the criteria of durability, security, operational simplicity, and scalability.
Option A: Create a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization's management account to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 bucket.
- Pros:
- Centralized management of logs in the management account, reducing overhead in managing multiple accounts.
- Encryption and MFA delete add security and protection for the logs.
- CloudTrail in all regions ensures comprehensive tracking of API calls across AWS services.
- Cons:
- While it uses an existing S3 bucket in the management account, the logs from multiple accounts are stored in the same bucket, potentially complicating access management and separation of logs by account.
- There may be concerns about cross-account access permissions if not configured carefully, especially with a large number of accounts.
Why rejected: Although this option is simple and reduces operational overhead by centralizing the logs, the potential complexity of managing permissions and the shared bucket across multiple accounts makes it less optimal for large, multi-account environments.
Option B: Create a new AWS CloudTrail trail in each member account of the organization. Create new Amazon S3 buckets to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 buckets.
- Pros:
- Dedicated S3 buckets per member account for logs, improving isolation and access control.
- Centralized trail configuration with multi-region deployment ensures comprehensive API call auditing.
- Cons:
- Requires creating and managing CloudTrail trails in each member account, leading to higher operational overhead.
- Each account would require individual configuration and maintenance of S3 buckets for log storage, increasing complexity in managing the entire solution.
- Scaling this approach would require significant operational effort as the number of accounts increases.
Why rejected: This option involves high operational overhead due to the need to configure CloudTrail trails and S3 buckets for each account. For large organizations, managing multiple trails and storage buckets could become cumbersome and error-prone.
Option C: Create a new AWS CloudTrail trail in the organization's management account. Create a new Amazon S3 bucket with versioning turned on to store the logs. Deploy the trail fo...
Author: Joseph · Last updated Jul 6, 2026
A company is deploying a distributed in-memory database on a fleet of Amazon EC2 instances. The fleet consists of a primary node and eight worker nodes. The primary node is responsible for monitoring cluster health, accepting user requests, distributing user requests to worker nodes, and sending an aggregate response back to a client. Worker nodes communicate with each other to repl...
To meet the company's requirements of deploying a distributed in-memory database with the lowest possible networking latency and maximum performance, the selection of the appropriate EC2 instance placement group is crucial. The key considerations include:
- Networking latency: The communication between the primary node and worker nodes, as well as between worker nodes themselves, needs to be as fast as possible to minimize delays in data replication and request handling.
- Cluster configuration: The fleet consists of a primary node and worker nodes, where worker nodes need to replicate data partitions with low latency.
- Performance optimization: The system requires maximum performance, particularly in terms of network performance for in-memory operations.
Now let's evaluate the options:
Option A: Launch memory-optimized EC2 instances in a partition placement group.
- Reasoning: A partition placement group spreads instances across multiple logical partitions in different hardware, reducing the risk of simultaneous failure but may introduce increased networking latency between partitions.
- Networking latency: The partition placement group is optimized for high availability, but it does not guarantee low latency between instances since instances in different partitions may experience higher network latency compared to those within the same partition.
- Why Rejected: While partition placement groups offer redundancy and fault tolerance, they are not optimal for low-latency, high-performance networking, which is required in this scenario for in-memory databases.
Option B: Launch compute-optimized EC2 instances in a partition placement group.
- Reasoning: This is similar to Option A but with compute-optimized instances. Compute-optimized instances are designed for compute-heavy workloads, but this use case is more focused on low-latency network communication.
- Networking latency: Similar to Option A, partition placement groups may not provide the low-latency, high-throughput network performance needed for the distributed in-memory database.
- Why Rejected: While compute-optimized instances may provide better compute performance...
Author: Amelia · Last updated Jul 6, 2026
A company maintains information on premises in approximately 1 million.csv files that are hosted on a VM. The data initially is 10 TB in size and grows at a rate of 1 TB each week. The company needs to automate backups of the data to the AWS Cloud.
Backups of the data must occur daily. The company needs a solution that applies custom filters to back up only a subset of the data that is located in de...
To meet the backup requirements with the least operational overhead, we need to consider factors such as automation, efficiency, ease of implementation, scalability, and filtering capabilities. Let's evaluate each option based on the specific requirements:
Key Requirements:
- Automated daily backups.
- Custom filtering to back up only a subset of data.
- High operational efficiency and minimal manual intervention.
- Scalability to handle data that grows by 1 TB per week.
- Direct Connect is available for high-speed data transfer.
Option A: Use the Amazon S3 CopyObject API operation with multipart upload to copy the existing data to Amazon S3. Use the CopyObject API operation to replicate new data to Amazon S3 daily.
- Reasoning: The CopyObject API can copy files between S3 buckets and allows multipart uploads for large files. However, this approach is not ideal for a daily incremental backup of a large dataset.
- Challenges:
- Manual effort: The CopyObject API does not provide native automation for incremental backups, filtering, or scheduling, so you would have to write custom scripts and logic.
- Lack of filtering: Custom filtering would require complex logic in the script to process and selectively copy data, making this solution harder to maintain and error-prone.
- Operational overhead: While technically feasible, this solution requires substantial custom development for automation, making it operationally more intensive.
- Why Rejected: The custom nature of this solution, combined with the manual effort required to implement filtering and scheduling, makes it less efficient for a large, continuously growing dataset.
Option B: Create a backup plan in AWS Backup to back up the data to Amazon S3. Schedule the backup plan to run daily.
- Reasoning: AWS Backup is a fully managed service designed to automate the backup of data. However, it is primarily intended for backing up AWS resources like EC2 instances, RDS databases, and EFS file systems. It doesn't natively support fine-grained filtering of specific files or directories on an on-premises VM.
- Challenges:
- Lack of filtering: AWS Backup does not provide a built-in method to apply custom filters for backing up specific files or directories. Therefore, it's not well-suited to the company's need to back up only a subset of data from specific directories.
- No native support for VM data: AWS Backup is not optimized for copying large volumes of data directly from an on-premises VM without significant setup or integration, which would add complexity.
