Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company wants to use Amazon Elastic Container Service (Amazon ECS) clusters and Amazon RDS DB instances to build and run a payment processing application. The company will run the application in its on-premises data center for compliance purposes.
A solutions architect wants to use AWS Outposts as part of the solution. The solutions architect is working ...
To determine the responsibilities of the company's operational team when using AWS Outposts for building and running a payment processing application, it's important to understand the roles of both AWS and the company in managing an Outposts environment. AWS Outposts bring AWS infrastructure, services, and operating models to on-premises data centers. While AWS manages certain aspects of Outposts, the company will have some responsibilities as well. Let’s evaluate the options based on this shared responsibility model.
Evaluating the Options:
A) Providing resilient power and network connectivity to the Outposts racks:
- Advantages: Ensuring resilient power and network connectivity to the Outposts racks is typically the responsibility of the customer (the company). AWS will provide the hardware and infrastructure, but the company needs to ensure that the data center environment is properly connected to power and networking resources for the Outposts hardware to function.
- Why selected: The operational team is responsible for maintaining the environment that the Outposts rely on, including providing power and network connectivity. AWS will handle the infrastructure management, but resilient power and network connectivity are typically on the operational team.
B) Managing the virtualization hypervisor, storage systems, and the AWS services that run on Outposts:
- Disadvantages: AWS manages the hardware, including the virtualization infrastructure (hypervisor), storage, and the underlying services running on the Outposts racks. The company does not directly manage these components.
- Why rejected: AWS takes care of managing the virtualization layer, storage systems, and running services. The operational team focuses more on using the resources AWS provides rather than managing the underlying infrastructure directly.
C) Physical security and access controls of the data center environment:
- Advantages: The company is responsible for securing the physical access to the data center environment. This includes controlling access to Outposts racks, servers, and network equipment to ensure compliance with security standards and regulations.
- Why selected: Physical security is a fundamental responsibility of the c...
Author: MoonlitPantherX · Last updated Aug 7, 2026
A company is planning to migrate a TCP-based application into the company's VPC. The application is publicly accessible on a nonstandard TCP port through a hardware appliance in the company's data center. This public endpoint can process up to 3 million requests per second with low latency. The company requires th...
To migrate a TCP-based application into AWS while maintaining high performance, the solution needs to meet the requirements of handling up to 3 million requests per second with low latency. Let's evaluate the options based on these needs.
Evaluating the Options:
A) Deploy a Network Load Balancer (NLB). Configure the NLB to be publicly accessible over the TCP port that the application requires:
- Advantages: A Network Load Balancer (NLB) is specifically designed for high performance and low-latency, handling millions of requests per second. It operates at the TCP/UDP layer (Layer 4) and can scale automatically to handle the required load. It is capable of providing a highly available, scalable, and low-latency solution for public-facing applications.
- Why selected: Since the application is TCP-based and requires handling millions of requests per second with low latency, the NLB is the best choice. It can support nonstandard ports and provide the performance and scalability needed. It's also well-suited for use cases like this, where the primary concern is traffic routing and performance at the network layer.
- Why others are rejected: The NLB is designed for TCP traffic and is ideal for this scenario where performance at scale and low latency are paramount.
B) Deploy an Application Load Balancer (ALB). Configure the ALB to be publicly accessible over the TCP port that the application requires:
- Advantages: ALBs can handle HTTP and HTTPS traffic and provide intelligent routing, SSL offloading, and WebSocket support.
- Disadvantages: ALBs operate at Layer 7 (the application layer), making them better suited for HTTP/HTTPS traffic. They are not ideal for general TCP traffic, especially at the scale and low-latency required by the application. The ALB will not perform as well with non-HTTP protocols or high-volume TCP workloads.
- Why rejected: The ALB is not designed to efficiently handle raw TCP traffic at the sc...
Author: Emma Brown · Last updated Aug 7, 2026
A company runs its critical database on an Amazon RDS for PostgreSQL DB instance. The company wants to migrate to Amazon Aurora PostgreSQL with minimal downtime and data loss.
Wh...
To select the best solution for migrating an Amazon RDS for PostgreSQL DB instance to Amazon Aurora PostgreSQL with minimal downtime and data loss, let's evaluate each option.
A) Create a DB snapshot of the RDS for PostgreSQL DB instance to populate a new Aurora PostgreSQL DB cluster.
- Explanation: This method involves taking a snapshot of the RDS PostgreSQL DB instance and restoring it into an Aurora PostgreSQL DB cluster.
- Advantages:
- Easy to set up.
- Provides a way to move data from RDS PostgreSQL to Aurora PostgreSQL.
- Minimal operational overhead.
- Disadvantages:
- It introduces downtime during the snapshot creation and the restore process. While the snapshot captures data at a certain point in time, any updates to the RDS instance after the snapshot is taken will not be reflected in the Aurora cluster.
- This could lead to data loss for transactions that happen during the migration.
B) Create an Aurora read replica of the RDS for PostgreSQL DB instance. Promote the Aurora read replica to a new Aurora PostgreSQL DB cluster.
- Explanation: This method involves setting up an Aurora read replica of the RDS for PostgreSQL DB instance. After replication is complete, the replica is promoted to a standalone Aurora DB cluster.
- Advantages:
- Minimal downtime as the RDS instance continues to be available during the migration.
- Replication ensures that all changes made to the source database are captured.
- Aurora can take over as the primary database with almost no downtime once the replica is promoted.
- Disadvantages:
- More complex to set up and manage compared to other options.
- Requires additional time for replication to sync all the data between RDS and Aurora.
C) Use data import from Amazon S3 to migrate the database to an Aurora PostgreSQL DB cluster.
- Explanation: This method involves exporting the data to Amazon S3 and then importing it into an Aurora PostgreSQL DB cluster.
- Advantages:
- Suitable for large datasets or when performing bulk data migration.
- Can be useful for migrations where data from a variety of sources (other ...
Author: Sara · Last updated Aug 7, 2026
A company's infrastructure consists of hundreds of Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) storage. A solutions architect must ensure that every EC2 instance can be recovered after a disaster.
...
To meet the requirement of ensuring that every EC2 instance can be recovered after a disaster with the least amount of effort, we will evaluate each option based on factors such as ease of implementation, operational overhead, and effectiveness in disaster recovery.
A) Take a snapshot of the EBS storage that is attached to each EC2 instance. Create an AWS CloudFormation template to launch new EC2 instances from the EBS storage.
- Explanation: This approach involves taking a snapshot of the EBS volumes and then using AWS CloudFormation to automate the launch of EC2 instances from these snapshots.
- Advantages:
- CloudFormation is a powerful tool for automating infrastructure deployment.
- EBS snapshots ensure that the data is preserved.
- Disadvantages:
- This solution requires manually creating CloudFormation templates and managing them.
- It doesn’t fully automate the recovery process for all EC2 instances and requires careful setup to ensure recovery of both EC2 instances and associated EBS volumes.
- Higher operational overhead for maintaining CloudFormation templates for each EC2 instance.
- Not as simple as some other options.
B) Take a snapshot of the EBS storage that is attached to each EC2 instance. Use AWS Elastic Beanstalk to set the environment based on the EC2 template and attach the EBS storage.
- Explanation: This option proposes using AWS Elastic Beanstalk for deployment, while still relying on EBS snapshots for storage.
- Advantages:
- Elastic Beanstalk simplifies the deployment of applications.
- Elastic Beanstalk can scale automatically, which could potentially help in managing EC2 instance recovery.
- Disadvantages:
- Elastic Beanstalk is typically used for managing application environments, not necessarily for the full disaster recovery of EC2 instances with specific EBS snapshots.
- This doesn’t fully align with the goal of recovering EC2 instances with their specific EBS volumes as it is more application-centric rather than infrastructure-centric.
- The solution requires more complex configuration and might not meet the requirement with minimal effort.
C) Use AWS Backup to set up a backup plan for the entire group of EC2 instances. Use the AWS Backup API or the AWS CLI to speed up the restore process for multiple EC2 instances.
- Explanation: This option involves using AWS Backup, which is a managed service that automates backups and restores of EC2 instances and other AWS resources.
- Advantages:
- AWS Backup is designed for s...
Author: Alexander · Last updated Aug 7, 2026
A company recently migrated to the AWS Cloud. The company wants a serverless solution for large-scale parallel on-demand processing of a semistructured dataset. The data consists of logs, media files, sales transactions, and IoT sensor data that is stored in Amazon S3. The company wants the solution to proces...
To determine the best solution for the company's requirement of a serverless, scalable, parallel processing system for a semistructured dataset stored in Amazon S3, we need to assess each option based on key factors such as operational efficiency, ease of scaling, and cost-effectiveness.
A) Use the AWS Step Functions Map state in Inline mode to process the data in parallel.
- Explanation: AWS Step Functions provides a Map state to iterate over a collection of items and process them in parallel. The Inline mode runs a specified Lambda function for each iteration.
- Advantages:
- Step Functions simplifies the orchestration of workflows and can provide parallel processing for small-scale datasets.
- Suitable for workflows that require conditional branching and state transitions.
- Disadvantages:
- Inline mode is not designed for large-scale, high-volume parallel processing.
- For very large datasets or high-frequency execution, Inline mode may encounter scaling or performance limitations.
- Operational complexity increases as you scale the number of parallel tasks, and the overall cost could increase with the high number of Lambda invocations.
B) Use the AWS Step Functions Map state in Distributed mode to process the data in parallel.
- Explanation: The Distributed mode of the Map state in AWS Step Functions is specifically designed for scaling large-scale parallel processing. It can distribute a large set of tasks across multiple AWS resources, such as Lambda functions.
- Advantages:
- Distributed mode provides true parallel processing at scale, making it ideal for processing thousands of items in the dataset in parallel.
- Step Functions will automatically handle task failures and retries, and scaling is managed seamlessly.
- This mode is more suited for handling large datasets and processing them efficiently with minimal operational overhead.
- Disadvantages:
- More complex than simpler solutions, although it offers more scalability and fault tolerance.
C) Use AWS Glue to process the data in parallel.
- Explanation: AWS Glue is a serverless data integration service that supports ETL (Extract, Transform, Load) processes for big data. It is optimized for batch processing of large datasets stored in Amazon S3.
- Advantages:
- AWS Glue can process large datasets in parallel and provides built-in optimizations for data transformation tasks.
- Fully serverless,...
Author: ShadowWolf101 · Last updated Aug 7, 2026
A company will migrate 10 PB of data to Amazon S3 in 6 weeks. The current data center has a 500 Mbps uplink to the internet. Other on-premises applications share the uplink. The company can use 80% of the internet...
To determine the best solution for migrating 10 PB of data to Amazon S3 in 6 weeks with the constraints of a 500 Mbps uplink and 80% of bandwidth allocated to migration (which equates to 400 Mbps), we need to evaluate the feasibility, scalability, and efficiency of each option.
A) Configure AWS DataSync to migrate the data to Amazon S3 and to automatically verify the data.
- Explanation: AWS DataSync is a managed service that automates the transfer of large volumes of data to Amazon S3. It provides encryption, data verification, and efficient data transfer capabilities.
- Advantages:
- High transfer speeds: AWS DataSync is optimized for large-scale data migrations and can leverage high-speed data transfer protocols to efficiently move data, which could provide much higher throughput than the uplink speed limit.
- Automatic verification: It offers automated data verification to ensure that data is copied correctly.
- Scalability: DataSync scales well for large data migrations and can handle 10 PB of data effectively.
- Managed service: Reduces operational overhead compared to other manual methods.
- Disadvantages:
- May still be constrained by the bandwidth of the internet connection unless other optimizations are available.
Why it's a good fit: DataSync provides high-speed, reliable migration capabilities with data verification, making it an ideal choice for a migration task of this size.
B) Use rsync to transfer the data directly to Amazon S3.
