Design Solutions for Organizational Complexity

1. An organization must connect 60 VPCs across three Regions and several accounts, with segmentation between production and development traffic. Which solution meets these requirements?

1. A Publish each VPC's services through AWS PrivateLink endpoints in every other VPC.
2. B Deploy a transit gateway in each Region, peer the gateways, and use separate route tables for each environment.
3. C Consolidate the workloads into three VPCs, one per Region, with a subnet per environment.
4. D Create VPC peering connections between every pair of VPCs and add the required routes.

2. An on-premises data center must reach AWS with consistent bandwidth, and a backup path must carry traffic if the primary circuit fails. Which solution meets these requirements?

1. A Provision AWS Direct Connect for the primary path and configure a Site-to-Site VPN as backup, with routing preferring Direct Connect.
2. B Provision two Site-to-Site VPN connections through different internet service providers.
3. C Provision Direct Connect and rely on the AWS backbone to reroute traffic automatically.
4. D Provision a single Direct Connect connection with a higher port speed.

3. Instances in a VPC must resolve names held in an on-premises DNS zone, and on-premises hosts must resolve names in a private hosted zone. Which solution meets these requirements?

1. A Add host file entries on the instances and the on-premises servers.
2. B Create a Route 53 private hosted zone containing copies of the on-premises records.
3. C Create Route 53 Resolver outbound and inbound endpoints with forwarding rules for each direction.
4. D Create a Route 53 public hosted zone for both domains so all hosts can resolve them.

4. An architect must determine why traffic between two VPCs attached to a transit gateway is not flowing, without generating test traffic. Which solution meets these requirements?

1. A Review the CloudWatch metrics published by the transit gateway attachments.
2. B Enable VPC Flow Logs on both VPCs and analyse the rejected records.
3. C Launch test instances in both VPCs and attempt a connection between them.
4. D Run Network Access Analyzer or VPC Reachability Analyzer to evaluate the configured path and identify the blocking component.

5. Applications in private subnets across many accounts must reach Amazon S3 without any route to the internet, at the lowest cost. Which solution meets these requirements?

1. A Create an interface VPC endpoint for Amazon S3 in each VPC and resolve it by private DNS.
2. B Route the traffic through a proxy fleet in a shared services VPC.
3. C Route the traffic through a centralized NAT gateway in a shared services VPC.
4. D Create a gateway VPC endpoint for Amazon S3 in each VPC and add the route to the private subnet route tables.

6. An organization must allow a security team in one account to assume read-only roles in 200 member accounts without maintaining a trust policy per account. Which solution meets these requirements?

1. A Create an IAM user in each account and share its credentials with the security team.
2. B Grant the security team access to the organization management account only.
3. C Deploy the role to every account with CloudFormation StackSets and use a trust policy conditioned on the organization identifier.
4. D Create the role manually in each account with a trust policy naming the security account.

7. An organization must centralize security findings, configuration compliance, and API activity from every account for audit. Which combination of steps meets these requirements? (Select TWO.)

1. A Enable AWS Security Hub and AWS Config with a delegated administrator aggregating findings across the organization.
2. B Ask each account owner to export findings to a shared bucket monthly.
3. C Enable Amazon Detective in the management account only.
4. D Enable CloudTrail separately in each account with delivery to a local bucket.
5. E Enable an organization CloudTrail trail delivering to a dedicated log archive account.

8. An architect must integrate a third-party identity provider so workforce users reach AWS accounts with corporate credentials and centrally assigned permissions. Which solution meets these requirements?

1. A Create an Amazon Cognito user pool federated to the identity provider.
2. B Create IAM users in each account and synchronize them from the corporate directory.
3. C Configure AWS IAM Identity Center with the provider as the identity source and assign permission sets to accounts.
4. D Configure a SAML identity provider and matching roles in every member account.

9. An organization must ensure that data encrypted in a shared services account can be decrypted by principals in specific member accounts only. Which solution meets these requirements?

1. A Encrypt with an AWS managed key and grant the member accounts read access to the objects.
2. B Encrypt with Amazon S3 managed keys and restrict the bucket policy to the member accounts.
3. C Encrypt with a customer managed AWS KMS key whose key policy grants decrypt to the named member account principals.
4. D Encrypt client-side with a key distributed to each member account team.

10. A workload must survive the loss of a Region with a recovery time objective of 10 minutes and a recovery point objective near zero, at moderate cost. Which solution meets these requirements?