- Why Rejected: While AWS Backup is a managed service, it lacks the required filtering and direct support for backing up specific on-premises data at the file level. Thus, it wouldn't be able to meet the specific requirements effectively.
Option C: Install the AWS Dat...
Author: Harper · Last updated Jul 6, 2026
A financial services company has an asset management product that thousands of customers use around the world. The customers provide feedback about the product through surveys. The company is building a new analytical solution that runs on Amazon EMR to analyze the data from these surveys. The following user personas need to access the analytical solution to perform different actions:
* Administrator: Provisions the EMR cluster for the analytics team based on the team's requirements
* Data engineer: Runs ETL scripts to process, transform, and enrich the datasets
* Data analyst: Runs SQL and Hive queries on the data
A solutions architect must ensure that all the user person...
To meet the company's requirements of ensuring least privilege access, approval of authorized applications, and resource tagging for all user personas accessing the analytical solution, we need a solution that both enforces fine-grained access control and integrates resource management effectively.
Let’s evaluate each option in detail:
Option A: Create IAM roles for each user persona. Attach identity-based policies to define which actions the user who assumes the role can perform. Create an AWS Config rule to check for noncompliant resources. Configure the rule to notify the administrator to remediate the noncompliant resources.
- Reasoning: This approach uses IAM roles to enforce least privilege access by attaching identity-based policies, specifying actions that each user persona can perform (administrator, data engineer, data analyst). It also incorporates AWS Config to monitor compliance and notify administrators about noncompliant resources.
- Benefits:
- Granular access control: IAM roles provide fine-grained control over the actions each persona can take.
- Compliance monitoring: AWS Config ensures that resources remain compliant, such as ensuring the correct tags are applied.
- Least privilege: This approach directly supports the principle of least privilege, ensuring each user persona only has access to the necessary resources.
- Challenges: While this option provides good access control and monitoring, it does not specifically handle controlling the applications that the user personas can launch, which is a key requirement.
- Why Rejected: Although the access control and monitoring aspects are strong, the lack of direct application control (i.e., restricting the ability to launch unauthorized applications) means that this solution doesn’t fully meet the requirements.
Option B: Set up Kerberos-based authentication for EMR clusters upon launch. Specify a Kerberos security configuration along with cluster-specific Kerberos options.
- Reasoning: Kerberos-based authentication adds a layer of security for accessing the EMR cluster, allowing only authorized users to authenticate.
- Benefits:
- Security: Provides robust authentication and authorization for users accessing the EMR cluster.
- Challenges:
- Not addressing least privilege: While Kerberos ensures secure access to the cluster, it does not directly address least privilege access across various user personas or control what applications can be launched.
- Doesn’t meet tagging requirements: This solution doesn't ensure that resources are tagged or meet other specific access control requirements outlined in the question.
- Why Rejected: Kerberos is useful for securing access to EMR clusters, but it doesn’t provide comprehensive access control for other resources or ensure resource tagging. It’s also not an efficient way to manage application launch restrictions or the least privilege access required by the user personas.
Option C: Use AWS Service Catalog to control the Amazon EMR versions available for deployment, the cluster configuration, an...
Author: Ella · Last updated Jul 6, 2026
A software as a service (SaaS) company uses AWS to host a service that is powered by AWS PrivateLink. The service consists of proprietary software that runs on three Amazon EC2 instances behind a Network Load Balancer (NLB). The instances are in private subnets in multiple Availability Zones in the eu-west-2 Region. All the company's customers are in eu-west-2.
However, the company now acquires a new customer in the us-east-1 Region. The company creates a new VPC and new subnets in us-east-1. The company establishes inter-Region VPC peering betw...
Reasoning
The goal is to provide access to a SaaS service that runs in the eu-west-2 Region (with EC2 instances behind a Network Load Balancer, NLB), while the new customer is located in the us-east-1 Region. The company does not want to deploy new EC2 instances in us-east-1 but needs to provide access to the service from the new customer's VPC.
Let's review the options and their suitability based on the requirements:
Option A: Configure a PrivateLink endpoint service in us-east-1 to use the existing NLB in eu-west-2.
- Pros:
- PrivateLink can be used to securely connect VPCs across different regions.
- The existing NLB in eu-west-2 is leveraged, meaning no new EC2 resources are needed in us-east-1.
- Cons:
- Directly configuring PrivateLink endpoint service in us-east-1 to use an NLB in eu-west-2 is not directly supported because PrivateLink is region-specific and it does not allow cross-region NLB usage. Each region's PrivateLink endpoint service can only use resources in that region.
Conclusion: This option cannot be used due to region limitations of PrivateLink endpoints.
Option B: Create an NLB in us-east-1. Create an IP target group using the IP addresses of the EC2 instances in eu-west-2 that host the SaaS service.
- Pros:
- The solution involves creating an NLB in us-east-1 and configuring a target group with IP addresses of instances in eu-west-2.
- The cross-region routing is feasible here as PrivateLink supports targeting services across regions via IP addresses.
- Cons:
- You need to ensure the EC2 instances in eu-west-2 are reachable via their private IP addresses, which requires careful management of security groups and routing.
- The NLB in us-east-1 will rely on IP-based routing, which might introduce complexi...
Author: Alexander · Last updated Jul 6, 2026
A company needs to monitor a growing number of Amazon S3 buckets across two AWS Regions. The company also needs to track the percentage of objects that are encrypted in Amazon S3. The company needs a dashboard to display this information for inte...
Let's evaluate each option based on the requirements and constraints:
Key Requirements:
1. Monitor multiple S3 buckets across two AWS regions.
2. Track the percentage of objects that are encrypted.
3. Provide a dashboard for internal compliance teams to display the metrics.
4. Minimize operational overhead.
Option Evaluation:
A) Create a new 3 Storage Lens dashboard in each Region to track bucket and encryption metrics. Aggregate data from both Region dashboards into a single dashboard in Amazon QuickSight for the compliance teams.
- Pros: AWS S3 Storage Lens can track encryption metrics and other S3 usage statistics out of the box. This solution would allow for monitoring across regions and aggregating data into a single dashboard using Amazon QuickSight.
