AWS Certified Solutions Architect – Associate

Answer C is correct because Amazon EventBridge is designed for creating event-driven architectures. It allows you to define rules that can filter and transform incoming events, meaning you can pass only the relevant parts of order data to each validation Lambda function, ensuring loose coupling. This matches the requirement to allow future changes without altering the entire system. Answer A is incorrect because using individual SQS queues for each validation phase creates tightly coupled components since each Lambda function is directly linked to a specific queue. This setup doesn‘t natively allow for filtering specific data segments without added complexity. Answer B is incorrect because while SNS allows for message filtering, it is primarily a pub/sub model and could lead to unnecessary duplication of data being sent to all subscribed Lambdas, which is not efficient for independent validation stages. Answer D is incorrect because introducing an intermediary Lambda function that transforms the data and invokes other Lambdas synchronously reduces the independence of each validation phase and adds unnecessary complexity to the system. An ideal solution would not require a supervisory Lambda function, but would instead use a system that allows each Lambda to be triggered with only the data it needs, as provided by EventBridge.

Answer A is correct because S3 Intelligent-Tiering automatically moves data between two access tiers (frequent and infrequent access) based on changing access patterns, optimizing costs, and maintaining fast access to frequently accessed files. This approach requires no overhead in managing the transition and is optimal for data lakes with varying access patterns. Answer B is incorrect because S3 Glacier is designed for archival data that does not require immediate access, which contradicts the need for fast access. Using S3 Select with Glacier doesn‘t provide the required on-demand access speed. Answer C is incorrect because while S3 Standard-IA reduces costs for infrequently accessed data, it involves higher retrieval fees and slower access times, not ideal for frequently accessed files. Answer D is incorrect because it involves unnecessary complexity in managing file transitions between storage classes and relies on Lambda for dynamic moves, which may not be cost-effective nor performant for on-demand access. Overall, using Intelligent-Tiering minimizes the need for manual intervention and custom management logic to strike an ideal balance between cost and access performance.

Answer A is correct because utilizing Amazon S3 with an Intelligent-Tiering lifecycle policy allows for automatic cost-optimization of storage. Amazon S3 Intelligent-Tiering automatically moves data to the most cost-effective access tier when access patterns change, thereby reducing costs without affecting performance. This is particularly beneficial because the requirement is to cut storage expenses. Answer B is incorrect because Amazon FSx for Windows File Server would generally increase costs due to the expenses associated with running Windows File Server and the requirement for Windows licensing. Answer C is incorrect as Amazon FSx for OpenZFS is optimized for high performance NFS workloads rather than cost minimization, and it may not provide the needed savings for the stated objective. Answer D is incorrect because while S3 Glacier Flexible Retrieval offers low-cost storage, it is designed mainly for archival purposes with infrequent retrieval, which might not fit the typical access patterns required for standard data retrieval in this scenario and can incur higher retrieval costs if accessed frequently. Therefore, option A offers the best balance of reduced storage costs without impacting accessibility and performance of the system.

Answer C is correct because establishing a gateway endpoint for Amazon S3 within the VPC allows private connectivity between the Lambda function and S3 without routing traffic over the internet or network address translation (NAT), thus bypassing the NAT instance entirely and addressing the timeout issue caused by excessive traffic on the NAT instance. Gateway endpoints for Amazon S3 enable direct access to S3 from the VPC‘s private subnets and require modifications to the subnets‘ route tables to route traffic for the S3 service through the endpoint. Answer A is incorrect because replacing the EC2 NAT instance with a managed NAT gateway still routes traffic through a NAT solution and does not provide direct S3 access, which the question requires. Answer B is incorrect as upgrading the NAT instance does not solve the core issue of needing direct access to S3, it merely increases capacity, which does not prevent timeouts related to NAT traffic. Answer D is incorrect because a transit gateway is not necessary for accessing Amazon S3 directly within a VPC, and it introduces unnecessary complexity and cost without solving the primary issue of avoiding internet-based traffic for S3 access.

Answer C is correct because setting up an Amazon Aurora MySQL Multi-AZ DB cluster with read replicas allows the application‘s reporting functionality to be offloaded to the read replicas, reducing the load on the master database and improving performance. Read replicas can be used to handle read-heavy workloads like report generation, which can alleviate the slowdown caused by writes during business hours. Answer A is incorrect because while Amazon DynamoDB with preset capacity can handle high throughput requirements for certain workloads, it would require significant changes to the application logic as DynamoDB is a NoSQL database, whereas the application is currently using MySQL. Answer B is incorrect because deploying on a compute-optimized Amazon EC2 instance may improve performance to some extent but doesn‘t specifically address the issue of read-write contention during report generation. Answer D is incorrect because a standby instance in a Multi-AZ setup is used for failover and is not intended for read operations; thus, it won‘t help in improving performance for reporting workloads.

Answer C is correct because creating an IAM role in the Production account with a trust policy that allows entities from the Development account to assume the role is the best method to securely and efficiently manage cross-account access. This ensures that senior developers, and eventually additional developers if necessary, can access the Production account as needed without directly creating user accounts within Production. By using IAM roles with trust policies, you leverage AWS best practices for cross-account access, reducing the need for managing individual user credentials in the Production account. Answer A is incorrect because creating distinct policy documents in each account separately without a cross-account role does not facilitate the seamless transfer of roles and permissions as needed for this requirement. Answer B is incorrect as creating a role in the Development account does not directly provide access to the Production account; the Production account must host the role to allow cross-account access from Development. Answer D is incorrect because IAM groups cannot be specified as a principal in a trust policy and it doesn‘t address cross-account role assumption; roles must be used in this context for permissions to be granted properly between accounts.

Answer D is correct because AWS Backup is a fully managed service that allows you to automate and centrally manage backups of AWS resources, including Amazon EFS, with capabilities for scheduling backups and replicating them to another AWS Region. This meets the business‘s need for a cost-effective, AWS-managed solution for cross-region data duplication. Answer A is incorrect because EFS-to-EFS replication is not a built-in feature and would not be considered AWS-managed, which could increase complexity and cost. Answer B is incorrect because while transferring data to Amazon S3 and using Cross-Region Replication can achieve data replication, it involves custom scripting and managing data transformations that add complexity. The costs associated with storing data in S3 and transferring it might not be as cost-effective as using AWS Backup, which is designed for such cross-region backups. Answer C is incorrect because setting up VPCs in separate regions and using VPC peering with rsync for data transfer is complex, requires custom management, and isn‘t AWS-managed, deviating from the requirement for a managed solution. Option C involves additional network traffic charges and manual maintenance which can be costly and less efficient.

