CCNA Design for New Solutions Questions

Why this answer

How to eliminate wrong answers

Option B is wrong because using Amazon EC2 instances for transformation introduces server management overhead and fixed costs, violating the serverless requirement and increasing cost compared to Lambda. Option C is wrong because Amazon SQS is a message queue designed for decoupling applications, not for real-time streaming analytics; it lacks the ordered, replayable, and high-throughput characteristics needed for IoT streaming data. Option D is wrong because Amazon Kinesis Data Analytics for real-time SQL performs in-stream analytics but does not handle data transformation before storage; it outputs to a destination like Firehose, and alone it cannot transform and store data in S3 without additional services.

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC peering with NAT gateways does not provide the private, scalable connectivity that PrivateLink offers; NAT gateways incur per-hour and per-GB costs and are not designed for service-to-service communication across separate VPCs. Option B is wrong because deploying all services in a single VPC violates the explicit requirement for each service to be isolated within its own VPC, and security groups alone cannot enforce network-level isolation at the VPC boundary. Option D is wrong because using a single VPC with Transit Gateway still places all services in the same VPC, failing the isolation requirement, and Transit Gateway incurs per-attachment and data processing costs that are unnecessary when PrivateLink can provide direct, cost-effective connectivity.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis is designed for real-time streaming data ingestion and processing (e.g., log streams, clickstreams), not for decoupling point-to-point asynchronous messaging between microservices; it uses shards and records, not queues with individual message visibility. Option C is wrong because AWS Lambda is a compute service that runs code in response to events, not a messaging or decoupling service; it can be a consumer or producer but does not itself provide a queue for asynchronous communication. Option D is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to multiple subscribers (fan-out), but it does not provide a queue for decoupling—subscribers must be available or use a queue integration; SNS alone does not offer the buffering and polling model needed for true asynchronous decoupling.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CodePipeline is a continuous delivery service that orchestrates the pipeline stages (source, build, test, deploy) but does not itself build or test code; it relies on other services like CodeBuild for those actions. Option B is wrong because AWS CodeDeploy is a deployment service that automates code deployments to compute services (including ECS) but does not perform build or test operations. Option C is wrong because AWS CodeCommit is a source control service that hosts Git repositories and does not have any capability to build or test application code.

Why this answer

How to eliminate wrong answers

Option B is wrong because a NAT Gateway is used to allow outbound internet access from a private subnet, not to enable Lambda to connect to RDS within the same VPC; using a NAT Gateway would route traffic through the internet, which is unnecessary and insecure for private database access. Option C is wrong because an IAM role alone does not provide network connectivity; Lambda still needs to be attached to the VPC via an ENI, and security group rules must explicitly allow traffic from the Lambda function's ENI, not from the Lambda service itself. Option D is wrong because Lambda automatically creates and attaches an ENI when configured with VPC settings; you cannot manually attach an ENI to a Lambda function, and the ENI is placed in the specified subnets, not directly attached as a separate step.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon CloudFront does not support mTLS; it can only present client certificates to origins (origin-facing mTLS) but cannot terminate incoming mTLS connections from clients. Option C is wrong because Network Load Balancer (NLB) with TLS termination only validates server certificates and does not support client certificate authentication (mTLS) at the listener level. Option D is wrong because Amazon API Gateway HTTP API does not support mTLS; only API Gateway REST API supports mTLS via mutual TLS authentication, but the HTTP API variant lacks this feature.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the instance can still have a public IP address assigned (e.g., via an Elastic IP or auto-assign public IP), but without a route to the internet gateway, that public IP is irrelevant for outbound connectivity. Option C is wrong because the instance state is not mentioned in the exhibit as a problem; if it were not running, the describe-instances output would show a 'stopped' or 'terminated' state, and the question states the instance is running. Option D is wrong because the security group explicitly allows outbound traffic to 0.0.0.0/0, so it is not blocking traffic.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon EBS volumes are bound to a single Availability Zone and cannot be shared across multiple AZs, making them unsuitable for multi-AZ highly available storage. Option B is wrong because Amazon FSx for Lustre is optimized for high-performance computing and large-scale data processing, not for general-purpose persistent storage for databases, and it lacks native integration with Kubernetes CSI for stateful workloads. Option D is wrong because Amazon S3 is an object storage service, not a file system; it does not support standard file system semantics like POSIX locks or concurrent read/write from multiple pods, and the S3 CSI driver is not an official or widely supported solution for persistent volume claims in EKS.