- Explanation: `rsync` is a command-line tool that can be used to transfer files over the network. It is commonly used for incremental transfers and is often employed for smaller-scale migrations.
- Advantages:
- Free and open-source, with minimal setup.
- Good for smaller datasets or incremental changes.
- Disadvantages:
- Performance issues: `rsync` is not optimized for transferring large volumes of data to cloud storage. It may not perform well for 10 PB of data, especially over a bandwidth-limited connection like the one described (500 Mbps).
- Lack of automation and management: It requires manual setup and management of multiple concurrent transfers to be effective, making it operationally more complex for this scale.
- Not optimized for cloud storage: rsync works best for file systems, but Amazon S3 is object storage, which means `rsync` is not designed to integrate well with it. You would need additional steps to integrate with S3, leading to more complexity.
Why it's rejected: `rsync` is not well-suited for a large-scale migration to Amazon S3, especially with the need for optimal bandwidth utilization and efficient handling of 10 PB of data.
C) Use the AWS CLI and multiple copy processes to send the data directly to Amazon S3.
- Explanation: Using the AWS CLI with multiple copy processes means manually managing multiple S3 `cp` commands or p...
Author: Rahul · Last updated Aug 7, 2026
A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the depen...
To meet the company's requirements of reducing the dependency on on-premises Internet Small Computer Systems Interface (iSCSI) network storage servers while ensuring low-latency access to frequently used data, we need to evaluate the options based on key factors such as infrastructure changes, low-latency access, and minimizing complexity.
A) Deploy an Amazon S3 File Gateway.
- Explanation: An Amazon S3 File Gateway provides an interface to Amazon S3 that allows on-premises applications to store and retrieve files as objects in S3. It supports file-based protocols such as NFS and SMB.
- Advantages:
- Minimal infrastructure changes: It allows existing on-premises applications to interact with S3, minimizing changes to applications.
- Data storage in S3: Provides scalable and durable storage with access through file protocols.
- Disadvantages:
- Not ideal for low-latency access: Amazon S3 is an object storage service, which typically does not offer the low-latency access needed for applications requiring fast performance.
- Not ideal for frequently accessed data: S3 File Gateway may not provide the performance necessary for workloads that require high-throughput and low-latency access to frequently used data.
Why it’s rejected: S3 is object storage, and while it offers good scalability, it is not optimized for low-latency, high-performance access that is required by some workloads.
B) Deploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
- Explanation: Amazon EBS provides block-level storage that can be attached to EC2 instances. Data can be backed up to Amazon S3 using EBS snapshots.
- Advantages:
- Low-latency access: EBS provides high-performance, low-latency block storage.
- Backup to S3: Snapshots allow for durable backups of EBS volumes.
- Disadvantages:
- On-premises storage issue: This option requires the use of EC2 instances, which doesn’t directly address the reduction of on-premises storage servers. It adds complexity in terms of managing EC2 instances and storage.
- Manual management: Although EBS provides low-latency storage, managing backups and ensuring minimal disruption to the workload may require additional setup.
Why it’s rejected: While EBS offers low-latency access, it requires more management and infrastructure overhead compared to solutions that are better suited to reducing on-premises servers without significant changes.
C) Deploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
- Explanation: The stored volumes configuration of the AWS Storage Gateway stores all data on-premises while asynchron...
Author: Max · Last updated Aug 7, 2026
A solutions architect is designing an application that will allow business users to upload objects to Amazon S3. The solution needs to maximize object durability. Objects also must be readily available at any time and for any length of time. Users will access objects frequently within the first 30 days after the objects are uploaded,...
In this case, the solution needs to maximize object durability, provide frequent access for objects in the first 30 days, and minimize costs by reducing storage costs for less frequently accessed objects after 30 days.
Let’s break down the options and key factors:
A) Store all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Glacier after 30 days.
- Pros: S3 Glacier is a very low-cost storage option for archiving data, making it an excellent choice for rarely accessed data.
- Cons: Objects stored in Glacier are not readily available. Accessing data in Glacier involves retrieval times (hours), which would not meet the requirement of ensuring that objects are "readily available at any time."
- Best for: Data that needs to be archived and doesn’t require quick access, like long-term backups.
- Why not selected: Glacier does not meet the requirement of “readily available at any time,” which is essential in this case.
B) Store all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
- Pros: S3 Standard-IA is designed for infrequently accessed data but still offers low-latency and high-throughput access. It balances cost and access performance well.
- Cons: S3 Standard-IA has a higher storage cost than S3 Glacier, but it provides faster access, which may be more expensive in cases where Glacier’s retrieval time is acceptable.
- Best for: Frequently accessed data that becomes less used over time but still needs to be available quickly.
- Why not selected: S3 Standard-IA might be more expensive than other options like S3 One Zone-IA if the durability requirement does not necessitate redundant storage across multiple availability zones.
C) Store all the objects in S3 Standard with an S3 Lifecycle rule to transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.
- Pros: S3 One Zone-IA is much cheaper than S3 Standard-IA because it stores data in a single availability zone. This can reduce costs while maintaining good access times...
Author: Olivia Johnson · Last updated Aug 7, 2026
A company has migrated a two-tier application from its on-premises data center to the AWS Cloud. The data tier is a Multi-AZ deployment of Amazon RDS for Oracle with 12 TB of General Purpose SSD Amazon Elastic Block Store (Amazon EBS) storage. The application is designed to process and store documents in the database as binary large objects (blobs) with an average document size of 6 MB.
The database size has grown over time, reducing the performance and increasing...
In this case, the company is facing performance and cost issues due to the storage growth and its reliance on Amazon RDS for Oracle with large binary objects (blobs) in the database. The goal is to improve database performance and reduce storage costs, while maintaining high availability and resilience.
Let's evaluate each option based on key factors: performance, cost-effectiveness, scalability, and alignment with the company's requirements.
A) Reduce the RDS DB instance size. Increase the storage capacity to 24 TiB. Change the storage type to Magnetic.
- Pros: Reducing the DB instance size would lower the cost of compute resources. Increasing storage capacity to 24 TiB would provide more room for data growth.
- Cons: Magnetic storage is a slow, legacy option that would drastically reduce database performance, especially when dealing with large binary objects (6 MB each). RDS Magnetic storage is not ideal for transactional or high-performance applications. The increased storage capacity may solve the space issue but not the performance bottleneck.
- Best for: Situations where cost is a major concern, and performance is not critical (e.g., archiving or infrequent access).
- Why not selected: This option would degrade performance significantly and is not suitable for a production environment that needs high availability, resilience, and good performance.
B) Increase the RDS DB instance size. Increase the storage capacity to 24 TiB. Change the storage type to Provisioned IOPS.
- Pros: Increasing the RDS DB instance size and using Provisioned IOPS (SSD) would improve performance, especially for write-heavy operations. Provisioned IOPS would provide high, consistent I/O performance, suitable for applications with high throughput and low-latency requirements.
- Cons: This option would likely lead to higher costs, especially with 24 TiB of Provisioned IOPS storage. While performance would improve, the company is still storing large binary objects (blobs) in the database, which isn't the most cost-effective approach for handling large binary data. Additionally, it does not address the issue of inefficient use of database storage for blobs.
- Best for: Applications that need high performance and can justify the higher cost of Provisioned IOPS storage.
- Why not selected: While it would improve performance, this solution does not address the underlying issue of inefficient storage for large binary objects (blobs) and would increase costs due to the high price of Provisioned IOPS.
C) Create an Amazon S3 bucket. Update the application to store documents in the S3 bucket. Store the object metadata in the existing database.
- Pros: This is a highly cost-effectiv...
Author: NebulaEagle11 · Last updated Aug 7, 2026
A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP.
The compa...
To increase the security of the application endpoint and restrict access to only the IP addresses registered by the retail locations, the solution needs to efficiently and dynamically manage access control based on the retail locations' IPs, with minimal overhead for maintenance. Let's evaluate each option:
A) Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.
- Pros: AWS WAF is a scalable and easy-to-manage solution that can be integrated with the ALB to filter inbound traffic. You can create an IP rule set in AWS WAF that allows or denies traffic based on the source IP addresses. This option allows flexibility in dynamically updating the registered IPs as the list changes. Additionally, AWS WAF can be used to provide protection against common web application attacks.
- Cons: There might be some overhead in managing the IP rules if the number of retail locations grows significantly. However, this is a manageable solution with the option to automate the update process through scripts or AWS Lambda functions to update the IPs dynamically.
- Best for: Use cases that require granular, scalable traffic filtering at the application layer. This solution is ideal for controlling access to the application while still allowing flexibility to modify IP restrictions.
- Why selected: AWS WAF is a good choice here because it integrates seamlessly with the ALB and allows for easy management of IP-based access control, which can be updated dynamically.
B) Deploy AWS Firewall Manager to manage the ALB. Configure firewall rules to restrict traffic to the ALB. Modify the firewall rules to include the registered IP addresses.
- Pros: AWS Firewall Manager can help centralize the management of firewall rules across multiple accounts, which is beneficial if the organization is managing multiple AWS accounts and VPCs.
- Cons: This solution adds complexity and is best suited for managing a broader range of security policies across multiple accounts and resources. It is not optimized for managing IP-based access control for a single ALB, especially when the need is limited to controlling access to one application with a known set of registered IP addresses.
- Best for: Organizations with multiple accounts or resources that require consistent firewall management across AWS.
- Why not selected: This solution is more complex than necessary for this use case, where managing IP filtering directly through AWS WAF on the ALB would be simpler and more efficient.
C) Store the IP addresses in an Amazon Dynam...
Author: Nathan · Last updated Aug 7, 2026
A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that con...
To meet the company's requirement of securing sensitive data within a data analysis platform while minimizing operational overhead, let's evaluate each solution option based on key factors like security, manageability, scalability, and operational complexity:
A) Create an IAM role that includes permissions to access Lake Formation tables.
- Pros: IAM roles are a fundamental way to control access to AWS resources and can be used to grant or deny access to Lake Formation tables based on user roles and permissions.
- Cons: While IAM roles are important for access control, they don't address the need to restrict access to sensitive data within a table itself (e.g., specific rows or cells of data). IAM alone cannot provide fine-grained security on data inside the tables based on content.
- Best for: Controlling access at the resource level (e.g., who can access specific tables or databases).
- Why not selected: This option does not offer the necessary granularity to protect sensitive portions of data within the tables (row-level or cell-level security). Therefore, it doesn't fulfill the requirement of securing sensitive information effectively.
B) Create data filters to implement row-level security and cell-level security.
- Pros: AWS Lake Formation provides built-in functionality to define data filters that enforce row-level security (RLS) and cell-level security (CLS) on tables. This solution can limit access to sensitive data by controlling which rows or cells of a table are visible to users based on defined permissions. It is a highly efficient, low-maintenance solution that integrates directly into Lake Formation.
- Cons: Requires defining appropriate filters, but this is a manageable configuration that can be easily maintained as data access requirements change.
- Best for: Organizations that need fine-grained access control to protect sensitive data at the row or cell level, without complex manual interventions.
- Why selected: This solution is the best fit because it directly addresses the need for controlling access to specific portions of the data (sensitive information) with minimal operational overhead. Once the filters are defined, they can be enforced automatically, reducing manual effort.
C) Create an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
- Pros: This approach would allow you to preprocess the data before it is ingested into Lake Formation, removing sensitive information in advance.
- Cons: While this approach could work, it adds significant operational overhead because you would need to maintain and monitor ...
Author: Samuel · Last updated Aug 7, 2026
A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data ce...
To meet the compliance requirements that the data must not be transmitted over the public internet, the solution must ensure that both data transfer to/from Amazon S3 and the communication between the EC2 instances and the on-premises data center occur over private connections without crossing the public internet. Let's evaluate each option based on these key requirements:
A) Deploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
- Pros: An interface VPC endpoint enables private communication between VPC resources and EC2 instances without the need for public IP addresses, which ensures that the communication does not traverse the public internet. The Site-to-Site VPN connection would establish a secure, encrypted tunnel between the on-premises data center and the VPC, also avoiding the public internet for communication.
