Amazon DynamoDB global tables provide a fully managed, multi-region, and multi-active database solution. This configuration directly meets the requirement for an active-active setup, allowing write operations in both the primary and secondary AWS Regions. DynamoDB automatically propagates writes between regions, with replication typically completing in under one second. This satisfies the sub-second recovery point objective (RPO) and is ideal for globally distributed applications like gaming that require low-latency data access and high availability.

A. An Amazon ElastiCache for Redis global datastore uses a primary cluster for writes and read-only secondary clusters, which is an active-passive configuration, not active-active for writes.

B. Using DynamoDB Streams with AWS Lambda is a custom, complex solution. A fully managed service like DynamoDB global tables is a more reliable and operationally simple way to achieve the same goal.

C. Amazon Aurora Global Database supports writes only in the primary Region. The secondary Regions contain read-only replicas, making it an active-passive solution for disaster recovery, not active-active.

1. Amazon DynamoDB Developer Guide - Global tables: "Global tables build on the global Amazon DynamoDB footprint to provide you with a fully managed

multi-region

and multi-active database... You can write data to any of your replica tables in any of the Regions." and "When an application writes data to a replica table in one Region

DynamoDB propagates the write to the other replica tables in the other AWS Regions automatically... a replicated write is completed in under one second."

Source: AWS Documentation

Amazon DynamoDB Developer Guide

Section: "Global tables".

2. Amazon Aurora User Guide - Overview of Amazon Aurora global databases: "An Aurora global database consists of one primary AWS Region where your data is mastered

and up to five read-only

secondary AWS Regions... You issue write operations directly to the primary cluster in the primary AWS Region."

Source: AWS Documentation

Amazon Aurora User Guide

Section: "Working with Amazon Aurora global databases"

Subsection: "Overview of Amazon Aurora global databases".

3. Amazon ElastiCache for Redis User Guide - Replication across AWS Regions using global datastores: "A global datastore is a collection of one primary and one or more secondary clusters that are replicated to one another... Write to your primary cluster and have the data available for reads from your secondary clusters to enable low-latency local reads."

Source: AWS Documentation

Amazon ElastiCache for Redis User Guide

Section: "Replication across AWS Regions using global datastores".

The most appropriate solution is to use AWS WAF (Web Application Firewall) with an IP set match rule. AWS WAF is designed to protect web applications from common exploits and can filter traffic based on various conditions, including the source IP address. A solutions architect can create one or more IP sets containing the 20,000+ registered IP addresses. This IP set is then used in a rule within a web ACL, which is associated directly with the Application Load Balancer (ALB). This approach efficiently filters traffic at the edge, allowing only requests from known retail locations to reach the application, fulfilling the security requirement in a scalable and manageable way.

B: AWS Firewall Manager is a service for centrally managing security policies (like WAF rules) across multiple accounts and resources, not the primary tool for creating the IP filtering logic itself for a single application.

C: This proposes a complex, custom-built solution using Lambda and DynamoDB. AWS WAF provides a native, more performant, and cost-effective managed service for this exact IP filtering use case.

D: Network ACLs have a very low limit on the number of rules (40 maximum per ACL), making it impossible to add rules for over 20,000 distinct IP addresses.

1. AWS WAF Developer Guide - IP set rule statement: "The IP set rule statement inspects the IP address of a web request's origin against a set of IP addresses and address ranges. ... You associate a web ACL with an AWS resource

to protect the resource. The resource can be an Amazon CloudFront distribution

an Amazon API Gateway REST API

an Application Load Balancer..."

Source: AWS WAF

AWS Firewall Manager

and AWS Shield Advanced Developer Guide

"Rule statement list

" section "IP set rule statement."

2. AWS WAF Developer Guide - Working with IP sets: "An IP set can hold up to 10

000 IP addresses or IP address ranges that you specify in CIDR notation." (Note: To accommodate over 20

000 IPs

multiple IP sets can be created and combined within a web ACL rule group).

Source: AWS WAF

AWS Firewall Manager

and AWS Shield Advanced Developer Guide

"Working with IP sets."

3. Amazon VPC User Guide - Network ACL quotas: "Rules per network ACL: 20 (default)

40 (maximum)". This hard limit makes NACLs unsuitable for the scale required in the scenario.

Source: Amazon VPC User Guide

"Quotas for your VPCs

" table entry for "Network ACLs."