Why this answer

How to eliminate wrong answers

Option B (Amazon Redshift) is wrong because it is a petabyte-scale data warehouse optimized for analytical queries on large datasets, not a transactional relational database for predictable workloads with read replicas. Option C (Amazon DynamoDB) is wrong because it is a NoSQL key-value and document database that does not support relational features like joins or SQL queries, and its read replicas are not designed for occasional reporting in the same manner as RDS. Option D (Amazon ElastiCache) is wrong because it is an in-memory caching service (Redis/Memcached) that does not provide persistent relational storage, automated backups, or Multi-AZ redundancy for a database workload.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because DynamoDB auto scaling adjusts read/write capacity for a DynamoDB table, not ECS task counts; it is irrelevant to scaling a web application's containerized tasks. Option C is wrong because while Application Auto Scaling can register an ECS service, step scaling policies require predefined step adjustments and are less optimal for maintaining a custom metric at a target value compared to target tracking. Option D is wrong because the AWS Auto Scaling console creates scaling plans for multiple resources, but for ECS services, the recommended and simpler approach is to use ECS Service Auto Scaling directly with a target tracking policy, not a scaling plan.

Why this answer

How to eliminate wrong answers

Option A is wrong because using strongly consistent reads for all requests would double the RCU consumption for the pattern that only needs eventually consistent reads, unnecessarily increasing costs. Option B is wrong because DAX is an in-memory cache that provides eventually consistent reads by default; it does not support strongly consistent reads, so it cannot satisfy the pattern requiring strong consistency. Option C is wrong because DynamoDB global tables are designed for multi-region replication and provide eventually consistent reads across regions; they do not support strongly consistent reads globally, and enabling them does not help meet local consistency requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon EBS provides block-level storage that must be attached to a single EC2 instance at a time (or shared via multi-attach with specific constraints), making it unsuitable as a shared filesystem for multiple compute instances and not decoupling storage from compute. Option B is wrong because Amazon EFS is a managed NFS filesystem that, while shared, still requires compute instances to mount it and incurs operational overhead for managing file-level access, and it does not offer the same level of durability (99.999999999% vs 99.999999999% for S3) or cost efficiency for large-scale document storage. Option D is wrong because Amazon FSx for Windows File Server provides a fully managed Windows file server using the SMB protocol, which introduces licensing costs and operational complexity, and is not designed for the high durability and decoupling benefits of object storage for user-uploaded documents.

Why this answer

How to eliminate wrong answers

Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and does not support HTTP/HTTPS routing or path-based rules, which are typically needed for microservices; also, VPC endpoints are used for private connectivity to AWS services, not for internet-facing traffic, and the question requires internet accessibility via an ALB. Option C is wrong because placing services in a single public subnet exposes them directly to the internet, bypassing the security of private subnets and increasing attack surface; it also violates best practices for microservices isolation. Option D is wrong because placing services in public subnets with Internet Gateways directly exposes them to inbound internet traffic, defeating the purpose of a secure microservices architecture and increasing operational overhead for security groups and patching.

Why this answer

How to eliminate wrong answers

Option B is wrong because placing all microservices in the same security group and allowing all traffic removes network segmentation, violating the isolation requirement and exposing services to unrestricted lateral movement. Option C is wrong because an Application Load Balancer per microservice adds unnecessary complexity, cost, and does not enforce service-to-service API-level security; ALBs operate at Layer 7 but cannot enforce mTLS or fine-grained routing between individual service instances. Option D is wrong because VPC peering between each microservice's VPC is operationally unscalable (n² peering connections), introduces latency, and does not provide application-layer API control or encryption between services.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the Lambda timeout to 15 minutes and memory to 10240 MB does not resolve the underlying issue of third-party API latency; it only delays the timeout, and Lambda has a maximum execution time of 15 minutes, but the function may still fail if the API is slow, and high memory increases cost without solving the buffering problem. Option B is wrong because Kinesis Data Firehose writes directly to S3, but triggering a Lambda function asynchronously from S3 events would not enrich data before storage; the enrichment would need to happen after the data is already in S3, which does not meet the requirement to enrich before storage and could lead to duplicate processing or data loss. Option C is wrong because Provisioned Concurrency reduces cold starts but does not address the timeout issue caused by third-party API latency; the function would still time out if the API is slow, and it does not provide buffering for traffic spikes.