Option A is correct because Amazon S3 Storage Lens provides detailed insights into bucket configurations, including identifying buckets without versioning across multiple regions, which directly meets the requirement, while Option B is incorrect because IAM Access Analyzer only audits permissions and does not monitor bucket configurations like versioning, and Option C is incorrect because S3 Multi-Region Access Points are designed for unified access to buckets, not for auditing or reporting configuration details like versioning.

Answer A is correct because implementing a gateway endpoint for Amazon S3 allows the Amazon EC2 instances in private subnets to access S3 without using the internet, reducing data transfer costs associated with NAT gateways or internet gateways. This setup also enhances security by keeping the data transfer within the AWS network. Answer B is incorrect because NAT gateways incur additional costs for data transfer out of the subnet and additional usage fees, which contradicts the goal of cost reduction. Answer C is incorrect as PrivateLink is used primarily for connecting VPCs to supported AWS services in a secure and scalable manner but incurs additional costs, making it less optimal for cost reduction specifically when accessing S3. Answer D is incorrect because deploying multiple NAT gateways increases costs significantly due to their usage and data transfer rates, which does not align with the cost-reduction goal specified in the question.

Answer A is correct because setting up EC2 instances within a cluster placement group is specifically designed to provide low network latency and high network throughput by locating instances in close proximity to each other, making it ideal for high-performance computing (HPC) workloads that require tightly interconnected instance communication. This configuration ensures the physical placement of instances to minimize latency and maximize throughput. Option B is incorrect because while Dedicated Instances offer physical isolation at the hardware level, they do not specifically enhance networking latency or throughput compared to a cluster placement group. Option C is incorrect because Spot Instances are designed for cost efficiency by using spare AWS capacity, but they do not inherently provide low latency or high throughput; they are not connected in a way that optimizes tightly coupled workloads. Option D is incorrect because creating an On-Demand Capacity Reservation ensures availability of capacity but does not influence the network latency or throughput between instances; it is more about instance availability rather than performance characteristics.

Answer A is correct because accessing Trusted Advisor insights from the organization‘s management account is necessary to have a centralized view of resources across all member accounts, enabling efficient cost management. Answer C is correct because examining Trusted Advisor‘s checks for Amazon RDS Reserved Instance Optimization helps identify opportunities to switch from On-Demand to Reserved Instances, which can significantly reduce costs. Answer B is incorrect because analyzing cost-saving opportunities at the member account level isn‘t necessary when using the management account, which has visibility across all accounts. Answer D is incorrect because while analyzing Idle DB Instances can help reduce costs, the question specifically asks for leveraging AWS Trusted Advisor in the context provided, which may not always include checks specific to idle instances. Answer E is incorrect because compute optimization suggestions, while valuable, are directed towards compute resources, not directly applicable to optimizing RDS for cost reduction per the context of the question.

The correct answer is C. Acquire a public certificate from AWS Certificate Manager (ACM) issued by Amazon in the us-east-1 Region. Answer C is correct because AWS allows the use of public SSL/TLS certificates from ACM at no extra charge for use with CloudFront, provided they are issued in the us-east-1 region, which is the default region for global applications like CloudFront. ACM public certificates are free and ideal for securing traffic with custom domain names in CloudFront. Answers A and B are incorrect because they involve private certificates; private certificates are typically used within a private CA for internal applications, which often incur costs unlike public certificates. Using private certificates for CloudFront would require additional configuration and costs, as they are not intended for public internet use. Answer D is incorrect because while it suggests the use of a public certificate, it specifies us-west-1 as the region. CloudFront requires public certificates to be issued in the us-east-1 region to be used at no additional cost, ensuring the most straightforward configuration for global distribution. Thus, selecting any certificate issued outside of the us-east-1 region would not align with AWS‘s free certificate offering for CloudFront.

Answer A is correct because Amazon Kinesis Data Streams is designed for real-time data streaming, allowing scalable data ingestion to handle large volumes efficiently. Answer E is correct because AWS Fargate with Amazon ECS is a scalable, serverless solution that manages containerized applications, which is suitable for processing tasks that take around 30 minutes, providing better scalability and reduced overhead compared to managing EC2 instances manually. Answer B is incorrect because while AWS Lambda and Step Functions are serverless, Lambda is unsuitable for tasks taking as long as 30 minutes since it has a maximum execution time limit of 15 minutes. Answer C is incorrect as AWS Data Pipeline is more suited for batch-oriented and less real-time processing, which might not address the need for near-real-time performance. Answer D is incorrect because while an Auto Scaling group can process large volumes of data, it requires managing EC2 instances, which is not a fully serverless solution and may not scale as seamlessly as AWS Fargate or Amazon Kinesis.

Answer C is correct because using Amazon EC2 instances with an Auto Scaling group across two Availability Zones along with an Application Load Balancer ensures high availability and automatic scaling of the web application as demand fluctuates. The Multi-AZ deployment for Amazon RDS provides failover support, improving the resiliency and uptime of the database without needing manual management. Answer A is incorrect because Amazon RDS for Microsoft SQL Server with read replicas is not an option provided by AWS. Also, read replicas are intended for read scaling, not high availability, which is achieved better with Multi-AZ. Answer B is incorrect as running the database on EC2 instances with replication across AWS Regions involves more management effort and complexity than using RDS with Multi-AZ. It also does not efficiently ensure high availability since the latency between regions could negatively impact performance. Answer D is incorrect because managing a deployment of three web servers and three databases on EC2 instances requires significant manual management effort compared to using RDS for high availability, also with increased costs as it over-provisions resources. Amazon RDS Multi-AZ is a more effective way to ensure database reliability and high availability.

