模擬試験 8

Cache-Control headers can influence repeated downloads, but they do not accelerate large uploads or optimize the long-distance path to S3. Trap: It mentions S3 and caching, but the question is about bidirectional transfer throughput.

EC2 plus CloudFront adds server management and mainly helps cached downloads, not frequent global uploads of 2-50 GB files. Trap: CloudFront is an edge service, but it is not the direct exam answer for global S3 upload acceleration.

ElastiCache is for in-memory application data, not storing or transferring multi-GB video objects across continents. Trap: The word cache is tempting, but this is not a small hot-data caching problem.

Directory Service plus a trust does not automatically create account SSO; IAM Identity Center or another federation layer is still required. Trap: The trust is part of the answer, but it is missing the SSO service.

Using an AWS-hosted directory as the identity source does not satisfy the requirement to continue managing users and groups in the existing on-premises AD. Trap: It includes IAM Identity Center, but it omits the trust to the existing directory.

A custom IdP on EC2 adds patching, availability, and security work when managed AWS identity integration already meets the requirements. Trap: Custom federation can work in theory, but the question asks for the standard managed approach.

A NAT gateway is not the best answer here because the instances already use IPv6 addresses and the AWS-native design for outbound-only IPv6 internet access is an egress-only internet gateway. Although NAT gateways can participate in IPv6-to-IPv4 access patterns through DNS64/NAT64, they are not the standard solution for native IPv6 internet egress from a private subnet. For this requirement, the correct route is ::/0 to an egress-only internet gateway, which preserves outbound connectivity while preventing inbound-initiated IPv6 connections. Trap: This option sounds related, but it does not satisfy the scenario's native outbound-only IPv6 connectivity as directly as the correct design.

An internet gateway (IGW) provides direct internet routing for subnets that have a route to it. Adding a default route to an IGW makes the subnet internet-routable for IPv6, meaning inbound initiation is possible at the routing layer (even if later blocked by SG/NACL). This conflicts with the requirement that external services must never be able to initiate inbound connections. Trap: This option sounds related, but it does not satisfy the scenario's native outbound-only IPv6 connectivity as directly as the correct design.

A virtual private gateway (VGW) is used for VPN connectivity (site-to-site VPN) and is not an internet egress mechanism. Routing internet-bound traffic to a VGW would not provide general internet access to external data providers. This option confuses private connectivity (VPN/Direct Connect) with public internet connectivity requirements. Trap: This option sounds related, but it does not satisfy the scenario's native outbound-only IPv6 connectivity as directly as the correct design.

Incorrect. Amazon RDS can store relationship data in tables, but answering questions like “who can access what through which chain of roles/groups/policies” typically requires many joins and recursive queries. This becomes complex to model, harder to maintain, and often slower for deep traversals than a graph database. Operationally, you also spend more effort on schema design, indexing, and query tuning for graph-like access patterns. Trap: Amazon RDS sounds related, but it does not satisfy the scenario's graph traversal over highly interconnected security relationships as directly as the correct design.

Incorrect. Amazon Redshift is an OLAP data warehouse optimized for large-scale analytical queries and aggregations, not for interactive graph traversals or relationship path queries. While SQL is available, modeling and querying multi-hop relationships is cumbersome and usually inefficient. Redshift is better suited for reporting and batch analytics (e.g., compliance dashboards), not real-time exploration of interconnected access relationships. Trap: Amazon Redshift sounds related, but it does not satisfy the scenario's graph traversal over highly interconnected security relationships as directly as the correct design.

Incorrect. DynamoDB is a key-value/document database optimized for predictable access patterns at scale. PartiQL provides SQL-like querying, but DynamoDB does not natively support graph traversals. Modeling complex relationships requires denormalization, adjacency lists, multiple items/GSIs, and application-side traversal, which increases development complexity and operational overhead compared to using Neptune for native relationship queries. Trap: DynamoDB sounds related, but it does not satisfy the scenario's graph traversal over highly interconnected security relationships as directly as the correct design.

A manual snapshot is a point-in-time copy, but by itself it does not enforce exact seven-year retention and deletion or provide audit trails. Trap: Snapshots preserve data, but the requirement is policy-managed retention plus audit logging.

Aurora automated backup retention is not managed with an S3-style lifecycle policy for this requirement. Trap: Lifecycle wording is tempting, but automated database backups are not S3 objects you lifecycle directly.

Aurora automated backup retention cannot simply be set to seven years with default automated backups. Trap: It sounds direct, but automated backup retention is limited and not enough for the compliance target.

