Practice Test #1

A single trail in the management account is not the same as an organization trail, so it would not automatically capture API activity for every member account. It also reuses an existing bucket rather than establishing the dedicated centralized storage described by the best option. Trap: It includes all Regions and S3 controls, but the coverage boundary is only the management account.

Per-account trails and buckets could be made to work, but they create high operational overhead across 30+ accounts, all Regions, and monthly account additions. The requirement explicitly asks for the least ongoing effort. Trap: It captures account-level activity, but at the cost of repeated setup and drift.

A normal trail in the management account still does not guarantee member-account coverage, and pushing notifications to an external management system adds tooling that the prompt rejects. It also does not improve the native log capture requirement. Trap: SNS notifications sound audit-friendly, but they do not replace organization-trail coverage.

Incorrect. While TGW is the right core service, creating a new Site-to-Site VPN specifically to VPC Y adds unnecessary operational overhead (additional tunnels, routing, monitoring). Also, “authorization rules” refers to AWS Client VPN, which is not part of the stated architecture/requirement. Least effort is to use TGW with existing connectivity patterns, not add extra VPNs. Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive networking constraint from the stem.

Incorrect. Updating route tables and enabling BGP propagation cannot make VPC peering transitive. Even with correct routes in the VPC route tables and VPN routes, AWS will not forward traffic from a VPN attachment in VPC X across the peering connection to VPC Y. This option is a common trap: routing configuration cannot bypass peering’s non-transitive design. Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive networking constraint from the stem.

Incorrect. A virtual private gateway (VGW) can be attached to only one VPC at a time; it cannot attach to both VPC X and VPC Y. You also cannot “split” the two VPN tunnels to different VPCs in the manner described. To share on-prem connectivity across multiple VPCs, use Transit Gateway (or separate VPNs per VPC, which is more effort). Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive networking constraint from the stem.

Increasing Lambda memory can improve CPU, network throughput, and sometimes SDK performance, so it may reduce execution duration for JSON parsing and normalization. However, the scenario includes explicit DynamoDB write throttling, and more Lambda power does not increase DynamoDB provisioned write capacity. In some cases, faster Lambda execution can even drive writes into DynamoDB more aggressively, leaving the underlying table bottleneck unresolved. Therefore, it is a useful tuning step but not one of the two most effective remediations compared with directly fixing capacity and decoupling ingestion. Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive data platform modernization constraint from the stem.

Increasing the payload size so each request contains more minutes of data would move the system away from near-real-time processing, which the question explicitly requires. Larger payloads also increase per-request processing time, retry cost, and failure blast radius if a request is dropped or throttled. This change would likely worsen Lambda duration and could create larger write bursts against DynamoDB when each request is finally processed. It does not address the root causes of synchronous coupling and insufficient write throughput. Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive data platform modernization constraint from the stem.

SQS FIFO is designed for strict ordering and deduplication, but those features come with lower throughput characteristics than alternatives such as Kinesis or SQS Standard. The option also states that Lambda processes each message individually, which preserves high per-message overhead and does not take advantage of efficient batch-oriented processing. For high-volume telemetry, strict ordering across all messages is usually unnecessary, and FIFO is not the best fit for maintaining scalable near-real-time ingestion. This makes it less effective than Kinesis for the stated requirements. Trap: It is tempting because it mentions a plausible AWS component, but it misses the decisive data platform modernization constraint from the stem.

Incorrect. S3 bucket CORS rules only affect cross-origin requests made directly to S3 (or via CloudFront to an S3 origin) for those static objects. The failing requests are to https://api.visit-nova.com (API Gateway), not to the S3 bucket. Updating S3 CORS will not change the headers returned by API Gateway for OPTIONS/POST, so the browser will still block the API call. Trap: It is tempting because it addresses a nearby AWS service or partial symptom, but it misses the decisive constraint in the question.

Incorrect. AWS WAF is not a CORS configuration mechanism and does not provide a standard, supported way to “enable a CORS rule” that injects CORS headers into responses. WAF primarily inspects and blocks/allows requests; it is not intended to authoritatively implement CORS response behavior for API Gateway. Relying on WAF for response header injection is not the correct architectural fix for browser CORS enforcement. Trap: It is tempting because it addresses a nearby AWS service or partial symptom, but it misses the decisive constraint in the question.

Partially helpful but insufficient as stated. Adding Access-Control-Allow-Origin in the Lambda response can work for the POST when using Lambda proxy integration, but it does not automatically address the preflight OPTIONS request, which is handled by API Gateway unless explicitly implemented. It also may not cover API Gateway-generated errors (4xx/5xx) unless gateway responses are configured. The most reliable exam answer is to enable CORS in API Gateway, including OPTIONS and all responses. Trap: It is tempting because it addresses a nearby AWS service or partial symptom, but it misses the decisive constraint in the question.

This option is not a good recommendation because simply creating a second Auto Scaling group does not solve the underlying issue unless that group uses a newly baked AMI and a controlled cutover strategy. As written, it just duplicates the same launch template and operational complexity, and patching both groups during the same window still risks health-check failures and churn. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive operations modernization constraint.

