A company remains eligible to use AWS Application Discovery Service as an existing customer. It must group supported VMware VMs and physical servers into migration waves.
Previous testing showed unacceptable latency when tightly coupled components were split between the data center and AWS. The CMDB is incomplete. The team needs observed dependencies and process information covering both server types.
Which discovery approach best meets these requirements?
Deploy Agentless Collector's VMware and Network Data Collection modules, then use the resulting dependency information to group the company's virtual and physical servers.
Deploy Discovery Agents to the virtual and physical servers, then validate process and connection data with application owners when defining migration groups.
Deploy Agentless Collector's VMware module and import physical-server specifications, then group systems by operating system, utilization, and proposed EC2 configuration.
Capture VPC Flow Logs from a pilot migration and combine them with the CMDB, then use the pilot's relationships to define the remaining migration waves.
B
Discovery Agents collect process and TCP connection information from supported physical servers and VMs. Application-owner validation supplies the business context needed for migration grouping. A is a plausible alternative for the VMware estate: Agentless Collector's Network Data Collection module does discover dependencies, but its targets come from the VMware vCenter module. It does not provide the required coverage of independent physical servers. C supplies inventory rather than the requested observed dependencies. D extrapolates from incomplete post-migration evidence.
Accelerate Workload Migration and Modernization
25
Select One
A company is replacing monolith capabilities with services that own separate databases. ALB path rules preserve existing URLs. The monolith still needs migrated data for reporting.
For each capability, only one implementation may accept writes at a time. A short write pause is permitted during rollback, but no previously accepted writes may be omitted when returning to the monolith.
Which approach provides the required rollback behavior?
Export service data to the monolith every 15 minutes. Pause service writes during rollback and use the latest completed export as the monolith's recovery point.
Commit service writes and then publish change events. Pause writes during rollback and use an empty event queue as the signal to restore monolith routing.
Capture changes transactionally and apply them to the monolith. Start rollback by restoring monolith routing, then finish replaying queued changes.
Capture changes durably with service writes and apply them idempotently. Pause writes, drain in-flight work, verify catch-up, and restore monolith routing.
D
Durable change capture coupled to service writes, such as a transactional outbox, closes the gap between database commit and event publication. Idempotent application handles retries. The pause and catch-up check ensure accepted writes are present before the monolith resumes. A can omit writes after the latest export. B can have an empty queue despite a committed write whose event was never published. C permits monolith activity while prior changes remain unapplied, risking missing or conflicting state.
Accelerate Workload Migration and Modernization
24
Select One
A company is migrating NFS data to EFS. It needs POSIX ownership and permissions preserved, repeated incremental transfers, and managed verification of the complete dataset before cutover.
The source remains active during initial transfers. Benchmarking confirms adequate time for the final changes and full verification after source writes stop.
Which procedure provides the required verification while avoiding repeated full-dataset verification during the active migration?
Use DataSync Basic mode with transferred-data verification during incremental runs and complete-dataset verification after source writes stop.
Use DataSync Basic mode with transferred-data verification throughout and use the final incremental run's verification result as the cutover acceptance check.
Use DataSync Basic mode with complete-dataset verification on every run and use the last successful verification before the write freeze as the acceptance check.
Use DataSync Basic mode for incremental copies and compare final source and destination file counts and byte totals as the cutover acceptance check.
A
Transferred-data verification checks incremental copies. Complete verification after writes stop compares the stable source and destination datasets. B does not check unchanged destination content during its final acceptance test. C performs repeated full verification and relies on a result obtained before the final write freeze. D's counts and byte totals do not establish content integrity. DataSync Basic mode supports complete verification with POINT_IN_TIME_CONSISTENT.
Accelerate Workload Migration and Modernization
23
Select One
A company must rehost supported physical and VMware servers on EC2. Applications cannot be refactored before the data center closes. Continuous replication and isolated test launches are required.
The company has a private Direct Connect path to the target VPC. Migration traffic must not traverse the public internet, and staging resources must not have public IP addresses.
Which approach best meets these requirements with a managed rehosting service?
Use MGN with private staging instances, NAT-based service access, and default source replication addressing; restrict traffic through security groups and route tables.
Use VM Import/Export with scheduled images and private S3 access; capture and import the final server images during the cutover maintenance window.
Use MGN with private-IP replication into a private staging subnet; configure MGN, EC2, and S3 endpoint access for the agents and staging resources.