1. A Restore the environment from cross-Region backups when the primary Region fails.
2. B Replicate data to a second Region and provision the application tier during failover.
3. C Run the environment at full capacity in both Regions and serve traffic from both.
4. D Run a scaled-down copy of the environment in a second Region with continuous data replication, and scale it up during failover.

11. An architect must design automatic recovery for a stateful workload whose instances occasionally fail their application health checks. Which solution meets these requirements?

1. A Create a CloudWatch alarm that notifies an operator when the health check fails.
2. B Place the instances in an Auto Scaling group with EC2 health checks and keep state on instance storage.
3. C Place the instances in an Auto Scaling group with ELB health checks and move shared state to a durable service outside the instances.
4. D Increase the instance size so the application is less likely to fail its health check.

12. An organization growing from 30 to 400 accounts must standardize account provisioning and apply preventive and detective controls consistently. Which solution meets these requirements with the LEAST custom engineering?

1. A Publish an onboarding checklist that each account owner follows during setup.
2. B Write automation that creates each account and applies a baseline from a shared template.
3. C Deploy AWS Control Tower and provision accounts through Account Factory with its control library.
4. D Create one account per business unit and separate workloads with IAM policies.

13. An organization must share a set of private subnets from a central networking account with application accounts so they can launch resources into them. Which solution meets these requirements?

1. A Share the subnets with the application accounts through AWS Resource Access Manager.
2. B Attach the networking VPC and each application VPC to a transit gateway.
3. C Create a VPC peering connection between the networking VPC and each application VPC.
4. D Recreate equivalent subnets in each application account's own VPC.

14. An organization must be notified centrally when specified events occur in any member account. Which solution meets these requirements?

1. A Ask each account owner to configure an SNS topic and subscribe the central team.
2. B Create EventBridge rules in each account that forward matching events to a central event bus in the security account.
3. C Enable AWS Config in each account and review the configuration timelines centrally.
4. D Poll each account's CloudTrail events from a central Lambda function on a schedule.

15. An organization must attribute spend to business units across 200 accounts and detect unexpected increases as they occur. Which combination of steps meets these requirements? (Select TWO.)

1. A Review the consolidated invoice at the end of each month.
2. B Enable AWS Cost Anomaly Detection with monitors scoped to the relevant dimensions.
3. C Enable AWS Trusted Advisor and review its cost checks quarterly.
4. D Define and enforce a cost allocation tagging strategy, and activate the tag keys for billing.
5. E Create one AWS Budgets budget per account with a fixed threshold.

16. An organization runs a steady baseline of EC2, Fargate, and Lambda usage and frequently changes instance families. Which purchasing option meets these requirements?

1. A Purchase Compute Savings Plans sized to the steady aggregate usage.
2. B Purchase Convertible Reserved Instances for each instance family in use.
3. C Purchase Standard Reserved Instances for each instance family in use.
4. D Run the baseline on Spot capacity to avoid any commitment.

17. Two VPCs in different accounts must exchange traffic, and the design must avoid the operational overhead of a transit gateway for a single pair. Which solution meets these requirements?

1. A Connect the two VPCs through a Site-to-Site VPN between virtual private gateways.
2. B Attach both VPCs to a new transit gateway and configure its route tables.
3. C Publish each VPC's services through AWS PrivateLink endpoints in the other.
4. D Create a VPC peering connection between the two VPCs and add the required routes in both.

18. An architect must select a Region for a workload whose users are concentrated in one country with a data residency requirement. Which consideration is decisive?

1. A Which Region offers the lowest compute pricing.
2. B Which Region was launched most recently.
3. C Which Region has the largest number of Availability Zones.
4. D Whether a Region exists within the required jurisdiction, since residency constrains the choice before latency does.

19. Traffic between a VPC and Amazon S3 must stay on the AWS network and be restricted to buckets owned by the organization. Which solution meets these requirements?

1. A Create a gateway VPC endpoint and attach an endpoint policy with an aws:ResourceOrgID condition.
2. B Route the traffic through a NAT gateway and restrict the destination by IP address.
3. C Apply a bucket policy on each internal bucket restricting access to the VPC.
4. D Create an interface VPC endpoint and restrict it with a security group.

20. An organization must prevent any member account from creating resources outside two approved Regions, and the restriction must survive a local administrator. Which solution meets these requirements?

1. A Attach a service control policy with an aws:RequestedRegion condition and a NotAction exception for global services.
2. B Disable the unapproved Regions in each account's settings.
3. C Attach an IAM policy with a Region condition to every role in every member account.
4. D Create an AWS Config rule that reports resources created in unapproved Regions.

21. An architect must ensure that encryption keys used across an organization can be audited centrally and that their use is attributable. Which solution meets these requirements?

1. A Use customer managed AWS KMS keys with key policies authored centrally, and review key usage in AWS CloudTrail.
2. B Use AWS managed keys so AWS handles the key lifecycle.
3. C Use Amazon S3 managed keys and enable server access logging.
4. D Use client-side encryption with keys distributed to each team.

22. A workload must recover from Regional failure within four hours, and the business accepts losing up to one hour of data. Which strategy is most cost-effective?

1. A Implement a warm standby running a scaled-down environment continuously.
2. B Implement a pilot light with data replicated continuously and the application tier provisioned during failover.
3. C Implement backup and restore from daily cross-Region snapshots.
4. D Implement an active-active deployment serving traffic from both Regions.

23. An architect must decide between scaling a workload up and scaling it out. Which characteristic favours scaling out?

1. A The workload depends on a single large in-memory dataset.
2. B The workload is licensed per server rather than per core.
3. C The workload can be partitioned across instances without shared state.
4. D The workload requires the largest available instance type.

24. An architect must design a backup strategy whose recovery points survive the compromise of the account holding the production data. Which solution meets these requirements?

1. A Increase the frequency of the backups so a recent copy always exists.
2. B Copy the recovery points to a separate account with a vault lock preventing deletion before the retention period expires.
3. C Copy the recovery points to a second Region in the same account.
4. D Enable versioning on the buckets holding the backups.

25. An architect must remove a single point of failure where one instance holds session state for a web tier. Which solution meets these requirements?

1. A Move session state to a shared managed data store so any instance can serve any request.
2. B Take frequent snapshots of the instance's volume.
3. C Enable detailed monitoring so the failure is detected sooner.
4. D Increase the instance size so it is less likely to fail.

26. An organization must give a central team read-only visibility into every member account without granting broad permissions. Which solution meets these requirements?

1. A Deploy a read-only role to every account with StackSets and restrict its trust policy to the central account.
2. B Share credentials for an IAM user created in each member account.
3. C Give the central team access to the organization management account only.
4. D Grant the central team administrator access in each member account.

27. An architect must decide how to organize accounts for an organization with production, development, and shared services workloads across three business units. Which approach is appropriate?

1. A Create one account per business unit and separate environments with tags.
2. B Create one account per workload regardless of policy requirements.
3. C Create a single account and separate workloads with IAM policies.
4. D Group accounts into organizational units reflecting the policy boundaries the business requires, and apply policies at those units.

28. An organization must detect unexpected cost increases without setting a threshold for every service. Which solution meets these requirements?

1. A Create an AWS Budgets budget for each service with a fixed threshold.
2. B Enable AWS Cost Anomaly Detection with monitors scoped to the relevant dimensions.
3. C Enable AWS Trusted Advisor and review its cost checks quarterly.
4. D Review the consolidated invoice at the end of each month.

29. An architect must attribute shared infrastructure cost to the business units that consume it. Which combination of steps meets these requirements? (Select TWO.)

1. A Purchase Reserved Instances for the shared infrastructure.
2. B Define a cost allocation tagging standard and enforce it with a tag policy.
3. C Activate the tag keys for billing so they appear in cost reports.
4. D Create a separate AWS account for every application in the organization.
5. E Enable detailed monitoring on the shared resources.

30. Two VPCs with overlapping CIDR ranges must exchange traffic for a specific application. Which solution meets these requirements?

1. A Attach both VPCs to a transit gateway with a shared route table.
2. B Create a VPC peering connection between the two VPCs.
3. C Renumber one VPC to remove the overlap.
4. D Expose the application through AWS PrivateLink so the consumer reaches it through an endpoint without routing between the overlapping ranges.

31. A transit gateway must isolate production VPCs from development VPCs while both reach a shared services VPC. Which solution meets these requirements?

1. A Create two transit gateways, one per environment.
2. B Use separate route tables for production and development attachments, each with a route to shared services but not to each other.
3. C Use security groups on the shared services instances to distinguish environments.
4. D Use a single route table with a default route to shared services.

32. An on-premises data center needs resilient connectivity to AWS with no single point of failure in either the circuit or the AWS device. Which solution meets these requirements?

1. A Provision two Direct Connect connections at the same location.
2. B Provision two Direct Connect connections at separate locations, each terminating on different AWS devices.
3. C Provision one Direct Connect connection with a Site-to-Site VPN backup.
4. D Provision one Direct Connect connection with two virtual interfaces.

