CCNA Design for New Solutions Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server is optimized for Windows-based workloads requiring SMB protocol support and Active Directory integration, not for general-purpose Linux-based concurrent access from multiple EC2 instances. Option B is wrong because Amazon S3 with S3 File Gateway presents an NFS or SMB mount point backed by S3, but it introduces latency and caching complexity, and S3 itself is an object store, not a POSIX-compliant file system suitable for concurrent read/write locking. Option D is wrong because Amazon EBS with Multi-Attach enabled supports only up to 16 Nitro-based EC2 instances in a single Availability Zone, lacks cross-AZ high availability, and does not provide a shared file system interface (it is a block-level device requiring a cluster-aware file system).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS KMS is a key management service for encryption keys, not for storing or rotating secrets like database credentials; it can encrypt secrets but does not manage rotation. Option B is wrong because AWS Systems Manager Parameter Store can store secrets but lacks native automatic rotation capabilities—it requires custom solutions or integration with Secrets Manager for rotation. Option C is wrong because IAM is used for access control and permissions, not for storing secrets or rotating credentials; it cannot store database passwords or manage their lifecycle.

Why this answer

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams is designed for change data capture from DynamoDB tables, not for ingesting high-throughput streaming data from IoT devices; it lacks the buffering, fan-out, and analytics capabilities needed for near real-time processing. Option C is wrong because Amazon SQS is a message queue for decoupling applications, not a streaming ingestion service; it does not support ordered, replayable, or near real-time analytics on continuous data streams. Option D is wrong because Amazon Kinesis Data Firehose alone cannot perform near real-time analytics—it is a delivery service that can only apply simple transformations (e.g., Lambda) but lacks native stream processing with windowing, aggregations, or joins; AWS Glue is a batch ETL service, not a streaming analytics engine.

Why this answer

How to eliminate wrong answers

Option B is wrong because optimistic locking with a version number prevents overwrites by rejecting stale updates, but it does not resolve conflicts by keeping the most recent write; it would cause writes to fail instead of automatically selecting the latest data. Option C is wrong because DynamoDB Streams can capture changes but do not provide built-in conflict resolution; using streams to reconcile conflicts would require custom application logic and would not automatically ensure the most recently written data is used. Option D is wrong because conditional writes prevent overwrites when a condition is not met, which would cause write failures rather than resolving conflicts by keeping the latest write.

Why this answer

Why this answer

How to eliminate wrong answers

Option A (S3 Standard) is wrong because it is designed for frequently accessed data with no cost savings for infrequent access patterns; using it for the first 30 days would incur higher storage costs than necessary since the logs are not accessed constantly. Option C (S3 One Zone-IA) is wrong because it stores data in a single Availability Zone, which does not provide the durability and availability required for application logs that may need to be recovered after a zone failure; the question does not indicate tolerance for such risk. Option D (S3 Glacier Flexible Retrieval) is wrong because it is intended for long-term archival with retrieval times ranging from minutes to hours, not for data that is accessed frequently within the first 30 days; it would introduce unacceptable latency for the initial frequent access pattern.

Why this answer

How to eliminate wrong answers

Option B (Enhanced Networking with ENA) is wrong because while it provides higher bandwidth and lower jitter than standard networking, it still operates through the kernel network stack and does not support OS-bypass, so it cannot achieve the ultra-low latency required for tightly coupled HPC inter-node communication. Option C (VPC Peering) is wrong because it is a logical connection between VPCs used for routing traffic, not a physical network adapter or interface; it does not reduce latency or provide OS-bypass for compute nodes within the same cluster. Option D (AWS Direct Connect) is wrong because it establishes a dedicated network connection from on-premises to AWS, not between compute nodes within a VPC; it is irrelevant to inter-node communication latency inside an HPC cluster.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because manual scaling requires human intervention to add or remove instances, which cannot respond to sudden spikes in real time. Option B is wrong because simple scaling with a cooldown period uses a single step adjustment and then locks scaling actions during the cooldown, which can delay response to rapid traffic changes and cause under- or over-provisioning. Option C is wrong because scheduled scaling relies on predictable patterns from historical data and cannot react to unexpected spikes that deviate from the schedule.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose has a minimum buffering interval of 60 seconds, which cannot achieve the required sub-second latency. Option C is wrong because AWS Database Migration Service (DMS) is designed for database migration and change data capture, not for real-time streaming ingestion from IoT devices. Option D is wrong because Amazon SQS does not support sub-second latency for streaming data and requires polling, which adds overhead; EC2 Auto Scaling adds management complexity and cannot guarantee the same low-latency processing as Lambda.