Use MGN with public staging addresses and TLS-encrypted replication; restrict ingress to the data center and release the public addresses after cutover.
C
MGN supports continuous server replication and test launches. Private replication addressing and endpoint access serve different parts of the architecture; both must be configured with routing and DNS. A retains internet-based service access. B does not provide continuous replication of the physical and virtual server estate. D violates the public-IP restriction. The deployment must account for the S3 access patterns of both agents and staging resources, including the documented interface and gateway endpoint roles.
Accelerate Workload Migration and Modernization
22
Select One
A company is migrating a 6 TB Oracle database to Aurora PostgreSQL. Oracle-specific PL/SQL packages require conversion. The source must remain writable during the initial migration, followed by a short cutover write freeze.
The company must validate data and test converted application behavior before switching production. The selected versions support the planned migration and validation features.
Which TWO actions form an appropriate plan?
Use a DMS replication task to recreate target tables and convert database code, then validate the generated PostgreSQL procedures against the source application.
Assess and convert schema and code, rewrite unsupported constructs, and prepare the target schema, including foreign-key and trigger handling for the load.
Use DMS Schema Conversion to assess database objects and transfer existing table data, then begin a CDC-only replication task for subsequent source changes.
Run DMS full load plus CDC with validation; freeze source writes and verify change application and validation results before switching applications.
B
Schema and code must be assessed, converted, and tested, while the data moves separately: full load transfers existing data and CDC applies later changes. The write freeze then permits final replication and validation checks before cutover. A replication task does not convert database code, and Schema Conversion does not transfer existing table data.
Accelerate Workload Migration and Modernization
21
Select Two
D
A company runs RDS for MySQL using a Multi-AZ DB instance deployment. Reports consume substantial writer CPU and tolerate replication lag.
The company wants to offload reports and adopt an RDS deployment designed for faster failover and lower write latency than its current topology. Aurora is not approved. A planned migration is acceptable, and the version and Region support Multi-AZ DB clusters.
Which approach best meets these requirements?
Migrate to a Multi-AZ DB cluster and direct reports to its reader endpoint.
Retain the deployment and add a read replica dedicated to the reporting workload.
Retain the deployment and increase writer capacity to accommodate reporting activity.
Migrate to a larger Multi-AZ DB instance deployment and direct reports to its standby.
A
This topology provides readable standbys and a reader endpoint. AWS describes lower write latency than Multi-AZ DB instance deployments and typically faster failover. B offloads reports but retains the original failover architecture. C adds capacity without the requested topology change. D attempts to read from a non-readable standby. These are deployment characteristics; workload-specific performance still requires validation.
Continuous Improvement for Existing Solutions
20
Select One
A catalog supports eight languages. A valid lang query parameter selects a language; otherwise, the origin uses a documented Accept-Language negotiation algorithm. Marketing parameters do not affect content.
CloudFront currently caches by all query parameters and the complete Accept-Language header. Many cache entries contain identical content.
The negotiation algorithm can run in a CloudFront Function. Which configuration most reduces duplicate variants without changing language selection?
Cache by lang and the complete Accept-Language header, exclude marketing parameters, and lengthen the TTL for catalog responses.
Cache by lang and forward Accept-Language through an origin request policy, letting the origin choose the language on cache misses.
Cache by lang and add Vary: Accept-Language to responses, using that response header to distinguish cached language variants.
Normalize requests to an explicit lang before cache lookup using the origin's negotiation rules, and cache by that language parameter.
D
The function produces the language the origin would have selected. CloudFront then caches by that normalized value rather than by many raw header combinations. A retains unnecessary variants. B can reuse a cached language for a different Accept-Language request when lang is absent. C assumes an arbitrary Vary response header changes CloudFront's configured cache key. Explicit valid language choices and fallback behavior must be preserved.
Continuous Improvement for Existing Solutions
19
Select One
A company uses AWS Config in all operating accounts and Regions. Its security account is a delegated administrator.
The company must automatically remove public SSH access while preserving other access, including approved public RDP. New accounts must receive the same control. Auditors require one cross-account compliance view.
Which TWO actions implement these requirements using AWS Config's native capabilities?
Deploy an organization Config rule and attach remediation directly with PutRemediationConfigurations from the delegated administrator account.
Configure AWS-DisablePublicAccessForSecurityGroup as the remediation document and pass the noncompliant security group identifier to the automation.