Why this answer

How to eliminate wrong answers

Option B (Amazon Route 53 Resolver) is wrong because it is a DNS resolution service for hybrid networks (on-premises to AWS), not a service discovery mechanism for ECS microservices; it does not register or manage service instances. Option C (Elastic Load Balancing) is wrong because it distributes traffic to targets but does not provide DNS-based service discovery for individual service instances; it is a load balancer, not a discovery registry. Option D (Amazon Elastic Container Registry) is wrong because it is a container image repository, not a service discovery tool; it stores Docker images but has no role in DNS resolution or instance registration.

Why this answer

How to eliminate wrong answers

Option A is wrong because encryption (e.g., SSE-S3, SSE-KMS) protects data at rest but does not provide access logging; the security requirement is about logging, not encryption. Option B is wrong because restricting access to a specific IP range controls who can access the bucket but does not enable logging; the requirement is for all access to be logged, not restricted. Option C is wrong because bucket versioning is already enabled per the template description, and versioning preserves object versions but does not log access events.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is a deployment service that automates application deployments to EC2, Lambda, or on-premises instances; it does not build Docker images or push them to ECR. Option B is wrong because AWS CodeCommit is a source control service for hosting Git repositories; it cannot perform build actions or push images to ECR. Option C is wrong because Amazon ECS is a container orchestration service that runs containers on a cluster; it does not build images or act as a build provider in CodePipeline.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is optimized for managing secrets (e.g., database credentials, API keys) with automatic rotation, not for general configuration files with versioning; it lacks hierarchical storage for environments like dev/test/prod. Option B is wrong because Amazon S3 can store configuration files with versioning and access control, but it is an object storage service, not a purpose-built configuration store; it requires additional logic for hierarchical retrieval and lacks native parameter-store features like tiered pricing and secure string encryption without extra setup. Option D is wrong because Amazon DynamoDB is a NoSQL database designed for high-performance key-value and document workloads, not for storing configuration files with versioning; it would require custom implementation for version control and access control, adding unnecessary complexity and cost.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Lambda has a maximum execution timeout of 15 minutes, but the transcoding job can take up to 30 minutes per file, so the Lambda function would time out before completion. Option C is wrong because managing an Auto Scaling group of EC2 instances with transcoding software introduces significant maintenance overhead (patching, scaling policies, instance health) and is not cost-effective for sporadic or bursty workloads compared to a serverless service. Option D is wrong while technically possible, using ECS Fargate tasks orchestrated by Step Functions adds unnecessary complexity and cost compared to MediaConvert, which is purpose-built for video transcoding and natively integrates with S3; Fargate requires custom container images, task definitions, and more operational overhead.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file-level storage service that introduces higher latency compared to in-memory solutions, and it is not optimized for the frequent read/write operations of session state. Option C is wrong because Amazon RDS for MySQL is a relational database with disk-based storage, which incurs higher latency and is overkill for simple key-value session data; it also requires connection management overhead that is unsuitable for high-frequency session access. Option D is wrong because Amazon DynamoDB is a NoSQL database that, while highly available and scalable, has higher latency than an in-memory cache like Redis for session state, and its cost per operation is typically higher for the small, transient data patterns of sessions.

Why this answer

How to eliminate wrong answers

Option B (Failover routing policy) is wrong because it is designed for active-passive failover between two endpoints, not for routing based on latency or proximity. Option C (Weighted routing policy) is wrong because it distributes traffic based on assigned weights, not on the user's latency or geographic location. Option D (Simple routing policy) is wrong because it routes all traffic to a single endpoint (or multiple endpoints in a round-robin fashion if multiple records are returned) and does not consider latency, health, or proximity.

Why this answer

How to eliminate wrong answers

Option A is wrong because deploying in multiple Regions and using Route 53 latency-based routing with active-passive failover introduces significant operational overhead for managing multi-Region infrastructure, and Route 53 DNS-based routing can be affected by client-side DNS caching, which may not provide the lowest latency for all users. Option B is wrong because Lambda@Edge is designed for lightweight compute at edge locations, not for proxying requests to an ALB; it would add unnecessary complexity, latency, and cost, and it is not a recommended pattern for simply routing traffic to an ALB. Option D is wrong because a CloudFront distribution with the ALB as the origin does not inherently optimize the network path from the client to the ALB; CloudFront caches content at edge locations, but for dynamic API traffic that cannot be cached, it adds an extra hop and does not improve the latency of the connection to the origin ALB.

