模擬試験 7

Keeping all movies in S3 Standard before lifecycle transitions meets access needs but leaves too much older content in higher-cost storage. Trap: It sounds safe because Standard is immediate, but the question asks to minimize cost based on known demand differences.

S3 Standard-IA has immediate access and does not use Glacier-style standard retrieval, so the option mixes service terminology and misses the lower-cost archive opportunity for old titles. Trap: Standard-IA seems reasonable for infrequent access, but the quoted retrieval tier belongs to Glacier, not Standard-IA.

Glacier Flexible Retrieval can be cost-effective, but bulk retrieval is far too slow for streaming to start within 5 minutes. Trap: Bulk is the cheapest retrieval tier, but cheapest retrieval does not satisfy the latency requirement.

S3 is durable, but S3 access points expose object storage rather than the current shared NFS file system workflow. Trap: S3 durability is attractive, but the question requires unchanged file access patterns.

File Gateway is mainly a hybrid bridge to AWS storage and does not cleanly replace the EC2 NFS pair with a managed highly available file system for AWS workstations. Trap: It mentions NFS, but it adds another gateway layer instead of solving the shared file-system requirement.

FSx for Lustre is a high-performance parallel file system, and the option adds a cross-AZ replication idea that is not the simple managed NFS replacement asked for. Trap: Video workloads can use Lustre, but the decisive clue is preserving existing NFS workflow.

Cognito identity pools issue temporary AWS credentials and are not the primary user directory for student sign-in to an API. Trap: The Cognito name is tempting, but identity pools solve AWS credential federation, not managed application-user authentication by themselves.

A Lambda authorizer can work for custom authorization, but building and operating student authentication code adds avoidable latency and maintenance. Trap: Custom Lambda logic feels flexible, but the scenario asks for operational efficiency and standard user authentication.

IAM users and IAM authorization are for AWS principals and SigV4-style access, not millions of public student accounts. Trap: IAM is secure for AWS access, but it is not a customer identity system for a global application.

The encryption choice is close, but manually rotating the KMS key every year violates the automatic rotation and low-overhead requirements. Trap: It uses the right key type, but the manual rotation step is the disqualifier.

SSE-S3 is simple, but it does not provide a customer-configurable annual KMS rotation control for the key requirement stated here. Trap: AWS-managed encryption sounds like least overhead, but the exam clue asks for explicit annual key rotation.

Imported key material cannot use KMS automatic rotation and requires customer-managed rotation procedures. Trap: Customer key material sounds strong for sensitive data, but it adds operations and fails automatic rotation.

Reserved Instances can save money for steady utilization, but this job varies by data volume and can use cheaper interruptible capacity. Trap: The job runs often, but frequent is not the same as a fixed baseline that justifies reserved capacity.

On-Demand avoids interruptions but costs more than necessary for a checkpointed fault-tolerant job. Trap: Consistent availability sounds efficient, but the workload explicitly tolerates interruption.

A 45-90 minute complex ML job on many EC2 instances is not a natural Lambda fit and may hit runtime/resource limits. Trap: Serverless can reduce operations, but it is not automatically cheaper or suitable for long-running heavy compute.

Step scaling can react to thresholds, but it requires choosing alarm bands and adjustment sizes rather than directly maintaining the 42% target. Trap: It uses CPU alarms, but the question gives a target value that maps to target tracking.

A custom Lambda polling CloudWatch every 5 minutes adds operational overhead and lag for functionality Auto Scaling already provides. Trap: Custom logic can change ASG capacity, but it is not the recommended managed scaling policy.

Scheduled scaling changes capacity by time, but it cannot maintain CPU near 42% when transcoding demand varies unexpectedly. Trap: Peak/off-peak scheduling may help predictable demand, but the requirement is metric-based automatic maintenance.

A snapshot restore creates a point-in-time copy, but production keeps changing after the snapshot and cutover requires more downtime or manual reconciliation. Trap: Snapshots are safe for testing and backup, but they are not a near-zero-downtime upgrade mechanism.

pg_dump and import is a manual logical migration that is slow and disruptive for a busy transactional database. Trap: It can move PostgreSQL data, but it does not meet least complexity or minimal downtime.

DMS can replicate changes and support low-downtime migrations, but it requires replication instances, task tuning, validation, and cutover orchestration. Trap: Continuous replication is relevant, but RDS Blue/Green is the simpler purpose-built path for this supported RDS upgrade.

A single large EC2 instance is not elastic and is still a single point of failure. It can saturate during 400% spikes and requires manual resizing or management. Trap: A larger instance may improve average performance, but it does not provide automatic scaling.

An ALB with four EC2 instances is fixed capacity as stated. Without an Auto Scaling group and policies, it may still degrade during peaks and requires ongoing instance operations. Trap: Load balancing sounds scalable, but four fixed instances do not automatically handle 400% seasonal growth.

API Gateway in front of EC2 adds an API layer but leaves backend scaling and patching to the EC2 fleet. The option does not include Auto Scaling or a low-ops compute model. Trap: It includes API Gateway, but the compute bottleneck remains EC2 without automatic scaling.

AWS Config encrypted-volumes is a detective compliance rule; it identifies resources after they exist. Trap: It sounds security-focused, but it does not enforce creation-time encryption by itself.

Systems Manager copy-and-swap automation is a remediation approach for existing volumes, not a default creation control. Trap: It can help migration, but the question is about all new volumes.

A customer-managed KMS key is useful, but Migration Hub does not enforce EBS encryption defaults. Trap: KMS is related to encryption, but the service named is not the EBS control plane.