Deploy an organization conformance pack with the rule and remediation configuration, using a runbook that removes SSH exposure and preserves other ingress.
Configure an organization-wide Config aggregator covering the operating Regions and give auditors access to the consolidated compliance results.
C
The organization conformance pack deploys both evaluation and remediation to every current and new account, and the runbook must remove only the SSH exposure while preserving other ingress, even when a rule spans multiple ports. The aggregator provides the single cross-account compliance view. Attaching remediation directly to an organization rule with PutRemediationConfigurations is not supported, and AWS-DisablePublicAccessForSecurityGroup would also disable approved public RDP. Supporting documents and execution permissions must exist in the target accounts and Regions.
Continuous Improvement for Existing Solutions
18
Select Two
D
An ECS service uses CodeDeploy blue/green deployments with an ALB production listener and a separate test listener.
Before production traffic shifts, integration tests must exercise the replacement task set through the test listener. The replacement must then receive 10% of production traffic for 15 minutes. An application-error alarm must automatically restore the previous task set's traffic.
Which configuration meets these requirements?
Use AfterAllowTestTraffic, linear 10%-per-minute shifting, and automatic rollback triggered by the application-error alarm.
Use AfterAllowTestTraffic, 10%-for-15-minutes canary shifting, and automatic rollback triggered by the application-error alarm.
Use AfterAllowTraffic, 10%-for-15-minutes canary shifting, and automatic rollback triggered by the application-error alarm.
Use AfterAllowTestTraffic, 10%-for-15-minutes canary shifting, and alarm-triggered stopping followed by operator-initiated rollback.
B
AfterAllowTestTraffic tests the replacement before production traffic shifts. The canary configuration keeps 10% on the replacement for 15 minutes. Alarm-triggered rollback restores the original traffic destination. A shifts too quickly. C tests after production traffic has shifted. D requires operator action where automatic recovery is required.
Continuous Improvement for Existing Solutions
17
Select One
An application in private subnets sends large volumes of data to same-Region S3 buckets through NAT gateways. NAT access is still required for unrelated internet requests.
On-premises systems connect through a Direct Connect transit VIF, Direct Connect gateway, and transit gateway. They must access the buckets using private IP addresses. Resolver inbound access and on-premises DNS forwarding are available.
All clients must retain their standard regional S3 endpoint names. Which solution minimizes endpoint processing costs?
Use a gateway endpoint for application traffic and an interface endpoint with private DNS limited to inbound Resolver queries for on-premises traffic.
Use interface endpoints with private DNS for both client groups, routing their S3 traffic through the endpoint network interfaces.
Use a gateway endpoint for both client groups, advertising its service prefix list through Direct Connect to the on-premises network.
Use a gateway endpoint for application traffic and a Direct Connect public VIF for on-premises requests to S3 regional endpoints.
A
The gateway endpoint avoids interface-endpoint processing charges for high-volume VPC traffic. The interface endpoint supplies private IP access for on-premises clients. Inbound-only private DNS selects the corresponding path while preserving standard names. B is functional but sends VPC traffic through chargeable interfaces. C attempts to extend gateway-endpoint access to on-premises clients. D uses public S3 addresses, contrary to the private-IP requirement.
Continuous Improvement for Existing Solutions
16
Select One
A Lambda application exhausts RDS for PostgreSQL connection limits during bursts, although CPU and query latency remain acceptable.
RDS Proxy provides little improvement. Metrics show that most client connections become pinned. Each client executes identical SET search_path and SET statement_timeout statements after connecting, followed by short transactions without other session state.
Which change most directly addresses the problem with minimal operational work?
Increase the proxy's connection allowance and extend client connection lifetimes, retaining the session-initialization statements in each function.
Configure an application-side connection pool in each Lambda environment, applying the session-initialization statements whenever that pool opens a connection.
Move the shared initialization statements into the proxy initialization query and remove them from the client connection setup.
Increase the database instance size and retain the existing proxy configuration, raising the number of sessions the database can accommodate.
C
RDS Proxy can apply identical session initialization when creating backend connections. Removing the client-issued SET statements avoids this source of PostgreSQL pinning and improves multiplexing opportunities. A and D increase capacity without correcting the cause. B distributes pools across execution environments while retaining the same session behavior. The answer depends on the identical initialization and lack of additional session-state requirements in the question.