Answer D is correct because AWS Compute Optimizer provides specific recommendations for EC2 instances and EBS volumes to optimize their utilization, which can help forecast and achieve cost savings. It analyzes usage patterns and suggests optimizations like resizing or changing volume types based on historical data. Answer A is incorrect because Amazon Inspector is a security assessment service that checks for vulnerabilities and policy breaches, not cost optimization. Answer B is incorrect as AWS Systems Manager is primarily used for operational data aggregation and automation rather than delivering cost optimization insights specifically for EBS volumes. Answer C is incorrect because Amazon CloudWatch mainly provides monitoring and alerting functionalities rather than optimization suggestions; while it can help track usage and performance, it does not directly offer cost-saving advice.

Answer B is correct because AWS Systems Manager Patch Manager is specifically designed for managing the application of operating system patches to your EC2 instances, which satisfies the need to automate OS inventory and updates. Amazon Inspector is a service that allows for monitoring and assessing vulnerabilities, perfectly aligning with the requirement for regular vulnerability reviews. Answer A is incorrect because while AWS Systems Manager Patch Manager is appropriate for managing patches, AWS Security Hub is more focused on security visibility and compliance checks than direct vulnerability assessments, making it less suitable for this scenario. Answer C is incorrect because AWS Shield Advanced is primarily for protection against DDoS attacks and not suited for vulnerability assessments; AWS Config is used for configuration management and compliance, not specifically for patch management. Answer D is incorrect because Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, not designed for vulnerability assessments. AWS Config, again, is not a tool for automated patch updates. The use of GuardDuty in this context would not address the need for OS inventory or patch management. Therefore, option B is the most comprehensive and aligned solution for automating OS updates and conducting vulnerability assessments on EC2 instances.

Answer B is correct because Amazon QuickSight is a business intelligence tool that can be used to create dashboards and data visualizations. By using Amazon Athena, which allows SQL querying directly on data stored in Amazon S3, the organization can efficiently query the AWS Cost and Usage Report to obtain specific data regarding NAT gateway expenses. This combination enables the development of a bespoke dashboard that can reflect desired expense metrics starting from the beginning of the month. Option A is incorrect because AWS DataSync is primarily used for transferring large amounts of data between on-premises storage and AWS, or between AWS services, and is not suited for querying the data for dashboard purposes. Options C and D are incorrect because Amazon CloudWatch is designed for monitoring and logging, but it is not suited for creating sophisticated BI dashboards or querying S3 data through Athena. Thus, while all options mention enabling a dashboard and querying a report, only the combination in B leverages the appropriate tools for the task: visualization via QuickSight and querying via Athena.

Answer A is correct because Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and anomalous behavior to protect your AWS accounts, workloads, and data. It can be integrated with AWS WAF to automatically update rules based on detected threats. Using Amazon GuardDuty in conjunction with Amazon EventBridge and AWS Lambda allows for automated responses to suspicious activities by modifying AWS WAF rules to counteract threats. Answer B is incorrect because AWS Firewall Manager is primarily used for managing AWS WAF, AWS Shield, and VPC security group configurations across multiple accounts and does not directly provide threat detection capabilities like GuardDuty. Answer C is incorrect because Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It does not directly integrate with AWS WAF for automatic threat rule updates. Answer D is incorrect because Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data in AWS, not a tool for threat detection and AWS WAF integration. Therefore, it wouldn‘t be suitable for the requirements specified in the question.

Answer B is correct because AWS Backup provides a centralized backup solution that allows for the management of backup operations across various AWS services like EC2, RDS, and DynamoDB. It simplifies backup management and centralizes the monitoring and automation processes, making it an ideal choice for the university seeking to streamline and automate their data backups using AWS-native solutions. Answer A is incorrect because using third-party solutions with AWS Storage Gateway introduces additional complexity and dependencies, contrary to the goal of using native AWS solutions. AWS Backup is more suited for managing backups of cloud resources directly. Answer C is incorrect because AWS Config is primarily used for resource compliance auditing and doesn‘t provide specific backup capabilities or the automation of backup processes. Lifecycle policies pertain more to data lifecycle management rather than operational backups. Answer D is incorrect because AWS Systems Manager State Manager is designed more for maintaining system configurations and does not inherently provide integrated backup management services. AWS Backup is the service specifically designed for managing and automating backups across supported AWS services.

Answer A is correct because establishing a VPC endpoint for Amazon S3 allows EC2 instances within a VPC to communicate privately with Amazon S3 over the AWS network, ensuring that data does not travel over the public internet. This meets the requirement of storing confidential information securely. Answer B is incorrect because a Network Load Balancer does not support S3 buckets as targets; they are used for directing traffic to EC2 instances, not S3. Answer C is incorrect because S3 buckets cannot be placed within a VPC; they are globally available services. Instead, secure access is achieved through VPC endpoints. Answer D is incorrect because AWS Direct Connect is a dedicated network connection between on-premises data centers and AWS, not a method to connect directly to an S3 regional endpoint from within a VPC, which would not inherently prevent public internet access without additional configuration.

Answer B is correct because Amazon Neptune is a graph database service that is well-suited for scenarios where relationships and graphs are important, such as IT systems diagrams. It supports the SPARQL query language, which is specifically designed for querying graph data, allowing the security division to effectively query the IT system diagram and identify security concerns with minimal operational burden. Other options are incorrect as they do not offer an optimal fit for graph-based data and querying. Answer A is incorrect because Amazon RDS is a relational database service, and while SQL can be used for querying, it is not ideal for graph data modeling or for capturing complex relationships in an IT systems diagram. Answer C is incorrect as Amazon Redshift is a data warehousing service optimized for analytics on structured data, not graph data, which makes it unsuitable for representing and querying complex relationships in IT systems. Answer D is incorrect because while Amazon DynamoDB is a fully managed NoSQL database service that supports PartiQL, it is not optimized for handling graph data or for the complex queries needed to analyze relationships in an IT system diagram.

Answer A is correct because it involves setting up an Auto Scaling group and an ELB in the DR Region, which ensures that the infrastructure is pre-provisioned and ready to scale in case of a disaster, thereby reducing downtime. Using DynamoDB as a global table allows data synchronization across regions, which ensures data consistency and availability. Implementing DNS failover redirects traffic quickly to the DR Region‘s ELB, enabling minimal interruption. Answer B is incorrect because deploying EC2 instances, ELBs, and DynamoDB tables on demand using CloudFormation could delay the availability of resources during a disaster, thereby increasing downtime. Answer C, while similar to B, does include DynamoDB as a global table which is good for data consistency, but still relies on on-demand deployment which increases potential downtime. Answer D is incorrect because using a CloudWatch alarm with a 10-minute assessment period before triggering failover to the DR Region‘s ELB would introduce unnecessary delay in addressing a disaster situation, thereby increasing potential downtime, whereas DNS failover could be implemented more promptly.