Volume Gateway snapshots are not a direct file migration and integrity-validation workflow to S3 for a 500 TB archive. Trap: Storage Gateway sounds like a migration bridge, but it is built for hybrid storage access rather than automated S3 migration verification.

Snowcone is an offline edge device option and is not the best fit for a 500 TB online migration with growing data; the option also adds device logistics instead of a managed ongoing transfer workflow. Trap: Snow family devices use checksums, but Snowcone capacity and offline handling do not align as well as DataSync here.

S3 Transfer Acceleration and multipart checksums can help uploads, but they require more custom transfer orchestration and do not provide the managed end-to-end migration workflow DataSync provides. Trap: Checksums sound like integrity validation, but the question asks for an automated migration solution, not a DIY upload process.

This option keeps the application tier serverless, which is attractive, but Aurora is a relational database service that introduces more database administration considerations than DynamoDB. Aurora Auto Scaling typically refers to scaling read capacity or adjusting database capacity, but it is not the same operational model as DynamoDB on-demand for highly bursty request patterns. The question does not state a need for relational queries or SQL transactions, so Aurora adds complexity without a clear requirement. For an exam question emphasizing minimal operations and unpredictable spikes, DynamoDB is the more aligned choice. Trap: Lambda and Amazon API Gateway sounds related, but it does not satisfy the scenario's zero infrastructure management and rapid burst scaling as directly as the correct design.

This option uses DynamoDB, which is a good database choice for variable traffic, but the compute layer relies on EC2 instances and Auto Scaling groups. EC2 Auto Scaling still requires infrastructure management such as AMI maintenance, patching, scaling policy tuning, and instance lifecycle handling. It also may not react as quickly as a serverless stack because new instances need time to launch and become healthy behind the load balancer. That makes it less aligned with the requirement for zero infrastructure management overhead and rapid scaling for sudden spikes. Trap: DynamoDB and Application Load Balancer sounds related, but it does not satisfy the scenario's zero infrastructure management and rapid burst scaling as directly as the correct design.

This option is the least aligned because it combines EC2-based infrastructure management with a relational database layer that is not clearly required by the scenario. Although ALB, Auto Scaling, and Aurora can be designed for high availability, they require more operational effort than a serverless architecture. EC2 scaling is generally slower than Lambda-based scaling because instances must boot and register before serving traffic. Aurora may be appropriate for relational workloads, but the question emphasizes elasticity and minimal management rather than relational database features. Trap: Amazon Aurora and Aurora sounds related, but it does not satisfy the scenario's zero infrastructure management and rapid burst scaling as directly as the correct design.

Amazon ECS is not Kubernetes, so the company would need to convert Kubernetes manifests into ECS task definitions and services. That would likely require changes to deployment tooling and CI/CD processes, which directly conflicts with the requirement to avoid pipeline modifications. Trap: Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes for compute and... sounds related, but the scenario is really testing Kubernetes compatibility and PostgreSQL compatibility under a tight timeline.

Using AWS Fargate with Amazon ECS reduces compute management overhead, and Amazon RDS for PostgreSQL is a good managed database choice. However, ECS still does not support direct reuse of existing Kubernetes manifests, so the migration would require replatforming the orchestration layer and likely adjusting the CI/CD pipeline. Trap: Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute and Amazon RDS for... sounds related, but the scenario is really testing Kubernetes compatibility and PostgreSQL compatibility under a tight timeline.

Amazon EKS preserves Kubernetes compatibility, and Aurora PostgreSQL-Compatible is a valid managed PostgreSQL-compatible database option. However, EKS on Fargate is not always the best lift-and-shift target for existing Kubernetes workloads because some workloads depend on capabilities or daemon patterns that are better supported on EC2-backed nodes, making migration riskier under a. Trap: Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute and Amazon Aurora... sounds related, but the scenario is really testing Kubernetes compatibility and PostgreSQL compatibility under a tight timeline.

A single Lightsail server with FTP is simple, but it is a server to patch, secure, back up, and recover, and it is less resilient than S3 for static files. Trap: It preserves FTP familiarity, but misses the best managed origin for static content.

EC2, Auto Scaling, an ALB, and FTP servers are unnecessarily complex and costly for monthly-updated static documents. Trap: It can be made resilient, but it overbuilds the origin layer for a static portal.

S3 is a good origin, but making the bucket public and using static website hosting is weaker than a private bucket restricted to CloudFront OAC. Trap: Transfer Family can support file-transfer workflows, but the public bucket origin design is the flaw.