Continuous Improvement for Existing Solutions
15
Select One
An AWS Batch platform runs independent jobs lasting one to six hours. Jobs support several instance families and can restart from checkpoints. Deadlines allow retries, and operators monitor progress for capacity shortages.
The company wants low compute cost, fewer interruption-related restarts, and limited loss of completed work.
Which TWO choices best support these goals?
Use SPOT_PRICE_CAPACITY_OPTIMIZED with multiple compatible instance types and subnets across Availability Zones in the managed Spot compute environment.
Use one instance type across Availability Zones and set the maximum Spot price to the On-Demand price as the interruption-management strategy.
Write checkpoints to S3 periodically and configure retries to resume from them, attempting an additional checkpoint when an interruption notice arrives.
Write checkpoints to instance store and configure replacement jobs to resume by opening the previous attempt's local checkpoint path.
A
Price-capacity-optimized allocation considers capacity and price across eligible pools, and durable checkpoints let replacement jobs recover prior progress. A maximum price cannot prevent capacity-driven interruptions, and instance-store checkpoints are not available to a replacement instance. The interruption-time checkpoint is best effort, so periodic checkpoints protect work when that final attempt cannot finish.
Design for New Solutions
14
Select Two
C
An order service writes 20,000 small records per second to DynamoDB. The current key consists of the order date as partition key and a monotonically increasing order ID as sort key. Testing shows concentrated write throttling.
Customer service retrieves records by order ID alone. Nightly processing retrieves all orders for a specified date. Sufficient aggregate capacity is available.
Which design best distributes writes while supporting both access patterns?
Use order ID as the table key and create a GSI partitioned by date, with order ID as the index sort key for nightly processing.
Use order ID as the table key and a GSI partitioned by date plus a calculated hash shard; query and combine the date's shards nightly.
Use date plus a random shard as the table partition key and order ID as its sort key; query all shards for individual-order lookups.
Keep the current keys and increase aggregate write capacity; add a GSI using the same date and order ID keys for nightly processing.
B
Order ID supports direct table retrieval. A calculated shard added to the date distributes index writes; nightly processing queries and combines the known shards. A concentrates writes in the date index. C requires information absent from a lookup by order ID alone. D preserves the concentration in both the table and index. Shard count and capacity must be tested against record sizes and traffic distribution.
Design for New Solutions
13
Select One
A claims application processes two million claims monthly. It performs 20 short automated steps, with a human approval wait of up to 48 hours between two phases.
The team requires a managed parent execution that tracks the full claim lifecycle. Automated actions are idempotent. Benchmarks show that each phase can run as a Synchronous Express Workflow within five seconds at the minimum billed memory tier.
Which design reduces orchestration charges while meeting the lifecycle requirement?
Place the automated steps and approval callback in a Standard Workflow, representing each automated action as a separate state in the parent execution.
Run an Express Workflow for each automated phase and use a DynamoDB-backed application coordinator to record and advance the full claim lifecycle.
Use a Standard parent that checks approval status at intervals, with each automated phase implemented as a nested Standard Workflow.
Use a Standard parent with an approval callback and Express child workflows invoked through the AWS SDK sfn:startSyncExecution integration.
D
The Standard parent handles the long wait and approval callback. Short, low-memory Express children reduce Standard state transitions. A retains a Standard transition for every automated step. B replaces the required managed parent with custom coordination. C adds polling and retains Standard children. The implementation is arn:aws:states:::aws-sdk:sfn:startSyncExecution, which waits for the Express execution response. The parent must inspect the returned status: an HTTP 200 response does not itself mean the child succeeded.
Design for New Solutions
12
Select One
A company distributes private S3 documents through two CloudFront distributions. Distribution X serves employees, and distribution Y serves partners.
A protected bucket contains SSE-KMS-encrypted documents. The security team requires both the bucket policy and the KMS key policy to restrict their CloudFront permissions to X. An internal uploader must retain its separately granted permissions.
Both distributions use origin access control. Which configuration meets the policy requirement?
Permit the CloudFront service principal in both policies, conditioning its permissions on X's distribution ARN through AWS:SourceArn.
Permit the CloudFront service principal in both policies, conditioning its permissions on the account that owns X through AWS:SourceAccount.
Condition the bucket permission on X's distribution ARN and the key permission on the account that owns X and Y.
Condition the key permission on X's distribution ARN and the bucket permission on the account that owns X and Y.
