模擬試験 3

DataSync and S3 Transfer Acceleration move data, but S3FS does not make S3 a native POSIX parallel file system for HPC workloads. Trap: It mentions S3 and acceleration, but the requirement is a mounted parallel file system, not transfer optimization.

Volume Gateway provides iSCSI block volumes for hybrid storage patterns and does not provide a shared POSIX parallel file system for many HPC clients. Trap: The phrase high-performance parallel access is tempting, but iSCSI volumes are not Lustre-style shared parallel storage.

EFS is managed and POSIX-compatible over NFS, but it is not the HPC parallel file system optimized for Lustre clients and extreme low-latency parallel I/O. Trap: Max I/O improves EFS scale, but the question asks for parallel file system clients and HPC performance.

gp2 cannot set IOPS independently; reaching 12,000 baseline IOPS would require a very large volume and likely wasted capacity. Trap: General purpose sounds right, but gp2 is the older model where performance is tied to size.

io2 can meet the IOPS need and decouple performance, but it is intended for higher-end provisioned IOPS workloads and is not the most cost-effective answer here. Trap: The high IOPS number tempts candidates toward io2, but the scenario stresses cost optimization.

io1 can provision IOPS independently, but it is typically more expensive than gp3 for this type of cost-optimized transcoding storage. Trap: It meets the tuning part, but misses the MOST cost-effective requirement.

EFS encryption at rest/in transit and security groups provide strong protection against network interception and storage media exposure, but they do not ensure confidentiality from privileged users who can mount the file system or manage instances with access. Administrators with OS-level access could still read files in plaintext once mounted. Trap: Store patient data in Amazon Elastic File System (Amazon EFS). Use EFS encryption in transit and at... sounds related, but the scenario is really testing protecting plaintext from privileged database access.

DynamoDB SSE-KMS encrypts data at rest, but DynamoDB decrypts data for authorized reads. This typically does not meet the requirement to keep data confidential from administrators/operators with legitimate access because access to the table (or roles with read permissions) can still retrieve plaintext. Trap: Store patient data in Amazon DynamoDB. Use AWS Key Management Service (AWS KMS) server-side encryption... sounds related, but the scenario is really testing protecting plaintext from privileged database access.

, HPC, ML, media processing) and is not a typical choice for storing and querying patient records/prescriptions. Encryption and AD integration address at-rest protection and authentication, but do not inherently prevent privileged administrators from accessing plaintext once they have filesystem access. Trap: Store patient data in Amazon FSx for Lustre with encryption enabled. Configure Windows Active Directory... sounds related, but the scenario is really testing protecting plaintext from privileged database access.

S3 and Athena are for analytical scans, not low-latency multi-hop relationship traversal in an application. Trap: Athena can query large data, but repeated self-joins over graph data are slow and scan-heavy.

MySQL can model connections, but recursive joins over millions of profiles and edges become complex and slower at depth. Trap: Relational tables can store the data, but they are not purpose-built for graph traversal.

DynamoDB would require iterative application-side queries for each hop and does not natively optimize arbitrary graph paths. Trap: It scales key-value access, but this query pattern is relationship traversal.

Route 53 geolocation routing is DNS-based and depends on resolvers and TTLs, so it cannot guarantee millisecond-level routing changes or rapid failover. An Application Load Balancer is Layer 7 and supports HTTP/HTTPS/gRPC, not UDP. AWS Lambda cannot run a custom C++ engine on a specialized Linux distribution and is not suitable for persistent ultra-low-latency UDP trading workloads. Trap: Geolocation DNS and Lambda sound globally managed, but they do not support UDP or custom OS latency needs.

CloudFront is designed for HTTP(S) content delivery and does not act as a general-purpose UDP front door for custom trading protocols. While NLB supports UDP, CloudFront cannot natively forward arbitrary UDP traffic to an NLB origin. Fargate also limits OS/kernel customization, making it a poor fit for specialized Linux distributions and latency-sensitive HFT engines. Trap: NLB is present, but CloudFront and Fargate do not fit arbitrary UDP with specialized Linux.

API Gateway regional endpoints and ALB are HTTP-centric services and do not support UDP traffic. Even if the backend ran on ECS, the front door would not meet the protocol requirement. Additionally, API Gateway introduces additional request processing overhead and is not intended for ultra-low-latency, high-frequency UDP trading flows requiring static IPs and anycast-based global routing. Trap: API Gateway/ECS sounds scalable, but API Gateway and ALB are HTTP oriented and miss UDP/static-anycast requirements.

Amazon MQ and a Multi-AZ app tier are good, but putting MySQL on EC2 Auto Scaling does not provide database replication or failover. Trap: Auto Scaling sounds highly available, but it does not make a stateful database consistent.

RDS Multi-AZ is right for MySQL, but self-managing RabbitMQ on EC2 keeps high broker operational overhead. Trap: Multi-AZ EC2 capacity helps, but RabbitMQ still needs clustering and failover management.

This leaves both RabbitMQ and MySQL as self-managed stateful EC2 systems, which conflicts with least operational overhead. Trap: More Auto Scaling groups do not replace managed replication and failover.

Lambda filtering happens after API Gateway and Lambda have already been invoked, so the attack still drives cost and can exhaust concurrency. Trap: It can reject requests logically, but too late in the request path.

Private API Gateway endpoints and VPC peering are not practical for public mobile users spread across carrier networks. Trap: Private networking sounds secure, but it would break normal mobile access.

Per-user IAM role assumption is operationally heavy and does not directly stop volumetric bot traffic. Mobile APIs normally use app/user authentication plus API-layer protection. Trap: Temporary credentials sound secure, but this is not the right anti-abuse control for a public mobile API.

ElastiCache is useful for reads, not durable purchase writes that must reach the system of record consistently. Trap: Caching sounds cost-effective, but purchase writes cannot be safely treated as cache entries.

Endless Lambda retries can amplify load, increase cost, and worsen a database saturation event. Trap: Retries feel resilient, but unbounded retries are an anti-pattern under peak load.

API Gateway usage plans can throttle clients, but they do not process all valid purchase demand or protect Aurora with load leveling. Trap: Throttling reduces pressure, but it can reject business-critical flash-sale transactions.

A single-AZ Elastic Beanstalk environment still has AZ-level risk and does not separate or harden the database tier. Trap: Beanstalk is managed, but the single-AZ and sticky-session design misses the resilience target.

S3 and CloudFront are good, but RDS read replicas are not the same as RDS Multi-AZ automatic failover for the primary database. Trap: The serverless API sounds modern, but the database HA requirement is not fully met.

Multi-AZ EC2 behind a load balancer improves compute availability, but it keeps static content on EC2 and uses an RDS instance with backups instead of managed failover. Trap: It is an incremental lift-and-shift, but it leaves too much operations work and database risk.