- Cons: While the VPN provides a secure connection to the VPC, it doesn't address the requirement for private communication between EC2 instances and S3. Additionally, EC2 to S3 communication would still be subject to public internet traffic unless a VPC endpoint is used specifically for Amazon S3.
- Best for: Secure private communication between the VPC and on-premises data center.
- Why not selected: This option does not ensure that communication with S3 is kept private because it relies on an interface VPC endpoint for EC2, which only applies to EC2-to-EC2 communication, not EC2-to-S3. The VPC endpoint for S3 is necessary to keep S3 access private.
B) Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.
- Pros: A gateway VPC endpoint for Amazon S3 allows EC2 instances to access S3 buckets securely and privately within the VPC without using the public internet. AWS Direct Connect is a dedicated network connection that establishes a private connection between the on-premises data center and AWS, providing reliable, secure communication over a private link.
- Cons: Direct Connect can be more expensive and complex to set up than a VPN. It might be overkill if the need is only to ensure private communication with S3 and between the VPC and the on-premises network.
- Best for: Organizations that require a high-throughput, low-latency, private network connection to AWS, and where communication with S3 and the on-premises data center must be private.
- Why selected: This solution ensures that both EC2 instances communicate privately with S3 (via the gateway VPC endpoint) and that communication between the on-premises data center and the VPC remains private (via Direct Connect). This meets the compliance requirement of preventing public i...
Author: Olivia · Last updated Aug 7, 2026
A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances.
The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute...
To address the problem of 503 Service Unavailable errors when the data volume spikes, we need to design a scalable solution that can handle varying amounts of traffic without overloading the application. Here's an analysis of each option:
Option A: Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
- Why it might work: Kinesis can help decouple data ingestion from the actual processing by buffering incoming data. Lambda is scalable and can process messages as they come through, allowing for nearly real-time data processing. This approach provides automatic scaling based on demand, which helps handle varying traffic loads without overloading the application.
- Why it's not ideal: If the application’s processing requirements are complex or need more than what Lambda offers (e.g., long-running tasks), this might not be a good fit. Lambda also has certain execution time limits (15 minutes), which may not work for all use cases.
- Key factors to consider: This design is best for real-time processing with limited compute complexity.
Option B: Use Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
- Why it might work: API Gateway can help with throttling and rate-limiting, potentially reducing the number of incoming requests during traffic spikes. The quota can help prevent overloading the backend.
- Why it's not ideal: Rate limiting may not be sufficient to address scalability issues if the backend itself is overwhelmed. It does not scale the backend resources or improve the application’s ability to handle increased traffic; it just manages the traffic coming in.
- Key factors to consider: This design is more about controlling the flow of incoming data rather than improving the application’s scalability.
Option C: Use Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
- Why it might work: SNS can decouple the data ingestion process, allowing you to asynchronously process incoming data. By placing EC2 instances behind an Auto Scaling grou...
Author: RadiantJaguar56 · Last updated Aug 7, 2026
A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the ...
To determine which solution will allow the application to process sensitive information from an Amazon S3 bucket while meeting the requirement of not using the internet, we need to consider various design options that provide secure, private, and scalable access to S3 from the EC2 instances in the private subnet.
Option A: Configure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
- Why it's not ideal: An internet gateway connects your VPC to the internet. If the application is running in a private subnet, it should not access the internet directly for security and privacy reasons. Additionally, an internet gateway would expose the application to the internet, which is not compliant with the requirement to avoid using the internet for access to the S3 bucket.
- Key factors to consider: The solution would violate the requirement to not use the internet to access the S3 bucket.
Option B: Configure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
- Why it's not ideal: A VPN connection would typically be used to securely connect a VPC to a remote on-premises network, and it is generally used for connecting external networks, not for allowing access to S3 directly from a private subnet within the same VPC. This adds unnecessary complexity and is not the most efficient or scalable option when the EC2 instances are already inside a VPC.
- Key factors to consider: The VPN connection is overkill for accessing S3 from an EC2 instance within the same VPC. It introduces unnecessary complexity for this specific use case.
Option C: Configure a NAT gateway. Update the S3 bucket p...
Author: Liam123 · Last updated Aug 7, 2026
A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information i...
To meet the requirement of encrypting sensitive information stored in Kubernetes secrets with the least operational overhead, we need to consider solutions that integrate directly with Amazon EKS and Kubernetes while minimizing manual intervention and complexity.
Option A: Use the container application to encrypt the information by using AWS Key Management Service (AWS KMS).
- Why it's not ideal: While it is possible for the application to handle encryption of sensitive information using AWS KMS, this approach would place the burden of encryption and decryption entirely on the application. The application would need to manage KMS keys, handle encryption, and ensure that secrets are correctly decrypted at runtime. This increases operational complexity and is not the most efficient or scalable solution for Kubernetes secrets management.
- Key factors to consider: This approach requires significant custom implementation and maintenance. It's not the most seamless or automated solution.
Option B: Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).
- Why it's ideal: Enabling secrets encryption in Amazon EKS using AWS KMS is the most streamlined and least operationally intensive approach. Kubernetes secrets are stored in etcd (the key-value store used by Kubernetes), and by enabling KMS encryption, you ensure that all secrets stored in the Kubernetes cluster are automatically encrypted at rest. This is a native feature of Amazon EKS and integrates seamlessly with the cluster, ensuring both security and ease of management with minimal overhead.
- Why it's the best choice: This solution is fully managed by AWS, with no need for additional code or infrastructure. It automatically handles encryption and decryption of secrets, aligning with best practices for containerized environments and reducing operationa...
Author: Ravi Patel · Last updated Aug 7, 2026
A company is designing a new multi-tier web application that consists of the following components:
* Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups
* An Amazon RDS DB instance for data storage
A solutions architect needs to limit acce...
To meet the requirement of limiting access to the application servers so that only the web servers can access them, we need a solution that ensures proper network segmentation and secure communication between the web and application tiers while enforcing the access control mechanism. Let's analyze each option:
Option A: Deploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
- Why it's not ideal: AWS PrivateLink is typically used to securely access services over a private network within a VPC, but it is primarily used for accessing AWS services and third-party services via private endpoints. It is not typically designed for securing communication between two tiers of an application within the same VPC, and using network ACLs for access control can become complex and difficult to maintain.
- Key factors to consider: While PrivateLink is useful for cross-VPC or third-party services, it's an over-engineered solution for this use case and doesn't directly align with the goal of limiting access between the web and application servers within the same VPC.
Option B: Deploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
- Why it's not ideal: VPC endpoints are used to enable private communication between VPCs and AWS services (like S3, DynamoDB, etc.), or between VPCs. However, a VPC endpoint wouldn't be the correct solution for securing communication between EC2 instances (web servers and application servers) in the same VPC. Additionally, security groups are a better choice than network ACLs for controlling traffic between EC2 instances.
- Key factors to consider: VPC endpoints are not intended for managing internal traffic between EC2 instances in the same VPC. Security groups provide better control for this type of use case.
Option C: Deploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the applic...
Author: Ahmed · Last updated Aug 7, 2026
A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes met...
To implement a solution that collects, aggregates, and summarizes metrics and logs from a microservices-based application running on Amazon EKS, we need a solution that can centrally monitor and provide insights into both application logs and infrastructure metrics.
Let’s analyze each option:
Option A: Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
- Why it might work: The Amazon CloudWatch agent can collect logs and metrics from EC2 instances and containers within an EKS cluster. However, this approach requires manual setup and configuration, such as deploying the CloudWatch agent as a DaemonSet in the EKS cluster to gather logs from individual pods. While CloudWatch is a good service for log aggregation and monitoring, using the CloudWatch agent requires more operational overhead for setup and management.
- Why it's not ideal: It is possible but not the most streamlined approach. CloudWatch agent setup needs to be explicitly configured for each container and pod, and it doesn't offer out-of-the-box EKS monitoring features like Container Insights does. It’s a bit more manual and operationally intensive compared to a solution specifically designed for EKS.
Option B: Run AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
- Why it might work: AWS App Mesh is a service mesh that provides microservices observability, traffic management, and security. It can aggregate metrics and logs from microservices running in the EKS cluster. App Mesh integrates with CloudWatch for logs and metrics, but it primarily focuses on service mesh capabilities like traffic control, service discovery, and security between microservices.
- Why it's not ideal: While App Mesh can provide traffic metrics and monitoring within the mesh, it is not a full-fledged log aggregation and monitoring solution. App Mesh focuses more on the networking and communication between microservices, so it might not be the best fit for comprehensive log collection and aggregation for your entire EKS cluster.
- Key factors to consider: App Mesh is suited for managing the interactions between microservices rather than serving as a centralized logging and metrics collection tool.
...
Author: Siddharth · Last updated Aug 7, 2026
A company has deployed its newest product on AWS. The product runs in an Auto Scaling group behind a Network Load Balancer. The company stores the product's objects in an Amazon S3 bucket.
The company recently experienced malicious attacks against its systems. The company needs a solution that continuously monitors for malicious activity in the AWS account, workloads, and access pa...
To meet the requirement of continuously monitoring for malicious activity, reporting suspicious activity, and displaying it on a dashboard, we need to consider the capabilities of the available AWS services and how they align with these needs.
Option A: Configure Amazon Macie to monitor and report findings to AWS Config
- Reasoning: Amazon Macie is primarily designed for discovering, classifying, and protecting sensitive data in Amazon S3. It focuses on identifying personally identifiable information (PII) and sensitive data within the S3 bucket. While it helps in monitoring access to sensitive data, it doesn't specifically focus on general malicious activity monitoring across workloads, network traffic, or access patterns.
- Why rejected: Although Macie is useful for protecting sensitive data in S3, it does not cover all aspects of monitoring for malicious activity or integrate well into a broader security dashboard as required. It is more focused on data classification than general threat monitoring.
- Use Case: Best suited for identifying and protecting sensitive data in S3.
Option B: Configure Amazon Inspector to monitor and report findings to AWS CloudTrail
- Reasoning: Amazon Inspector is a service designed for vulnerability assessments of EC2 instances and workloads, focusing on security vulnerabilities in applications and network configurations. It performs assessments and generates findings but does not directly monitor for general malicious activity like intrusion detection.
- Why rejected: Amazon Inspector is useful for vulnerability scanning and assessing EC2 instances for weaknesses, but it does not actively monitor or report suspicious activity in a real-time context, nor does it integrate with a dashboard for continuous monitoring.
- Use Case: Best for vulnerability assessments in EC2 instances but not for continuous malicious activity detection or monitoring of S3 access patterns.
Option C: Configure Amazon GuardDuty to monitor and re...
Author: Siddharth · Last updated Aug 7, 2026
A company wants to migrate an on-premises data center to AWS. The data center hosts a storage server that stores data in an NFS-based file system. The storage server holds 200 GB of data. The company needs to migrate the data without interruption to existing services. Multiple resources in AWS must be able to acc...
To migrate the on-premises data center’s NFS-based file system to AWS, several factors must be considered, such as ensuring no service interruptions, enabling multiple AWS resources to access the data using the NFS protocol, and minimizing costs. Below are the steps that best meet the requirements:
Option A: Create an Amazon FSx for Lustre file system
- Reasoning: Amazon FSx for Lustre is designed for high-performance workloads and integrates well with high-performance compute environments like machine learning or analytics. While it supports the NFS protocol, it is typically more suited for use cases that require high throughput and low-latency access to data, such as large-scale data processing and analytics. This makes it more expensive than other storage solutions like Amazon EFS and isn't ideal for a simple file system migration.
- Why rejected: This solution is not the most cost-effective for migrating a standard NFS-based file system. It is designed for high-performance scenarios, which is overkill in this case where cost is a priority.