A
AWS:SourceArn identifies X's distribution. An account-level condition cannot distinguish X from Y because both belong to the same account. B scopes neither permission to X individually. C and D scope only one of the two policies. Even where another policy could block an operation, those options fail the explicit requirement that each policy independently scope its CloudFront permission to X. Uploader permissions remain separate.
Design for New Solutions
11
Select One
A company is adding a recovery Region for an ECS Fargate application using Aurora MySQL.
The secondary Region must continuously run synthetic transactions through its application deployment, including supported database writes for test accounts. During a primary-Region outage, the recovery environment must become independently writable.
The budget supports reduced application capacity in the recovery Region. Recovery targets are an RPO below one minute and an RTO of 30 minutes, subject to validation through monitoring and drills.
Which design best supports these requirements?
Use Aurora Global Database and deploy secondary application tasks for scheduled tests. Promote the secondary for each test cycle and restore the original topology afterward.
Use Aurora Global Database with reduced application capacity. Exercise secondary reads and validate write transactions through the primary Region's application deployment.
Use Aurora Global Database with write forwarding and reduced application capacity. Include database promotion, application reconnection, and scale-out in recovery drills.
Copy hourly database backups and maintain reduced application capacity. Restore a database before each test cycle and repeat that procedure during regional recovery.
C
Reduced application capacity supports continuous secondary-stack testing. Write forwarding sends supported writes to the primary while it is healthy. Database promotion makes the recovery Region independently writable during failover. A does not provide continuous testing. B tests write behavior through the wrong application deployment. D's hourly backups do not support the specified RPO target. Replication lag and recovery execution must be monitored and tested rather than assumed.
Design for New Solutions
10
Select One
A UDP service runs behind Network Load Balancers in two Regions. Customers allowlist destination IP addresses and cannot quickly update their firewall rules.
The company needs health-based routing for new flows without waiting for clients to refresh DNS. Operators must be able to reduce traffic to a Region during maintenance. The existing NLB-based deployments should remain in place.
Which solution requires the least custom routing logic?
Give the regional NLBs fixed addresses and publish Route 53 latency records with health checks, using short TTLs to control failover and maintenance routing.
Use a custom routing accelerator with EC2 forwarding instances in subnet endpoints, implementing endpoint selection and regional health handling in forwarding software.
Use a standard Global Accelerator with UDP listeners and regional NLB endpoint groups, using endpoint-group traffic dials for maintenance.
Create a separate standard accelerator for each Region and place their addresses behind Route 53 failover records, changing the preferred record during maintenance.
C
A standard accelerator supports UDP, regional NLB endpoints, health-based routing, and traffic dials. A and D retain DNS-dependent regional selection. B introduces forwarding software and custom health and routing logic. The requirement concerns new flows; it does not assume seamless relocation of every established connection.
Design for New Solutions
9
Select One
An order-processing application consumes messages from an SQS standard queue. Each order has a stable, unique identifier. Processing creates an order record and decrements inventory in two DynamoDB tables in the same Region.
A worker can fail after database changes commit but before deleting the message. Processing must prevent duplicate inventory decrements and negative stock.
The queue already has a monitored dead-letter queue and a retention policy covering the investigation period.
Which TWO processing actions should the architect recommend?
Use a FIFO queue and independently write the order and inventory records, using the order identifier as the message deduplication identifier.
Conditionally create the order, then decrement inventory in a separate request, using the order record's existence to identify completed processing on retries.
Use one transaction to create an absent order and decrement inventory, conditioning the inventory update on the requested quantity being available.
Delete messages after a committed transaction or verification of the same previously committed order; return other processing failures to the queue's retry flow.
C
A single transaction couples conditional order creation with the inventory reduction, preventing both duplicate decrements and insufficient-stock updates. After a failure, a worker can verify that the same order was already committed before deleting its message, and other failures return to the queue's retry flow. FIFO deduplication does not protect against consumer retries, and separate order and inventory requests can leave an order record without its inventory update.
Design for New Solutions
8
Select Two
D
A company has two steady compute workloads. The first will remain on M5 instances in us-east-1 for three years. The second will move among instance families, Fargate, Lambda, and potentially another Region.
A separate 10-day event needs a fixed number of instances in one Availability Zone. The company plans to create an immediate-use On-Demand Capacity Reservation shortly before the event and cancel it afterward. Capacity must be confirmed before the event begins.
Savings Plans commitments will be sized at the applicable discounted rates.
Which purchasing strategy best matches these requirements?