Why this answer

How to eliminate wrong answers

Option A is wrong because restricting access by EC2 instance public IP is not secure (IPs can change, and other AWS services or instances could share the same IP) and does not provide temporary credentials. Option B is wrong because storing IAM user credentials in EC2 user data exposes long-term access keys, which can be compromised and require manual rotation. Option C is wrong because hardcoding AWS access keys in application code is a severe security risk, as the keys are static, can be exposed in version control, and violate the principle of least privilege.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing session state on the local instance store of each EC2 instance is not scalable (state is lost on instance termination or replacement) and cannot be shared across instances in an Auto Scaling group, leading to session loss during scaling events. Option C is wrong because Amazon DynamoDB, while scalable and durable, is not the most cost-effective for session state due to its per-request pricing and higher latency compared to an in-memory cache like Redis, especially for high-frequency read/write workloads. Option D is wrong because Amazon RDS for MySQL is a relational database with higher latency and cost for key-value session storage, and it lacks the in-memory performance and simple key-value access patterns needed for low-latency session state.

Why this answer

How to eliminate wrong answers

Option B is wrong because using Amazon SQS to buffer requests to Lambda introduces additional latency and does not resolve the root cause of Lambda throttling or DynamoDB write throttling; DAX caches reads, not writes, so it does not help with write throttling. Option C is wrong because increasing DynamoDB write capacity units to the maximum expected peak is cost-inefficient and does not adapt to variable traffic, while Lambda provisioned concurrency is a valid approach but the option lacks the complementary DynamoDB scaling strategy needed for write throttling. Option D is wrong because replacing Lambda with Amazon ECS on Fargate adds operational complexity and does not directly address the throttling issues; Application Auto Scaling for ECS does not solve DynamoDB write throttling, and the migration is unnecessary for a serverless application.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon SQS buffers write requests but does not address the root cause of connection exhaustion; it only decouples the write path, leaving read operations and other direct database interactions still vulnerable to connection pool exhaustion. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB, not for Amazon RDS for PostgreSQL, and it cannot pool or manage database connections. Option D is wrong because increasing the max_connections parameter only raises the limit, but does not prevent Lambda from opening too many connections; it can lead to resource contention and still exhaust database resources under high concurrency.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing the Lambda function outside the VPC and using a NAT gateway would still require the function to traverse the internet to reach the database, introducing latency and security risks; moreover, NAT gateways are not designed for Lambda-to-VPC database access without VPC attachment. Option B is wrong because placing the Lambda function inside the VPC introduces significant cold start latency (often 10–30 seconds) due to the need to create and attach an ENI to the function's execution environment, which is especially problematic for a 5-minute timeout workload. Option C is wrong because Amazon RDS Proxy manages database connections but does not eliminate the need for the Lambda function to be inside the VPC or use a VPC endpoint; keeping Lambda outside the VPC without a VPC endpoint would still require public internet access or a NAT gateway, defeating the purpose of RDS Proxy's connection pooling.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because scheduled scaling actions are time-based and do not respond to real-time CPU utilization; they are used for predictable traffic patterns, not dynamic scaling. Option B is wrong because a simple scaling policy can only perform a single adjustment (e.g., add one instance) when a CloudWatch alarm triggers, and it requires waiting for the entire cooldown period before responding to another alarm, making it less responsive and prone to oscillation. Option D is wrong because ALB health checks are designed to determine instance health based on application-level responses (e.g., HTTP 200), not CPU utilization; marking instances unhealthy based on CPU would cause the ALB to stop routing traffic, potentially dropping valid requests, and is not a supported mechanism for Auto Scaling.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a content delivery network; it stores data in a single region and does not provide global edge caching or low-latency distribution on its own. Option B is wrong because Amazon EC2 is a compute service that runs virtual servers in specific regions; it lacks built-in global edge caching and would require manual scaling and additional services to achieve low-latency delivery worldwide. Option C is wrong because Amazon Route 53 is a DNS and traffic management service; it resolves domain names to IP addresses but does not cache or deliver content, so it cannot reduce latency for content delivery.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway with a single VPN does not provide the required 10 Gbps throughput; VPN throughput is limited by the VPN endpoint and internet conditions, typically maxing out at 1.25 Gbps per tunnel. Option B is wrong because a single Direct Connect connection with a backup VPN does not meet the high availability requirement; the VPN backup introduces failover latency and cannot sustain 10 Gbps throughput during failover. Option C is wrong because multiple Site-to-Site VPN connections from the data center to the VPC cannot aggregate to 10 Gbps reliably; VPN throughput is per-tunnel limited (e.g., 1.25 Gbps per tunnel with ECMP), and internet-based VPNs are subject to jitter and packet loss.