- Use Case: Best suited for high-performance, compute-intensive workloads.
Option B: Create an Amazon Elastic File System (Amazon EFS) file system
- Reasoning: Amazon EFS is a fully managed NFS-based file system that provides scalable storage with a simple interface, making it a great choice for migrating data from an NFS-based file system without significant service interruptions. EFS is designed to be highly available and can scale to meet growing storage demands, making it a highly suitable and cost-effective solution for the scenario where multiple AWS resources need to access data via NFS.
- Why selected: EFS supports the NFS protocol, is cost-effective for the given use case, and can easily scale as required. It also integrates seamlessly with other AWS services and can be used to replace the on-premises storage server with minimal downtime.
- Use Case: Ideal for migrating NFS-based file systems to AWS with minimal disruption, cost efficiency, and scalable access.
Option C: Create an Amazon S3 bucket to receive the data
- Reasoning: Amazon S3 is an object storage service, not a file system that supports NFS natively. While it can store data and integrate with various AWS services, it does not support the NFS protocol directly for access by other AWS resources. Migr...
Author: Vikram · Last updated Aug 7, 2026
A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file sy...
To meet the company's requirements for high availability, replication, and data retention, we need to carefully consider several factors such as the deployment type of FSx for Windows File Server, the replication and backup strategies, and the ability to lock data for a minimum of 5 years. Let’s break down the key elements and evaluate each option:
Key Requirements:
1. Recovery Point Objective (RPO) of 5 minutes: The replication mechanism must provide near real-time or frequent backups to meet the RPO requirement.
2. Replication to a different region (us-west-2): Data must be replicated to us-west-2 for disaster recovery purposes.
3. Data retention of 5 years: The replicated data must not be deleted for 5 years, which requires configuring AWS Backup Vault Lock in compliance mode to prevent deletions.
Analysis of Each Option:
Option A: Create an FSx for Windows File Server file system in us-east-1 with Single-AZ 2 deployment. Use AWS Backup for daily backup with backup replication to us-west-2 and AWS Backup Vault Lock in compliance mode.
- Single-AZ 2 Deployment Type: This type of deployment provides only local redundancy within a single Availability Zone, which doesn't meet the high availability and disaster recovery needs. Single-AZ is not a good choice for production environments where uptime is critical, as it doesn’t provide multi-AZ fault tolerance.
- Why rejected: This option doesn’t meet the high availability requirement because the Single-AZ 2 deployment type is less fault-tolerant compared to Multi-AZ. It also does not provide the RPO of 5 minutes, as backups are performed on a daily basis.
- Use case: Best for non-critical or low-availability workloads where cost savings are prioritized over fault tolerance and RPO.
Option B: Create an FSx for Windows File Server file system in us-east-1 with Multi-AZ deployment. Use AWS Backup for daily backup with backup replication to us-west-2 and AWS Backup Vault Lock in governance mode.
- Multi-AZ Deployment Type: This is ideal because it ensures high availability by replicating data across multiple Availability Zones in us-east-1, making the solution more fault-tolerant and highly available.
- AWS Backup Vault Lock in Governance Mode: Governance mode allows for some flexibility in terms of deleting or modifying backup data by authorized users, which doesn’t meet the requirement to prevent deletions for 5 years. The data must be in compliance mode for the required retention period.
- Why reje...
Author: Jack · Last updated Aug 7, 2026
A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensur...
To meet the requirement of ensuring that the mandatory AWS CloudTrail configuration applied to new developer accounts is not modified, the solution must prevent developers from modifying the CloudTrail configuration in their accounts. Below, we'll analyze the options in detail:
Option A: Create an IAM policy that prohibits changes to CloudTrail and attach it to the root user
- Reasoning: This option is problematic because IAM policies cannot be attached to the root user. The root user in an AWS account has full administrative access and cannot have IAM policies attached to it. Even if a policy could be attached, the root user would still be able to override or modify the policy, so this is not a reliable way to enforce security.
- Why rejected: IAM policies cannot be applied to the root user, so this option would not prevent modifications by the root user.
- Use case: This option is not suitable for enforcing security for the root user.
Option B: Create a new trail in CloudTrail from within the developer accounts with the organization trails option enabled
- Reasoning: While enabling the "organization trails" option for CloudTrail can ensure that logs are recorded across multiple accounts, it doesn't specifically prevent developers from modifying the configuration or settings of CloudTrail in their accounts. Developers could still change the CloudTrail settings, such as turning off logging or deleting the trail, even with organization trails enabled.
- Why rejected: This option does not meet the requirement to prevent developers from modifying the CloudTrail configuration; it simply helps centralize logging across accounts.
- Use case: Useful for centralizing logs but not for enforcing immutability of CloudTrail settings.
Option C: Create a service control policy (SCP) that prohibits changes to CloudTrail and attach it to the developer accounts
- Reasoning: Service control policies (SCPs) are a great way to enforce ...
Author: Andrew · Last updated Aug 7, 2026
A company is planning to deploy a business-critical application in the AWS Cloud. The application requires durable storage with consistent, low-latency performance.
Which type ...
When selecting a storage solution for a business-critical application in the AWS Cloud that requires durable storage with consistent, low-latency performance, the solution must meet these specific needs: durability, low-latency access, and high performance.
Option A: Instance store volume
- Reasoning: Instance store volumes provide temporary storage that is directly attached to an EC2 instance. However, data stored in instance store volumes is ephemeral, meaning it is lost when the instance is stopped, terminated, or fails. This makes it unsuitable for business-critical applications that require durability. Instance store also lacks the durability and consistency needed for most production environments.
- Why rejected: Instance store is not persistent and does not provide the durability needed for business-critical applications.
- Use case: Suitable for temporary storage, such as cache or scratch space, but not for durable, business-critical applications.
Option B: Amazon ElastiCache for Memcached cluster
- Reasoning: Amazon ElastiCache is a managed service for in-memory caching. It supports both Memcached and Redis. While it provides low-latency performance, it is designed for caching and not for durable storage. It is optimized for transient data that can be recreated, not for long-term, persistent storage.
- Why rejected: ElastiCache is not a persistent storage solution. It is designed for caching and high-speed data retrieval, not for durable storage needed by business-critical applications.
- Use case: Best for caching scenarios to improve application performance, but not suitable for durable storage needs.
Option C: Provisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume
- Reasoning: Provisioned IOPS SSD (io1 or io2) volumes in Amazon EBS are designed for high-performance, low-latency workloads that r...
Author: Liam · Last updated Aug 7, 2026
An online photo-sharing company stores its photos in an Amazon S3 bucket that exists in the us-west-1 Region. The company needs to store a copy of all new photos in the us-east-1 Region....
To solve this requirement of storing a copy of all new photos in the us-east-1 Region, let's evaluate each option based on key factors such as operational effort, efficiency, and automation.
Option A: Create a second S3 bucket in us-east-1. Use S3 Cross-Region Replication to copy photos from the existing S3 bucket to the second S3 bucket.
- Why it works: S3 Cross-Region Replication (CRR) is an automated feature that replicates objects between S3 buckets in different regions. This solution requires minimal operational effort once configured. It handles replication of new objects, and S3 handles the management of replication automatically.
- Key factor: Lowest operational effort. Once configured, CRR handles the replication without the need for continuous manual intervention.
- Why it's better than others: It automatically replicates new objects to the second S3 bucket without needing a Lambda function or additional configuration. This solution scales seamlessly and is designed for cross-region replication.
Option B: Create a cross-origin resource sharing (CORS) configuration of the existing S3 bucket. Specify us-east-1 in the CORS rule's AllowedOrigin element.
- Why it's not ideal: CORS is used for enabling web applications to request resources from different domains. It doesn't replicate or copy photos to another bucket; it simply allows cross-origin requests. It does not meet the requirement of storing a copy of the photos in another region.
- Why it is rejected: CORS is a policy for browser-based access control, not a method for replication or storage.
Option C: Create a second S3 bucket in us-east-1 across multiple Availability Zones. Create an S3 Lifecycle rule to save photos into the second S3 bucket.
- Why it’s not ideal: S3 Lifecycle policies manage the transition or deletion of objects in S3 buckets, but t...
Author: Elizabeth · Last updated Aug 7, 2026
A company is creating a new web application for its subscribers. The application will consist of a static single page and a persistent database layer. The application will have millions of users for 4 hours in the morning, but the application will have only a few thousand users during the rest of the day. The company's data architects have r...
To meet the requirements of the web application, which will experience varying load patterns (millions of users for 4 hours in the morning and fewer during the rest of the day), while also needing the ability to rapidly evolve the schema, let's evaluate each solution based on scalability, flexibility, and operational efficiency.
Option A: Deploy Amazon DynamoDB as the database solution. Provision on-demand capacity.
- Why it works: DynamoDB is a fully managed NoSQL database service that offers scalable, high-performance storage. With on-demand capacity mode, it automatically adjusts the read and write throughput based on the actual traffic, which is ideal for variable workloads, especially when traffic spikes and fluctuates throughout the day.
- Key factor: Scalability and ease of management. With on-demand capacity, DynamoDB automatically handles the traffic increase during peak hours (millions of users) without manual intervention. This is particularly useful for unpredictable traffic patterns.
- Why it's selected: DynamoDB allows rapid schema changes and handles high scalability demands seamlessly without needing to provision resources manually.
Option B: Deploy Amazon Aurora as the database solution. Choose the serverless DB engine mode.
- Why it works: Amazon Aurora serverless automatically adjusts database capacity based on application demand. It scales in response to traffic spikes (like the high number of users in the morning) and scales down during quieter periods. Aurora also allows for flexible schema evolution and supports SQL-based queries, making it ideal for relational data.
- Key factor: Scalability and schema flexibility. Aurora serverless is highly scalable, and its SQL support means it can accommodate complex queries. It’s also ideal for applications where demand fluctuates dramatically.
- Why it's selected: Aurora provides the scalability needed to handle millions of users in a short period while maintaining flexibility in schema changes. It's suitable for the use case where the schema might evolve rapidly.
Option C: Deploy Amazon DynamoDB as the database solution. Ensure that DynamoDB auto scaling is enabled.
- Why it's not ideal: While DynamoDB with auto scaling can handle changes in throughput requirements, it may not offer the same granular control over scaling as on-demand capacity mode. Auto scaling requires you to define target throughput settings, and it doesn't adapt as quickly to sudden increases in traffic as on-demand capacity.
- Why it's rejected: On-demand ...
Author: Rahul · Last updated Aug 7, 2026
A company uses Amazon API Gateway to manage its REST APIs that third-party service providers access. The company must protect the REST APIs from SQL injection and cross-site scripting attacks.
...
To protect REST APIs from SQL injection and cross-site scripting (XSS) attacks, we need to consider the most operationally efficient solution that can easily integrate with Amazon API Gateway and provide robust protection against these types of threats. Let's evaluate each option:
Option A: Configure AWS Shield
- Why it's not ideal: AWS Shield is a managed DDoS protection service that protects AWS services like CloudFront, Elastic Load Balancing, and Route 53 from large-scale DDoS attacks. However, Shield is not specifically designed for application-layer attacks like SQL injection or cross-site scripting. It primarily defends against network-level and transport-layer DDoS attacks.
- Why it's rejected: It doesn't provide the targeted protection against SQL injection and XSS, which are application-level vulnerabilities.
Option B: Configure AWS WAF
- Why it works: AWS WAF (Web Application Firewall) provides protection at the application layer and can specifically guard against common web exploits like SQL injection and cross-site scripting (XSS). AWS WAF allows you to define rules that inspect incoming web traffic and block malicious requests based on patterns. It integrates seamlessly with API Gateway.
- Key factor: Operational efficiency. AWS WAF can be directly associated with API Gateway, offering a highly customizable and automated solution to block specific attacks like SQL injection and XSS without the need for manual intervention.