Cover both steady workloads with Compute Savings Plans. Use the planned immediate-use Capacity Reservation for the event and cancel it afterward.
Use EC2 Instance Savings Plans for M5 and Compute Savings Plans for the changing workload. Use the planned immediate-use Capacity Reservation for the event.
Cover both steady workloads with EC2 Instance Savings Plans in us-east-1. Use the planned immediate-use Capacity Reservation for the event and cancel it afterward.
Use EC2 Instance Savings Plans for M5 and Compute Savings Plans for the changing workload. Replace the planned event reservation with one-year zonal Reserved Instances.
B
EC2 Instance Savings Plans suit the fixed family and Region. Compute Savings Plans follow eligible usage across the changing compute services and Regions. A is workable but uses the less specialized plan for the fixed baseline. C does not cover the changing workload's cross-service and cross-Region requirements. D purchases a year-long reservation for a short event. The question explicitly uses an immediate-use Capacity Reservation: creation depends on available capacity, and the event proceeds only after confirmation. This avoids conflating it with a future-dated reservation commitment.
Design Solutions for Organizational Complexity
7
Select One
A platform team works from a tooling account. Routine deployments from the Organizations management account are prohibited, although one-time organization setup is allowed.
The team must deploy a CloudFormation template to three Regions in every Development OU account. New accounts must receive the template automatically. Resources should be removed when accounts leave the OU.
Which approach minimizes ongoing operational work?
Run a tooling-account pipeline that enumerates the OU, assumes deployment roles, and reconciles individual regional stacks whenever account membership changes.
Create a self-managed StackSet and use EventBridge and Lambda to maintain its account targets, execution roles, and account-removal operations.
Publish the template through Service Catalog and run an account-lifecycle workflow that provisions or terminates the product in the required accounts and Regions.
Register the tooling account as a StackSets delegated administrator and use an OU-targeted service-managed StackSet with automatic deployment and retention disabled.
D
Delegated administration permits the tooling account to operate service-managed StackSets. OU targeting and automatic deployment handle account additions. Disabling retention requests stack deletion when accounts leave the target OU. The other approaches require maintaining additional provisioning and lifecycle automation. Resource deletion remains subject to successful stack operations and resource retention settings.
Design Solutions for Organizational Complexity
6
Select One
An analytics role in Account B reads SSE-KMS-encrypted objects from an S3 bucket in Account A. S3 permissions already permit access, but KMS decrypt requests fail.
The customer managed key must remain in Account A. There are no cross-account KMS grants or applicable explicit denies. Account A wants Account B's administrators to decide which of their principals receive permission to decrypt.
Which TWO changes meet these requirements?
Permit kms:Decrypt for Account B's account principal in the key policy, using arn:aws:iam::<Account-B-ID>:root.
Permit the analytics role directly in the key policy and remove its KMS identity policy, centralizing the role's authorization in Account A.
Grant the analytics role kms:Decrypt in an IAM policy whose Resource is the ARN of the key's alias.
Grant the analytics role kms:Decrypt in an IAM policy whose Resource is the ARN of the customer managed key.
A
The key policy allows Account B to delegate the operation, and Account B's IAM policy then grants the analytics role decryption on the key ARN. Naming the role directly in the key policy while removing its IAM permission removes the caller-side permission needed for this cross-account arrangement, and it takes the decision away from Account B's administrators. An alias ARN is not the key resource used to authorize decryption.
Design Solutions for Organizational Complexity
5
Select Two
D
A company has 40 workload VPCs across 25 accounts and a shared-services VPC in its networking account. Private connectivity exists between these VPCs and the data center.
Workload accounts own Route 53 private hosted zones with distinct domain names. Every workload must resolve the on-premises corp.example.com zone. On-premises systems must resolve every workload's private zone.
The company wants the fewest Resolver endpoint deployments and centralized on-premises forwarding targets, without duplicating DNS records.
Which TWO actions should the architect take?
Create an outbound endpoint and corporate-domain forwarding rule in shared services. Share the rule through AWS RAM and associate it with workload VPCs.
Create an outbound endpoint and corporate-domain forwarding rule in every workload VPC. Associate each local rule with its owning workload VPC.
Associate the private zones with shared services using cross-account authorizations. Forward on-premises private-zone queries to an inbound endpoint in that VPC.
Create replicas of the private zones in shared services. Synchronize their records from workload accounts and forward on-premises queries to a central inbound endpoint.
