Practice Test #4

CloudFront can cache and reduce read latency, but it is not a multi-Region write solution and does not replicate objects between Regions. Global Accelerator improves routing to regional endpoints, but S3 is not fronted by GA in a way that provides active-active writes and a single S3 data endpoint. This option also keeps a single bucket, so ap-southeast-2 writes still traverse to us-east-1, increasing latency.

One-way CRR only replicates from the original bucket to the new bucket. If the application in ap-southeast-2 writes to its local bucket, those objects will not replicate back to us-east-1, violating the requirement to support writes from both Regions while keeping datasets aligned. It also lacks a single global access endpoint; the application would need region-specific bucket logic.

S3 gateway endpoints provide private connectivity from a VPC to S3 within a Region; they do not create a global endpoint, do not enable multi-Region writes, and do not replicate data. S3 Intelligent-Tiering is a storage class optimization for cost and access patterns, unrelated to cross-Region latency reduction or active-active multi-Region data access.

This improves performance by adding capacity (desired 28) and uses Reserved Instances for 20, but it is not the most cost-effective. The workload’s average CPU is only 10%, indicating 20 instances are significantly overprovisioned for baseline. Reserving 20 instances for 3 years locks in unnecessary spend. Also, setting desired capacity to 28 is not true elasticity; it keeps extra instances running even outside spike hours unless scaling policies reduce it.

Spot Fleet with DefaultTargetCapacityType set to On-Demand effectively provisions mostly On-Demand capacity, so it doesn’t materially reduce cost versus using Auto Scaling with On-Demand. Additionally, Spot Fleet is a legacy approach compared to EC2 Auto Scaling with mixed instances policies. It also doesn’t address right-sizing the baseline; it keeps TotalTargetCapacity at 20 continuously, which remains overprovisioned given 10% average CPU.

This relies primarily on Spot capacity (DefaultTargetCapacityType=Spot) with a maintain request, which can reduce cost but introduces interruption and capacity-availability risk during critical market-open spikes. The question emphasizes resolving latency during spikes for a compliance program; without explicit interruption tolerance and fallback to On-Demand, Spot is risky. Replacing NLB with ALB is unnecessary for a stateless API already behind NLB and adds change without clear benefit.

Amazon FSx for Windows File Server provides a managed SMB file system that applications can access over SMB, and AWS DataSync can migrate data into it. However, the requirement is specifically to move the shared storage to Amazon S3 for durability and cost efficiency during the interim period. FSx for Windows stores data in the FSx file system rather than using S3 as the primary storage backend, so it does not satisfy the core storage-location requirement. It also introduces an AWS-hosted file system service when the design goal is to keep SMB access on premises while S3 serves as the durable backend.

Copying data directly from the on-premises SMB repository to an S3 bucket can satisfy the durability/cost goal, but it does not satisfy the access requirement. The application cannot use native S3 APIs for 4 months and must continue to access the dataset via SMB with minimal changes. S3 is an object store and does not provide an SMB endpoint for Windows clients without an intermediary service.

AWS Server Migration Service (historical) is for migrating server workloads, not for providing an SMB interface backed by S3. Even if a file server were lifted and shifted to EC2, that would still mean operating a file server in AWS, which the requirements prohibit. It also adds operational burden (patching, scaling, HA) and does not inherently achieve the goal of storing the dataset in S3 as the primary repository.

Incorrect. Amazon GuardDuty is a threat detection service that analyzes logs (VPC Flow Logs, DNS logs, CloudTrail, etc.) to identify suspicious activity. It does not deploy or enforce AWS WAF Web ACLs on ALBs. GuardDuty can complement WAF by detecting threats, but it is not a control plane mechanism for centrally attaching WAF rules across an AWS Organizations environment.

Incorrect. AWS Shield Advanced primarily provides enhanced DDoS protection and response features. While Shield Advanced integrates with AWS WAF and can help with DDoS-related WAF configurations, it is not the standard service for centrally deploying and continuously enforcing WAF Web ACLs across hundreds of accounts and ALBs. Firewall Manager is the correct centralized enforcement mechanism for WAF policies.

Incorrect. AWS Security Hub aggregates security findings and provides compliance/security posture management across accounts and Regions. It does not push configuration changes like attaching WAF Web ACLs to ALBs. Security Hub can report on misconfigurations or missing controls (via standards and integrations), but it is not used to deploy and enforce WAF rules organization-wide.

AWS Lambda is not an appropriate primary service for running CI unit tests and security scans for multiple microservices because of execution time limits, packaging constraints, and lack of a full build environment. A second Lambda function to send notifications is also unnecessary when EventBridge and SNS already provide native event-driven alerting for pipeline and build failures. AWS Amplify plugins and interactive prompts are designed for developer workflows, not automated enterprise CI/CD pipelines that must run unattended. Using Amazon SES as an approval mechanism is not how CodePipeline approvals are implemented; the service already includes a native manual approval action for gated promotions.

Jenkins can technically run tests and scans, but it introduces unnecessary operational overhead and does not align with the requirement to modernize using AWS CodePipeline and managed AWS developer tools. EventBridge can emit events, but sending alerts directly with Amazon SES is less standard and less suitable than SNS for rapid team notifications and fan-out integrations. CloudFormation nested stacks with parameters can support configuration, but the option is weaker because the rest of the design relies on non-native tooling and custom approval logic. Using AWS Lambda to perform lead developer approvals is also incorrect because CodePipeline already provides a built-in manual approval stage specifically for this purpose.

AWS CodeDeploy is intended for deployment orchestration and application rollout strategies, not for executing unit tests and security scans during CI. CloudWatch alarms are not the best fit for immediate notification of build failures because CodeBuild state change events through EventBridge provide a more direct and reliable event source for failed test runs. Managing separate Docker images for each feature and toggling them with the AWS CLI is operationally cumbersome and does not represent a clean feature-toggle or environment-configuration strategy within a pipeline. Although the manual approval stage is appropriate, the core testing, alerting, and feature-management portions of this option do not satisfy the requirements well.