- Cons: S3 Storage Lens would need to be set up separately in each region, leading to some operational overhead in managing multiple dashboards. However, this is relatively minimal compared to the alternatives.
- Conclusion: This solution is practical, uses native AWS services with low overhead, and provides an easy way to visualize the metrics in QuickSight. It's a solid choice for the least operational overhead, as it leverages AWS managed services.
B) Deploy an AWS Lambda function in each Region to list the number of buckets and the encryption status of objects. Store this data in Amazon S3. Use Amazon Athena queries to display the data on a custom dashboard in Amazon QuickSight for the compliance teams.
- Pros: This approach involves using Lambda to gather data, S3 to store it, and Athena to query it, which offers flexibility.
- Cons: This solution requires significant custom development and management of Lambda functions, S3 storage, and Athena queries. It would involve more operational overhead, including managing the Lambda functions, ensuring they run correctly, and maintaining the data pipeline. Additionally, building custom queries and dashboards in QuickSight requires extra effort.
- Conclusion: This option introduces unnecessary complexity and operational overhead for what is a straightforward requirement, making it less optimal....
Author: Ravi Patel · Last updated Jul 6, 2026
A company's CISO has asked a solutions architect to re-engineer the company's current CI/CD practices to make sure patch deployments to its application can happen as quickly as possible with minimal downtime if vulnerabilities are discovered. The company must also be able to quickly roll back a change in case of errors.
The web application is deployed in a fleet of Amazon EC2 instances behind an Application Load Balancer. The company is currently using GitHub to host the application source code, and has configured an AWS...
Key Requirements:
1. Quick patch deployments: The system should allow for fast deployments of patches when vulnerabilities are discovered.
2. Minimal downtime: The deployment process should ensure that the application experiences as little downtime as possible.
3. Rollback capability: The ability to quickly roll back a deployment in case of errors is critical.
4. Current architecture: The application is hosted on a fleet of EC2 instances behind an Application Load Balancer (ALB).
5. Existing tools: The company already uses AWS CodePipeline to trigger builds from GitHub and uses AWS CodeBuild for building the application.
Option Analysis:
A) Configure CodePipeline with a deploy stage using AWS CodeDeploy configured for in-place deployment. Monitor the newly deployed code, and, if there are any issues, push another code update.
- Pros:
- In-place deployments with AWS CodeDeploy update the existing EC2 instances without replacing them, which allows for quicker patching.
- Fast deployment of updates, as only the EC2 instances need to be updated.
- Can still roll back in case of failures, but this process can take longer compared to blue/green deployments.
- Cons:
- Downtime may occur during the in-place deployment process, particularly if the application is not designed to be highly available during updates.
- Rollback would be possible, but it may involve redeploying the previous version of the code.
- Conclusion: This solution meets the requirement of fast patching and rollback but is not ideal for minimizing downtime during deployments, especially in a scenario where high availability is crucial.
B) Configure CodePipeline with a deploy stage using AWS CodeDeploy configured for blue/green deployments. Monitor the newly deployed code, and, if there are any issues, trigger a manual rollback using CodeDeploy.
- Pros:
- Blue/green deployments provide zero-downtime deployments by maintaining two separate environments (blue and green).
- New code is deployed to the green environment, tested, and then traffic is shifted to it. If any issues arise, traffic can quickly be shifted back to the blue environment.
- Rollback is as simple as shifting traffic back to the blue environment, offering minimal downtime.
- Allows for fast deployment and patching, while ensuring high availability.
- Cons:
- Manual rollback requires intervention from the team if issues are detected. However, this is generally a minimal overhead since the rollback action is simple and quick.
- Conclusion: This is the be...
Author: Ethan · Last updated Jul 6, 2026
A company is managing many AWS accounts by using an organization in AWS Organizations. Different business units in the company run applications on Amazon EC2 instances. All the EC2 instances must have a BusinessUnit tag so that the company can track the cost for each business unit.
A recent audit revealed that some instances were missing this tag....
Reasoning
The company has a requirement that all EC2 instances must have a BusinessUnit tag for cost tracking purposes. The goal is to enforce this tagging requirement moving forward to avoid issues like the recent audit finding that instances were missing this tag. We need to evaluate the options available for ensuring that this tagging policy is consistently applied across all accounts in the organization.
Option A: Enable tag policies in the organization. Create a tag policy for the BusinessUnit tag. Ensure that compliance with tag key capitalization is turned off. Implement the tag policy for the ec2:instance resource type. Attach the tag policy to the root of the organization.
- Pros:
- Tag policies allow the company to define rules for tags and enforce them across all accounts in the organization.
- By creating a tag policy specifically for the BusinessUnit tag, the company can enforce consistent tagging across all EC2 instances.
- Attaching the policy to the root of the organization means it will apply to all accounts in the organization.
- Cons:
- Turning off compliance with tag key capitalization means that the tag may not strictly be enforced for capitalization, which can lead to inconsistencies in the way the tag is applied (e.g., "businessunit" vs. "BusinessUnit").
Conclusion: This option is a valid choice but the lack of capitalization enforcement could cause tagging inconsistencies.
Option B: Enable tag policies in the organization. Create a tag policy for the BusinessUnit tag. Ensure that compliance with tag key capitalization is turned on. Implement the tag policy for the ec2:instance resource type. Attach the tag policy to the organization's management account.
- Pros:
- By enforcing capitalization compliance, this ensures that the BusinessUnit tag is consistently applied with the correct case across all EC2 instances.
- The tag policy applied at the management account level will ensure that it is enforced across...
Author: Andrew · Last updated Jul 6, 2026
A company is running a workload that consists of thousands of Amazon EC2 instances. The workload is running in a VPC that contains several public subnets and private subnets. The public subnets have a route for 0.0.0.0/0 to an existing internet gateway. The private subnets have a route for 0.0.0.0/0 to an existing NAT gateway.
A solutions architect needs to migrate the entire fleet of EC2 instances to...