- Why it's selected: AWS WAF is designed for protecting web applications, and it can easily be configured to block SQL injection and XSS attacks through predefined managed rules or custom rule sets.
Option C: Set up API Gateway with an Amazon CloudFront distribution. Configure AWS Shield in CloudFront.
- Why it's not ideal: While this setup provides DDoS protection (through AWS Shield in CloudFront), it doesn't provide protection against application-layer attacks suc...
Author: Sofia · Last updated Aug 7, 2026
A company wants to provide users with access to AWS resources. The company has 1,500 users and manages their access to on-premises resources through Active Directory user groups on the corporate network. However, the company does not want users to have to maintain another identity to access the resources. A solutions architect must manage user a...
To meet the company's requirement of managing access to AWS resources while preserving access to on-premises resources (and avoiding the need for users to maintain a separate identity for AWS), let's evaluate each option:
Option A: Create an IAM user for each user in the company. Attach the appropriate policies to each user.
- Why it's not ideal: Creating individual IAM users for all 1,500 users would require manual setup and maintenance, which is not scalable or efficient for a large number of users. Additionally, the company wants to avoid managing another identity source for AWS. This solution would introduce significant operational overhead in terms of user management and policy attachment.
- Why it's rejected: This solution does not leverage the existing Active Directory setup and would require additional user management work, which goes against the goal of avoiding the creation of separate identities for AWS.
Option B: Use Amazon Cognito with an Active Directory user pool. Create roles with the appropriate policies attached.
- Why it's not ideal: Amazon Cognito is typically used for user authentication for applications, not for integrating on-premises Active Directory groups directly. While it can connect with Active Directory through federated identities, it adds complexity and extra steps for integration. The requirement is to avoid managing a new identity pool or service.
- Why it's rejected: This solution would require setting up and maintaining an additional user pool and complicates the integration with the existing on-premises Active Directory setup. It also doesn’t completely eliminate the need for separate management of AWS identities.
Option C: Define cross-account roles with the appropriate policies attached. Map the roles to the Active Directory groups.
- Why it's not ideal: Cross-account roles are used for access between different AWS accounts, but the scenario here involves managing access within the same account. This option is not relevant to the problem of mapping on-premises Active Directory groups directly to AWS roles.
- Why it's rejected: Cross-account roles ar...
Author: Nathan · Last updated Aug 7, 2026
A company is hosting a website behind multiple Application Load Balancers. The company has different distribution rights for its content around the world. A solutions architect needs to ensure that users are served the correct content without violating ...
To meet the requirements of serving users the correct content based on distribution rights, the solutions architect needs to ensure the traffic is routed according to geolocation to meet specific regional distribution rules. Let's evaluate the options:
Option A: Configure Amazon CloudFront with AWS WAF
- Why it's not ideal: Amazon CloudFront is a Content Delivery Network (CDN) designed for caching and delivering content globally, but it alone does not handle the specific routing of traffic based on geographic location for content distribution rights. AWS WAF provides protection against common web application threats but doesn’t address geolocation-based routing for content delivery.
- Why it's rejected: While CloudFront with WAF can help with caching and security, it doesn’t solve the need to serve users content based on distribution rights defined by region.
Option B: Configure Application Load Balancers with AWS WAF
- Why it's not ideal: Application Load Balancers (ALBs) distribute traffic to web applications, but they don’t have the capability to route traffic based on geographic location. AWS WAF would provide protection against threats but doesn't address geolocation-based routing. ALBs are typically used for application-level traffic distribution rather than controlling the distribution of content based on users' regions.
- Why it's rejected: This solution does not meet the requirement of ensuring content distribution is handled by geolocation, as ALBs do not have built-in support for that.
Option C: Configure Amazon Route 53 with a geolocation policy
- Why it works: Amazon Route 53 is a highly scalable Domain Name System (DNS) service that can route traffic based on geolocation. By configuring Route 53 with a geolocation routing policy, the servi...
Author: Kunal · Last updated Aug 7, 2026
A company stores its data on premises. The amount of data is growing beyond the company's available capacity.
The company wants to migrate its data from the on-premises location to an Amazon S3 bucket. The company needs a solution that will automat...
To meet the company's requirement of migrating data to Amazon S3 with integrity validation after the transfer, let's analyze each option based on key factors like data transfer method, integrity validation, and suitability for growing data volumes.
A) Order an AWS Snowball Edge device. Configure the Snowball Edge device to perform the online data transfer to an S3 bucket.
- Analysis: AWS Snowball Edge is typically used for large-scale data migrations when high volumes of data need to be transferred in a physically secure manner. It supports both offline and online data transfers and allows for the validation of data integrity during the migration.
- Pros:
- Validates data integrity (hash-based).
- Suitable for large-scale data transfers with limited network bandwidth.
- Cons:
- Snowball Edge is typically designed for bulk, offline migrations rather than continuous or ongoing data transfer.
- The device itself must be ordered and shipped, which can add some time to the process, and it might not be ideal for ongoing real-time data migration.
Scenario: This option works well for bulk data transfer, but it is not optimal for continuous or online data transfer. Additionally, using Snowball Edge is better suited for one-time migrations and is more beneficial in environments with limited network connectivity.
B) Deploy an AWS DataSync agent on premises. Configure the DataSync agent to perform the online data transfer to an S3 bucket.
- Analysis: AWS DataSync is designed for automated data migration, offering high-speed, secure data transfer from on-premises to Amazon S3. It supports continuous transfer of growing datasets and includes automatic integrity validation via checksums during transfer.
- Pros:
- Supports large and growing datasets.
- Provides automated integrity validation, ensuring data accuracy after migration.
- Is specifically designed for online transfers with automatic scheduling and monitoring.
- Cons:
- May not be ideal if the data transfer needs to be done in a physical offline manner (such as in areas with limited connectivity).
Scenario: This solution is ideal for ongoing, real...
Author: Ahmed97 · Last updated Aug 7, 2026
A company wants to migrate two DNS servers to AWS. The servers host a total of approximately 200 zones and receive 1 million requests each day on average. The company wants to maximize availability while minimizing the operational overhead that is related t...
To migrate the company's DNS servers to AWS while maximizing availability and minimizing operational overhead, let's analyze each option based on key factors like high availability, management overhead, and the ability to handle 200 DNS zones with 1 million requests daily.
A) Create 200 new hosted zones in the Amazon Route 53 console Import zone files.
- Analysis: Amazon Route 53 is a highly available and scalable DNS service, and it can easily handle the 200 DNS zones and 1 million requests per day. It also offers automated health checks and routing policies, significantly reducing the operational overhead.
- Pros:
- Highly available and fully managed service.
- Eliminates the need to manage DNS servers.
- Scales automatically to handle high request volumes.
- Integrates with other AWS services, offering seamless management.
- Cons:
- Migration would involve manual steps to import all 200 zone files.
- Requires initial configuration to move data from the old servers to Route 53.
Scenario: This solution is ideal for companies looking to fully offload the management and scaling of DNS infrastructure to AWS with minimal ongoing maintenance. It is especially suitable when reducing operational overhead and maximizing availability is a priority.
B) Launch a single large Amazon EC2 instance Import zone files. Configure Amazon CloudWatch alarms and notifications to alert the company about any downtime.
- Analysis: This option involves running DNS servers on an EC2 instance. While it can handle DNS requests, it does not maximize availability. A single EC2 instance would create a single point of failure, which could be detrimental in a high-availability environment.
- Pros:
- Provides more control over the DNS configuration.
- Could potentially handle DNS requests if appropriately sized.
- Cons:
- Does not maximize availability since it relies on a single EC2 instance.
- Requires manual scaling and monitoring configuration.
- Increased operational overhead with management of EC2 instances and scaling.
Scenario: This solution is more suited for companies that require full control over their DNS configuration or specific custom configurations not available in Route 53. However, it does not meet the high availability requirement without additional complexity (e.g., EC2 failover, clustering).
C) Migrate the servers to AWS by using AWS Server Mi...
Author: Ishaan · Last updated Aug 7, 2026
A global company runs its applications in multiple AWS accounts in AWS Organizations. The company's applications use multipart uploads to upload data to multiple Amazon S3 buckets across AWS Regions. The company wants to report on incomplete multipart uploads f...
To determine the most suitable solution for reporting on incomplete multipart uploads across multiple AWS accounts in AWS Organizations with the least operational overhead, let's analyze each option based on factors like ease of use, automation, scalability, and the nature of the task (reporting incomplete multipart uploads).
A) Configure AWS Config with a rule to report the incomplete multipart upload object count.
- Analysis: AWS Config is a service that provides configuration monitoring and compliance auditing. However, it is primarily designed to track configuration changes and resource compliance, rather than operational tasks like multipart upload tracking.
- Pros:
- AWS Config can track a wide variety of resources and changes across AWS accounts.
- Cons:
- While AWS Config can be used for compliance, it is not well-suited for reporting on S3-specific issues like incomplete multipart uploads.
- Requires manual setup of rules, which can add operational overhead.
- AWS Config’s focus is on resource configuration, not specific storage reporting like multipart upload status.
Scenario: AWS Config is more suitable for compliance tracking of resource configurations rather than specific operational metrics like multipart uploads. It would be an over-engineered solution for this task.
B) Create a service control policy (SCP) to report the incomplete multipart upload object count.
- Analysis: Service Control Policies (SCPs) are used to define permissions and restrictions within AWS Organizations. They help control access to AWS services and resources but do not provide reporting capabilities or handle operational metrics like incomplete multipart uploads.
- Pros:
- SCPs are useful for controlling access and managing permissions within an organization.
- Cons:
- SCPs do not provide a mechanism to report or track multipart upload statuses.
- SCPs are not designed to monitor data or resource states, which makes them unsuitable for this use case.
Scenario: SCPs are useful for security and access management but not for reporting operational metrics like incomplete uploads.
C) Configure S3 Storage Lens to report the incomplete multipart upload object count.
- An...
Author: Leo · Last updated Aug 7, 2026
A company runs a production database on Amazon RDS for MySQL. The company wants to upgrade the database version for security compliance reasons. Because the database contains critical data, the company wants a quick solution to upgrade and test functionali...
To determine the best solution for upgrading the Amazon RDS for MySQL database with the least operational overhead while ensuring data integrity and security compliance, let's review each option based on key factors such as downtime, complexity, data integrity, and ease of use.
A) Create an RDS manual snapshot. Upgrade to the new version of Amazon RDS for MySQL.
- Analysis: This option involves creating a manual snapshot of the database before performing the upgrade to the new version. This ensures that the database can be restored to its previous state if needed.
- Pros:
- Simple and quick to perform with minimal operational complexity.
- Snapshot provides a backup in case the upgrade needs to be rolled back.
- Amazon RDS handles the upgrade process and can do so with minimal downtime.
- Cons:
- The upgrade process itself could involve some downtime (usually brief but dependent on the database size).
- No easy way to test the new version without affecting the production environment.
Scenario: This option works well when a simple upgrade with a backup is sufficient and minimal downtime is acceptable. However, it lacks an integrated mechanism for testing the new version before full deployment.
B) Use native backup and restore. Restore the data to the upgraded new version of Amazon RDS for MySQL.
- Analysis: Using native MySQL backup and restore involves manually exporting data from the existing RDS instance and restoring it to a new RDS instance running the upgraded version.
- Pros:
- Allows a clean restore to the upgraded version.
- Cons:
- Requires more manual steps, such as data export, restore, and validation.
- Can result in longer downtime as the backup and restore process can take time, especially for large datasets.
- Higher operational overhead compared to other solutions.
Scenario: This solution is useful if there are custom configurations or if the upgrade needs to be done outside of RDS capabilities, but it introduces unnecessary complexity and downtime for a simple version upgrade.
C) Use AWS Database Migration Service (AWS DMS) to replicate the data to the upgraded new version of Amazon RDS for MySQL.
- Analysis: AWS DMS can be used to replicate data between source and target databases, ensuring data consistency while allowing the production database to remain online during the migration.