A
Centralized outbound forwarding lets one shared rule serve every workload VPC, and associating the workload private zones with the shared-services VPC lets a single inbound endpoint answer on-premises queries for all of them. Per-VPC outbound endpoints multiply deployments, and replicating zones duplicates DNS records and adds synchronization work. Cross-account hosted-zone association and RAM sharing of Resolver rules are distinct mechanisms.
Design Solutions for Organizational Complexity
4
Select Two
C
A transit gateway connects 30 application VPCs, a shared-services VPC, and a VPN attachment to a data center. All address ranges are unique.
Applications must reach shared services and the data center but must not reach other application VPCs. Shared services and the data center must reach every application. Neither forwards traffic between application networks.
Application teams control their VPC route tables. The company expects to add 20 application VPCs and wants to minimize central routing administration.
Which transit gateway design meets these requirements?
Associate applications with a table containing shared-services and VPN routes. Associate shared services and the VPN with a table containing all attachment routes.
Associate all attachments with one table containing every propagated route. Add blackhole routes for application CIDRs to prevent communication between applications.
Associate each application with its own table containing shared-services and VPN routes. Associate the remaining attachments with a table containing every application route.
Associate all attachments with one table containing every propagated route. Distribute restricted VPC route configurations to application teams through CloudFormation StackSets.
A
Applications use a table exposing shared services and the data center. The second table provides routes back to applications. C also isolates applications but adds per-application route tables. B's blackholes block required traffic toward application destinations. D relies on VPC routes controlled by application teams rather than central transit gateway enforcement.
Design Solutions for Organizational Complexity
3
Select One
A company uses Okta and IAM Identity Center for access to 120 AWS accounts. Okta groups identify job functions, and a synchronized user attribute identifies each employee's cost center.
In a shared account, S3 objects are organized under cost-center prefixes. A DynamoDB table uses costCenter as its partition key and a record identifier as its sort key. Engineers must access only their cost center's data.
New cost centers are introduced frequently. Attribute changes must affect the next sign-in after synchronization, without creating additional IAM policies.
Which design requires the least ongoing administration?
Create a permission set per cost center and automate group assignments. Generate the permission policy and S3 prefix scope when each new cost center is introduced.
Deploy SAML roles for each job function directly in every account. Pass cost center as a session tag and maintain the account-role mappings in Okta.
Pass cost center as a principal tag. Compare it with resource tags on S3 prefixes and DynamoDB items when authorizing engineers' data-access operations.
Pass cost center as a principal tag. Reference it in S3 prefix permissions and DynamoDB LeadingKeys conditions within reusable permission sets.
D
The cost-center session attribute can determine the allowed S3 key prefixes and DynamoDB partition-key values. Policies must restrict access to operations and resources that preserve those conditions. A requires new policies for new cost centers. B can work but duplicates federation administration across accounts. C incorrectly treats prefixes and individual DynamoDB items as resource-tagged entities.
Design Solutions for Organizational Complexity
2
Select One
A company manages 80 accounts through AWS Organizations. Each production account has a local CloudTrail trail that delivers S3 data events to an account-specific analytics pipeline.
Application administrators have AdministratorAccess, including IAM administration. A centrally deployed SecOps-Automation role trusts only a role in the security account.
Only SecOps-Automation may stop, delete, or modify the local trails. Application administrators must retain their other administrative capabilities. The control must apply automatically when accounts join the production OU.
Which approach meets these requirements?
Use an OU-level SCP with a Team=Security principal-tag exemption. Protect the automation role's trust policy and apply the security tag to that role.
Use OU-level SCPs with a principal-ARN exemption for the automation role. Restrict administrators' changes to the role, its trust, its permissions, and its replacement.
Use an OU-level SCP with a principal-ARN exemption for the automation role. Protect its attached permission policies and delegate trust-policy administration to application administrators.
Apply administrator permissions boundaries through StackSets. Deploy a Config rule that restores the boundaries when account administrators change or remove them.
B
An SCP explicit deny constrains member-account administrators despite AdministratorAccess. The exemption must not become an escalation path: administrators must be unable to alter the role's trust, permissions, or identity. A allows administrators to tag another principal with the exempting value. C lets them change the role's trust policy. D detects and repairs a removed boundary rather than preventing the prohibited action.
Design Solutions for Organizational Complexity
1
Select One
.png)
.svg)
