Question 630
A regulated migration team has already finalized its application waves. It now needs a custom executable cutover runbook across several AWS accounts that calls supported DMS, EC2 and networking APIs in a required order, pauses for a signed approval, waits for asynchronous activities to finish, and records state even if a coordinator workstation disconnects. This is orchestration of a known procedure, not discovery or migration-wave planning. What AWS capability should the team implement?
- Use AWS Transform migration planning only and assume a finalized wave plan automatically executes arbitrary per-account migration APIs with human approval and retry semantics.
- Build a Step Functions Standard state machine with scoped AWS SDK/service integrations, explicit wait/retry/failure states and an approved callback approval step for the migration workflow.
- Use Route 53 latency routing to order migration steps because a DNS health check records durable multistep cutover state.
- Invoke separate scripts from one EC2 console session with no durable execution state and assume workstation connection loss is a valid rollback mechanism.
Explanation
Correct Answer
B:Standard Step Functions supports durable multi-service workflow orchestration, synchronous waits, retries, error handling and callback/task-token approvals across supported AWS APIs.
Incorrect Answers
A:Migration planning establishes and coordinates waves but is not a substitute for the custom durable service API execution state machine and manual approval specified.
C:DNS routing cannot invoke and track dependency-ordered DMS/EC2/network activities or persist an audited process history.
D:Ad hoc scripts lack the requested managed durable workflow state, structured approval boundary and restart/retry handling.
Question 631
An application runs on premises and must use a private hybrid network path into AWS during migration. It needs a dedicated, consistent high-bandwidth circuit for months, and management is willing to pay for provisioning time. Which connection service should be considered?
- Create only a Site-to-Site VPN over the shared internet and label its variable-bandwidth path as a dedicated physically provisioned circuit.
- Use an Internet Gateway for the remote site without any established VPN or private connectivity and call it a dedicated circuit.
- Plan AWS Direct Connect with appropriate virtual interfaces, routing and redundant connectivity for the migration window.
- Use S3 Transfer Acceleration for file uploads and assume it provides private, permanent IP connectivity to all VPC applications.
Explanation
Correct Answer
C:Direct Connect offers a dedicated network path and can support sustained hybrid transfer where lead time and redundancy are planned.
Incorrect Answers
A:A VPN encrypts transit over existing networks but does not supply the requested private dedicated port capacity.
B:An internet route is not equivalent to a provisioned Direct Connect connection.
D:Transfer Acceleration is a service-specific upload optimization, not a general private hybrid circuit into VPCs.
Question 632
A legacy on-premises application can tolerate temporary network outages but cannot wait for a private circuit installation. It needs encrypted connectivity to VPC application tiers during a short migration rehearsal. What hybrid connectivity approach is the practical first step?
- Place an AWS Direct Connect order and schedule a temporary migration rehearsal before any provisioned connection or virtual interface exists.
- Create an AWS Site-to-Site VPN with appropriate customer gateway, tunnels, BGP or static routing, and test failover.
- Use Direct Connect immediately without ordering any connection or configuring router handoff equipment.
- Publish a Route 53 private hosted zone without any Site-to-Site VPN, Direct Connect or equivalent network route between premises and the VPC.
Explanation
Correct Answer
B:Site-to-Site VPN offers encrypted connectivity over available internet paths without waiting for a dedicated private circuit.
Incorrect Answers
A:A dedicated DX circuit requires installation and handoff, so it cannot be immediately used in the stated short rehearsal.
C:A dedicated physical connection cannot be conjured without provisioning and route configuration.
D:DNS names do not themselves establish encrypted IP connectivity or a hybrid tunnel.
Question 633
A migrated document-processing service runs on Linux workers in three Availability Zones. All workers must read and update the same POSIX-style directory tree concurrently, and the file store needs managed regional availability. Which storage service is the best fit?
- Attach one gp3 EBS volume in Multi-Attach mode to every Linux worker across three Availability Zones and assume native POSIX coordinated NFS semantics.
- Use S3 mount software as a fully transparent replacement for native POSIX shared file-locking and update semantics across all workers.
- Export a filesystem from a single EC2 instance over NFS and treat its EBS volume as a managed multi-AZ EFS replacement with no redundant file-server layer.
- Amazon EFS with mount targets in the necessary AZs and application-appropriate file permissions.
Explanation
Correct Answer
D:EFS offers a managed NFS-based shared filesystem accessible to Linux clients across AZs, with regional durability and elastic shared capacity.
Incorrect Answers
A:EBS Multi-Attach has limited instance/AZ and clustered-filesystem requirements and is not a regional multi-AZ managed NFS namespace for arbitrary concurrent workers.