33. Traffic between VPCs attached to a transit gateway must be inspected by a firewall, and the inspection VPC is in a different account. Which combination of steps meets these requirements? (Select TWO.)

1. A Peer each spoke VPC directly to the inspection VPC.
2. B Share the transit gateway with the inspection account through AWS Resource Access Manager.
3. C Enable appliance mode on the spoke VPC attachments.
4. D Configure route tables so traffic between the spoke VPCs is directed to the inspection VPC attachment.
5. E Attach the inspection VPC to a separate transit gateway.

34. An organization must ensure that developers can create IAM roles for their applications but cannot grant those roles permissions beyond a defined ceiling. Which solution meets these requirements?

1. A Require a permissions boundary on every role developers create, enforced with a condition on the role creation permission.
2. B Have a central team create all roles on request.
3. C Restrict developers to a fixed set of pre-created roles.
4. D Grant developers full IAM access and audit role creation weekly.

35. A third-party SaaS provider must access resources in a customer's account, and the access must be revocable without contacting the provider. Which solution meets these requirements?

1. A Grant the provider's account access through a resource policy with no expiry.
2. B Create a role trusted by the provider's account with an external ID condition, so revoking is deleting the role.
3. C Give the provider the account's root credentials.
4. D Create an IAM user for the provider and share its access keys.

36. Security findings from all accounts must be aggregated centrally, and remediation must be automated for a defined set of finding types. Which solution meets these requirements?

1. A Aggregate findings in Security Hub with a delegated administrator, and route the defined finding types through EventBridge to automation.
2. B Enable GuardDuty in each account without central aggregation.
3. C Have each account team review their own findings and remediate manually.
4. D Export findings to a central bucket and review them monthly.

37. An architect must encrypt data in transit between two application tiers within the same VPC. Which consideration applies?

1. A Application-level TLS is required, because network isolation within a VPC does not encrypt the payload.
2. B Traffic within a VPC is automatically encrypted.
3. C Security groups provide encryption between tiers.
4. D A VPC endpoint encrypts traffic between tiers.

38. A workload must survive the failure of a dependency it calls synchronously without failing user requests. Which solution meets these requirements?

1. A Implement a circuit breaker with a fallback response so the workload degrades gracefully when the dependency fails.
2. B Increase the timeout on calls to the dependency.
3. C Retry failed calls to the dependency indefinitely.
4. D Deploy the dependency in a second Region.

39. A backup strategy must protect against an administrator accidentally deleting all backups. Which solution meets these requirements?

1. A Take backups more frequently so a recent copy always exists.
2. B Copy backups to a vault in a separate account with a vault lock that prevents deletion before retention expires.
3. C Require multi-factor authentication for deletion.
4. D Enable versioning on the backup bucket.

40. An architect must decide whether a workload should scale up or scale out to handle growth. Which characteristic favours scaling up?

1. A The workload runs on a per-core licence.
2. B The workload holds a large state in memory that cannot be partitioned across instances.
3. C The workload processes independent requests with no shared state.
4. D The workload must tolerate the failure of any single instance.

41. An architect must design automatic recovery for a stateful application running on a single EC2 instance. Which combination of steps meets these requirements? (Select TWO.)

1. A Take a manual snapshot of the instance daily.
2. B Store the state on an EBS volume or EFS file system that survives the instance.
3. C Configure a CloudWatch alarm with the EC2 recover action, or an Auto Scaling group of one that replaces the instance.
4. D Increase the instance size to reduce the chance of failure.
5. E Store the state on the instance store volume.

42. An organization must prevent member accounts from leaving the organization. Which solution meets these requirements?

1. A Set a strong password on each member account's root user.
2. B Enable AWS Config in the management account.
3. C Attach a service control policy denying the organizations:LeaveOrganization action.
4. D Remove administrator access from all member account users.

43. Resources in a central account must be shared with member accounts without duplicating them. Which solution meets these requirements?

1. A Copy the resources into each member account.
2. B Give member accounts cross-account roles into the central account.
3. C Share the resources through AWS Resource Access Manager with the organization or organizational unit as the principal.
4. D Grant each member account access through resource policies individually.

44. An organization must be alerted when any member account's CloudTrail is stopped. Which solution meets these requirements?

1. A Create an AWS Config rule in each account reporting trail status.
2. B Rely on the organization trail continuing to log the management account.
3. C Review each account's trail status in the console weekly.
4. D Match the StopLogging event in EventBridge from the organization trail and route it to a central notification.