Why this answer

How to eliminate wrong answers

Option B is wrong because removing the VPC configuration would disconnect the Lambda from the VPC entirely, preventing any access to the RDS database (which is inside the VPC), and would not resolve the timeout. Option C is wrong because increasing memory to 1024 MB improves CPU and network throughput but does not fix the fundamental network connectivity issue caused by missing subnets; the timeout is due to network path failure, not resource constraints. Option D is wrong because security group rules control inbound/outbound traffic, but the default security group already allows all outbound traffic; the issue is subnet misconfiguration, not firewall rules.

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because caching database queries with ElastiCache reduces database load and query latency, but does not directly address high CPU utilization on the EC2 instances themselves, which is the root cause of the latency spikes. Option B is wrong because Spot Instances are cost-effective but can be interrupted with a two-minute warning, making them unsuitable for a high-traffic web application that requires consistent availability and low latency during peak hours. Option C is wrong because increasing the EC2 instance size (vertical scaling) is less cost-effective and scalable than horizontal scaling, as it leads to over-provisioning during off-peak hours and has a hard limit on instance size, failing to handle unpredictable traffic spikes efficiently.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an Internet Gateway enables communication between a VPC and the internet, not direct access to VPC resources from a Lambda function; Lambda already uses a VPC-attached ENI for private connectivity. Option C is wrong because VPC peering connects two separate VPCs, but the Lambda function needs to be directly attached to the target VPC, not rely on a peering connection. Option D is wrong because a NAT Gateway allows outbound internet access from private subnets, but it does not enable a Lambda function to access VPC resources; the function must be attached to the VPC with appropriate security group rules.

Why this answer

How to eliminate wrong answers

Option B is wrong because VPC peering connects entire VPCs at the network layer, but it does not provide application-layer security (like mTLS), traffic shaping, or observability for microservices; it also adds complexity and does not scale well with many services. Option C is wrong because an internet-facing Application Load Balancer exposes services to the public internet, which is unnecessary and insecure for internal service-to-service communication, and it adds latency and cost. Option D is wrong because an internal Network Load Balancer operates at Layer 4 and cannot perform mTLS, application-layer routing, or provide the fine-grained traffic management needed for microservices; it also lacks built-in observability and retry logic.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring the target group to use HTTP protocol does not encrypt traffic between the client and the ALB; it only affects the backend connection, and the client-to-ALB leg remains unencrypted if the listener is HTTP. Option B is wrong because restricting inbound traffic to approved IPs controls network access but does not encrypt the data in transit; encryption requires TLS/SSL, not IP filtering. Option C is wrong because using HTTP on port 80 and relying on VPC network ACLs provides no encryption; network ACLs are stateless packet filters and do not provide any cryptographic protection for data in transit.

Why this answer

How to eliminate wrong answers

Option A is wrong because the bucket policy is not mentioned in the exhibit; the attached IAM policy uses a `Deny` effect with a condition, not a blanket denial of all uploads without encryption. Option C is wrong because bucket ownership is irrelevant to the IAM policy's encryption condition; the policy does not check ownership, and the user can upload to any bucket they have permissions for. Option D is wrong because the user does have `s3:PutObject` permission granted by the `Allow` statement; the failure is due to the `Deny` statement triggered by the missing encryption header, not a lack of the action permission.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 cross-region replication is used to automatically replicate objects to a different AWS region for data redundancy or compliance, not to grant cross-account access to a partner. Option C is wrong because a pre-signed URL grants temporary access to a specific object using a URL that embeds credentials, but it does not allow the partner to use their own AWS account credentials; it also expires and is not suitable for ongoing or large-scale access. Option D is wrong because providing an IAM user in the company's account would require the partner to use that user's credentials (access key and secret key) instead of their own account credentials, violating the requirement that the partner uses their own account credentials.