This option is insufficient because changing ALB target group health checks or monitoring does not address the fact that replacement instances are launched from an outdated AMI. Health check tuning might reduce the chance of instances being marked unhealthy during a reboot, but it is only a mitigation and can delay detection of real failures if made too lenient. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive operations modernization constraint.

This option is incorrect because instance scale-in protection does not prevent Auto Scaling from terminating and replacing instances that are marked unhealthy by ELB or EC2 health checks. It only protects instances from scale-in events when the group reduces capacity. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive operations modernization constraint.

Direct Connect improves connectivity from the Frankfurt colocation to AWS, but it does not keep compute physically in-country or in the colocation for all jurisdictions. It also does not solve disconnected rural kiosk processing. Trap: Connectivity alone is not a hybrid runtime.

Snowball Edge Storage Optimized is not the right always-on AWS-consistent platform for regulated cardholder services, and Wavelength targets 5G carrier edge locations rather than rural kiosks with outages. Trap: It chooses edge-sounding services, but maps them to the wrong constraints.

Local Zones may not exist in each required jurisdiction and do not place workloads in the company colocation. Wavelength assumes carrier-edge connectivity and does not provide disconnected operation for kiosks. Trap: Lower-latency AWS locations are not the same as customer-site infrastructure.

AWS DMS CDC is intended for data replication and captures changes (inserts/updates/deletes) from logs, not comprehensive database activity. It will not reliably capture SELECT statements and is not a full audit trail of all SQL activity. Trap: It is tempting because it mentions AWS Database Migration Service, but it misses a required capability, constraint, or lower-operations pattern from the stem.

Aurora Database Activity Streams does not use Amazon EventBridge as its primary delivery mechanism; it publishes to Amazon Kinesis Data Streams. While Lambda could decrypt and write to S3, this adds custom processing and operational overhead, and EventBridge is not the intended ingestion service for DAS. Trap: It is tempting because it mentions Amazon EventBridge, but it misses a required capability, constraint, or lower-operations pattern from the stem.

Like option A, AWS DMS CDC does not capture full database activity such as SELECT statements and is not a compliance-grade activity monitoring solution. Loading into Amazon Redshift is also unnecessary for the core requirement (centralized durable storage with long retention and low-latency delivery). Trap: It is tempting because it mentions AWS DMS, but it misses a required capability, constraint, or lower-operations pattern from the stem.

Incorrect. Route 53 alias failover to IoT Core regional data endpoints does not address the fixed custom hostname requirement; devices connect to mqtt.coldfleet.example.com and TLS/SNI/cert validation typically won’t align with regional endpoint hostnames. Also, migrating from DynamoDB to Aurora PostgreSQL is unnecessary and risky for a 2.3 TB time-series workload, and Aurora global database doesn’t solve IoT endpoint hostname continuity. Trap: It can look plausible because it mentions AWS IoT Core data endpoints in both Regions and Amazon Route 53 alias failover routing policy with values set to the AWS IoT Core data endpoints in both Regions, but the requirement is unchanged device hostname, DNS failover, and active-active DynamoDB persistence.

Incorrect. Latency-based routing is not designed for outage-driven failover; it can still return an unhealthy Region unless combined with failover policies/health checks appropriately. MemoryDB is an in-memory cache, not a durable time-series system of record, and cross-Region replication does not match the durability and scale needs. While IoT domain configuration is relevant, the rest of the design fails storage requirements. Trap: It can look plausible because it mentions AWS IoT Core domain configuration in each Region and Amazon Route 53 latency-based routing policy that uses the two regional data endpoints as values, but the requirement is unchanged device hostname, DNS failover, and active-active DynamoDB persistence.

Incorrect. Using latency-based routing to regional IoT endpoints does not preserve the single custom hostname requirement and is not deterministic for failover under outage. DynamoDB Streams replication is not a full active-active multi-Region solution; it is typically one-directional, adds custom consumers/operational burden, and does not provide the same multi-Region write availability and managed conflict handling as DynamoDB global tables. Trap: It can look plausible because it mentions AWS IoT Core regional data endpoints and Amazon Route 53 latency-based routing policy that references the AWS IoT Core regional data endpoints, but the requirement is unchanged device hostname, DNS failover, and active-active DynamoDB persistence.

AWS Managed Microsoft AD adds managed domain controllers and cost, which the prompt explicitly wants to avoid. It also says to turn on only the IAM Identity Center feature rather than AWS Organizations all features. Trap: It uses IAM Identity Center, but the directory and Organizations prerequisites are off.

AD Connector is the right directory choice, but the option leaves AWS Organizations in an insufficient feature mode. IAM Identity Center account assignments need Organizations all features. Trap: The low-cost directory choice is correct, but the organization setup is incomplete.

This enables Organizations all features, but AWS Managed Microsoft AD still violates the cost and no-AWS-domain-controllers constraint. The company only needs to use existing AD for console access. Trap: It fixes the Organizations prerequisite but overbuilds the directory layer.