Why this answer

How to eliminate wrong answers

Option A (SSE-S3) is wrong because it uses AWS-managed keys stored and managed entirely by S3, not in CloudHSM, and S3 inherently has access to the keys without explicit customer permission. Option C (Client-side encryption) is wrong because it encrypts data before sending to S3, which does not use S3's server-side encryption at rest and does not involve S3 managing keys or encryption; the requirement specifies S3 encryption at rest. Option D (SSE-KMS) is wrong because it uses AWS KMS keys, which are not stored in CloudHSM; while KMS can use a CloudHSM key store (custom key store), the keys are still managed by KMS, and S3 can access them via KMS policies without requiring per-request key provision, which does not satisfy the explicit permission requirement as strictly as SSE-C.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance and availability by routing traffic over the AWS global network, but it does not reduce cross-AZ data transfer costs within a single region; it primarily reduces latency and improves fault tolerance for global traffic. Option B is wrong because placing all web tier instances in one AZ and all application tier instances in another AZ violates the high availability requirement (single AZ failure would take down the entire tier) and actually increases cross-AZ traffic, incurring higher data transfer costs. Option C is wrong because using a single AZ for all tiers eliminates cross-AZ traffic but completely defeats the requirement for high availability across three Availability Zones, making the application vulnerable to AZ failures.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-KMS is a different encryption type that requires additional kms:Decrypt permissions; the question specifies SSE-S3, not SSE-KMS, so the user would not need KMS permissions. Option B is wrong because there is no condition in the IAM policy that would deny access; SSE-S3 does not impose any condition on the user's ability to download. Option D is wrong because SSE-S3 does use AES-256 encryption (it is the default), and the statement 'SSE-S3 is not AES256' is factually incorrect.

Why this answer

How to eliminate wrong answers

Option A is wrong because bucket policies alone cannot enforce SSE-KMS on all objects; they can only require encryption headers on PutObject, but SCPs are needed to deny non-compliant actions across all accounts. Option B is wrong because AWS Config with automatic remediation is reactive—it detects non-compliance after the bucket is created or modified, which may leave a window of exposure, and it is less efficient than proactive prevention via SCPs. Option D is wrong because denying s3:PutBucketPublicAccessBlock would actually prevent the use of the PublicAccessBlock configuration, which is the mechanism to block public access; instead, you need to deny actions that make buckets public (e.g., s3:PutBucketAcl with public access) or require the PublicAccessBlock to be set.

Why this answer

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not at the instance or service level; they cannot enforce fine-grained isolation between services within the same VPC, and a misconfigured rule could inadvertently allow database traffic. Option B is wrong because IAM policies control access to AWS API actions (e.g., RDS API calls), not direct network-level database connections; they cannot prevent a service from connecting to another service's database if the database endpoint is reachable over the network. Option C is wrong because security groups within the same VPC can restrict traffic, but they do not provide the strong isolation required; a misconfigured security group or a compromised service could still access the database if the security group rule is too permissive, and the services share the same VPC routing table, increasing the attack surface.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because storing static content on an EC2 instance behind an Application Load Balancer introduces unnecessary compute overhead, management complexity, and higher cost without any benefit for static content; EC2 is designed for dynamic processing, not serving static assets efficiently at global scale. Option C is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for transient, high-speed data (e.g., session state, database query results), not for durable, long-term storage of static content; it lacks the persistence and origin-pull capabilities needed for a CDN origin. Option D is wrong because S3 Transfer Acceleration only speeds up uploads to an S3 bucket over long distances using AWS edge locations, but it does not cache content at edge locations for low-latency downloads; it does not provide global content distribution or high availability for serving static content to users.

Why this answer

How to eliminate wrong answers

Option B is wrong because client-side encryption does not use AWS managed keys; it uses keys managed by the client, which violates the requirement for AWS managed keys. Option C is wrong because HTTP does not provide encryption in transit, leaving data vulnerable to interception, and PCI DSS requires encrypted transmission (e.g., HTTPS/TLS). Option D is wrong because SSE-C uses customer-provided keys, not AWS managed keys, failing the requirement for AWS managed keys.