B:S3 provides object semantics; mount adapters do not guarantee the managed shared POSIX filesystem behavior that EFS offers for concurrent Linux access.
C:A self-managed single NFS host can become a single point of failure; EFS provides the requested managed regional shared filesystem.
Question 634
A company migrated microservices that already package applications in OCI containers. Teams want managed orchestration with a Kubernetes API and workload portability, while minimizing management of the control plane. Which AWS compute platform fits?
- Use Amazon EKS for managed Kubernetes control-plane operation and choose suitable managed nodes or Fargate profiles.
- Run Amazon ECS on Fargate and assume its task APIs are a fully compatible managed Kubernetes API for current application manifests.
- Use Amazon ECS service definitions with Kubernetes-native controllers and custom resources without any Kubernetes control plane.
- Run upstream Kubernetes clusters with self-managed control plane and etcd on EC2 even though managed control-plane operation is the principal requirement.
Explanation
Correct Answer
A:EKS provides managed Kubernetes orchestration while retaining the Kubernetes ecosystem and options for worker-capacity management.
Incorrect Answers
B:ECS is a managed orchestrator, but it does not expose the required Kubernetes API and objects used for workload portability.
C:ECS is a capable separate orchestrator but does not run existing Kubernetes controller APIs and manifests; EKS is the managed Kubernetes choice.
D:Self-managed Kubernetes provides the API but defeats the goal of outsourcing control-plane management to EKS.
Question 635
A company already has approved Amazon ECS task definitions for migrated Linux batch containers. Each independent job can run for 30–40 minutes, jobs start only when queue or scheduler events arrive, and they need VPC networking. The team must avoid maintaining EC2 hosts AND must not pay for a continuously running worker service between jobs. Which ECS execution pattern is appropriate?
- Use Amazon ECS with an EC2 capacity provider but keep an idle always-on self-managed host fleet for irregular tasks.
- Migrate each 40-minute ECS task into one synchronous Lambda invocation and assume Lambda has no per-invocation execution-duration limit.
- Use ECS on Fargate with an always-running service set to one or more desired tasks through long idle periods, instead of starting one-off task executions as the irregular batch jobs arrive.
- Launch one-off ECS RunTask executions on AWS Fargate when jobs arrive, with task-level VPC networking and no permanently running worker service.
Explanation
Correct Answer
D:ECS RunTask starts eligible containerized jobs on demand; Fargate avoids EC2 hosts and tasks terminate when processing ends. It handles jobs exceeding Lambda invocation limits without a continuously provisioned ECS service.
Incorrect Answers
A:ECS on EC2 can run containers but requires host capacity lifecycle and upkeep; Fargate removes the stated worker-host requirement.
B:AWS Lambda has a bounded invocation duration, so a 30–40-minute job cannot run as one invocation; one-off Fargate tasks fit the existing ECS packaging and runtime.
C:Fargate runs tasks without hosts, but a permanently running service wastes idle capacity for independent irregular batch work; choose on-demand tasks/scheduling.
Question 636
A migrated Windows application must share a managed SMB filesystem among several application servers and retain Windows ACL semantics. The existing architecture depends on Active Directory integration. Which AWS managed storage is a suitable target?
- Use Amazon FSx for Windows File Server with appropriate directory integration and SMB file shares.
- Deploy Amazon EFS with IAM authorization and mount it as an Active Directory-integrated SMB share supporting Windows NTFS ACL inheritance.
- Deploy FSx for Lustre linked to S3 as the Windows domain file share and assume Lustre implements Windows SMB ACLs natively.
- Run SMB shares on a single EC2 Windows file server backed by a standalone EBS volume and assume that self-management meets the managed regional storage goal.
Explanation
Correct Answer
A:FSx for Windows File Server provides managed SMB storage with Windows permission and directory integration features.
Incorrect Answers
B:EFS is a managed NFS filesystem and does not provide the native Windows SMB and NTFS access-control semantics required by this application.
C:FSx for Lustre serves high-performance parallel POSIX-style workloads; FSx for Windows File Server is designed for managed SMB and AD integration.
D:A self-managed file server adds administration and availability dependencies; FSx for Windows File Server provides managed SMB and AD integration.
Question 637
A geospatial simulation workload reads multi-terabyte shared POSIX files with very high parallel throughput during an HPC training run. Data starts in S3 and must be moved efficiently into a high-performance file system for computation. Which service is a strong fit?
- Use Amazon EFS Standard and assume its general-purpose shared-file performance automatically meets a tested highly parallel Lustre HPC I/O profile.
- Use per-worker EBS io2 volumes and synchronize the files between nodes by copying them at job start, treating independent block volumes as a shared namespace.