Answer D is correct because creating an S3 gateway endpoint allows EC2 instances in a private subnet to access S3 buckets without traversing the public internet, adhering to the regulation requirements and being cost-effective as it does not incur data transfer charges associated with NAT gateways. Answer A is incorrect because a NAT gateway would allow private subnet instances to access the internet, but it involves higher costs due to data transfer fees, which is not cost-effective. Answer B is incorrect since AWS Storage Gateway is primarily used for hybrid cloud storage solutions, such as extending on-premises storage to AWS, and is not necessary for direct access from EC2 to S3 within AWS. Answer C is incorrect as S3 interface endpoints are more expensive than gateway endpoints due to data processing fees, making them less cost-effective for accessing S3 from a VPC.

Answer D is correct because AWS Storage Gateway provides a hybrid cloud storage service that presents a local cache for files stored on AWS, allowing seamless integration with existing applications that require low-latency access, like those using SMB shares. This service facilitates the transfer of on-premises files to AWS without altering application code. Answer A is incorrect because Amazon EFS is a native AWS file system for Linux-based workloads and does not support SMB directly, nor does it provide a direct way to migrate files from on-premises without modification. Answer B is incorrect as Amazon FSx for Windows File Server offers SMB file shares but doesn‘t facilitate automatic file migration from on-premises to AWS. Answer C is incorrect because AWS Snowball Edge is a physical device solution used for large-scale data transfer over networks with limited bandwidth and isn‘t suitable for applications that require ongoing low-latency access and integration, as it involves manual data transfer processes.

Answer D is correct because client-side encryption ensures that data is encrypted before being transferred to AWS S3 with encryption keys managed by the client, fulfilling the requirement of preventing third-party access before encryption and transfer. It uses AWS KMS to securely manage the keys which enhances security by maintaining control over the encryption keys. Answer A is incorrect because using S3-managed keys for client-side encryption does not prevent third-party access before encryption; it also relies on Amazon‘s services for key management which slightly shifts control away from the client. Answer B is incorrect because server-side encryption with AWS KMS encrypts data after it‘s uploaded to S3, meaning data could be vulnerable during transfer. This does not satisfy the requirement to encrypt data before transfer. Answer C is incorrect for similar reasons to B; while dual-layer encryption provides additional security, it still occurs server-side and post-transfer, leaving data exposed prior to reaching AWS S3. By focusing on pre-transfer encryption entirely handled by the client, option D meets all stated criteria effectively.

The Solutions Architect can use Auto Scaling group across multiple AZs with an ALB in front to create an elastic and highly available architecture. Then, migrate the database to an Amazon RDS multi-AZ deployment to create HA for the database tier. This results in a fully redundant architecture that can withstand the failure of an availability zone.
CORRECT: “Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs“ is a correct answer.
CORRECT: “Create new private subnets in the same VPC but in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment“ is also a correct answer.
INCORRECT: “Create new public subnets in the same AZ for high availability and move the web tier to the public subnets“ is incorrect. If subnets share the same AZ they are not suitable for splitting your tier across them for HA as the failure of a an AZ will take out both subnets.
INCORRECT: “Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer (ALB)“ is incorrect. The instances are in a single AZ so the Solutions Architect should create a new auto scaling group and launch instances across multiple AZs.
INCORRECT: “Create new private subnets in the same VPC but in a different AZ. Create a database using Amazon EC2 in one AZ“ is incorrect. A database in a single AZ will not be highly available.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-increase-availability.html
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html
Topic: amazon-ec2/Topic: amazon-rds

The Provisioned IOPS SSD (io1) volume type will offer the most consistent performance and can be configured with the amount of IOPS required by the application. It will also provide the lowest latency of the options presented.

CORRECT: “Provisioned IOPS SSD (io1)“ is the correct answer.
INCORRECT: “General Purpose SSD (gp2)“ is incorrect. This is not the best solution for when you require high I/O, consistent performance and low latency.
INCORRECT: “Throughput Optimized HDD (st1)“ is incorrect. This is a HDD type of disk and not suitable for low latency workloads that require consistent performance.
INCORRECT: “Cold HDD (sc1)“ is incorrect. This is the lowest cost option and not suitable for frequently accessed workloads.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Topic: amazon-ebs/

Service control policies (SCPs) offer central control over the maximum available permissions for all accounts in your organization allowing you to ensure your accounts stay within your organization’s access control guidelines.
In the example below, a policy in OU1 restricts all users from launching EC2 instance types other than a t2.micro:

(IMAGE)
CORRECT: “Create a service control policy in the root organizational unit to deny access to the services or actions“ is the correct answer.
INCORRECT: “Create a Network ACL that limits access to the services or actions and attach it to all relevant subnets“ is incorrect. Network ACLs control network traffic – not API actions.
INCORRECT: “Create an IAM policy in the root account and attach it to users and groups in each account“ is incorrect. This is not an efficient or centrally managed method of applying the security restrictions.
INCORRECT: “Create cross-account roles in each account to limit access to the services and actions that are allowed“ is incorrect. This is another example of a complex and inefficient method of providing access across accounts and does not restrict API actions within the account.
References:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html

Topic: aws-solutions-architect-associate/security-identity-compliance/aws-accounts/

An inbound rule should be created for the relevant protocols (HTTP/HTTPS) and the source should be set to any address (0.0.0.0/0).
The outbound rule should forward the relevant protocols (HTTP/HTTPS) and the destination should be set to the web server security group.
Note that on the web server security group you’d want to add an Inbound rule allowing HTTP/HTTPS from the ELB security group.
CORRECT: “Add an Outbound rule that allows HTTP/HTTPS, and specify the destination as the web server security group“ is a correct answer.
CORRECT: “Add an Inbound rule that allows HTTP/HTTPS, and specify the source as 0.0.0.0/0“ is also a correct answer.
INCORRECT: “Add an Outbound rule that allows ALL TCP, and specify the destination as the Internet Gateway“ is incorrect as the relevant protocol should be specified and the destination should be the web server security group.
INCORRECT: “Add an Outbound rule that allows HTTP/HTTPS, and specify the destination as VPC CIDR“ is incorrect. Using the VPC CIDR would not be secure and you cannot specify an Internet Gateway in a security group (not that you’d want to anyway).
INCORRECT: “Add an Inbound rule that allows HTTP/HTTPS, and specify the source as 0.0.0.0/32“ is incorrect. The address 0.0.0.0/32 is incorrect as the 32 mask means an exact match is required (0.0.0.0).
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
Topic: aws-elastic-load-balancing-aws-elb

To manage your objects so that they are stored cost effectively throughout their lifecycle, configure their Amazon S3 Lifecycle. An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects. There are two types of actions:
– Transition actions—Define when objects transition to another storage class. For example, you might choose to transition objects to the S3 Standard-IA storage class 30 days after you created them, or archive objects to the S3 Glacier storage class one year after creating them.
– Expiration actions—Define when objects expire. Amazon S3 deletes expired objects on your behalf.
CORRECT: “Use an S3 lifecycle policy with object expiration configured to automatically remove objects that are more than 60 days old“ is the correct answer.
INCORRECT: “Write a Ruby script that checks the age of objects and deletes any that are more than 60 days old“ is incorrect as the automated method is to use object expiration.
INCORRECT: “Use an S3 bucket policy that deletes objects that are more than 60 days old“ is incorrect as you cannot do this with bucket policies.
INCORRECT: “Use an S3 lifecycle policy to move the log files that are more than 60 days old to the GLACIER storage class“ is incorrect. Moving logs to Glacier may save cost but the question requests that the files are permanently deleted.
References:
https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html
Topic: amazon-s3-and-glacier

Amazon RDS Proxy is a fully managed, highly available database proxy for Amazon RDS that makes applications more scalable, more resilient to database failures, and more secure.
During a failover, RDS Proxy automatically connects to a standby database instance while preserving connections from your application and reducing failover times for RDS and Aurora multi-AZ databases. So, there is minimal downtime for the application.
CORRECT: “Configure an Amazon RDS Proxy for the database and modify the application to connect to the proxy endpoint“ is the correct answer (as explained above.)
INCORRECT: “Implement more RDS MySQL read replicas in the cluster to manage the load during the failover“ is incorrect.
Adding more read replicas to the cluster does not decrease the downtime during a failover. It only improves the database‘s ability to handle read-heavy workloads. Read replicas do not contribute to a faster failover process.
INCORRECT: “Establish a secondary RDS MySQL cluster within the same AWS Region. During any future failover, modify the application to connect to the secondary cluster‘s writer endpoint“ is incorrect.
This approach is operationally heavy as it involves managing two separate RDS clusters and manually updating the application‘s database endpoint during a failover. Moreover, it does not necessarily reduce the downtime during a failover as there might be data inconsistency issues between the primary and secondary clusters, depending on the replication latency.
INCORRECT: “Implement an Amazon ElastiCache for Redis cluster to manage the load during the failover“ is incorrect.
ElastiCache is an in-memory cache and not a relational database service. It is typically used to cache frequently accessed data to reduce latency and improve application performance, not for managing failovers.
References:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html
Topic: amazon-rds

Amazon API Gateway and AWS Lambda together make a highly scalable solution for APIs. Provisioned concurrency in Lambda ensures that there is always a warm pool of functions ready to quickly respond to API requests, thereby guaranteeing low latency even during peak traffic times.
CORRECT: “Use Amazon API Gateway along with AWS Lambda functions with provisioned concurrency“ is the correct answer (as explained above.)
INCORRECT: “Implement the API using AWS Elastic Beanstalk with auto-scaling groups“ is incorrect.
Elastic Beanstalk is a viable option for deploying applications and auto-scaling and can help handle increased traffic, but it doesn‘t guarantee the low latency requirement during peak traffic times.
INCORRECT: “Use Amazon API Gateway with AWS Fargate tasks to handle the API requests“ is incorrect.
API Gateway with Fargate can provide scalable compute, but this approach can result in higher operational overhead because of the need to manage the container lifecycle.
INCORRECT: “Implement the API on an Amazon EC2 instance behind an Application Load Balancer with manual scaling“ is incorrect.
This solution does not scale automatically and would require manual intervention to ensure optimal performance during traffic spikes. Therefore, it doesn‘t satisfy the requirement of minimizing operational overhead.
References:
https://docs.aws.amazon.com/lambda/latest/dg/provisioned-concurrency.html
Topic: amazon-api-gateway

Each instance that you launch has an associated root device volume, either an Amazon EBS volume or an instance store volume.
You can use block device mapping to specify additional EBS volumes or instance store volumes to attach to an instance when it’s launched. You can also attach additional EBS volumes to a running instance.
You cannot use a block device mapping to specify a snapshot, EFS volume or S3 bucket.
CORRECT: “EBS volume“ is a correct answer.
CORRECT: “Instance store volume“ is also a correct answer.
INCORRECT: “EFS volume“ is incorrect as described above.
INCORRECT: “Snapshot“ is incorrect as described above.
INCORRECT: “S3 bucket“ is incorrect as described above.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html
Topic: amazon-ebs

On-Demand pricing ensures that instances will not be terminated and is the most economical option. Use on-demand for ad-hoc requirements where you cannot tolerate interruption.
CORRECT: “On-Demand“ is the correct answer.
INCORRECT: “Spot“ is incorrect. Spot pricing may be the most economical option for a short duration over a weekend but you may have the instances terminated by AWS and there is a requirement that the servers run uninterrupted.
INCORRECT: “Reserved“ is incorrect. Reserved pricing provides a reduced cost for a contracted period (1 or 3 years), and is not suitable for ad hoc requirements.
INCORRECT: “Dedicated instances“ is incorrect. Dedicated instances run on hardware that’s dedicated to a single customer and are more expensive than regular On-Demand instances.
References:
https://aws.amazon.com/ec2/pricing/
Topic: amazon-ec2

Amazon RDS‘s automatic storage scaling allows the database to automatically increase its storage capacity when the available storage is low. This feature helps to prevent out-of-storage situations and requires no operational overhead.
CORRECT: “Enable automatic storage scaling for the MySQL instance“ is the correct answer (as explained above.)
INCORRECT: “Migrate the database to a larger Amazon RDS MySQL instance“ is incorrect.
While this would provide more storage, it does not address the issue of potential future storage shortages and requires significant operational effort for the migration.
INCORRECT: “Implement a lifecycle policy to delete older data from the MySQL instance“ is incorrect.
While this might help free up some storage, it might not be suitable if all data is essential for business operations. Also, this does not provide a long-term solution if data growth continues.
INCORRECT: “Utilize Amazon ElastiCache to offload some read traffic and reduce database load“ is incorrect.
While ElastiCache can help to improve the database‘s read efficiency, it doesn‘t directly address the disk space concern for the RDS instance.
References:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html
Topic: amazon-rds

This solution involves creating an application layer in the new region and using Amazon Aurora Global Database, which supports replicating your databases across multiple regions with minimal impact on performance.
This configuration can enhance disaster recovery capabilities and can reduce the impact of planned maintenance. Amazon Route 53 health checks with a failover routing policy can automatically route traffic to the new region in the event of a failure in the primary region, thereby ensuring high availability.
With an Aurora global database, there are two different approaches to failover depending on the scenario. You can use manual unplanned failover (detach and promote) or managed planned failover.
CORRECT: “Establish the application layer in the new region. Use Amazon Aurora Global Database for deploying the database in the primary and new regions. Apply Amazon Route 53 health checks with a failover routing policy to the new region. Perform a manual failover as required“ is the correct answer (as explained above.)
INCORRECT: “Replicate the application layer in the new region. Implement an Aurora MySQL Read Replica in the new region using Route 53 health checks and a failover routing policy. In case of primary failure, promote the Read Replica to primary“ is incorrect.
This solution involves creating a Read Replica in the new region, which would indeed allow for the promotion of the Read Replica to a primary instance if necessary. However, this process isn‘t instantaneous and could lead to service interruption, which is not what the question asked for. Aurora Global Database provides a lower RTO/RPO.
INCORRECT: “Create a similar application layer in the new region. Establish a new Aurora MySQL database in this region. Use AWS Database Migration Service (AWS DMS) for ongoing replication from the primary database to the new region. Implement Amazon Route 53 health checks with a failover routing policy to the new region“ is incorrect.
AWS Database Migration Service (AWS DMS) is primarily used for migrating databases to AWS from on-premises environments or for replicating databases for data warehousing and other use cases. It isn‘t as suitable for ongoing high-availability or failover scenarios as Amazon Aurora Global Database, which is specifically designed for these situations.
INCORRECT: “Expand the existing Auto Scaling group into the new Region. Utilize Amazon Aurora Global Database to extend the database across the primary and new regions. Implement Amazon Route 53 health checks with a failover routing policy directed towards the new region“ is incorrect.
It is not possible to expand an Auto Scaling group across multiple Regions. ASGs operate within a Region only.
References:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-disaster-recovery.html#aurora-global-database-failover
Topic: amazon-aurora

An Amazon Simple Queue Service (SQS) can be used to offload and decouple the long-running requests. They can then be processed asynchronously by separate EC2 instances. This is the best way to reduce the overall latency introduced by the long-running API call.
CORRECT: “Create an Amazon SQS queue and decouple the long-running API calls“ is the correct answer.
INCORRECT: “Change the EC2 instance to one with enhanced networking to reduce latency“ is incorrect. This will not reduce the latency of the API call as network latency is not the issue here, it is the latency of how long the API call takes to complete.
INCORRECT: “Increase the ALB idle timeout to allow the long-running requests to complete“ is incorrect. The issue is not the connection being interrupted, it is that the API call takes a long time to complete.
INCORRECT: “Change the ALB to a Network Load Balancer (NLB) and use SSL/TLS termination“ is incorrect. SSL/TLS termination is not of benefit here as the problem is not encryption or processing of encryption. The issue is API call latency.
References:
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html
Topic: aws-application-integration-services

Connection draining is enabled by default and provides a period of time for existing connections to close cleanly. When connection draining is in action an CLB will be in the status “InService: Instance deregistration currently in progress”.
CORRECT: “Connection Draining“ is the correct answer.
INCORRECT: “Sticky Sessions“ is incorrect. Session stickiness uses cookies and ensures a client is bound to an individual back-end instance for the duration of the cookie lifetime.
INCORRECT: “Proxy Protocol“ is incorrect. The Proxy Protocol header helps you identify the IP address of a client when you have a load balancer that uses TCP for back-end connections.
INCORRECT: “Deletion Protection“ is incorrect. Deletion protection is used to protect the ELB from deletion.
References:
https://aws.amazon.com/about-aws/whats-new/2014/03/20/elastic-load-balancing-supports-connection-draining/
Topic: aws-elastic-load-balancing-aws-elb

The Metrics Server collects resource metrics like CPU and memory usage from each node and its pods and provides these metrics to the Kubernetes API server for use by the Horizontal Pod Autoscaler, which automatically scales the number of pods in a deployment, replication controller, replica set, or stateful set based on observed CPU utilization.
The Kubernetes Cluster Autoscaler automatically adjusts the size of the Kubernetes cluster when there are pods that failed to run in the cluster due to insufficient resources or when there are nodes in the cluster that have been underutilized for an extended period and their pods can be placed on other existing nodes.
CORRECT: “Utilize the Kubernetes Metrics Server to enable horizontal pod autoscaling based on resource utilization“ is a correct answer (as explained above.)
CORRECT: “Employ the Kubernetes Cluster Autoscaler for dynamically managing the quantity of nodes in the EKS cluster“ is also a correct answer (as explained above.)
INCORRECT: “Implement the Kubernetes Vertical Pod Autoscaler to adjust the CPU and memory allocation for the pods“ is incorrect.
The Vertical Pod Autoscaler adjusts the resources of the pods and not the number of pods or nodes, which won‘t directly help with scaling according to traffic patterns.
INCORRECT: “Integrate Amazon SQS and connect it to Amazon EKS for workload management“ is incorrect.
Amazon SQS is a message queuing service, and while it can be used to manage workloads by decoupling microservices, it doesn‘t directly help with autoscaling an EKS cluster based on traffic patterns.
INCORRECT: “Leverage AWS X-Ray to track and analyze the application‘s network activity“ is incorrect.
AWS X-Ray provides insights into the behavior of your applications, but it doesn‘t directly help with autoscaling an EKS cluster.
References:
https://kubernetes.io/docs/tasks/debug/debug-cluster/resource-metrics-pipeline/#metrics-server
https://docs.aws.amazon.com/eks/latest/userguide/autoscaling.html
Topic: amazon-ecs-and-eks