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon RDS does not support automatic scaling of compute resources; it only supports storage auto-scaling, so a Single-AZ instance would still require manual scaling or over-provisioning to handle spikes. Option C is wrong because DynamoDB is a NoSQL database, not a relational database, and the question explicitly requires a relational database. Option D is wrong because using a large instance size for a Single-AZ instance leads to over-provisioning and higher costs during low-traffic periods, failing to minimize costs while handling variable traffic.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an RDS MySQL cross-region read replica typically has replication lag of several seconds to minutes, making it impossible to guarantee a 5-second RPO, and promoting a read replica takes longer than 1 minute due to the need to stop replication and apply any pending changes. Option B is wrong because manual snapshots cannot be taken every 5 seconds (the minimum interval is 5 minutes for automated snapshots, and manual snapshots have no such frequency guarantee), and copying snapshots to another region adds significant delay, far exceeding the 5-second RPO. Option C is wrong because AWS DMS continuous replication introduces latency that often exceeds 5 seconds, and the failover process to promote the target database as the primary typically takes more than 1 minute, especially if schema changes or data consistency checks are required.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-C requires the customer to manage and provide encryption keys with each S3 request, and implementing a Lambda function to rotate keys every 90 days introduces significant operational overhead and does not natively provide an audit trail of key usage. Option B is wrong because SSE-S3 uses S3-managed keys that are rotated automatically by AWS but do not support customer-controlled rotation schedules (they are rotated at least annually, not every 90 days) and S3 server access logs do not provide a detailed audit trail of key usage. Option D is wrong because client-side encryption with the AWS Encryption SDK requires managing encryption logic in the application, and storing keys in Secrets Manager with automatic rotation adds complexity and operational overhead compared to a fully managed server-side solution.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a TCP listener does not support SSL termination at the load balancer; it forwards encrypted traffic as-is, and proxy protocol v2 is used with TCP listeners to preserve client IP, but this does not meet the SSL termination requirement. Option B is wrong because using a TCP listener on port 443 and forwarding to instances on port 443 with SSL certificates on instances means SSL termination occurs on the instances, not at the load balancer, and client IP is not preserved without proxy protocol. Option C is wrong because forwarding HTTPS traffic on port 443 to instances on port 443 with SSL certificates on instances means SSL termination is performed on the instances, not at the load balancer, and disabling proxy protocol does not preserve the client IP via X-Forwarded-For.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-C requires the customer to manage and rotate their own encryption keys, increasing operational overhead. Option C is wrong because client-side encryption with AWS KMS requires the application to handle encryption and key management, adding complexity and operational burden. Option D is wrong because SSE-KMS with automatic rotation rotates the KMS key only annually (once per year), not every 90 days as required, and also incurs additional costs and management overhead.

Why this answer

How to eliminate wrong answers

Option B is wrong because the command does not inherently list instances in JSON format; the default output format is JSON, but the user can specify other formats like text or table with the `--output` parameter, and the question does not state that JSON is forced. Option C is wrong because the command includes no filter (e.g., `--filters Name=instance-state-name,Values=running`) to limit results to running instances; it returns all instances regardless of state. Option D is wrong because `--query` is used correctly here—it applies a JMESPath expression to filter the output fields, and the syntax `Reservations[*].Instances[*].[InstanceId,State.Name]` is valid and will not cause the command to fail.

