Practice Test #10

S3 is excellent object storage, but the option says to mount the bucket on every EC2 instance, which is not the managed POSIX file-system pattern expected here. Trap: S3 sounds scalable for videos, but the mount wording points away from the correct shared-file solution.

An NFS export from the primary EC2 instance keeps content dependent on one server and creates another scaling bottleneck. Trap: It resembles shared storage, but the primary instance remains a single point of failure.

ALB and Auto Scaling are useful, but Global Accelerator optimizes routing and static IP entry points; it does not cache course materials. Trap: The scaling half is attractive, but the acceleration service does not solve repeated content reads.

Route 53 failover is DNS-based and cannot guarantee immediate failover because clients and resolvers may cache records beyond the intended TTL. Also, NLB cannot “invoke Lambda” directly; Lambda integrations are associated with ALB (HTTP/HTTPS) or other event sources, not NLB UDP listeners. Trap: It may look relevant because it mentions Network Load Balancer, but the decisive clue is UDP, microsecond latency, and immediate regional failover.

Application Load Balancer is a Layer 7 load balancer and does not support UDP. Even though Global Accelerator would help with latency and failover, the ALB endpoint cannot accept UDP traffic from trading terminals. Trap: It may look relevant because it mentions AWS Global Accelerator, but the decisive clue is UDP, microsecond latency, and immediate regional failover.

This combines Route 53 DNS failover with ALBs. It fails two requirements: ALB does not support UDP, and Route 53 failover is not immediate due to DNS caching/TTL behavior. Trap: It may look relevant because it mentions Application Load Balancer, but the decisive clue is UDP, microsecond latency, and immediate regional failover.

Incorrect. ACM does provide managed renewal for eligible certificates and can generate expiration-related notifications, but it does not support configuring a daily publish schedule “starting 30 days before expiration” to SNS as described. The option implies a built-in, configurable daily notification feature that ACM does not offer in that form. For exam purposes, treat this as an overstatement of ACM’s native notification capabilities. Trap: It sounds easy because ACM owns the certificates, but ACM does not provide that configurable daily SNS schedule.

Not the best choice. AWS Config can evaluate resources against rules and mark them compliant/non-compliant, but using it to detect “expires within 30 days” is an indirect approach and may require custom rules and careful handling of evaluation frequency and latency. It also adds operational overhead compared to an event-driven pattern. Config is better suited for configuration compliance (e.g., required settings), not certificate lifecycle alerting. Trap: Config is useful for compliance, but it is indirect for certificate lifecycle alerts and adds evaluation overhead.

Incorrect. Trusted Advisor can report on expiring certificates, but it is not the most direct or reliable mechanism for precise, event-driven 30-day alerting. It may depend on support plan level and check refresh intervals, and translating check status into timely SOC notifications is less straightforward. This approach is more of a periodic advisory check than an automated lifecycle event workflow. Trap: Trusted Advisor can warn about expiring resources, but it is periodic advisory data rather than precise event-driven alerting.

SNS does not provide a durable competing-consumer backlog, and CPU utilization can miss a growing queue of long-running jobs. Trap: It sounds event-driven, but SNS fanout is not the same as durable job buffering.

SQS is the right buffer, but network throughput is a weak proxy for pending fraud jobs and this uses legacy launch configurations. Trap: The queue part is attractive, but the scaling metric is not tied to backlog.

SNS publication count reflects producer rate, not unprocessed backlog, and SNS does not let workers drain work at their own pace. Trap: Counting published messages seems related to volume, but it does not protect against slow processing or failed workers.

Gateway Load Balancer is for inserting network appliances, not authenticating game clients or collecting API telemetry into an analytics pipeline. Trap: It includes containers and storage, but it does not provide the managed API and auth pattern the clients need.

API Gateway and Kinesis Data Streams can be part of a streaming design, but the option uses a generic Lambda function for authentication and does not provide the native API Gateway authorizer pattern. Trap: Kinesis Data Streams is a strong streaming service, so the ingestion part can look plausible.

Adding a Lambda function does not make Gateway Load Balancer a client authentication or telemetry ingestion service. Trap: The Lambda mention sounds serverless, but the front door is still the wrong service.

Creating additional Amazon EBS volumes on the EC2 instance is unnecessary because the target storage service is explicitly Amazon FSx for Lustre, not instance-attached block storage. EBS would store data locally for a single instance and would not provide the shared, high-performance file system semantics required by the application design. Trap: It may look plausible because it mentions Amazon EBS, but the scenario is about automated file migration to fsx for lustre.

Using rsync commands to manually transfer files introduces operational overhead and contradicts the requirement that the migration be automated and minimize manual intervention. Although rsync can perform incremental copies, it requires custom scripting, scheduling, credential handling, and monitoring that AWS managed services are designed to avoid. Trap: It may look plausible because it mentions a related AWS feature, but the scenario is about automated file migration to fsx for lustre.

AWS DataSync does not support an on-premises FTP server as a source location. DataSync supports specific storage types such as NFS, SMB, Amazon S3, and certain AWS storage services, but FTP is not one of its valid location types. Trap: It may look plausible because it mentions a related AWS feature, but the scenario is about automated file migration to fsx for lustre.

Dashboards help humans view metrics but do not create automatic Boolean alerting or rapid intervention. Trap: Visualization feels useful for monitoring, but it does not reduce paging noise by itself.

CloudWatch Synthetics canaries monitor user journeys or endpoints, not the simultaneous state of EC2 memory and packet-loss metrics. Trap: Canaries raise alarms, but they test availability from the outside.

Single metric alarms do not provide the clean alarm-state correlation requested; a composite alarm is the intended feature for this AND condition. Trap: Metric math can be tempting, but composite alarms are purpose-built to combine alarm states.

AWS Organizations can create and group accounts, but by itself it does not provide the same managed landing zone automation and guardrails as Control Tower. Trap: It shares subnets correctly, but misses the automatic security-control requirement.

Control Tower helps with accounts, but deploying a separate VPC in every project account and routing through an inspection VPC adds network management overhead instead of centralizing subnet management. Trap: It includes Control Tower, but the network pattern is heavier than needed.

This combines manual Organizations account management with per-account VPCs and Transit Gateway routing, so it is the highest-overhead option among the choices. Trap: Transit Gateway is powerful, but the scenario asks for least overhead centralized networking.

Amazon S3 does not provide signed cookies in the way CloudFront does, and the scenario is already using CloudFront for delivery. Trap: Signed cookies are a CloudFront feature, but the option names S3 signed cookies.

Origin access control prevents direct S3 access, but it does not distinguish premium subscribers from non-premium subscribers. Trap: OAC is important for private origins, but it is not an entitlement system.

Field-level encryption protects sensitive request fields and does not block non-premium viewers from course objects. Trap: It is a security feature, but unrelated to content entitlement.