You can create AMIs of the EC2 instances and then copy them across Regions. This provides a point-in-time copy of the state of the EC2 instance in the remote Region.
Once you’ve created AMIs of EC2 instances and copied them to the second Region, you can then launch the EC2 instances from the AMIs in that Region.
This is a good DR strategy as you have moved stateful EC2 instances to another Region.
CORRECT: “Create AMIs of the instances and copy them to another Region“ is the correct answer.
CORRECT: “Launch instances in the second Region from the AMIs“ is also a correct answer.
INCORRECT: “Launch instances in the second Region using the S3 API“ is incorrect. Though snapshots (and EBS-backed AMIs) are stored on Amazon S3, you cannot actually access them using the S3 API. You must use the EC2 API.
INCORRECT: “Enable cross-region snapshots for the Amazon EC2 instances“ is incorrect. You cannot enable “cross-region snapshots” as this is not a feature that currently exists.
INCORRECT: “Copy the snapshots using Amazon S3 cross-region replication“ is incorrect. You cannot work with snapshots using Amazon S3 at all including leveraging the cross-region replication feature.
References:
https://aws.amazon.com/blogs/aws/ebs-snapshot-copy/
Topic: amazon-ec2

Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into categories, for example, host name, events, and security groups.
Instance metadata is available at http://169.254.169.254/latest/meta-data.
CORRECT: “Metadata“ is the correct answer.
INCORRECT: “Tags“ is incorrect. Tags are used to categorize and label resources.
INCORRECT: “User data“ is incorrect. User data is used to configure the system at launch time and specify scripts.
INCORRECT: “Parameters“ is incorrect. Parameters are used in databases.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
Topic: amazon-ec2

AWS AppSync simplifies application development by letting you create a flexible API to securely access, manipulate, and combine data from one or more data sources. AppSync is a managed service that uses GraphQL to make it easy for applications to get exactly the data they need, including from multiple DynamoDB tables.
AWS AppSync is designed for real-time and offline data access which makes it an ideal solution for this scenario.
CORRECT: “AWS AppSync with multiple data sources and resolvers“ is the correct answer (as explained above.)
INCORRECT: “AWS Lambda with Step Functions“ is incorrect.
AWS Step Functions make it easy to coordinate the components of distributed applications and microservices using visual workflows. However, while you could theoretically build a flow to retrieve data from multiple tables, it‘s not the most efficient solution as it introduces additional complexity and potential latency.
INCORRECT: “Amazon S3 with Lambda triggers“ is incorrect.
While you can use AWS Lambda to execute code in response to triggers like changes to data in an Amazon S3 bucket, this doesn‘t directly allow the application to retrieve data from multiple DynamoDB tables. This approach would also involve unnecessary data transfers and added latency.
INCORRECT: “AWS Glue with a DynamoDB connector“ is incorrect.
AWS Glue is a fully managed extract, transform, and load (ETL) service that makes it easy to prepare and load your data for analytics. However, AWS Glue isn‘t meant for real-time data retrieval in an application. Using it for real-time data retrieval would likely be overcomplicated and inefficient.
References:
https://aws.amazon.com/appsync/product-details

AWS Service Catalog enables organizations to create and manage catalogs of IT services that are approved for use on AWS. It allows centrally managed service portfolios, which clients can use on a self-service basis.
AWS Service Catalog provides a single location where organizations can centrally manage catalogs of IT services, which simplifies the organizational process and helps ensure compliance.
CORRECT: “Create AWS Service Catalog portfolios for the clients“ is the correct answer (as explained above.)
INCORRECT: “Create AWS CloudFormation stacks for the clients“ is incorrect.
While AWS CloudFormation is a powerful service for infrastructure as code (IaC), it doesn‘t provide a straightforward way for clients to discover and use shared tools or solutions for self-service needs. It lacks the management features and access control mechanisms necessary for this scenario.
INCORRECT: “Create AWS Systems Manager documents for the clients“ is incorrect.
AWS Systems Manager documents define the actions that Systems Manager performs on your managed instances. Although Systems Manager allows the central management of resources and applications, it doesn‘t provide an effective means for clients to self-discover and use shared tools or solutions.
INCORRECT: “Create AWS Config rules for the clients“ is incorrect.
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It isn‘t designed to centrally manage and distribute software tools or solutions.
References:
https://aws.amazon.com/servicecatalog/
Topic: aws-service-catalog

The Network Load Balancer operates at the connection level (Layer 4), routing connections to targets – Amazon EC2 instances, containers and IP addresses based on IP protocol data. It is architected to handle millions of requests/sec, sudden volatile traffic patterns and provides extremely low latencies.
The NLB provides high throughput and extremely low latencies and is designed to handle traffic as it grows and can load balance millions of requests/second. NLB also supports load balancing to multiple ports on an instance.
CORRECT: “Network Load Balancer“ is the correct answer.
INCORRECT: “Classic Load Balancer“ is incorrect. The CLB operates using the TCP, SSL, HTTP and HTTPS protocols. It is not the best choice for requirements of extremely high throughput and low latency and does not support load balancing to multiple ports on an instance.
INCORRECT: “Application Load Balancer“ is incorrect. The ALB operates at the HTTP and HTTPS level only (does not support TCP load balancing).
INCORRECT: “Route 53“ is incorrect. Route 53 is a DNS service, it is not a type of ELB (though you can do some types of load balancing with it).
References:
https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html
Topic: aws-elastic-load-balancing-aws-elb