Why this answer

How to eliminate wrong answers

Option A is wrong because chaining multiple Lambda functions via Step Functions does not extend the per-invocation timeout; each individual Lambda function still has a 15-minute limit, and splitting an image into parts would require custom orchestration and state management, not a native solution for long-running tasks. Option C is wrong because using SQS to queue images does not change Lambda's maximum execution time; each Lambda invocation still cannot exceed 15 minutes, so images requiring longer processing would time out. Option D is wrong because Lambda's maximum timeout is fixed at 15 minutes (900 seconds) and cannot be increased; this is a hard AWS service limit, not a configurable parameter.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams requires you to manage shard provisioning and scaling to handle variable throughput, and it does not natively deliver data to S3 without additional consumers (e.g., Lambda or Firehose), increasing operational overhead and cost. Option B is wrong because AWS Lambda has a maximum execution timeout of 15 minutes and is not designed for buffering streaming data; it would require custom code to aggregate and write to S3, leading to complexity and potential data loss during bursts. Option D is wrong because Amazon SQS is a message queue with a maximum message retention of 14 days, but it does not provide built-in buffering for time-based delivery to S3; you would need additional components to poll, buffer, and write data, increasing overhead and cost.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Amazon EFS) is wrong because it is a file-level storage service for Linux workloads, not designed for single objects up to 5 TB (its maximum file size is 52 TB, but it lacks native HTTPS object access and is optimized for shared file systems, not direct HTTP retrieval). Option C (AWS Storage Gateway) is wrong because it is a hybrid storage service that provides on-premises access to AWS storage, not a primary storage service for direct HTTPS access to large files; it adds latency and complexity for a purely cloud-native application. Option D (Amazon EBS) is wrong because it is block-level storage attached to a single EC2 instance, cannot be accessed directly via HTTPS, and has a maximum volume size of 16 TB but requires an EC2 instance to serve files, making it unsuitable for direct object retrieval over the internet.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Multi-AZ in a different Region is not a supported configuration; Multi-AZ provides high availability within a single Region by synchronously replicating to a standby in a different Availability Zone, not across Regions. Option C is wrong because daily snapshots cannot achieve an RPO of 1 hour; snapshot frequency is at most once every 5 minutes, but daily snapshots would result in up to 24 hours of potential data loss, far exceeding the 1-hour RPO. Option D is wrong because Amazon S3 cross-Region replication is used for S3 objects, not for RDS database backups; RDS automated backups and manual snapshots are stored in S3, but the replication of those backups via S3 CRR does not provide the low RTO or RPO required, as it would still require restoring from a snapshot, which takes longer than 15 minutes.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a launch configuration is a template for launching instances, not a mechanism for automatic recovery or high availability; manually associating it with instances does not provide any automated failover or replacement. Option C is wrong because EC2 Auto Recovery only recovers an individual instance within the same AZ if it becomes impaired, but it cannot handle the loss of an entire AZ or redistribute instances across other AZs. Option D is wrong because manually launching additional instances in other AZs requires human intervention and does not provide automated recovery or scaling, violating the requirement to survive an AZ failure without manual action.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing for internal NLB operates at Layer 4 and does not provide service mesh capabilities like traffic routing based on HTTP headers, observability with distributed tracing, or mTLS security between services. Option C is wrong because AWS Cloud Map is a service discovery tool that registers service instances and provides DNS-based or API-based resolution, but it does not handle traffic routing, observability, or security policies required for a service mesh. Option D is wrong because Amazon API Gateway with VPC linking is designed for external API management and routing to backend services, not for internal service-to-service communication within a microservices mesh, and it lacks the sidecar proxy model and fine-grained traffic control of a service mesh.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Lambda has a maximum execution timeout of 15 minutes, but each message requires 5 minutes of processing time; however, the real issue is that Lambda is not designed for sustained high-throughput, long-running tasks—it scales quickly but can hit concurrency limits and is less cost-effective for continuous 5-minute executions compared to Fargate. Option C is wrong because Amazon MQ (ActiveMQ) is a managed message broker that is not serverless and incurs fixed infrastructure costs, making it less scalable and cost-effective than SQS for this high-volume, steady-state workload. Option D is wrong because Lambda triggers from SQS have a maximum invocation timeout of 15 minutes (which is fine for 5-minute messages), but the batch size of 1 and the need to process 1,000 messages per second would require massive Lambda concurrency, quickly exhausting account limits and driving up costs due to per-invocation billing, making it less scalable and cost-effective than Fargate.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the instance size (vertical scaling) is a manual, one-time change that does not automatically handle sudden traffic spikes; it also introduces a single point of failure and does not leverage the elasticity of Auto Scaling. Option C is wrong because manually increasing the desired capacity when traffic spikes requires human intervention and real-time monitoring, which defeats the purpose of automated scaling and can lead to delays or errors during spikes. Option D is wrong because scheduled scaling is designed for predictable traffic patterns (e.g., time-of-day peaks) and cannot react to sudden, unplanned traffic spikes; it would either over-provision or under-provision during unexpected events.

Why this answer

How to eliminate wrong answers

Option B is wrong because placing the application behind a public Application Load Balancer requires the ALB to have public internet access, which violates the 'no public internet access' requirement. Option C is wrong because a NAT gateway in a public subnet still requires an internet gateway for outbound traffic, and the application would need a route to the NAT gateway, which ultimately uses the internet; this does not meet the 'no internet access' condition. Option D is wrong because AWS PrivateLink is the underlying technology for Interface VPC endpoints, but it cannot be used directly for S3; S3 requires a Gateway VPC endpoint (or an Interface endpoint with a different configuration), and PrivateLink alone does not provide the correct connectivity for S3 without additional setup.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL database service designed for storing application data, not for securely managing secrets; storing credentials in DynamoDB would require you to manage encryption and access control manually, and it lacks built-in secret rotation. Option C is wrong because AWS Identity and Access Management (IAM) is used for managing permissions and access to AWS resources, not for storing secrets; while IAM roles can grant Lambda permissions to access Secrets Manager, IAM itself cannot store or retrieve credential values. Option D is wrong because AWS Systems Manager Parameter Store can store secrets as SecureString parameters, but it does not natively support automatic rotation of database credentials, which is a key requirement for securely managing credentials over time.