45. An organization must right-size EC2 instances across hundreds of accounts based on actual utilization. Which solution meets these requirements?

1. A Review CloudWatch CPU metrics for each instance manually.
2. B Purchase Reserved Instances for all current sizes.
3. C Downsize every instance by one size and observe.
4. D Enable AWS Compute Optimizer with the organization as the scope and review its recommendations centrally.

46. Reserved Instance discounts purchased in one account must benefit usage in other accounts of the organization. Which configuration is required?

1. A Transfer the Reserved Instances to each account monthly.
2. B Move all workloads into the purchasing account.
3. C Enable Reserved Instance sharing in the organization's consolidated billing so discounts apply across accounts.
4. D Purchase Reserved Instances separately in each account.

47. A Savings Plan's commitment appears underused, and the organization must determine whether it was sized correctly. Which approach is appropriate?

1. A Cancel the plan and repurchase a smaller one.
2. B Compare the commitment against the previous month's total bill.
3. C Increase workload usage to consume the commitment.
4. D Review the Savings Plan utilization and coverage reports in Cost Explorer to see how much commitment is used and how much eligible usage is uncovered.

48. An organization must centralize outbound internet access for many VPCs rather than deploying a NAT gateway in each. Which solution meets these requirements?

1. A Deploy a NAT gateway in every VPC.
2. B Assign public addresses to the instances.
3. C Peer every VPC with an egress VPC.
4. D Route the VPCs through a shared egress VPC attached to a transit gateway, with NAT gateways in that VPC only.

49. An organization must resolve private hosted zone records from an on-premises network. Which solution meets these requirements?

1. A Replicate the records into the on-premises DNS servers.
2. B Add host file entries on the on-premises servers.
3. C Create a public hosted zone containing the private records.
4. D Create a Route 53 Resolver inbound endpoint and forward on-premises queries to it.

50. A central inspection VPC must receive traffic from many spoke VPCs and return it symmetrically. Which solution meets these requirements?

1. A Route spoke traffic through a NAT gateway in the inspection VPC.
2. B Place the inspection appliance in each spoke VPC.
3. C Attach the inspection VPC to the transit gateway with appliance mode enabled and route spoke traffic through it.
4. D Peer each spoke VPC directly to the inspection VPC.

51. An organization must ensure that encryption keys used by a workload cannot be used outside a specified Region. Which solution meets these requirements?

1. A Replicate the key to every Region.
2. B Use a Regional KMS key, since KMS keys are Regional and cannot be used in another Region.
3. C Apply a service control policy denying key use elsewhere.
4. D Restrict the key with a tag condition.

52. An organization must prevent a workload's IAM role from being assumed by a principal in another account. Which solution meets these requirements?

1. A Restrict the role's trust policy to principals within the organization using an organization condition.
2. B Attach a permissions boundary to the role.
3. C Remove the role's attached policies.
4. D Shorten the role's maximum session duration.

53. A workload must survive the loss of a Region with no data loss for committed transactions. Which solution meets these requirements?

1. A Accept that synchronous cross-Region replication is generally impractical, and design for a recovery point measured in seconds using asynchronous replication with lag monitoring.
2. B Deploy read replicas in the second Region.
3. C Use synchronous replication between Regions.
4. D Take cross-Region snapshots every minute.

54. An architecture must limit the blast radius of a failure to a subset of users. Which solution meets these requirements?

1. A Deploy the workload across three Availability Zones.
2. B Partition users into cells, each with its own independent stack, so a failure affects only one cell.
3. C Add a second Region for failover.
4. D Increase the workload's instance count.

55. An organization must apply a configuration setting across all accounts that persists as AWS adds new features to the service. Which solution meets these requirements?

1. A Apply a declarative policy from AWS Organizations, which maintains the desired configuration as the service evolves.
2. B Deploy the setting with CloudFormation StackSets.
3. C Apply a service control policy denying changes to the setting.
4. D Audit the setting quarterly in each account.

56. An organization must charge internal teams for shared infrastructure they consume. Which solution meets these requirements?

1. A Ask each team to estimate their usage.
2. B Divide the shared cost equally between teams.
3. C Attribute the shared cost to the platform team.
4. D Meter each team's usage of the shared resources and allocate cost proportionally using tags or AWS Billing Conductor.

57. An organization must forecast next quarter's AWS spend. Which solution meets these requirements?

1. A Use the Pricing Calculator for the current architecture.
2. B Multiply last month's bill by three.
3. C Use Cost Explorer's forecasting on historical usage, adjusting for known planned changes.
4. D Use the sum of the team's budget requests.