- Pros:
- DMS can keep the orig...
Author: Suresh · Last updated Aug 7, 2026
A solutions architect is creating a data processing job that runs once daily and can take up to 2 hours to complete. If the job is interrupted, it has to restart from the beginning.
How sh...
To determine the best solution for this data processing job, we need to consider factors such as cost-effectiveness, the job's nature (which may run up to 2 hours and requires a restart if interrupted), scalability, and ease of management. Let's evaluate each option:
A) Create a script that runs locally on an Amazon EC2 Reserved Instance that is triggered by a cron job.
- Analysis: Using an EC2 Reserved Instance means you are paying for an instance that is always running, regardless of whether the job is running or idle. This could lead to unnecessary costs, especially for a job that runs only once daily and for a short duration (up to 2 hours).
- Pros:
- Offers full control over the environment.
- Cons:
- Reserved Instances are billed regardless of usage, which is costly for a job that only runs once per day.
- Not as cost-effective for infrequent use, as you're paying for a server that runs continuously.
- Managing cron jobs and ensuring that interruptions and restarts are handled adds operational overhead.
Scenario: This option is suitable when you need full control over the environment, but it is not cost-effective for a job that runs infrequently.
B) Create an AWS Lambda function triggered by an Amazon EventBridge scheduled event.
- Analysis: AWS Lambda is a serverless solution that charges based on the number of executions and execution time, which makes it cost-effective for intermittent jobs. However, Lambda has a maximum execution time limit of 15 minutes. Since the job can take up to 2 hours, Lambda would not be suitable for this use case.
- Pros:
- Extremely cost-effective for short-duration, event-driven tasks.
- Serverless, with no infrastructure to manage.
- Cons:
- The execution time limit of 15 minutes would prevent Lambda from running jobs that take up to 2 hours.
Scenario: Lambda is great for short-duration tasks but not suitable for long-running tasks like the one in this scenario.
C) Use an Amazon Elastic Container Service (Amazon ECS) Fargate task triggered by an Amazon EventBridge scheduled event.
- Analysis: Amazon ECS with Fargate is a serverless container orchestration service that allows you to...
Author: Joseph · Last updated Aug 7, 2026
A social media company wants to store its database of user profiles, relationships, and interactions in the AWS Cloud. The company needs an application to monitor any changes in the database. The application needs to analyze the relationships between the data entities and to...
To address the requirements for a social media company that needs to store user profiles, relationships, and interactions in the AWS Cloud, and requires an application to monitor changes, analyze relationships, and provide recommendations, we need to carefully consider the capabilities of each option. Let’s break down each option based on key factors like operational overhead, suitability for relationship analysis, scalability, and integration:
Key Factors for Selection:
- Operational Overhead: The solution should minimize operational complexity. This means selecting options that handle scaling, monitoring, and management with minimal effort.
- Relationships and Recommendations: The solution should be optimized for managing relationships between data entities (e.g., user profiles, friends, interactions). A graph-based solution would be ideal for relationship analysis.
- Change Monitoring: The solution needs a mechanism to monitor changes in the database and process them in real-time to generate recommendations.
- Data Consistency and Integrity: Since the solution is related to user interactions and relationships, maintaining consistency and reliability of data is essential.
---
Option A: Use Amazon Neptune to store the information. Use Amazon Kinesis Data Streams to process changes in the database.
- Amazon Neptune: A fully managed graph database service optimized for storing and querying graph data, making it well-suited for handling relationships between entities (such as user profiles, friends, interactions). It supports both property graph and RDF graph models, which can help in analyzing relationships.
- Amazon Kinesis Data Streams: Kinesis Data Streams allows for real-time data streaming but doesn't integrate natively with Neptune for change tracking. This means additional work is required to integrate Kinesis with Neptune and ensure that changes are processed in real-time.
- Operational Overhead: There is added complexity in manually setting up the integration between Kinesis and Neptune. You need to handle the coordination of these services, which could increase operational overhead.
Option B: Use Amazon Neptune to store the information. Use Neptune Streams to process changes in the database.
- Amazon Neptune: As stated, Neptune is the right choice for graph-based storage and relationships.
- Neptune Streams: Neptune Streams provides a native feature to track changes to data in Neptune in real time, including updates to nodes and edges in the graph. This is well integrated with Neptune, reducing the operational over...
Author: Layla · Last updated Aug 7, 2026
A company is creating a new application that will store a large amount of data. The data will be analyzed hourly and will be modified by several Amazon EC2 Linux instances that are deployed across multiple Availability Zones. The needed amount of storage space will continue to ...
Key Factors for Selection:
- Scalability: The solution needs to handle the growing amount of storage for the next 6 months.
- Data Access: The data will be analyzed hourly and will be modified by several Amazon EC2 Linux instances across multiple Availability Zones (AZs). This implies that the data must be readily accessible with low-latency access.
- Multi-AZ Access: The solution needs to support multiple EC2 instances, potentially across multiple Availability Zones, and allow for seamless access.
- Performance: The data will be modified frequently, so the solution must allow for high-throughput and low-latency writes and reads.
---
Option A: Store the data in Amazon S3 Glacier. Update the S3 Glacier vault policy to allow access to the application instances.
- Amazon S3 Glacier: S3 Glacier is designed for long-term archival storage with retrieval times ranging from minutes to hours. This is primarily intended for infrequent access to data that does not require frequent modification or low-latency access.
- Data Modification: Since the data will be modified frequently (every hour), S3 Glacier is not suitable. Retrieval times are too slow, and writing/reading data would incur unnecessary delays.
- Use Case: S3 Glacier would be suitable for archiving infrequently accessed data, but not for applications that require high-performance, real-time access with frequent modifications.
- Rejected: This option is not suitable due to its slow retrieval times and lack of support for frequent data modification.
Option B: Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the application instances.
- Amazon EBS: EBS provides block-level storage that can be attached to individual EC2 instances. However, EBS volumes are tied to a single Availability Zone. For a multi-AZ deployment, you would need to implement replication or other methods to ensure redundancy and access across AZs.
- Single AZ Limitation: EBS volumes are limited to a single AZ. Since the application instances are across multiple AZs, accessing EBS from multiple AZs requires complex configurations like replication or using Amazon Elastic File System (EFS) for shared access.
- Use Case: EBS is useful for high-performance, low-latency storage attached to individual EC2 instances, but it doesn't meet the multi-AZ access requirement without additional configurations.
- Rejected: This option is rejected due to the limitation of EBS being tied to a single Availabili...
Author: Zara · Last updated Aug 7, 2026
A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. Increases in traffic are causing performance problems. The company determines that database queries are the primary reason for th...
Key Factors for Selection:
- Performance Issue: The problem is slow performance due to database queries, which are most likely related to read-heavy traffic, potentially causing contention or resource bottlenecks in the primary DB instance.
- Traffic Type: The goal is to improve performance, especially for read traffic, by offloading some of the load from the primary DB instance.
- Scalability and Redundancy: The solution should help scale the database to handle increased traffic while maintaining availability and reliability.
---
Option A: Serve read traffic from the Multi-AZ standby replica.
- Amazon RDS Multi-AZ: In a Multi-AZ configuration, the standby replica is a synchronous replica that is automatically updated and used for failover. However, standby replicas are not designed for read traffic. They are intended for disaster recovery and failover purposes.
- Rejected: This option would not improve performance because the standby replica cannot be used for serving read traffic in a Multi-AZ setup. The standby replica is not readable unless you promote it to be the primary instance during failover, which would cause downtime.
Option B: Configure the DB instance to use Transfer Acceleration.
- Transfer Acceleration: This feature is associated with Amazon S3 to speed up data uploads and downloads over long distances. It is not relevant for improving RDS database performance, as RDS does not use S3 Transfer Acceleration for database queries.
- Rejected: This option is not suitable because Transfer Acceleration does not address database query performance or reduce latency for RDS.
Option C: Create a read replica from the source DB instance. Serve read traffic from the read replica.
- Read Replica: Amazon RDS allows creating read replicas, which are asynchronous copies of the primary database instance. By offloading read traffic to the r...
Author: Olivia · Last updated Aug 7, 2026
A company collects 10 GB of telemetry data daily from various machines. The company stores the data in an Amazon S3 bucket in a source data account.
The company has hired several consulting agencies to use this data for analysis. Each agency needs read access to the data for its analysts. The company must share the data from the...
Key Factors for Selection:
- Security: The solution must ensure that access to the telemetry data is controlled and secure, preventing unauthorized access.
- Operational Efficiency: The solution must be efficient to manage, especially given that the company needs to share the data with multiple consulting agencies, and ideally should not require manual effort to manage access at an individual level for each user.
- Scalability: The solution should be scalable as the number of agencies and analysts may increase over time.
- Ease of Management: The solution should minimize the operational overhead associated with managing access.
---
Option A: Configure S3 global tables to replicate data for each agency.
- S3 Global Tables: S3 Global Tables is a feature typically used in Amazon DynamoDB for cross-region replication, not for Amazon S3. There is no equivalent feature in Amazon S3 for replicating data across accounts for read access.
- Rejected: This option is not applicable as S3 Global Tables does not exist, and cross-account replication in S3 is managed differently.
Option B: Make the S3 bucket public for a limited time. Inform only the agencies.
- Public Access: Making the S3 bucket public would expose the data to anyone on the internet, which is highly insecure, even if you inform the agencies about the limited time. It could result in unintended access or misuse of the data.
- Security Concerns: Making the bucket public introduces significant security risks and should be avoided unless absolutely necessary, which is not the case here.
- Rejected: This option is rejected due to the significant security risks involved with public access.
Option C: Configure cross-account access for the S3 bucket to the accounts that the agencies own.
- Cross-Account Access: Using cross-account access is a secure and efficient way to share data from an S3 bucket with other AWS accounts. You can grant read-only access to the S3 bucket ...
Author: Ishaan · Last updated Aug 7, 2026
A company uses Amazon FSx for NetApp ONTAP in its primary AWS Region for CIFS and NFS file shares. Applications that run on Amazon EC2 instances access the file shares. The company needs a storage disaster recovery (DR) solution in a secondary Region. The data that is replicated in the secondary Region needs to be acces...
Key Factors for Selection:
- Data Replication: The solution needs to replicate data between the primary and secondary Regions for disaster recovery (DR), ensuring that the same protocols (CIFS and NFS) can be used in the secondary Region for accessing the replicated data.
- Operational Overhead: The solution should minimize manual intervention and management complexity. This means choosing a solution that integrates seamlessly with the existing setup and requires minimal configuration.
- Protocol Support: The solution must allow access to the replicated data using the same protocols (CIFS and NFS) as in the primary Region, ensuring consistency and compatibility for the applications.
- Disaster Recovery Requirements: The solution should provide a reliable, scalable, and efficient way to handle disaster recovery without disrupting normal operations.
---
Option A: Create an AWS Lambda function to copy the data to an Amazon S3 bucket. Replicate the S3 bucket to the secondary Region.
- AWS Lambda and S3: Lambda can be used for automation, and S3 provides durable storage, but S3 does not support CIFS or NFS protocols. Applications that rely on CIFS or NFS to access file shares would not be able to directly use data stored in S3, which would require additional steps to reconfigure applications or change the way data is accessed.
- Operational Complexity: While the Lambda function can automate copying, accessing the data with CIFS or NFS would require additional steps, such as re-architecting the applications to read from a different storage service. This increases operational overhead and complexity.
- Rejected: This solution is not ideal because S3 does not support the necessary protocols (CIFS and NFS), making it incompatible with the current application architecture.
Option B: Create a backup of the FSx for ONTAP volumes by using AWS Backup. Copy the volumes to the secondary Region. Create a new FSx for ONTAP instance from the backup.