- Use Amazon EFS throughput without validating the high-parallel file-access requirements or its fit for the Lustre-style S3-linked HPC workload.
- Use Amazon FSx for Lustre with S3 data repository integration and suitable throughput capacity.
Explanation
Correct Answer
D:FSx for Lustre is designed for parallel high-performance shared file access and can integrate with S3 datasets.
Incorrect Answers
A:EFS is shared POSIX storage but FSx for Lustre is purpose-built for the parallel high-throughput HPC access pattern and S3 data repository integration here.
B:Separate EBS devices do not expose one coherent parallel POSIX filesystem to all workers; FSx for Lustre supplies a managed shared dataset.
C:EFS provides shared file semantics but FSx for Lustre is the purpose-designed parallel HPC filesystem with data-repository linking and tuned throughput.
Question 638
A migrated database workload has a spiky request pattern with intermittent quiet periods. It needs Aurora-compatible SQL transactions and automatic fine-grained database capacity changes without provisioning a fixed large instance for the whole day. Which database configuration should be assessed?
- Use fixed-capacity Aurora provisioned writer plus read replica auto scaling and assume it scales the write-instance compute up and down during traffic spikes.
- Evaluate Aurora Serverless v2 for supported engines and tune its capacity range to the application latency and scaling requirements.
- Configure Aurora provisioned with fixed writer capacity and rely on RDS read-replica auto scaling to change the SQL writers CPU allocation as write load spikes.
- Use an Aurora Serverless v2 configuration with a fixed identical minimum and maximum capacity and claim it will autoscale between them.
Explanation
Correct Answer
B:Aurora Serverless v2 scales supported relational database capacity across configured ranges while retaining Aurora SQL behavior.
Incorrect Answers
A:Replica auto scaling changes reader count, not the provisioned writers capacity. Aurora Serverless v2 supports configured variable Aurora compute capacity.
C:Reader count scaling cannot change writer capacity automatically. Aurora Serverless v2 varies supported relational compute within an ACU range.
D:Setting an equal minimum and maximum removes the dynamic capacity range needed to respond to this spiky workload and its intermittent low-use periods.
Question 639
A migrated video inference workload runs in a CUDA-enabled OCI container and requires one dedicated NVIDIA GPU and a privileged driver configuration in the container host. A prototype ECS Fargate task definition fails compatibility checks on its gpu and privileged parameters. The team can manage a specialized GPU worker fleet. Which ECS deployment target fits?
- Keep the ECS Fargate launch type and specify gpu and privileged task-definition parameters, without changing the deployment target.
- Use an ECS Fargate task with a CPU-only instance family and expect a dedicated NVIDIA GPU device to appear inside the container at runtime.
- Use Amazon ECS with GPU-capable EC2 container instances and compatible task definitions, maintaining supported host drivers and capacity.
- Use S3 Glacier storage to execute each CUDA kernel without any provisioned compute or GPU device.
Explanation
Correct Answer
C:ECS EC2 launch capacity on supported GPU instance classes provides explicit control of GPU devices and necessary host configuration.
Incorrect Answers
A:GPU and privileged task-definition parameters are unsupported on Fargate, matching the observed compatibility failure.
B:Fargate cannot expose a dedicated host GPU in the supported ECS task configuration required for this inference workload.
D:S3 is storage rather than a GPU compute runtime and cannot execute OCI container kernels.
Question 640
An application team wants managed Kubernetes on AWS, but its current workload includes a privileged node-level security agent delivered as a DaemonSet and a CSI driver requiring specific host access. The team plans to run every pod on EKS Fargate and assumes this will work unchanged. Which architectural decision is most appropriate?
- Use Amazon EKS with suitably managed EC2 node groups for workloads requiring unsupported privileged or DaemonSet host functions, and use Fargate only for compatible pods.
- Move the privileged DaemonSet to a Fargate profile without converting it to an eligible sidecar, and keep its node-host access assumptions.
- Run the CSI driver as an ordinary Fargate Pod and assume all host-mounted storage operations are supported unchanged.
- Use S3 website hosting as the Kubernetes node runtime for privileged daemon processes.
Explanation
Correct Answer
A:EKS managed node groups provide host-level capabilities required by some privileged DaemonSets and CSI agents; Fargate profiles can still host compatible workloads, with the deployment split planned explicitly.
Incorrect Answers
B:EKS Fargate does not support DaemonSets or privileged pods, so a profile does not satisfy host-agent requirements.
C:Fargate host access and CSI/daemon compatibility must be reviewed; not all node-level drivers work on managed Fargate compute.
D:A static website service cannot run Kubernetes node agents or a privileged CSI driver.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests