Practice Test #5

ASG + ALB can add EC2 capacity, but it does not reduce operational toil for container orchestration (still managing hosts, deployments, bin packing) and leaves the self-managed Kafka cluster problem unsolved by switching to Kinesis (requires app changes and redesign). Read replicas help, and S3 offloads static assets, but overall it’s not the best “minimize toil” answer given Kafka and container management remain heavy. Trap: Create an EC2 Auto Scaling group behind an Application Load Balancer. Create additional read replicas for the DB instance. Create Amazon Kinesis Data Streams and confi... looks plausible because it addresses part of the scenario, but it misses or misstates a decisive requirement from the stem.

Multi-AZ and storage autoscaling improve database availability and storage management, but they do not materially increase read throughput for a presale surge. Like option A, it proposes moving from Kafka to Kinesis, which is not a low-toil, low-change swap for an existing Kafka-based architecture. It also keeps compute on EC2 ASGs, which still requires significant operational work for containers and scaling behavior. Trap: Create an EC2 Auto Scaling group behind an Application Load Balancer. Deploy the DB instance in Multi-AZ mode and enable storage autoscaling. Create Amazon Kinesis Dat... looks plausible because it addresses part of the scenario, but it misses or misstates a decisive requirement from the stem.

Creating your own Kubernetes cluster on EC2 increases operational overhead (control plane/worker management, upgrades, scaling, security hardening) compared to managed EKS/Fargate. MSK and CloudFront are strong choices, but the compute layer conflicts with the requirement to minimize toil quickly before next week’s event. This option modernizes streaming and CDN, but makes container operations more complex than the current setup. Trap: Deploy the services on a Kubernetes cluster you create on EC2 instances behind an Application Load Balancer. Deploy the DB instance in Multi-AZ mode and enable storage... looks plausible because it addresses part of the scenario, but it misses or misstates a decisive requirement from the stem.

Creating a Client VPN endpoint in each AWS account could provide access, but it is not the best architecture here because it creates multiple endpoints, duplicated configuration, and higher operational overhead. It also does not inherently solve centralized access across all six VPCs from a single user connection unless users connect to different endpoints as needed. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive hybrid networking constraint.

This option is incorrect because VPC peering does not support transitive routing. A Client VPN endpoint associated with the hub VPC can provide access to resources in that VPC, but traffic from VPN clients cannot simply traverse the hub and then continue over peering connections to the spoke VPCs as a transit path. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive hybrid networking constraint.

This option is incorrect because AWS Client VPN is not designed to connect to an existing Site-to-Site VPN as a mechanism for reaching AWS workloads across multiple VPCs. The Site-to-Site VPN connects the corporate network to AWS, but remote users connecting through Client VPN would still face the same underlying routing limitations to the spoke VPCs. Trap: It is tempting because it addresses part of the scenario, but it misses the decisive hybrid networking constraint.

Service control policies (SCPs) in AWS Organizations do not grant permissions; they only define the maximum available permissions for accounts/OUs. An SCP cannot be used to provide the Insights account access to Commerce resources, and SCPs also do not implement DynamoDB attribute-level filtering/redaction. Trap: It sounds like centralized governance, but the policy type or attachment point does not create the required preventive control.

DynamoDB does not support attaching a general resource-based IAM policy directly to a table in the same way Amazon S3 bucket policies work for cross-account access. Cross-account access to DynamoDB is typically done through IAM role assumption (or via AWS services like API Gateway/Lambda acting as a controlled access layer). Trap: It uses a real IAM feature, but not the one that establishes the required access path and enforcement boundary.

A permissions boundary is a guardrail that limits the maximum permissions a role can receive, but it does not by itself implement the correct cross-account access pattern or replace the need for a properly scoped identity policy and trust relationship. You would still need the Commerce role with least-privilege permissions and a trust policy. Trap: It uses a real IAM feature, but not the one that establishes the required access path and enforcement boundary.

Incorrect because AWS Server Migration Service rehosts a VM onto Amazon EC2 rather than migrating the database into Amazon RDS for PostgreSQL. The requirement explicitly states that the database must run on RDS after migration, so lifting and shifting the database VM does not satisfy the target-state architecture. Even if SMS could reduce downtime for a VM move, it is the wrong service for a managed PostgreSQL destination. Trap: This can look plausible because it mentions Use an AWS Server Migration Service (AWS SMS) replication job to migrate the database server VM to AWS, but it fails at least one decisive constraint in the stem.

Incorrect because VM Import/Export is primarily a one-time image import/export mechanism and does not provide continuous replication or an efficient low-downtime migration workflow for an active production application server. It also does not address the challenge of repeatedly synchronizing changes across a 420 TB footprint. For a strict cutover target, a one-time import process is generally too rigid and operationally disruptive. Trap: This can look plausible because it mentions Use VM Import/Export to import the application server VM, but it fails at least one decisive constraint in the stem.

Incorrect because although AWS SMS can replicate an application VM, it is not the strongest answer in a scenario dominated by extremely large attached storage volumes totaling 420 TB. The initial data movement is the primary bottleneck, and Snowball Edge is better suited than SMS for seeding such a large amount of data into AWS. SMS also does not solve the database modernization requirement, so pairing it with DMS is less optimal than using Snowball for bulk transfer and DMS for the database. Trap: This can look plausible because it mentions Use an AWS Server Migration Service (AWS SMS) replication job to migrate the application server VM to AWS, but it fails at least one decisive constraint in the stem.