Why this answer

How to eliminate wrong answers

Option B is wrong because Kinesis Data Analytics is designed for real-time SQL or Apache Flink analytics on streaming data, not for archiving raw data to S3; it lacks native S3 delivery and would require additional services to archive. Option C is wrong because using the Kinesis Client Library (KCL) requires you to run custom application code (e.g., on EC2 or ECS) to process records and write to S3, adding operational overhead and cost compared to a fully managed Firehose solution. Option D is wrong because a single Lambda function reading directly from a Kinesis stream cannot scale to handle 5,000 records per second (10 shards × 500 records/s) without complex parallel processing logic, and Lambda's maximum concurrency and 15-minute timeout make it inefficient for sustained high-throughput archiving.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC peering connects entire VPCs, not individual subnets, and does not inherently isolate services from the internet; it also adds complexity and transitive routing limitations. Option B is wrong because AWS PrivateLink creates VPC endpoints for accessing specific AWS services or your own services via NLB, but it is not designed for inter-service communication within the same VPC and introduces unnecessary cost and latency. Option C is wrong because placing services in public subnets exposes them to the internet even with restrictive security groups, as public subnets have a route to an internet gateway, violating the isolation requirement.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service accessed via HTTP/S APIs, not a file system; it introduces higher latency and does not support low-latency file-level locking or concurrent NFS-style access required by multiple EC2 instances. Option B is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time (except for multi-attach EBS, which is limited to specific instance types and is not designed for shared, frequently updated datasets across many instances). Option C is wrong because Amazon S3 Glacier is designed for archival and long-term backup with retrieval times ranging from minutes to hours, making it completely unsuitable for low-latency, frequently updated access.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the data retention period to 365 days (the maximum) only extends how long records are stored in the stream; it does not provide dedicated throughput per consumer or enable independent reprocessing from a specific timestamp. Option C is wrong because resharding increases the number of shards to scale write/read capacity, but it does not give each consumer a dedicated connection or the ability to reprocess from a chosen point without affecting other consumers. Option D is wrong because the Kinesis Client Library (KCL) with checkpointing allows consumers to track their progress and resume from a checkpoint, but it still shares the 2 MB/second per shard among all consumers using the same shard, causing contention and lacking the independent, low-latency delivery that Enhanced Fan-Out provides.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC Endpoints are used for private access to AWS services (e.g., S3, DynamoDB) and do not provide connectivity to on-premises data centers; they also do not offer encryption or high availability for hybrid connectivity. Option C is wrong because VPC Peering does not support transitive routing (it is a one-to-one connection) and cannot connect multiple VPCs to multiple on-premises locations without a hub; additionally, it does not inherently provide encryption or low-latency guarantees for hybrid links. Option D is wrong because AWS Client VPN is a remote access VPN for individual clients (not site-to-site) and VPC Peering again lacks transitive routing and cannot aggregate multiple on-premises connections.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Simple Notification Service (SNS) is a pub/sub messaging service that pushes notifications to subscribers (e.g., HTTP endpoints, Lambda, SQS), but it does not provide a durable queue for decoupling; tasks sent via SNS are not stored for later retrieval if the consumer is unavailable. Option B is wrong because Amazon EventBridge is an event bus service designed for routing events between AWS services and SaaS applications, not for building a point-to-point task queue between a web front-end and a processing tier; it lacks the built-in message retention and polling mechanics of a queue. Option C is wrong because Amazon Kinesis Data Streams is optimized for real-time streaming of large volumes of data (e.g., log ingestion, clickstreams) and requires consumers to manage shard-level processing, which is overkill and more complex than a simple task queue for decoupling web requests.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS DMS for continuous replication incurs ongoing replication instance costs and data transfer charges, making it more expensive than a cross-region read replica for this RPO/RTO requirement. Option C is wrong because automated backups and restore to us-west-2 when needed cannot achieve an RPO of 1 hour, as backups are typically taken once per day and restore times exceed 15 minutes. Option D is wrong because a Multi-AZ deployment in us-east-1 provides high availability within a single region, not disaster recovery across regions, and fails to meet the requirement for a secondary region in us-west-2.