The only solution presented that actually works is to create a NAT gateway in the public subnet of each AZ. They must be created in the public subnet as they gain public IP addresses and use an internet gateway for internet access.
The route tables in the private subnets must then be configured with a route to the NAT gateway and then the EC2 instances will be able to access the internet (subject to security group configuration).
CORRECT: “Create a NAT gateway in the public subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT gateway“ is the correct answer.
INCORRECT: “Create a NAT gateway and attach it to the VPC. Add a route to the gateway to each private subnet route table“ is incorrect. You do not attach NAT gateways to VPCs, you add them to public subnets.
INCORRECT: “Configure an internet gateway. Add a route to the gateway to each private subnet route table“ is incorrect. You cannot add a route to an internet gateway to a private subnet route table (private EC2 instances don’t even have public IP addresses).
INCORRECT: “Create a NAT instance in the private subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT instance“ is incorrect. You do not create NAT instances in private subnets, they must be created in public subnets.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
Topic: amazon-vpc

Run Command is designed to support a wide range of enterprise scenarios including installing software, running ad hoc scripts or Microsoft PowerShell commands, configuring Windows Update settings, and more.
Run Command can be used to implement configuration changes across Windows instances on a consistent yet ad hoc basis and is accessible from the AWS Management Console, the AWS Command Line Interface (CLI), the AWS Tools for Windows PowerShell, and the AWS SDKs.
CORRECT: “Run Command“ is the correct answer.
INCORRECT: “AWS CodeDeploy“ is incorrect. AWS CodeDeploy is a deployment service that automates application deployments to Amazon EC2 instances, on-premises instances, serverless Lambda functions, or Amazon ECS services.
INCORRECT: “AWS Config“ is incorrect. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It is not used for ad-hoc script execution.
INCORRECT: “AWS OpsWorks“ is incorrect. AWS OpsWorks provides instances of managed Puppet and Chef.
References:
https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale

Enhanced networking provides higher bandwidth, higher packet-per-second (PPS) performance, and consistently lower inter-instance latencies. If your packets-per-second rate appears to have reached its ceiling, you should consider moving to enhanced networking because you have likely reached the upper thresholds of the VIF driver. It is only available for certain instance types and only supported in VPC. You must also launch an HVM AMI with the appropriate drivers.
AWS currently supports enhanced networking capabilities using SR-IOV. SR-IOV provides direct access to network adapters, provides higher performance (packets-per-second) and lower latency.
CORRECT: “Use enhanced networking“ is the correct answer.
INCORRECT: “Configure a RAID 1 array from multiple EBS volumes“ is incorrect. You do not need to create a RAID 1 array (which is more for redundancy than performance anyway).
INCORRECT: “Create a placement group and put the EC2 instance in it“ is incorrect. A placement group is used to increase network performance between instances. In this case there is only a single instance so it won’t help.
INCORRECT: “Add multiple Elastic IP addresses to the instance“ is incorrect. Adding multiple IP addresses is not a way to increase performance of the instance as the same amount of bandwidth is available to the Elastic Network Interface (ENI).
References:
https://aws.amazon.com/premiumsupport/knowledge-center/enable-configure-enhanced-networking/
Topic: amazon-ec2

Default security groups have inbound allow rules (allowing traffic from within the group) whereas custom security groups do not have inbound allow rules (all inbound traffic is denied by default). All outbound traffic is allowed by default in custom and default security groups.
CORRECT: “There is an inbound rule that allows all traffic from the security group itself“ is a correct answer.
CORRECT: “There is an outbound rule that allows all traffic to all addresses“ is also a correct answer.
INCORRECT: “There is an inbound rule that allows all traffic from any address“ is incorrect as explained above.
INCORRECT: “There is an outbound rule that allows all traffic to the security group itself“ is incorrect as explained above.
INCORRECT: “There is an outbound rule that allows traffic to the VPC router“ is incorrect as explained above.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
Topic: amazon-vpc

A multi-site solution runs on AWS as well as on your existing on-site infrastructure in an active- active configuration. The data replication method that you employ will be determined by the recovery point that you choose. This is either Recovery Time Objective (the maximum allowable downtime before degraded operations are restored) or Recovery Point Objective (the maximum allowable time window whereby you will accept the loss of transactions during the DR process).
CORRECT: “Multi-site“ is the correct answer.
INCORRECT: “Backup and restore“ is incorrect. This is the lowest cost DR approach that simply entails creating online backups of all data and applications.
INCORRECT: “Pilot light“ is incorrect. With a pilot light strategy a core minimum of services are running and the remainder are only brought online during a disaster recovery situation.
INCORRECT: “Warm standby“ is incorrect. The term warm standby is used to describe a DR scenario in which a scaled-down version of a fully functional environment is always running in the cloud.
References:
https://aws.amazon.com/blogs/publicsector/rapidly-recover-mission-critical-systems-in-a-disaster

The aws:PrincipalOrgID global key provides a simpler alternative to manually listing and updating all the account IDs for all AWS accounts that exist within an Organization. The following Amazon S3 bucket policy allows members of any account in the ‘123456789’ organization to add an object into the ‘mydctbucket’ bucket.

(image)
CORRECT: “Use the global key of AWS Organizations within a bucket policy using the aws:PrincipalOrgID key to allow access only to accounts which are part of the Organization“ is the correct answer (as explained above.)
INCORRECT: “Use Attribute Based Access Control by referencing Tags of accounts which are either enrolled as part of AWS Organizations, or not“ is incorrect. This could be a viable option, however maintaining an accurate tagging policy as opposed to referencing the PrincipalOrgID would much more difficult.
INCORRECT: “Use AWS Config and AWS Lambda functions to make remediations to the bucket policy as and when new accounts are created and tagged as not being part of AWS Organizations. Update the S3 bucket policy accordingly“ is incorrect.
Every time an account is added or removed from the organization this workflow would have to fire. This solution would need to be built and maintained, whereas it is much easier to refer to the PrincipalOrgID once and avoid needing to change the Bucket Policy.
INCORRECT: “Add all the non-organizational accounts to an Organizational Unit (OU) and attached a Service Control Policy (SCP) which denies access to the specific Amazon S3 bucket“ is incorrect. You can only use Organization Units (OUs) and Service Control Policies (SCPs) with accounts that are a part of AWS Organizations – meaning this solution could not work.
References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

Topic: aws-organizations/