Design for New Solutions29% · 6 topics

Q1. An ECS service is deployed blue/green with CodeDeploy. If errors increase in the new version, you want to revert to the old version without human intervention. Which method is most appropriate?

1. Stop blue/green, switch to all-at-once deployment, and re-release a fix immediately when errors occur
2. Greatly increase client-side retry counts so errors are absorbed by retries
3. Have staff check logs hourly after deployment and redeploy the old task definition if errors are high
4. Associate CloudWatch alarms with the deployment group and enable automatic rollback on alarm

Q2. Right after switching traffic to the new version in a blue/green deployment, the error rate alarm fired. The old environment still exists. What is the most appropriate first step?

1. Switch traffic back to the old environment (blue) to stop the impact, then investigate the new version
2. Delete the old environment to cut costs, then work on fixing and re-releasing the new version
3. Keep traffic switched until all logs from the erroring new version are collected and analyzed
4. Add instances to the new environment and watch for a while to see if errors decrease

Q1. The operations team spends a lot of time every month patching and backing up self-managed MySQL on EC2. You want to reduce operational burden in the new system. What is the most appropriate choice?

1. Move MySQL to Windows Server and let Windows Update automatic updates handle database patches too
2. Stop patching and update the OS and database together only when a problem is found
3. Increase EC2 instances to run multiple MySQL servers and patch them manually one at a time
4. Use a managed database such as Amazon Aurora MySQL and leave patching and backups to AWS

Q2. You want to automate backups of EBS, RDS and DynamoDB in multiple accounts, keep costs down while enabling restore in another Region, and prevent deletion by ransomware. Which configuration is most appropriate?

1. Take no backups and handle ransomware deletion with just Multi-AZ databases and EBS encryption
2. Configure copies to another Region and transition to cold storage in an AWS Backup plan, and enable Vault Lock
3. Store all backups in the same account and Region as production, prioritizing restore speed
4. Have staff take snapshots manually every day in each service's console and manage them with dates in the names

Q1. For a large web app used worldwide, you want to block most attacks at the edge and prevent direct access to the origin ALB. Which configuration is most appropriate?

1. Expose the ALB directly to the internet and avoid attacks by making the ALB's DNS name long and hard to guess
2. Associate WAF with CloudFront, and allow the ALB security group only from the CloudFront managed prefix list
3. Require all users to register their source IP addresses in advance and manage an allow list on the ALB manually
4. Without CloudFront, always keep several times peak capacity of EC2 behind the ALB to absorb all the load from attack requests

Q2. You are designing attack protection for a large website. Thousands of login attempts in 5 minutes are repeated from specific IP addresses. Which is the most suitable?

1. AWS WAF managed rule groups
2. AWS WAF rate-based rules
3. AWS Shield Advanced
4. CloudFront geographic restrictions

Q1. Which statement about disaster recovery (DR) drills is incorrect?

1. Feed procedural gaps and quota or permission shortfalls found in drills into improvements
2. Run drills using methods that do not affect production (such as launching the recovery environment in an isolated network)
3. Because drills may affect production, it is best never to run them and only maintain runbooks
4. Run drills regularly and measure whether actual RTO and RPO meet targets

Q2. Before releasing a new service company-wide, you want to prevent it from stopping by hitting limits during a sudden increase in usage. What is the most appropriate measure?

1. Service quotas increase automatically and without limit with usage, so no preparation is needed
2. Estimate needed service quotas, request increases in advance and monitor utilization with CloudWatch alarms
3. After release, contact AWS Support each time a limit error occurs to have it raised
4. Keep users limited to a few departments to avoid hitting limits and postpone the company-wide release indefinitely

Q1. In an Aurora failover drill, the DB switched in 30 seconds, but app connection errors continued for several minutes. The app cached DNS results for a long time. What is the most appropriate next step?

1. Point the app at the reader endpoint
2. Use the cluster endpoint with short DNS caching (or use RDS Proxy)
3. Fix the app to the primary instance's endpoint
4. Review the Aurora failover priority tiers

Q2. Which configuration best meets the requirements for this portal?

1. Always run environments of the same size in two Regions and write to both databases simultaneously every time
2. Build web, app and DB on EC2 yourselves with the same configuration as on-premises, and operate the OS and middleware yourselves
3. Configure CloudFront, ALB, ECS on Fargate and Aurora Serverless v2 across multiple AZs
4. Put the web server and database together on one large EC2 instance and take EBS snapshots every night

Q1. Three months after go-live, Fargate usage has stabilized. What is the most appropriate way to further lower first-year costs?

1. Repurchase a 3-year Savings Plan at peak usage, retroactive to the first day of operation
2. Use no discounts and fix the CPU and memory allocated to tasks at the minimum values
3. Stop using Fargate and rebuild everything to run all tasks on Spot EC2
4. Determine the always-used amount from actual usage and purchase Compute Savings Plans for just that amount

Q2. You are designing attack protection for a large website. To prepare for large-scale DDoS attacks, you want 24/7 support from a specialist team and protection against usage charges increased by attacks. Which is the most suitable?

1. AWS WAF managed rule groups
2. AWS WAF rate-based rules
3. AWS Shield Advanced
4. CloudFront geographic restrictions