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 One Zone-Infrequent Access is designed for data that is accessed infrequently but requires rapid retrieval (milliseconds), and it stores data in a single Availability Zone, which does not provide the durability needed for a 7-year retention period; its cost is higher than Glacier Deep Archive for long-term archival. Option B is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, but it is not optimized for purely archival data that will almost never be accessed; it incurs monitoring and automation fees that make it less cost-effective than Glacier Deep Archive for data that will be stored for 7 years with infrequent access. Option D is wrong because S3 Standard is designed for frequently accessed data with millisecond retrieval and is the most expensive storage class, making it unsuitable for cost-effective long-term archival of infrequently accessed logs.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Glue with streaming ETL is designed for processing streaming data from sources like Amazon Kinesis or Kafka, not for capturing changes directly from an RDS database; it lacks native CDC capabilities to read database transaction logs. Option B is wrong because AWS Lambda with database polling requires custom code to repeatedly query the database for changes, which introduces latency, increased load on the database, and is not a real-time streaming solution; it also does not capture deletes or changes efficiently without additional logic. Option C is wrong because Amazon Kinesis Data Streams with a custom producer requires you to build and manage your own application to poll the RDS database and push changes to Kinesis, adding operational overhead and complexity; it does not provide native CDC integration with database transaction logs.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'aws:SecureTransport' is correctly spelled with a capital 'T' in the condition key; the spelling in the template is accurate. Option C is wrong because the bucket policy already has an explicit 'Deny' effect for requests without 'aws:SecureTransport', so adding an 'Allow' statement for HTTPS is unnecessary and would not fix the issue of HTTP uploads being allowed. Option D is wrong because the resource ARN 'arn:aws:s3:::my-unique-bucket-123/*' is correct for covering object-level actions like PutObject; omitting '/*' would only cover bucket-level actions, not object uploads.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse optimized for structured, frequently queried data, not for storing large volumes of raw log data over long periods; using data sharing does not provide a cost-effective archival tier like S3 Glacier Deep Archive, and retaining logs for 5 years in Redshift would be prohibitively expensive. Option C is wrong because Amazon OpenSearch Service with UltraWarm storage is designed for near-real-time search and analytics on log data, but it does not support SQL-based queries natively (it uses its own query DSL) and UltraWarm is not a long-term archival tier; it also lacks the cost efficiency of S3 Glacier Deep Archive for 5-year retention. Option D is wrong because Amazon RDS for PostgreSQL is a relational database service intended for transactional workloads, not for storing and analyzing large volumes of log data; automated backups are for point-in-time recovery, not for long-term archival, and storing logs for 5 years in RDS would incur high storage costs and performance issues.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy does not include a `Deny` effect; it uses an `Allow` effect with a condition, which does not explicitly deny access from other IPs—it simply does not grant permission for those IPs, and an explicit deny would be needed to block them. Option C is wrong because the `Resource` is specific enough: it targets `arn:aws:s3:::example-bucket/*`, which precisely identifies objects within the named bucket, and IAM policies require an ARN format that is valid and specific. Option D is wrong because the policy only allows `s3:GetObject` (not all S3 actions) and only on `example-bucket` (not all buckets), as clearly specified in the `Action` and `Resource` fields.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Amazon EKS managed node groups) is wrong because, while it reduces some operational burden by automating node provisioning and updates, it still requires you to manage EC2 instances (e.g., instance types, scaling policies, and patching), which adds operational overhead compared to Fargate. Option C (Amazon EC2 instances) is wrong because it requires full manual management of the underlying virtual machines, including OS patching, security updates, and scaling, which contradicts the goal of minimizing operational overhead. Option D (Self-managed EC2 nodes) is wrong because it places the entire burden of node lifecycle management (provisioning, patching, scaling, and troubleshooting) on the development team, resulting in the highest operational overhead.