- AWS Backup: AWS Backup can back up FSx for ONTAP volumes, but the process of copying backups to the secondary Region and creating a new FSx instance involves several manual steps and does not provide real-time replication. This method also introduces recovery time and potential downtime, which may not be ideal for disaster recovery.
- Operational Overhead: The backup and recovery process requires manual intervention, adding operational overhead an...
Author: Madison · Last updated Aug 7, 2026
A development team is creating an event-based application that uses AWS Lambda functions. Events will be generated when files are added to an Amazon S3 bucket. The development team currently has Amazon Simple Notification Service (Amazon SNS) configured as the event ta...
To process events from Amazon S3 in a scalable way using AWS Lambda functions, let's evaluate the options one by one:
A) Create an SNS subscription that processes the event in Amazon Elastic Container Service (Amazon ECS) before the event runs in Lambda:
- Reason for rejection: Amazon ECS is a container orchestration service designed for running containerized applications, not for event-driven processing in this scenario. ECS involves managing infrastructure and scaling, which is not necessary when processing events from Amazon S3 in a serverless fashion. Lambda would be a more efficient, cost-effective solution for this type of event-driven architecture.
B) Create an SNS subscription that processes the event in Amazon Elastic Kubernetes Service (Amazon EKS) before the event runs in Lambda:
- Reason for rejection: Similar to ECS, Amazon EKS is a managed Kubernetes service that involves managing containerized applications and clusters, which introduces complexity for event-driven processing. It's typically used for larger, more complex application workloads, and wouldn't be the most efficient way to handle S3 events before passing them to Lambda.
C) Create an SNS subscription that sends the event to Amazon Simple Queue...
Author: MysticJaguar44 · Last updated Aug 7, 2026
A solutions architect is designing a new service behind Amazon API Gateway. The request patterns for the service will be unpredictable and can change suddenly from 0 requests to over 500 per second. The total size of the data that needs to be persisted in a backend database is currently less than 1 GB with unpredictable future ...
Let's evaluate the options to determine which combination of AWS services would meet the requirements of an unpredictable request pattern with simple key-value queries and a backend database with unpredictable future growth:
Key Requirements:
- Unpredictable request patterns: The service should be able to scale dynamically from 0 to over 500 requests per second.
- Small backend data storage (less than 1 GB currently): We need a backend database solution that can handle a small amount of data now but scale as needed in the future.
- Key-value queries: The data can be queried using simple key-value requests.
Option Analysis:
A) AWS Fargate:
- Reason for rejection: AWS Fargate is a serverless compute service for containers. While it can automatically scale the compute capacity for containerized applications, it introduces unnecessary complexity for handling simple key-value requests and database interactions in this case. It’s typically used for long-running applications or complex workloads that require container orchestration. It doesn’t align well with the key-value query requirement and unpredictable request patterns.
B) AWS Lambda:
- Reason for selection: AWS Lambda is ideal for event-driven, unpredictable workloads. It automatically scales in response to incoming requests, with no need to manage infrastructure. Lambda would be well-suited for handling the unpredictable request patterns, especially when paired with API Gateway. It is highly cost-effective for low-volume or infrequent workloads, and it scales seamlessly without worrying about provisioning resources. This makes Lambda a great fit for handling API requests in this scenario.
C) Amazon DynamoDB:
...
Author: Zara · Last updated Aug 7, 2026
A company collects and shares research data with the company's employees all over the world. The company wants to collect and store the data in an Amazon S3 bucket and process the data in the AWS Cloud. The company will share the data with the company's employees. The company need...
Let's evaluate the options based on the company's requirement for securely storing and sharing research data with employees, minimizing operational overhead, and ensuring simplicity in access:
Key Requirements:
- Secure solution for data sharing: The data needs to be stored securely and shared with employees across the world.
- Minimize operational overhead: The solution should not require extensive management or configuration.
- Easy access for employees: The solution should allow employees to securely access the data.
Option Analysis:
A) Use an AWS Lambda function to create an S3 presigned URL. Instruct employees to use the URL:
- Reason for selection: This approach allows secure, temporary access to specific files in the S3 bucket without needing to expose full S3 access permissions. Lambda can generate presigned URLs with defined expiration times, offering control over access duration. The presigned URL mechanism is secure, easy to implement, and requires minimal operational overhead. This is ideal for a scenario where the employees need temporary access to specific files rather than continuous access.
- Scenario Use: Best when you need controlled, time-limited access to certain files in S3. It is ideal for sharing research data on a temporary basis with employees globally.
B) Create an IAM user for each employee. Create an IAM policy for each employee to allow S3 access. Instruct employees to use the AWS Management Console:
- Reason for rejection: While this method is secure, it introduces high operational overhead. Managing individual IAM users and policies for each employee is cumbersome, especially when dealing with a large number of employees. Employees would need to interact with the AWS Management Console, which may not be user-friendly for those without deep AWS experience. This method also does not scale well and can become complex and error-prone.
- Scenario Use: Suitable for a small number of employees who need fine-grained access to AWS resources directly via the AWS Console, but not ideal for large-scale sharing.
C) Cre...
Author: Noah · Last updated Aug 7, 2026
A company is building a new furniture inventory application. The company has deployed the application on a fleet ofAmazon EC2 instances across multiple Availability Zones. The EC2 instances run behind an Application Load Balancer (ALB) in their VPC.
A solutions architect has observed that incoming traffic se...
Let's analyze the options to determine the best solution for the observed issue where incoming traffic is favoring one EC2 instance, resulting in latency for some requests:
Key Problem:
- Traffic imbalance: Incoming traffic is favoring one EC2 instance behind the ALB, causing latency for some requests. This suggests that the Application Load Balancer (ALB) might not be distributing traffic evenly across the available EC2 instances.
Option Analysis:
A) Disable session affinity (sticky sessions) on the ALB:
- Reason for selection: Sticky sessions (also called session affinity) cause the ALB to route requests from the same client to the same EC2 instance based on a session cookie. If sticky sessions are enabled, it could lead to uneven traffic distribution, where certain instances may handle a disproportionate amount of traffic. Disabling sticky sessions ensures that the ALB routes requests in a more even, stateless manner, which is ideal for load balancing in most scenarios. Disabling sticky sessions can help resolve the issue by allowing the ALB to more evenly distribute traffic.
- Scenario Use: This is a good solution if session affinity (sticky sessions) is the cause of the traffic imbalance.
B) Replace the ALB with a Network Load Balancer:
- Reason for rejection: A Network Load Balancer (NLB) operates at the connection level (Layer 4), while an Application Load Balancer (ALB) operates at the HTTP/HTTPS request level (Layer 7). The ALB is better suited for routing HTTP requests, and replacing it with an NLB wouldn't necessarily solve the issue of uneven traffic distribution. The NLB is more appropriate for high-performance, low-latency applications, but it would not provide the same level of advanced routing features and metrics as the ALB.
- ...
Author: Daniel · Last updated Aug 7, 2026
A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service (AWS KMS) keys. A solutions architect needs to design a solution that will ens...
Let's analyze the options in order to select the appropriate combination of actions that will ensure the required permissions are set correctly for the Lambda function to download and decrypt files from Amazon S3 using AWS KMS keys.
Key Requirements:
- The Lambda function needs permission to decrypt files that are encrypted with AWS KMS keys.
- The required permissions need to be set to ensure that the Lambda function can access the encrypted files in S3 and perform decryption operations.
Option Analysis:
A) Attach the kms:decrypt permission to the Lambda function’s resource policy:
- Reason for rejection: Lambda resource policies are used to control access for invocations from specific sources (such as Amazon API Gateway or other services), but not for granting KMS decryption permissions. Permissions to access KMS resources (like decrypting files in S3) must be granted to the Lambda function's execution role, not through the Lambda resource policy. Hence, this option is not applicable for granting decryption permissions.
B) Grant the decrypt permission for the Lambda IAM role in the KMS key's policy:
- Reason for selection: KMS key policies control who can perform operations like encryption and decryption on a particular KMS key. Granting the `kms:decrypt` permission to the Lambda IAM role in the KMS key's policy ensures that the Lambda function (through its IAM role) has the necessary permissions to decrypt data that is encrypted using that KMS key. This is a valid and secure way to control decryption access to the Lambda function.
C) Grant the decrypt permission for the Lambda resource policy in the KMS key's policy:
- Reason for rejection: Lambda resource policies are used for controlling who can invoke the Lambda ...
Author: Michael · Last updated Aug 7, 2026
A company wants to monitor its AWS costs for financial review. The cloud operations team is designing an architecture in the AWS Organizations management account to query AWS Cost and Usage Reports for all member accounts. The team must run this query once a month and provide a ...
To determine the most scalable and cost-effective solution, let's review the options based on the key factors: cost, scalability, ease of use, and efficiency in fulfilling the monthly analysis requirement.
A) Enable Cost and Usage Reports in the management account. Deliver reports to Amazon Kinesis. Use Amazon EMR for analysis.
- Cost: Amazon Kinesis and Amazon EMR can incur significant costs, especially when handling large datasets and performing complex data analysis. It requires managing and scaling EMR clusters, which adds additional operational overhead.
- Scalability: Kinesis and EMR are scalable, but for the use case of simple monthly billing analysis, they are overkill. This approach is designed for real-time streaming data and big data processing, which adds complexity that may not be needed for monthly cost analysis.
- Efficiency: This is an unnecessarily complex solution for the requirement, as managing Kinesis streams and EMR clusters requires ongoing administration and maintenance.
- When to use: This option is more suitable for real-time data processing and large-scale data analysis, not for monthly cost reporting.
B) Enable Cost and Usage Reports in the management account. Deliver the reports to Amazon S3. Use Amazon Athena for analysis.
- Cost: S3 storage is cost-effective for storing the AWS Cost and Usage Reports. Athena allows for serverless querying, so there are no infrastructure costs, and you only pay for the queries you run, which is cost-efficient for monthly analysis.
- Scalability: This option is highly scalable as S3 can handle large amounts of data, and Athena can scale to query massive datasets with minimal management effort.
- Efficiency: Athena allows users to run SQL queries directly on the data stored in S3, providing an efficient and low-latency way to query the reports. It requires minimal setup and is easy to use.
- When to use: Ideal for cost-effective and scalable querying of large datasets without the need for managing infrastructure or complex data processing pipelines.
C) Enable Cost and Usage Reports for member accounts. Deliver the reports to Amazon S3. Use Amazon Redshift for analysis.
- Cost: Redsh...
Author: Matthew · Last updated Aug 7, 2026
A company wants to run a gaming application on Amazon EC2 instances that are part of an Auto Scaling group in the AWS Cloud. The application will transmit data by using UDP packets. The company wants to ensure that the application can scale out and...
To determine the best solution for running a gaming application on EC2 instances in an Auto Scaling group that uses UDP packets, let's evaluate each option based on traffic handling, scalability, and suitability for UDP traffic.
A) Attach a Network Load Balancer to the Auto Scaling group.
- Traffic Handling: A Network Load Balancer (NLB) is designed to handle high-performance, low-latency TCP and UDP traffic. It can handle millions of requests per second and supports UDP traffic natively, which is essential for this gaming application that uses UDP packets.
- Scalability: NLB automatically scales based on incoming traffic, which is ideal for this use case since the Auto Scaling group will scale in and out based on traffic load.
- Suitability for UDP Traffic: NLB is specifically designed to support UDP, which is the key requirement here for the gaming application. NLB will efficiently distribute UDP traffic to the EC2 instances in the Auto Scaling group.
- When to use: This solution is perfect for applications that require low-latency, high-throughput, and efficient handling of UDP traffic.
B) Attach an Application Load Balancer to the Auto Scaling group.
- Traffic Handling: An Application Load Balancer (ALB) is optimized for HTTP/HTTPS traffic and operates at the application layer (Layer 7). It does not support UDP traffic, making it unsuitable for this gaming application.
- Scalability: While ALB can scale with traffic, it does not meet the requirement to handle UDP packets, making it a poor choice for this use case.
