Practice Test #2

IAM Identity Center is the right direction, but this option specifies a one-way trust. For this exam pattern, the expected integration with self-managed Microsoft AD uses AWS Managed Microsoft AD with a two-way forest trust. Trap: It looks attractive because it includes IAM Identity Center and existing AD integration, but the trust model is the mismatch.

AWS Directory Service alone does not provide the centralized AWS account SSO experience required across 15 AWS accounts. The missing piece is IAM Identity Center for account assignments and unified sign-in. Trap: It may seem sufficient because it mentions trust with the existing AD, but directory trust is not the same as multi-account AWS SSO.

An on-premises IdP can federate to AWS, but it is not the most effective AWS-native solution for centralized access across many AWS accounts already managed by AWS Organizations. Trap: It sounds plausible because SSO and federation are involved, but it adds more operational overhead than the native IAM Identity Center plus AD integration approach.

A direct DataSync task to FSx for Lustre is not the valid transfer path described in the option, even though DataSync is file-aware in supported source and destination combinations. Trap: It sounds right because DataSync preserves POSIX metadata, but service support for the destination matters.

Rsyncing into S3 turns files into objects and can lose native POSIX semantics before the managed transfer begins. That conflicts with the explicit metadata and symlink requirement. Trap: S3 staging sounds scalable, but the first copy step is not a compliant filesystem-aware migration.

Snowmobile is intended for massive multi-petabyte or exabyte migrations, so it is excessive for 500 TB. It also adds S3 staging without improving the POSIX-preservation requirement. Trap: The service is an offline transfer option, but the scale points to Snowball Edge instead.

CloudFormation and Systems Manager Automation standardize provisioning, but they do not stop teams from creating resources outside those templates unless separate guardrails exist. Trap: Templates sound controlled, but the prompt asks for centralized prevention across accounts.

EventBridge and Lambda would react after expensive resources are launched, so cost can still be incurred and custom remediation must be maintained. Trap: Automated termination sounds protective, but it is detective rather than preventive.

Service Catalog can offer approved products, but preventing all other provisioning paths requires additional IAM or SCP controls and more administration. Trap: It is useful for self-service standardization, not the simplest account-wide deny guardrail.

A read-only mount option is an operating system setting and can drift across instances or be changed by privileged users. Trap: It sounds read-only, but the question asks for IAM-based enforcement.

An identity-based deny can block a role, but each role must be managed correctly and new roles can be missed. The resource policy is the more central and operationally efficient control for a shared file system. Trap: It uses IAM, but it puts the control on every identity instead of the shared EFS resource.

Access points and POSIX permissions can constrain directory access, but they are not the requested IAM-based guarantee against all EFS client writes. Trap: POSIX permissions are useful, but they are not the strongest answer when the requirement names IAM access controls.

A peered VPC can add capacity, but it requires another VPC, route table updates, peering management, and cross-VPC security rules. Trap: It works technically, but the scenario asks for the least operational overhead.

Transit Gateway is useful for many-VPC hub-and-spoke networks, but it is unnecessary complexity for a single VPC that just needs more IPs. Trap: TGW sounds scalable, but it solves connectivity, not the simplest address expansion.

VPN instances and gateways add the most management burden and are not needed for VPC address exhaustion inside AWS. Trap: A VPN may connect networks, but it is slow to deploy and operationally heavy for this problem.

Storage Gateway Volume Gateway exposes block volumes over iSCSI; it is not a POSIX parallel file system and does not provide Lustre-style parallel I/O for 100+ nodes. Trap: The word gateway may sound useful for hybrid storage, but this workload needs HPC file semantics, not block storage presentation.

An EC2 instance with EBS RAID and self-managed file system software is not fully managed and can create scaling, metadata, and availability bottlenecks. Trap: RAID can improve storage performance on one server, but the scenario asks for a fully managed parallel file system.

Amazon EFS provides managed POSIX file storage over NFS, but it is not the best fit for sub-millisecond, HPC parallel I/O workloads that need Lustre semantics. Trap: EFS is tempting because it is shared and managed, but the parallel file system and HPC latency clues point to FSx for Lustre.

project-code is not AWS-defined; it is a company tag applied by the organization tagging policy. Trap: The management account part is right, but the tag type is wrong.

Activating the tag from a member account does not centrally enable organization-wide consolidated billing analysis. Trap: The tag type is right, but the billing control point is wrong.

This uses both the wrong account scope and the wrong tag type for a customer business tag. Trap: It names Cost Explorer, but misses the two key governance details.

A default retention period does not delete objects when retention ends; the requirement includes automatic deletion after 90 days. Trap: It sounds like the 90-day setting, but it does not provide the lifecycle cleanup action.

Lifecycle policies expire or transition objects; they do not provide compliance protection from early deletion. Trap: Lifecycle is needed for deletion, but not for retention protection.

Tags can help filter policies, but tagging alone does not enforce retention or automatic deletion. Trap: Tags can be used by lifecycle rules, but they are metadata rather than a retention mechanism.

Network Access Analyzer checks network reachability paths, not IAM user permissions or policy privilege. Trap: The word analyzer is tempting, but the domain is networking.

A CloudWatch alarm on create or modify events does not review all current IAM permissions or identify over-privileged users. Trap: It can notify on activity, but it is not a permissions audit.

Amazon Inspector focuses on software vulnerabilities and exposure in workloads, not IAM policy analysis. Trap: Inspector is a security service, but it solves a different exam problem.