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon Route 53 is designed for static DNS resolution and does not natively support dynamic service registration and health checking for ephemeral ECS tasks, making it unsuitable for dynamic service discovery in a microservices architecture; additionally, an Application Load Balancer is an ingress point for incoming traffic, not an egress point for outbound traffic to external services. Option C is wrong because while AWS Cloud Map is correct for service discovery, an Internet Gateway is used for bidirectional communication between a VPC and the internet, not as a single egress point—it would allow direct outbound access from all resources, bypassing centralized security and monitoring. Option D is wrong because Amazon Route 53 is not designed for dynamic service discovery in ECS, and VPC endpoints are used for private connectivity to AWS services, not for routing traffic to external SaaS applications over the internet.

Why this answer

How to eliminate wrong answers

Option B is wrong because SNS triggers Lambda synchronously via a push mechanism, which would cause the S3 event to be lost if the Lambda function times out or fails, and SNS does not provide a buffer for retries or backpressure. Option C is wrong because S3 synchronous invocation of Lambda has a 15-minute timeout limit that matches the requirement, but synchronous invocation would block the S3 event and could lead to throttling or failures if the processing takes the full 15 minutes; moreover, S3 synchronous invocation is not designed for long-running asynchronous tasks. Option D is wrong because EventBridge can capture S3 events and trigger Step Functions, but Step Functions itself does not directly handle the 15-minute processing; it would still need to invoke a Lambda function or another service, and the question asks for the service to trigger the processing, not orchestrate it.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because daily automated snapshots cannot achieve a 15-minute RPO; the RPO would be up to 24 hours, and restoring from a snapshot in the DR Region takes longer than 2 hours for RTO. Option B is wrong because Amazon Aurora Global Database is more expensive than a cross-Region read replica for RDS MySQL, and the question specifies RDS for MySQL, not Aurora; using Aurora would require migrating the database, adding cost and complexity. Option C is wrong because AWS Backup copying backups to the DR Region still relies on snapshot schedules (typically daily), failing the 15-minute RPO, and EC2 Image Builder addresses application recovery but not the database RPO/RTO requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy only allows s3:PutObject, not all actions on the bucket. Option C is wrong because there is no second statement; the policy has a single statement with an Allow effect, and GetObject is not included. Option D is wrong because the IP address matches the condition (10.0.1.5), so the Allow effect applies, not a Deny.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by directing traffic to the optimal endpoint based on health and geography, but it does not distribute traffic across EC2 instances within a region; it uses anycast IPs and routes to Application Load Balancers or Network Load Balancers. Option C is wrong because AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, not for distributing traffic across EC2 instances in multiple AZs. Option D is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses and can route traffic to multiple endpoints using policies like weighted or latency routing, but it does not perform load balancing at the application layer or distribute traffic across instances in real time.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides a hardware security module for key generation and storage, but it does not integrate with KMS for automatic key rotation; managing rotation manually would be complex and error-prone, and the question specifically requires a KMS-based solution. Option B is wrong because an AWS managed key for S3 cannot be used with EC2 instances directly (it is tied to S3), and the key is managed by AWS, not the customer, violating the customer-managed key requirement. Option D is wrong because generating a new key every 90 days and re-encrypting all data is unnecessary overhead; KMS automatic rotation (every 365 days) already preserves old backing keys for decryption, and manual rotation with re-encryption violates the principle of least effort and could introduce data availability risks.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS Secrets Manager) is wrong because it is designed to securely store and rotate secrets such as database credentials or API keys, not to manage user authentication or issue JWTs. Option C (AWS Identity and Access Management) is wrong because IAM is used for managing AWS resource permissions via policies and roles, not for authenticating end users or issuing JWTs; it cannot issue tokens for external user identities. Option D (AWS Security Token Service) is wrong because STS issues temporary AWS credentials (access keys, session tokens) for IAM roles or federated users, not JWTs for application-level authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog is a governance tool for creating and managing a catalog of approved IT services (e.g., pre-configured CloudFormation templates), not a service discovery mechanism. Option B is wrong because Amazon Route 53 private hosted zones provide DNS resolution within a VPC but require manual registration of records and do not support dynamic registration or health-based filtering of service instances without additional automation. Option C is wrong because AWS Systems Manager Parameter Store is a secure hierarchical store for configuration data and secrets, not a service discovery service; it lacks native DNS or API-based endpoint resolution and health checking for dynamic service instances.

Why this answer

How to eliminate wrong answers

Option A (Amazon EBS with Multi-Attach) is wrong because EBS Multi-Attach only supports a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, and it does not support Fargate tasks, which are serverless and cannot attach EBS volumes directly. Option C (Amazon S3) is wrong because S3 is an object storage service that does not support the NFS protocol; it uses RESTful APIs (HTTP/HTTPS) and is not a POSIX-compliant file system mountable via NFS. Option D (Amazon FSx for Lustre) is wrong because FSx for Lustre is designed for high-performance computing (HPC) workloads with a POSIX-compliant file system but does not natively support the NFS protocol; it uses the Lustre client protocol instead.

Why these pairings

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because synchronous replication across AWS Regions would introduce high latency and is not supported by Aurora; Aurora's synchronous replication is limited to within a single Region. Option B is wrong because Aurora Global Database uses asynchronous replication with a typical RTO of 1 minute or less, but it requires a secondary cluster that incurs ongoing compute and storage costs, making it more expensive than a cross-Region replica. Option D is wrong because daily snapshots with cross-Region copy have an RTO that can exceed 15 minutes due to the time required to copy and restore the snapshot, and they also risk data loss of up to 24 hours.