- Suitability for UDP Traffic: ALB does not support UDP traffic, so it cannot meet the application’s needs.
- When to use: ALB is more suitable for web applications that handle HTTP/HTTPS traffic, not for UDP-based applications like gaming.
C) Deploy an Amazon Route 53 record set with a weighted policy to route traffic appropriately.
- Traffic Handling: Amazon Route 53 is a DNS service that can direct traffic to various resources based on routing policies, such as weighted routing. However, Route 53 is not designed for load ...
Author: Noah · Last updated Aug 7, 2026
A company runs several websites on AWS for its different brands. Each website generates tens of gigabytes of web traffic logs each day. A solutions architect needs to design a scalable solution to give the company's developers the ability to analyze traffic patterns across all the company's websites. This analysis by the developers will occur on demand once a week...
To determine the most cost-effective and scalable solution for analyzing web traffic logs, let's evaluate each option based on cost, scalability, query requirements, and ease of use.
A) Store the logs in Amazon S3. Use Amazon Athena for analysis.
- Cost: Storing logs in Amazon S3 is extremely cost-effective, especially for large datasets. Athena is a serverless service that allows you to query data directly in S3 using standard SQL without managing infrastructure. You only pay for the queries you run, making it highly cost-efficient.
- Scalability: Both Amazon S3 and Athena are highly scalable. S3 can handle an enormous amount of data without any performance degradation, and Athena can efficiently query large datasets in S3.
- Query Requirements: Athena supports SQL queries, so the developers can perform on-demand analysis of the logs with standard SQL, which matches the requirement.
- Ease of Use: Athena is easy to set up and does not require provisioning or managing servers. It’s a fully managed solution that integrates well with S3.
- When to use: Ideal for large, unstructured data that needs to be queried periodically. Given that the logs are generated in large quantities but only need to be analyzed once a week, Athena is an optimal choice as it’s both cost-effective and scalable.
B) Store the logs in Amazon RDS. Use a database client for analysis.
- Cost: Amazon RDS can be expensive for storing large datasets, especially considering the volume of web traffic logs. RDS is a managed relational database service, but it requires you to provision instances and manage the database, which incurs more cost compared to S3 and Athena.
- Scalability: While RDS can scale vertically by upgrading instances, it is not as well-suited for handling vast amounts of logs as S3 and Athena. Managing the scaling of RDS can be more complex, and it might not be as efficient as using a serverless solution.
- Query Requirements: RDS supports SQL queries, which aligns with the requirement for SQL-based analysis. However, setting up RDS for this purpose would require more management.
- Ease of Use: RDS requires more setup and management compared to a serverless solution like Athena. It involves configuring the database schema, managing scaling, and backups, which increases operational overhead.
- When to use: RDS is more appropriate for transactional databases and applications that require frequent querying of structured data, not for large-scale, on-demand log analysis.
C) Store the logs in Amazon OpenSearch Service. Use OpenSearch Service for analysis.
- Cost: OpenSearch Service (formerly Elasticsearch) is suitable for search and log analytics but can be more expensi...
Author: Noah · Last updated Aug 7, 2026
An international company has a subdomain for each country that the company operates in. The subdomains are formatted as example.com, country1.example.com, and country2.example.com. The company's workloads are behind an Application Load Balancer. The company wants to en...
To meet the requirement of encrypting website data in transit, we need to consider two key factors: certificate management (for domain validation) and validation methods (to prove ownership of the domain). Let's analyze the options based on these factors.
A) Use the AWS Certificate Manager (ACM) console to request a public certificate for the apex top domain example.com and a wildcard certificate for .example.com.
- Reasoning: This option involves requesting a public certificate for both the apex domain (example.com) and a wildcard certificate for the subdomains (.example.com). A wildcard certificate will cover all subdomains, such as country1.example.com, country2.example.com, etc., allowing for encrypted communication across all the subdomains without needing separate certificates for each.
- Suitability: The use of a wildcard certificate is perfect for this scenario, as it enables encryption across multiple subdomains with a single certificate.
- Validation: Public certificates issued by ACM are typically validated using DNS or email validation.
- Why it is selected: This is the most cost-effective and simple approach to cover both the apex domain and its subdomains with encryption.
B) Use the AWS Certificate Manager (ACM) console to request a private certificate for the apex top domain example.com and a wildcard certificate for .example.com.
- Reasoning: A private certificate is used within the company’s internal network, typically for private communication, and is not suitable for public-facing websites. This option would not meet the requirement for encrypting website data for external customers.
- Suitability: Private certificates are not suitable for public websites because they cannot be trusted by external clients like web browsers.
- Why it is rejected: Since the company’s websites are public-facing, using a private certificate does not meet the encryption requirement for external users.
C) Use the AWS Certificate Manager (ACM) console to request a public and private certificate for the apex top domain example.com.
- Reasoning: This option includes both a public and a private certificate. However, there is no clear need for a private certificate for this use case since the company’s websites are pu...
Author: Maya2022 · Last updated Aug 7, 2026
A company is required to use cryptographic keys in its on-premises key manager. The key manager is outside of the AWS Cloud because of regulatory and compliance requirements. The company wants to manage encryption and decryption by using cryptographic keys that are retained outside of the AWS Cloud and that support a va...
The company’s requirement is to manage cryptographic keys in an on-premises key manager that is outside the AWS Cloud, with support for external key managers from different vendors. The solution must have minimal operational overhead. Let’s evaluate each option based on these criteria.
A) Use AWS CloudHSM key store backed by a CloudHSM cluster.
- Reasoning: AWS CloudHSM is a fully managed hardware security module (HSM) service that provides secure key management within the AWS Cloud. However, this option would not meet the requirement of keeping the keys outside of the AWS Cloud. The keys would still be stored in the AWS Cloud and managed by CloudHSM, making it unsuitable for the company’s needs.
- Why it is rejected: The primary requirement is to store the keys in an on-premises key manager outside of the AWS Cloud, which is not supported by AWS CloudHSM. This option involves the management of keys in the AWS Cloud, which contradicts the company’s compliance requirement.
B) Use an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.
- Reasoning: AWS KMS External Key Store (XKS) allows AWS KMS to manage keys that are stored in an external key manager outside of the AWS Cloud. This is an ideal option for scenarios where the cryptographic keys must be retained outside of AWS due to regulatory and compliance requirements. AWS KMS can still provide encryption and decryption services by integrating with the external key manager (which can be on-premises or with another vendor).
- Suitability: This solution aligns perfectly with the company’s requirement of using cryptographic keys stored outside AWS while minimizing operational overhead. It also supports integration with various external key managers from different vendors.
- Why it is selected: This solution provides the least operational overhead because it combines the benefits of ...
Author: Ava · Last updated Aug 7, 2026
A solutions architect needs to host a high performance computing (HPC) workload in the AWS Cloud. The workload will run on hundreds of Amazon EC2 instances and will require parallel access to a shared file system to enable distributed processing of large datasets. Datasets will be accessed across multiple instances simultaneously. The workload requires access latency w...
To determine the best solution for the HPC workload in the AWS Cloud, we need to assess the performance requirements, the need for parallel access, and the postprocessing needs. Let's break down each option and its suitability for the given scenario:
A) Use Amazon Elastic File System (Amazon EFS) as a shared file system. Access the dataset from Amazon EFS.
- Suitability: Amazon EFS is a managed, scalable file storage solution that provides shared access for multiple EC2 instances. It supports NFS protocol and can scale automatically. However, EFS is typically designed for low to moderate performance workloads, not for high-performance computing (HPC) with low-latency requirements.
- Why it’s rejected: EFS offers higher latencies (ranging from tens of milliseconds to more) compared to the <1 ms requirement of this HPC workload. It also might not perform optimally for the heavy parallel access expected in HPC scenarios where high throughput and low latency are crucial.
B) Mount an Amazon S3 bucket to serve as the shared file system. Perform postprocessing directly from the S3 bucket.
- Suitability: Amazon S3 provides scalable object storage but is not designed to act as a traditional shared file system. While it can serve as storage for data, it doesn't support low-latency random access needed for HPC workloads. S3 is typically used for bulk storage, not for high-performance parallel access.
- Why it’s rejected: S3 has higher access latencies (typically tens of milliseconds), does not support simultaneous parallel file system access, and lacks the low-latency characteristics required for high-performance computing.
C) Use Amazon FSx for Lustre as a shared file system. Link the file system to an Amazon S3 bucket for postprocessing.
- Suitability: Amazon FSx for Lustre...
Author: Andrew · Last updated Aug 7, 2026
A gaming company is building an application with Voice over IP capabilities. The application will serve traffic to users across the world. The application needs to be highly available with an automated failover across AWS Regions. The company wants to minimize the latency of users ...
To meet the requirements of providing low latency, high availability, and automated failover across AWS Regions for the gaming company's Voice over IP (VoIP) application, let's analyze each option and determine which one is most suitable:
A) Use AWS Global Accelerator with health checks.
- Suitability: AWS Global Accelerator is a service that improves the availability and performance of applications with global users. It uses a global network to route traffic to the optimal endpoint based on health, geography, and routing policies. With health checks and automatic failover, Global Accelerator can route traffic to the healthiest endpoint, ensuring high availability across AWS Regions. It helps reduce latency by directing traffic to the closest AWS edge location, providing low-latency routing.
- Why it’s selected: Global Accelerator is designed for use cases that require low-latency traffic routing and high availability across multiple regions. It avoids IP address caching issues because it provides static IP addresses for the application endpoints. This solution meets the needs for minimal latency, automated failover, and global coverage with low reliance on DNS caching.
B) Use Amazon Route 53 with a geolocation routing policy.
- Suitability: Amazon Route 53 provides DNS services and supports routing policies like geolocation, which routes traffic based on the geographic location of users. Geolocation routing helps direct users to the nearest endpoint in a region, thus reducing latency. However, Route 53 alone does not provide the automated failover across regions or high availability management like Global Accelerator.
- Why it’s rejected: While geolocation routing can minimize latency by sending users to the nearest endpoint, Route 53 doesn't provide as seamless failover and global traffic management as Global Accelerator. Additionally, Route 53 relies on DNS, which can suffer from caching issues on user devices, leading to stale IP addresses or delays in failover. This makes it less i...
Author: Nia · Last updated Aug 7, 2026
A weather forecasting company needs to process hundreds of gigabytes of data with sub-millisecond latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities.
A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput. Files that are stored in the solution should ...
To meet the requirements of the weather forecasting company, we need to ensure the solution supports high throughput, sub-millisecond latency, high availability, and concurrent access by thousands of compute instances to process large datasets. Let's analyze the available options based on these criteria:
A) Use Amazon FSx for Lustre scratch file systems.
- Suitability: Amazon FSx for Lustre is designed for high-performance workloads that require low latency and high throughput. The scratch file system type is optimized for temporary storage of large datasets that are processed by HPC workloads. However, scratch file systems are typically used for temporary or intermediate storage and are not intended for long-term, highly available data storage.
- Why it’s rejected: FSx for Lustre scratch file systems do not provide the durability and availability required for the company's persistent data storage. While it offers high throughput, it is not suited for datasets that need to be stored and accessible over a long period and by thousands of compute instances.
B) Use Amazon FSx for Lustre persistent file systems.
- Suitability: FSx for Lustre persistent file systems provide high-performance storage with low latency, making them ideal for HPC workloads. It is designed for use cases where the data needs to be accessible over a long period and supports high-throughput parallel access by multiple compute instances. This option would provide the high availability and performance needed for processing large datasets.
- Why it’s selected: FSx for Lustre persistent file systems offer the required high throughput and low-latency access, are designed to handle sustained workloads, and support multiple instances accessing data concurrently. They also provide the durability and availability required for long-term data storage, which is suitable for the weather forecasting company's needs.
C) Use Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode.
- Suitability: Amazon EFS is a scalable, managed file...
