Practice Test #1

A cron script on EC2 in every account is polling-based, operationally heavy, and does not provide native compliance history. Trap: It appears to automate detection and deletion, but it creates instances, schedules, custom logging, and an RDS dependency in every account.

A Lambda polling design still requires custom state, custom reporting, and OpenSearch clusters in each account instead of managed compliance history. Trap: SAM and Lambda sound serverless, but the governance and historical compliance requirements remain custom-built.

GuardDuty is for threat findings and does not provide a standard NAT gateway creation compliance rule with audit-ready Config history. Trap: EventBridge plus Step Functions looks event-driven, but the cited GuardDuty finding type is not the right control plane for this policy.

Two 10 Gbps links provide bandwidth, but only one circuit exists at each Direct Connect location, so the design has less circuit-level redundancy than required for a highly resilient pattern. Trap: The 10 Gbps size looks sufficient, but the question is about surviving circuit and router failures with maximum resiliency.

Four 1 Gbps links total 4 Gbps only in normal operation; losing one circuit leaves only 3 Gbps, and losing a router could leave only 2 Gbps. Trap: The four-link layout is resilient, but the per-link bandwidth is too small for the failure requirement.

Two 1 Gbps links provide only 2 Gbps before any failure and less after a link or router failure. Trap: Using two locations and routers sounds redundant, but it fails the stated throughput requirement.

A DynamoDB table and Lambda updater can push CIDR changes, but it requires custom code, IAM, deployment, retries, and drift handling in every account. Trap: It creates a central data store, but the actual security group changes still depend on bespoke synchronization.

It uses a prefix list, but then adds EventBridge and Lambda in every account and omits AWS RAM sharing. Directly referencing a shared prefix list is simpler and more scalable. Trap: Prefix list is the right primitive, but the option reintroduces avoidable automation.

S3 plus Lambda is another custom fan-out mechanism that must be deployed and operated across accounts. It is not as operationally efficient as a native shared prefix list. Trap: S3 can hold a central file, but storing CIDRs is not the same as making security groups consume them natively.

AWS managed prefix lists are reusable CIDR sets for VPC resources, not the control point for DX gateway route advertisements, and this still uses two prefixes. Trap: The words prefix list match the clue, but the feature is the wrong kind of prefix list.

Adding both /21s to the allowed prefix list would require two entries, but the list has room for only one. Trap: It uses the correct allowed prefix list, but it ignores the entry-limit constraint.

10.0.32.0/20 is the right aggregate, but placing it in AWS managed prefix lists would not advertise routes over Direct Connect. Trap: The CIDR math is right, which can hide that the AWS feature is wrong.

Advertising a longer, more-specific prefix from the 2 Gbps router would attract traffic to the slower link because longest-prefix match wins before BGP attribute comparison. Trap: The word 'longer' sounds like de-preference, but a longer prefix is more specific and therefore more preferred.

Advertising a less-specific route from the 5 Gbps router would make the desired primary path less attractive if the 2 Gbps side advertises a more-specific route. Trap: It modifies the 5 Gbps path, but in the wrong direction for AWS route selection.

Prepending AS_PATH on the 5 Gbps router would make the primary link less preferred and steer traffic to the 2 Gbps path. Trap: AS_PATH prepending is the right tool, but it must be applied to the backup path, not the preferred path.

A CNAME is not valid at the zone apex example.com and is less appropriate for AWS load balancer targets than an alias record. Trap: A CNAME to an ALB DNS name looks familiar for subdomains, but the requirement is https://example.com.

A Resolver outbound endpoint is for forwarding DNS queries from the VPC to on-premises DNS, which is the opposite direction. Trap: The word Resolver is right, but the endpoint direction is wrong.

AmazonProvidedDNS at 172.31.0.2 is intended for resources inside the VPC and is not the supported target for on-premises conditional forwarding. Trap: The .2 resolver is tempting because it resolves VPC DNS, but hybrid access requires Resolver endpoints.

A spread placement group separates instances for failure isolation and ENA alone does not provide the EFA HPC communication model. Trap: Spread placement groups sound resilient, but this question is optimizing performance rather than blast-radius isolation.

Multiple VPCs and Transit Gateway add routing hops and are not used to maximize microsecond-level EC2 cluster communication. Trap: Transit Gateway is excellent for scalable routing domains, not tightly coupled HPC east-west performance.

A cluster placement group does not span multiple AZs, and cross-AZ placement adds latency that works against the HPC requirement. Trap: Multi-AZ is tempting for availability, but the workload asks for the fastest node-to-node path.

Default Flow Logs do not satisfy the custom metadata requirement, and CloudWatch Logs is usually costlier for 12-month high-volume retention. Trap: Flow Logs are the right service, but both the default format and destination miss key requirements.

Traffic Mirroring captures packets and requires monitoring targets, which is excessive and expensive for broad long-term metadata logging. Trap: It sounds like it logs all traffic, but the question asks for flow metadata and lowest cost.

CloudWatch Logs can receive custom Flow Logs, but it is not the lowest-cost destination for large-scale 12-month retention with archival access patterns. Trap: It satisfies custom fields, but the destination conflicts with the lowest-cost retention clue.

Static source multicast does not meet the dynamic receiver registration requirement. Trap: It includes UDP, but misses IGMP dynamic joins.

It is static and uses TCP, so both membership and transport are wrong. Trap: The TGW wording looks close, but not the multicast mechanics.

IGMP is correct, but TCP does not carry the multicast payload traffic. Trap: It gets control plane right and data plane wrong.