WAF and Firewall Manager do not attach to a WorkSpaces directory or control WorkSpaces client authentication. Trap: An IPSet sounds like scalable IP governance, but it is for supported web resources.

Restricted device certificates validate devices, but they do not enforce that the login came from the warehouse network public IPs. Trap: Kiosks make device trust tempting, but the policy requirement is network origin.

Host firewall rules inside each WorkSpace do not control where a user can initiate the WorkSpaces login and create image maintenance overhead. Trap: It appears to enforce network rules, but at the wrong layer and with poor operability.

RDS for MySQL Multi-AZ and an ALB-backed EC2 tier help, but Amazon Neptune is a graph database and is not an appropriate low-latency session store. This leaves the session-continuity requirement poorly served. Trap: It keeps MySQL and uses Multi-AZ, but the session tier is the architectural mismatch.

DocumentDB is MongoDB-compatible, not MySQL-compatible, so it violates minimal code changes. Kinesis Data Firehose is a delivery service, not a session store, and an NLB lacks the Layer 7 routing behavior expected for this web app. Trap: It names scalable services, but they do not match the relational and session requirements.

RDS for MariaDB Multi-AZ changes the database engine and Memcached does not provide Redis-style replication with Multi-AZ automatic failover. Session continuity during failure is therefore weaker than option B. Trap: It looks close because it uses managed relational and cache services, but the cache choice misses failover.

Incorrect. You don’t subscribe an SNS topic “in each additional Region” to an SQS queue in us-east-1 to achieve multi-Region processing; that would still deliver messages to only one queue and would not create regional processing. Also, SNS subscriptions are configured on the SNS topic to endpoints (queues), not by “regional SNS” unless you create additional topics, which the option does not clearly do. Trap: It may look plausible because it uses relevant AWS services, but it misses the decisive constraint described in the explanation.

Incorrect. SQS does not “fan out messages” by publishing to SNS topics; the fan-out pattern is SNS -> multiple SQS queues (or other endpoints). Introducing regional SNS topics also adds complexity and does not address the requirement that URLs are published only from us-east-1 unless you build additional forwarding logic. This option reverses the intended direction of integration. Trap: It may look plausible because it uses relevant AWS services, but it misses the decisive constraint described in the explanation.

Incorrect. Creating new SNS topics and Lambda functions in each Region could work only if you also implement a mechanism to publish from us-east-1 to each regional topic (custom code, EventBridge, or another bridge). The option implies direct publishing to regional topics, which adds operational overhead and is unnecessary because SNS can already deliver cross-Region to SQS queues directly (simpler and more aligned with the requirement). Trap: It may look plausible because it uses relevant AWS services, but it misses the decisive constraint described in the explanation.

The AWS Application Discovery Agent can provide the required port/process-level dependency data, and Migration Hub can visualize those dependencies correctly. However, this option is still wrong because it says the Quick Insights assessment report is downloaded from Migration Hub, which is not where Quick Insights is produced. Quick Insights is a Migration Evaluator output, so this option fails to satisfy the reporting requirement. Trap: It can look plausible because it mentions AWS Application Discovery Agent on each on-premises VM and AWS Migration Hub to view dependencies and download the Quick Insights assessment report from Migration Hub, but the requirement is both port/process dependency mapping and Migration Evaluator Quick Insights reporting.

This option is incorrect on multiple fronts. Migration Evaluator Collector is not installed on each VM; it is deployed as a collector appliance, so the collection method described is inaccurate. In addition, Migration Evaluator does not provide application dependency visualization, and Amazon QuickSight is unrelated to generating a Migration Evaluator Quick Insights report. Therefore, it does not meet either the dependency-mapping workflow or the reporting workflow correctly. Trap: It can look plausible because it mentions Amazon QuickSight and then download the Quick Insights assessment and QuickSight, but the requirement is both port/process dependency mapping and Migration Evaluator Quick Insights reporting.

This option has the lowest apparent overhead, but it does not meet the dependency requirement. The AWS Application Discovery Service Agentless Collector OVA gathers VMware inventory and performance metadata, but it does not capture process-level and port-level communication details needed for inter-application dependency mapping. Because the question explicitly requires port/process-level visualization, agentless discovery alone is insufficient even if the discovered inventory can be uploaded to Migration Evaluator for Quick Insights. Trap: It can look plausible because it mentions AWS Application Discovery Service Agentless Collector and AWS Migration Hub to view dependencies, but the requirement is both port/process dependency mapping and Migration Evaluator Quick Insights reporting.

Application Load Balancers do not support assigning static Elastic IP addresses directly. The firewall cannot safely allow-list ALB node IPs because they can change. Trap: It tries to keep the current endpoint, but assumes a capability ALB does not provide.

Migrating the ALB target groups directly to an NLB removes the ALB Layer 7 behavior used for path-based routing and TLS handling. NLB is Layer 4 and cannot replace these ALB features as described. Trap: It provides static IPs, but sacrifices the explicit ALB routing requirement.

Gateway Load Balancer is for inserting virtual appliances, not for presenting static client-facing IPs and forwarding to an ALB target group. It does not solve the ALB static IP front-end requirement. Trap: The firewall theme makes GWLB sound plausible, but this is not a network appliance insertion problem.