Key Requirements:
1. Migrate to IPv6: The company needs to migrate its EC2 instances to use IPv6 addresses.
2. Private subnet isolation: EC2 instances in private subnets must not be accessible from the public internet.
3. Public and Private Subnet Routes: The public subnets have routes to the internet through the existing internet gateway, and private subnets use a NAT gateway for internet access. This setup needs to support IPv6 while maintaining the security of the private subnets.
Option Evaluation:
A) Update the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets. Update all the VPC route tables, and add a route for ::/0 to the internet gateway.
- Pros:
- Custom IPv6 CIDR block can be associated with the VPC and subnets, which allows flexibility in IP address assignment.
- The route for `::/0` in the internet gateway is valid for public subnets, allowing instances in public subnets to access the internet via IPv6.
- Cons:
- This solution does not address the requirement for private subnets. Adding `::/0` to the internet gateway would expose the EC2 instances in the private subnets to the internet via IPv6, which contradicts the requirement that private subnets must not be accessible from the public internet.
- Conclusion: This option is rejected because it would expose the private subnets to the internet.
B) Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and all subnets. Update the VPC route tables for all private subnets, and add a route for ::/0 to the NAT gateway.
- Pros:
- The Amazon-provided IPv6 CIDR block is a standard approach for assigning IPv6 addresses to the VPC.
- The NAT gateway is already in place for the private subnets, and the addition of the `::/0` route to the NAT gateway allows IPv6 traffic to flow from private subnets to the internet.
- Cons:
- NAT gateways do not support IPv6. A NAT gateway can only handle IPv4 traffic, so adding a route for IPv6 traffic (`::/0`) to the NAT gateway would not work.
- Conclusion: This option is rejected because NAT gateways do not support IPv6.
C) Update the exi...
Author: IronLion88 · Last updated Jul 6, 2026
A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The company deploys the API successfully. However, the API is not accessible from an Amazon E...
To solve the issue of providing connectivity between the Amazon EC2 instance in a VPC and the private REST API deployed via Amazon API Gateway, the selected solution needs to establish a secure, internal route to access the API within the VPC. Let's go through the options and evaluate which is the most appropriate.
Option A: Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows `apigateway:` actions. Disable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC. Use the VPC endpoint's DNS name to access the API.
- Explanation: This option involves setting up a VPC endpoint for API Gateway and disabling private DNS naming. However, disabling private DNS would prevent the API from being accessible using the typical API Gateway domain name (i.e., `execute-api.<region>.amazonaws.com`), which could be problematic because it would require manual DNS configuration and could complicate the setup.
- Rejection Reason: Disabling private DNS naming complicates the process by requiring custom DNS configurations, and it isn't as seamless or scalable as using private DNS.
Option B: Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows the `execute-api:Invoke` action. Enable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint's DNS names to access the API.
- Explanation: This option allows seamless connectivity with private DNS enabled. The private DNS naming ensures that the EC2 instance in the VPC can access the API through the standard API Gateway endpoint without requiring custom DNS configuration. This option uses the `execute-api:Invoke` action, which is necessary to call the API, and attaches an appropriate endpoint...
Author: Zara · Last updated Jul 6, 2026
A large payroll company recently merged with a small staffing company. The unified company now has multiple business units, each with its own existing AWS account.
A solutions architect must ensure that the company can centrally manage the billing and access policies for all the AWS accounts. The solutions architect configures AWS Organizations by sending an invi...
To meet the requirement of centrally managing billing and access policies for all AWS accounts in a unified company, a solution needs to provide both centralized management and secure, flexible access between accounts. After configuring AWS Organizations and sending invitations to all member accounts, the next step is to establish a way for the centralized management account (the root of the AWS Organization) to manage and control access to member accounts. Let’s review each option and determine which one best fits the scenario.
Option A: Create the OrganizationAccountAccess IAM group in each member account. Include the necessary IAM roles for each administrator.
- Explanation: This option suggests creating an IAM group in each member account and adding necessary IAM roles. While this setup could provide some level of organization, it doesn’t directly address the need for centralized access management from the management account (which is typically required when managing multiple AWS accounts under an organization). Managing access in each member account independently can lead to complexity and doesn’t leverage AWS Organizations’ centralized access management capabilities.
- Rejection Reason: The solution is not central enough and requires manual configuration in each member account, making it harder to manage at scale.
Option B: Create the OrganizationAccountAccessPolicy IAM policy in each member account. Connect the member accounts to the management account by using cross-account access.
- Explanation: This option involves creating a specific IAM policy in each member account to allow cross-account access. While cross-account access is a valid method to enable access, the use of a specific IAM policy in each account could be cumbersome and complex to manage, especially when scaling to many accounts. It also doesn’t make use of the built-in AWS Organizations roles and policies for centralized access...
Author: VioletCheetah55 · Last updated Jul 6, 2026
A company has application services that have been containerized and deployed on multiple Amazon EC2 instances with public IPs. An Apache Kafka cluster has been deployed to the EC2 instances. A PostgreSQL database has been migrated to Amazon RDS for PostgreSQL. The company expects a significant increase of orders on its platform when a new versi...
In this scenario, the company needs to prepare its architecture for a significant increase in orders, which requires improving scalability, reducing operational overhead, and ensuring that resources can dynamically handle increased traffic and load. Let's evaluate each option based on these requirements.
Option A: Create an EC2 Auto Scaling group behind an Application Load Balancer. Create additional read replicas for the DB instance. Create Amazon Kinesis data streams and configure the application services to use the data streams. Store and serve static content directly from Amazon S3.
- Explanation:
- EC2 Auto Scaling: This provides horizontal scaling to manage increased traffic.
- Read Replicas for DB: This helps offload read traffic, but doesn’t improve write performance or availability.
- Kinesis Data Streams: While Kinesis can handle high throughput and real-time data streaming, it is an over-complication for just increasing application scalability. It would be more useful for use cases involving event-driven processing or streaming data, not necessarily for handling increased orders in this case.
- Static Content in S3: Storing static content in S3 reduces the burden on EC2 instances, but it’s less relevant for the specific goal of scaling the application backend itself.
