模擬試験 5

IAM user access keys on EC2 are long-term credentials and are harder to rotate and protect than role-based temporary credentials. Trap: The permissions are similar, but the credential delivery method is insecure for EC2 workloads.

Parameter Store access is controlled with IAM and KMS permissions; Aurora does not establish a trust relationship that grants EC2 access to parameters. Trap: Resource policies and trust relationships sound security-focused, but they target the wrong control plane.

A VPC endpoint can keep traffic private, but it does not authorize GetParameter or decrypt a SecureString value. Trap: Private network access helps, but IAM and KMS permissions are still required.

S3 Object Lock governance mode can be bypassed by users with the required permissions, so it does not guarantee immutability for strict regulatory retention. Trap: Governance mode sounds compliant, but it is designed for controlled bypass scenarios.

SSE-S3 is low overhead, but customers do not configure its key rotation behavior, so it does not meet the stated key-management requirement. Trap: S3-managed encryption is easy, but the clue asks for configurable key rotation governance.

Imported KMS key material creates customer lifecycle work for generation, import, expiration, and replacement, which conflicts with least operational overhead. Trap: It sounds like stronger control, but the operational burden is the trap.

AWS WAF filters HTTP requests; it cannot govern which Regions accounts use or prevent VPC internet gateway attachments. Trap: WAF sounds like an internet security control, but this is account and network governance.

Network ACLs can block packets, but they do not prevent users from creating prohibited resources, and per-user IAM policies are hard to keep consistent across accounts. Trap: It controls traffic and identities locally, but not the organization-wide preventive boundary.

AWS Config is primarily detective; it can alert after a noncompliant resource appears, but the question requires prevention. Trap: Continuous monitoring is useful for evidence, but the clue says prevent accidental violations.

SNS is a push notification service and does not by itself provide pull-based buffering, visibility timeouts, or consumer backpressure for the processing services. Trap: Pub/sub sounds decoupled, but SNS alone is not the durable work queue described here.

Lambda is compute, not a message backbone, and using it to pass messages adds coupling without queue semantics such as visibility timeouts and redrive. Trap: Serverless compute can process events, but the prompt asks for reliable communication between services.

DynamoDB Streams is change data capture from a table, not the simplest general-purpose queue for distributing batch work among microservices. Trap: Streams can trigger processing, but it adds table and stream management for a queue-shaped problem.

DataSync is useful for online transfer, but it still depends on the constrained internet connection and would risk missing the deadline. Trap: A VPC endpoint sounds efficient, but it does not add bandwidth from the data center to AWS.

Direct Connect provides dedicated connectivity, but provisioning and capacity planning typically do not fit an urgent 10-day bulk migration. Trap: Dedicated bandwidth is attractive, but the scenario needs an immediate one-time transfer solution.

Storage Gateway supports hybrid storage access and caching, but it would still upload data over the limited network link over time. Trap: It is a storage migration-related service, but not the best tool for urgent 75 TB seeding.

More read replicas can help read scaling, but they do not solve application connection disruption during writer failover. Trap: Replicas sound highly available, but the outage involved the writer endpoint.

A secondary cluster in another Region adds DR capability but requires application switch logic and more operational overhead for scaling exercises. Trap: Cross-Region failover sounds resilient, but it is too heavy for minimizing routine failover downtime.

ElastiCache can reduce database read load, but it does not manage Aurora writer failover or application database connections. Trap: Caching may improve performance, but the problem is failover downtime.

Auto Scaling PostgreSQL on EC2 behind an NLB does not provide safe single-writer semantics, replication, or managed failover. Trap: It borrows web-tier scaling ideas, but stateful databases need database HA, not load-balanced writers.

Refactoring Apache web logic into Lambda is a larger rewrite and does not satisfy the compatibility-focused migration. Trap: Serverless can scale, but the scenario asks for minimal compatibility risk during migration.

Replacing PostgreSQL with DynamoDB requires schema and query redesign, so it breaks relational compatibility. Trap: DynamoDB is resilient and scalable, but it is not a drop-in PostgreSQL replacement.

Not suitable. Although S3 PUT can trigger Lambda, processing ~2 GB files is a poor fit due to Lambda limits and constraints (ephemeral storage sizing, memory/runtime, and inefficient download/transform/upload for very large objects). Even if technically possible with tuning, it increases failure risk and operational burden (timeouts, retries, partial processing) compared to managed ETL services. Trap: Lambda is easy to trigger from S3, but multi-GB file conversion is outside its comfortable operating model.

Closer technically (Spark is appropriate for large-scale transformations), but operational overhead is higher. A “Spark job” typically implies managing EMR clusters or Spark infrastructure, packaging dependencies, scaling, and monitoring. Invoking it via Lambda adds orchestration complexity. AWS Glue provides managed Spark with less setup and fewer moving parts for the same JSON-to-Avro conversion requirement. Trap: Spark is technically appropriate, but running your own Spark job adds cluster and orchestration overhead.

Incorrect service pattern. Glue crawlers/tables plus Athena are designed for interactive SQL analytics over data in place, not for converting each incoming object into a new Avro object set. Athena query results are typically written as CSV/JSON/Parquet in query result locations, and using Lambda to periodically query introduces latency, complexity, and cost without guaranteeing one-to-one file conversion semantics. Trap: Athena can query data, but this requirement is object format conversion, not interactive SQL over a table.

S3 sync creates local copies that can become stale and does not provide a shared file system with concurrent updates. Trap: Transfer Acceleration helps uploads over distance, but not low-latency shared file access inside a VPC.

CloudFront and S3 require object retrieval or API changes, which violates the requirement that the application keep its existing file access method. Trap: It can distribute files globally, but it is not a mounted shared file system.

EBS is block storage tied to an Availability Zone and is not suitable as one shared file system attached to 15 instances across AZs. Trap: Provisioned IOPS sounds fast, but block storage does not solve multi-AZ shared file access.