- Rejection Reason: Kinesis is not the best fit for this architecture and adds unnecessary complexity. The rest of the changes are useful, but it misses some optimizations, such as database high availability and containerized service scaling.
Option B: Create an EC2 Auto Scaling group behind an Application Load Balancer. Deploy the DB instance in Multi-AZ mode and enable storage auto scaling. Create Amazon Kinesis data streams and configure the application services to use the data streams. Store and serve static content directly from Amazon S3.
- Explanation:
- EC2 Auto Scaling: Same benefit as option A, providing scalability for application services.
- Multi-AZ Deployment for DB: This ensures high availability and failover capability for the database, which is important during high traffic periods.
- Storage Auto Scaling: Automatically increases storage as needed for the database, which is important to prevent capacity issues during high load.
- Kinesis Data Streams: Again, Kinesis adds unnecessary complexity for this use case, as it is not needed to handle increased orders in the application directly.
- Static Content in S3: Good for offloading static content but doesn’t contribute to the backend scalability of the services.
- Rejection Reason: While Multi-AZ deployment is a good addition, the use of Kinesis is still overkill, and it doesn't address the need for containerized services that would scale efficiently and flexibly.
Option C: Deploy the application on a Kubernetes cluster created on the EC2 instances behind an Application Load ...
Author: Aarav · Last updated Jul 6, 2026
A company hosts a VPN in an on-premises data center. Employees currently connect to the VPN to access files in their Windows home directories. Recently, there has been a large growth in the number of employees who work remotely. As a result, bandwidth usage for connections into the data center has begun to reach 100% during business hours.
The company must design a solution on AWS that will support the growth of the company's remote workforce, reduce th...
To support the growth of the company's remote workforce while reducing bandwidth usage for connections into the on-premises data center and minimizing operational overhead, we need to focus on solutions that provide scalable, managed, and efficient ways to access files and reduce the reliance on the on-premises infrastructure. Let's review each option:
Option A: Create an AWS Storage Gateway Volume Gateway. Mount a volume from the Volume Gateway to the on-premises file server.
- Explanation: An AWS Storage Gateway can be used to integrate on-premises environments with cloud storage. The Volume Gateway specifically allows you to present iSCSI-based volumes to on-premises servers. This solution would help in extending on-premises storage to AWS but would still rely on the on-premises file server, and doesn't inherently reduce the bandwidth usage for remote workers accessing files.
- Rejection Reason: While this solution helps integrate on-premises data with cloud storage, it doesn’t directly address the problem of supporting remote users or reducing operational overhead. The reliance on on-premises infrastructure and the need for further management still exists.
Option B: Migrate the home directories to Amazon FSx for Windows File Server.
- Explanation: Amazon FSx for Windows File Server provides a fully managed, highly available, and scalable file storage solution that is compatible with the SMB protocol. By migrating the home directories to Amazon FSx, remote workers can access their files directly in the cloud, reducing the need to connect to the on-premises data center. This will significantly reduce bandwidth usage for VPN connections while improving scalability.
- Reason for selection: FSx for Windows File Server is an excellent choice for managing Windows file storage in the cloud, reducing operational overhead by removing the need for maintaining an on-premises file server. It directly addresses the requirement to scale efficiently for remote users.
Option C: Migrate the home directories to Amazon FSx for Lustre.
- Explanation: FSx for Lustre is optimized fo...
Author: Elijah · Last updated Jul 6, 2026
A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances.
A solutions architect must encrypt the unencrypted volumes and ensure that unencrypted volumes will be detected automatically in the future. Additionally, the company wants a solution that can centrally mana...
Reasoning
The company needs to encrypt unencrypted Amazon Elastic Block Store (EBS) volumes, automatically detect any unencrypted volumes in the future, and manage the security and compliance of multiple AWS accounts centrally. The options provided involve both manual and automated solutions to meet these requirements. Let’s evaluate each option to identify the most suitable combination for meeting the company’s needs.
Option A: Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the strongly recommended controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
- Pros:
- AWS Control Tower provides a centralized way to manage security and compliance across multiple AWS accounts.
- Guardrails are security and compliance rules that can help ensure best practices, including encryption.
- Categorizing accounts into organizational units (OUs) helps organize accounts by function or department, which is useful for governance.
- Cons:
- This option does not specifically address the task of detecting and encrypting unencrypted volumes directly. While AWS Control Tower helps with central management, it does not perform encryption tasks automatically.
Conclusion: This option is useful for central management, governance, and compliance but does not directly address the encryption task. It should be combined with other solutions to fully meet the requirements.
Option B: Use the AWS CLI to list all the unencrypted volumes in all the AWS accounts. Run a script to encrypt all the unencrypted volumes in place.
- Pros:
- The AWS CLI can be used to list and manage unencrypted volumes across multiple accounts. A script could automate the process of encrypting those volumes.
- This approach offers flexibility in handling specific volumes directly.
- Cons:
- Manual effort: This approach is not automated and would require periodic scripts to run, making it harder to scale across multiple accounts. It's also prone to errors if not carefully managed.
- It does not address ongoing detection of unencrypted volumes in the future.
Conclusion: While it could be used to handle the initial encryption of unencrypted volumes, this approach is manual, lacks scalability, and does not provide a continuous compliance solution. Therefore, it is not a recommended approach.
Option C: Create a snapshot of each unencrypted volume. Create a new encrypted volume from the unencrypted snapshot. Detach the existing volume, and replace it with the encrypted volume.
- Pros:
- This approach encrypts existing unencrypted volumes ...
Author: Ella · Last updated Jul 6, 2026
A company hosts an intranet web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Currently, users authenticate to the application against an internal user database.
The company needs to authenticate users to the application by using an existing AWS Directory Service for Microsoft Active Direc...
To meet the requirement of authenticating users to an intranet web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB) using an existing AWS Directory Service for Microsoft Active Directory, we need to examine the provided options and select the most appropriate solution based on key factors such as compatibility with AWS Directory Service, ease of integration, and security considerations.
Option Analysis
A) Create a new app client in the directory. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule. Configure the listener rule with the appropriate issuer, client ID and secret, and endpoint details for the Active Directory service. Configure the new app client with the callback URL that the ALB provides.
- Analysis: This option is not suitable because it suggests using an OpenID Connect (OIDC) configuration for authentication against Active Directory. However, AWS Directory Service for Microsoft Active Directory does not natively support OIDC, which means the authentication will not work out-of-the-box without complex integration.
- Rejected because: The directory service does not natively support OIDC and requires additional configuration steps to make this work.
B) Configure an Amazon Cognito user pool. Configure the user pool with a federated identity provider (IdP) that has metadata from the directory. Create an app client. Associate the app client with the user pool. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule. Configure the listener rule to use the user pool and app client.
- Analysis: This is a strong option because it uses Amazon Cognito to integrate with the existing Active Directory. Amazon Cognito supports federating identities from a variety of identity providers (IdPs), including Active Directory. By integrating with Cognito, we can offload the authentication logic to AWS and easily configure the ALB to authenticate users using the Cognito user pool.
- Accepted because: Cognito provides a direct and scalable way to manage federated authentication, and th...
Author: Suresh · Last updated Jul 6, 2026
A company has a website that serves many visitors. The company deploys a backend service for the website in a primary AWS Region and a disaster recovery (DR) Region.
A single Amazon CloudFront distribution is deployed for the website. The company creates an Amazon Route 53 record set with health checks and a failover routing policy for the primary Region's backend service. The company configures the Route 53 record set as an origin for the CloudFront distribution. The company configures another record set that points to the backend service's endpoint in the DR Region as a seco...
To optimize failover time for the website's backend service, the solution must minimize the time it takes for CloudFront and Route 53 to route traffic to the disaster recovery (DR) Region once the primary Region becomes unavailable. Let's evaluate the options:
Option A: Deploy an additional CloudFront distribution.
This option involves creating a second CloudFront distribution and configuring Route 53 with health checks and failover records for both distributions. However, this approach would introduce unnecessary complexity by deploying a second CloudFront distribution. It does not necessarily improve failover time and could add overhead in managing two distributions instead of utilizing CloudFront’s existing capabilities for failover.
Option B: Set the TTL to 4 seconds for the existing Route 53 record sets.
Reducing the TTL (time-to-live) for the Route 53 record sets to a lower value like 4 seconds will make DNS failover quicker because DNS resolution will occur more frequently. However, DNS caching at both the client side and intermediary servers might still delay failover, especially if they respect a longer TTL or cache entries for more than 4 seconds. Additionally, this doesn't directly address the failover behavior between CloudFront and backend services. It focuses on DNS resolution but doesn't optimize the CloudFront failover process.
Option C: Create new record sets for the backend services using a latency...
Author: Ella · Last updated Jul 6, 2026
A company is using multiple AWS accounts and has multiple DevOps teams running production and non-production workloads in these accounts. The company would like to centrally-restrict access to some of the AWS services that the DevOps teams do not use. The company decided to use AWS Organizations and successfully invited all AWS accounts into the Organization. They would like to allow access to services that are currently in-use and deny a few specific ser...
To address the requirements of restricting access to certain AWS services while managing multiple AWS accounts as a unit, the company can leverage AWS Organizations and service control policies (SCPs). Let's evaluate the options:
Option A: Use a Deny list strategy.
A Deny list strategy is effective for restricting access to a small number of services by explicitly denying those services in an SCP. By using SCPs, you can define a set of services that should not be accessible to the DevOps teams. This is a good approach when the company has a known list of services that need to be denied access. The Deny list strategy will restrict access to the services that the teams should not use, while allowing access to others.
Why this option is selected: It directly aligns with the requirement to deny access to specific services while allowing the others to remain available. This approach is flexible and works well in AWS Organizations.
Option B: Review the Access Advisor in AWS IAM to determine services recently used.
The Access Advisor in AWS IAM provides insights into which services IAM roles or users have accessed recently. While this can be useful for auditing and determining which services have been used in the past, it is not a practical tool for directly managing or restricting access to services. It does not directly help in applying access control to services in AWS Organizations.
Why this option is rejected: The Access Advisor is useful for monitoring, but it does not facilitate enforcing restrictions through SCPs. It’s not suited for the proactive management of service access at the organizational level.
Option C: Review the AWS Trusted Advisor report to determine services recently used.
AWS Trusted Advisor provides insights on best practices but mainly focuses on cost optimization, security, fault tolerance, and performance. It doesn’t specifically focus on providing detailed reports on which services have been recently used or granting or denying access to services. Trusted Advisor also doesn’t provide mechanisms for enforcing policies like SCPs.
Why this option is rejected: Trusted Advisor is helpful for optimization and best practices but does not meet the requirement of restricting access to specific services through a central policy.
Option D: Remove the default FullAWSAccess SCP.
By default, AWS Organizations attaches a FullAWSAccess SCP to all accounts, which allows full access to AWS services. Removing this S...
Author: Aditya · Last updated Jul 6, 2026
A live-events company is designing a scaling solution for its ticket application on AWS. The application has high peaks of utilization during sale events. Each sale event is a one-time event that is scheduled. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application uses PostgreSQL for the databas...
To design a scaling solution that maximizes availability during high-traffic sale events for the ticket application, the solution must consider several key factors: the ability to scale the application servers, ensuring database performance under high loads, and efficiently handling automatic scaling. Here’s an analysis of each option:
Option A: Use a predictive scaling policy for the EC2 instances. Host the database on an Amazon Aurora PostgreSQL Serverless v2 Multi-AZ DB instance with automatically scaling read replicas. Create an AWS Step Functions state machine to run parallel AWS Lambda functions to pre-warm the database before a sale event. Create an Amazon EventBridge rule to invoke the state machine.
- Predictive Scaling for EC2: Predictive scaling can be useful to automatically scale the application based on historical usage data. However, it may not be the most reliable for one-time sale events with unpredictable traffic spikes. Predictive scaling typically relies on historical data, and sale events may differ in timing and load.
- Aurora PostgreSQL Serverless v2: Aurora Serverless v2 can automatically scale its compute resources based on demand, making it a good option for variable database load. However, Aurora Serverless is best for workloads with variable demand but may not be suitable for workloads with very high and predictable spikes.
- Pre-warming database using Lambda: Pre-warming the database before a sale is a good approach to ensure it’s ready, but this adds complexity with Step Functions and Lambda functions. Additionally, there’s no mention of handling database failover, which could be critical during high load.
Why this option is rejected: While this setup could work, it’s overly complex, and Aurora Serverless may not provide enough performance for very high, predictable spikes. Also, predictive scaling may not be the best fit for a highly predictable, one-time event.
Option B: Use a scheduled scaling policy for the EC2 instances. Host the database on an Amazon RDS for PostgreSQL Multi-AZ DB instance with automatically scaling read replicas. Create an Amazon EventBridge rule that invokes an AWS Lambda function to create a larger read replica before a sale event. Fail over to the larger read replica. Create another EventBridge rule that invokes another Lambda function to scale down the read replica after the sale event.
- Scheduled Scaling for EC2: A scheduled scaling policy is ideal for predictable events, such as sale events, as it allows scaling based on the specific timing of the event. This ensures that EC2 instances are ready ahead of the sale event, providing the necessary resources.
- RDS for PostgreSQL with Multi-AZ: RDS for PostgreSQL with Multi-AZ ensures high availability, which is important for the database layer during high-traffic events. Scaling read replicas dynamically based on traffic is a good approach for read-heavy workloads.
- Lambda Function for Scaling Read Replica: The Lambda function to scale the read replica before the sale event and scale it down afterward is a practical solution. It ensures the database can handle the additional load without requiring manual intervention.
Why this option is selected: This approach is the most straightforward and well-suited to a one-time, predictable event. The use of scheduled s...
Author: Liam · Last updated Jul 6, 2026
A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution.
The company requires that replication traffic does not travel through the public internet. The application also must not be accessible from the internet. The company does not want this solutio...
To meet the company's requirements of configuring cloud backup with AWS Elastic Disaster Recovery (DR) without replication traffic traveling through the public internet, and ensuring that the application is not accessible from the internet while avoiding excessive bandwidth consumption, the following steps must be considered:
Option A: Create a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.
- Why this is selected: This option aligns with the requirement to prevent replication traffic from traveling through the public internet by setting up a private connection. The use of private subnets and a virtual private gateway ensures that traffic remains within the AWS network, with no exposure to the internet. The NAT gateways are required for outbound internet access if needed, but critical traffic will remain within the private network.
- Why this option is relevant: Ensuring that replication traffic is routed through private subnets and a private connection aligns with the security and performance requirements. The VPC setup with private subnets and the virtual private gateway ensures that replication traffic does not go through the public internet.
Option B: Create a VPC that has at least two public subnets, a virtual private gateway, and an internet gateway.
- Why this is rejected: While this option does provide internet access, it conflicts with the requirement to ensure that replication traffic does not travel through the public internet. Public subnets expose traffic to the internet, which does not align with the security and bandwidth requirements. This configuration would allow replication traffic to potentially travel over the public internet, which is specifically to be avoided.
- Why this is not ideal: The public subnets with an internet gateway expose resources to the internet, making this option unsuitable for the requirements to keep replication traffic secure and private.
Option C: Create an AWS Site-to-Site VPN connection between the on-premises network and the target AWS network.
- Why this is selected: A Site-to-Site VPN connection will securely route replication traffic between the on-premises network and the AWS network over an encrypted tunnel. This avoids using the public internet directly for replication and ensures that data remains secure. It also prevents any potential exposure to the internet.
- Why this is relevant: The VPN connection allows for secure communication between on-premises and AWS infrastructure, making it ideal for ensuring that ...
Author: Zara · Last updated Jul 6, 2026
A company that provides image storage services wants to deploy a customer-facing solution to AWS. Millions of individual customers will use the solution. The solution will receive batches of large image files, resize the files, and store the files in an Amazon S3 bucket for up to 6 months.
The solution must handle significant variance in demand. The solution must also be relia...
To meet the requirements of the image storage service, let's break down and analyze the options.
Key Requirements:
1. Handling significant variance in demand: The solution must scale dynamically to handle large volumes of image uploads.
2. Reliability and ability to rerun jobs: If a job fails, the system should allow retrying or reprocessing.
3. Cost-effectiveness: The solution should optimize for costs while ensuring reliability and scalability.
4. Expiration of images: Images need to be automatically deleted or archived after 6 months.
Option Breakdown:
A) Use AWS Step Functions to process the S3 event that occurs when a user stores an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
- Pros:
- AWS Step Functions help handle complex workflows, retries, and error handling, ensuring reliability.
- The lifecycle policy will ensure that images are automatically expired after 6 months.
- Cons:
- AWS Step Functions can incur more cost due to the orchestration of workflows, especially at large scale.
- Processing each image in place might not be the best solution for large images or high throughput since AWS Lambda has a limit on execution time and memory.
- It doesn't provide a separate storage solution for resized images, possibly causing higher storage costs.
B) Use Amazon EventBridge to process the S3 event that occurs when a user uploads an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
- Pros:
- EventBridge provides event-driven architecture, allowing for scaling based on the event and ensuring smooth handling of batch uploads.
- S3 Lifecycle expiration is in place for automatic deletion.
- Cons:
- Similar to Option A, resizing images in place might lead to issues with large file sizes and long processing times.
- EventBridge is useful but adds an extra layer of complexity compared to simpler solutions, and it's often better used for more distributed event routing rather than simple image upload events.
C) Use S3 Event Notifications to invoke an AWS Lambda function when a user stores an image. Use the Lambda function to resize the image in place and store ...
Author: Emma · Last updated Jul 6, 2026
A company has an organization in AWS Organizations that includes a separate AWS account for each of the company's departments. Application teams from different departments develop and deploy solutions independently.
The company wants to reduce compute costs and manage costs appropriately across departments. The company also wants to improve visibility into billing for individu...
To meet the company's requirements, we need to focus on cost optimization, appropriate management of departmental resources, and visibility into billing while ensuring operational flexibility in selecting compute resources. Let’s evaluate each option based on these factors.
Key Requirements:
- Cost reduction and management across departments.
- Improved visibility into billing by department.
- Maintaining operational flexibility in selecting compute resources.
Option A: AWS Budgets for Each Department + Tag Editor + EC2 Instance Savings Plans
- AWS Budgets: Useful for tracking and controlling costs per department. However, AWS Budgets alone does not provide the level of visibility and cost management needed by itself.
- Tag Editor: Good for applying tags to resources, but would not be as effective as a full tagging strategy.
- EC2 Instance Savings Plans: Savings Plans tied to EC2 instances, which would limit flexibility. The company wants flexibility in selecting compute resources, so EC2 Instance Savings Plans, which lock in usage for specific instance types, could reduce the operational flexibility needed for varied compute resources across departments.
Option B: AWS Organizations with Consolidated Billing + Tagging Strategy + SCPs + EC2 Instance Savings Plans
- Consolidated Billing: Consolidates billing across accounts, improving visibility and simplifying cost management.
- Tagging Strategy: Identifying departments with tags will help manage and track costs per department, but using SCPs (Service Control Policies) for applying tags is not the best choice, as SCPs are designed for managing permissions and access control, not tagging resources.
- EC2 Instance Savings Plans: As mentioned earlier, EC2 Instance Savings Plans lock in usage to specific EC2 instance types, limiting operational flexibility for departments, which goes against the requirement of keeping flexibility.
Option C: AWS Organizations with Consolidated Billing + Tagging Strategy + Tag Editor + Compute Savings Plans
- Consolidated Billing: ...
Author: ThunderBear · Last updated Jul 6, 2026
A company has a web application that securely uploads pictures and videos to an Amazon S3 bucket. The company requires that only authenticated users are allowed to post content. The application generates a presigned URL that is used to upload objects through a browser interface. Most users are reporting slow upload times for objects larger than 100 M...
To address the issue of slow uploads for objects larger than 100 MB while ensuring that only authenticated users can upload content to the S3 bucket, the key is to select a solution that optimizes upload performance and secures access. Let's review each option and the reasoning behind selecting the most appropriate one.
Key Requirements:
- Authenticated access: Ensure that only authenticated users can upload content.
- Improved upload performance: Focus on optimizing upload times for larger objects (greater than 100 MB).
- Preserving security: Continue ensuring security through the upload process.
Option A: API Gateway with Edge-Optimized Endpoint, S3 Proxy, and Cognito User Pools
- API Gateway: Configures an edge-optimized API that proxies S3 operations. While this may provide security through the COGNITO_USER_POOLS authorizer, this setup introduces unnecessary complexity and overhead for object uploads.
- Drawbacks:
- Performance issues: API Gateway does not optimize the upload process for large files like S3 Transfer Acceleration does.
- Latency: The edge-optimized API could introduce latency compared to direct S3 access, especially for larger file uploads.
- Complexity: Uploading large files through an API Gateway proxy is not ideal for large object uploads due to potential throttling and overhead of the API Gateway handling each chunk of the file.
Option B: API Gateway with Regional Endpoint, Lambda Authorizer, S3 Proxy
- API Gateway: Similar to Option A, but using a regional API endpoint instead of an edge-optimized one. While it provides Lambda authorizer functionality for authentication, this approach still suffers from performance limitations, especially when handling large files.
- Drawbacks:
- Performance limitations: This approach still doesn't optimize uploads for large files. Uploading through API Gateway will add latency and possibly result in slower performance for larger files compared to direct access methods like S3 Transfer Acceleration.
- Unnecessary complexity: Introducing Lambda authorizers adds unnecessary complexity in securing uploads, as presigned URLs already provide a simple way to authenticate and authorize users securely.
Option C: Enable S3 Transfer Accelerati...
Author: William · Last updated Jul 6, 2026
A large company is migrating its entire IT portfolio to AWS. Each business unit in the company has a standalone AWS account that supports both development and test environments. New accounts to support production workloads will be needed soon.
The finance department requires a centralized method for payment but must maintain visibility into each group's spending to allocate costs.
The security team requires a c...
To meet the company's needs, we must address the following requirements:
- Centralized payment while maintaining visibility into individual group spending for chargebacks.
- Centralized IAM management across all accounts to ensure consistent security practices.
Let’s evaluate the options in detail.
Option A: Use a collection of parameterized AWS CloudFormation templates defining common IAM permissions
- Description: CloudFormation templates can define common IAM permissions that need to be applied to each account. The templates can be parameterized and launched into each account to ensure that IAM policies are correctly applied.
- Drawbacks:
- Manual effort: Each new account would need to launch the appropriate CloudFormation stack manually, which introduces operational overhead.
- Scaling issues: As the number of accounts grows, this method can become cumbersome to maintain and automate.
- Less flexibility: CloudFormation templates for IAM policies are less dynamic compared to more centralized IAM control solutions like AWS Organizations.
- Does not directly address the need for centralized billing.
Option B: Use AWS Organizations to create a new organization from a chosen payer account
- Description: AWS Organizations allows you to create a centralized billing account (payer account), organize accounts into organizational units (OUs), and invite existing accounts to join the organization. New accounts can also be created under the same organization, allowing for consolidated billing and visibility into each account’s spending.
- Benefits:
- Centralized billing: AWS Organizations provides centralized billing through the payer account while maintaining visibility into each account’s spending for cost allocation.
- Flexibility: You can create and manage accounts at scale, supporting both development, test, and production environments in separate accounts.
- Security: While it doesn’t directly handle IAM, AWS Organizations is a foundation that can be combined with service control policies (SCPs) for centralized security controls.
Option C: Require each business unit to use its own AWS accounts and tag each AWS account
- Description: Each business unit uses its own AWS account, and tags are applied to each account for cost allocation. Cost Explorer can be enabled to help administe...