4. AWS Firewall Manager Developer Guide - What is AWS Firewall Manager?: "AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organization." This highlights its role as a central management tool

not the direct implementation mechanism for a single ALB.

Source: AWS WAF

AWS Firewall Manager

and AWS Shield Advanced Developer Guide

"What is AWS Firewall Manager?".

The requirement is to prevent traffic originating from Application A from reaching Application B. Network Access Control Lists (NACLs) are the appropriate tool for this scenario as they operate at the subnet level and support explicit deny rules. By adding an outbound deny rule to the NACL associated with Application A's subnet, with the destination being the CIDR block of Application B's subnet, all traffic from A to B is blocked before it leaves the source subnet. NACLs are stateless, so this single rule effectively prevents the communication as requested.

A. Security groups do not support explicit deny rules. Furthermore, an outbound rule on Application B's security group would not block inbound traffic.

B. Security groups do not have explicit deny rules; they only support allow rules. Any traffic not matching an allow rule is implicitly denied.

C. An outbound rule on Application B's subnet NACL controls traffic leaving that subnet, not traffic entering it from Application A's subnet.

1. AWS Documentation: VPC User Guide - Network ACLs. This document states

"A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets." It also specifies under "Network ACL rules" that rules can either "ALLOW" or "DENY" traffic. The solution in option D correctly applies a DENY rule to the outbound traffic of the source subnet.

Source: AWS VPC User Guide

Section: "Control traffic to subnets using network ACLs"

Sub-section: "Network ACL rules".

2. AWS Documentation: VPC User Guide - Security groups. This document clarifies the function of security groups

stating

"A security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic." Under "Security group rules

" it specifies

"Security group rules are always permissive; you can't create rules that deny access." This directly invalidates options A and B.

Source: AWS VPC User Guide

Section: "Control traffic to resources using security groups"

Sub-section: "Security group rules".

3. AWS Documentation: VPC User Guide - Compare security groups and network ACLs. This comparison table explicitly highlights the key differences. It shows that Security Groups operate at the instance level and support "Allow rules only

" while Network ACLs operate at the subnet level and support "Allow and deny rules." This confirms that a NACL is the correct tool for a deny action and that applying it to the source subnet's outbound traffic (as in option D) is the correct implementation.

Source: AWS VPC User Guide

Section: "Control traffic to resources using security groups"

Sub-section: "Compare security groups and network ACLs".

Amazon ElastiCache for Redis Global Datastore is a feature specifically designed to meet these requirements. It provides a fully managed, fast, and secure solution for replicating a Redis cluster across multiple AWS Regions. This feature enables low-latency global reads and disaster recovery by allowing a secondary cluster in another Region to be promoted to primary with minimal downtime. All cross-Region traffic within a Global Datastore is encrypted, fulfilling the security requirement. This managed service approach represents the least operational effort compared to manual replication or backup-and-restore methods.

A. Using AWS Database Migration Service (AWS DMS) for cache replication is not a standard pattern and introduces significant operational complexity, contradicting the "least effort" requirement.

C. This option is incorrect for the same reason as option A; AWS DMS is not the appropriate tool for low-latency cache replication and adds unnecessary operational overhead.

D. A snapshot-and-restore strategy is a valid disaster recovery method but does not provide low-latency replication. This approach leads to a higher Recovery Point Objective (RPO).

1. AWS ElastiCache User Guide for Redis: "Replication Across AWS Regions Using Global Datastore" - This section details that Global Datastore is designed for "fully managed

fast

reliable

and secure cross-region replication." It explicitly states its use for "low latency global reads and disaster recovery."

2. AWS ElastiCache User Guide for Redis: "Disaster Recovery with Global Datastore" - This page describes the process of promoting a secondary cluster to primary in a disaster recovery scenario

highlighting the managed failover capability. It notes

"In the unlikely event of regional degradation

one of the healthy secondary clusters can be promoted to become the new primary with full read/write capabilities."

3. AWS ElastiCache User Guide for Redis: "Encryption in Transit" - This section confirms that for Global Datastore

"All inter-region traffic between the clusters is encrypted." This directly addresses the security requirement in the question.

Amazon RDS Read Replicas are designed specifically for offloading read-heavy workloads, such as business reporting queries, from the primary (source) DB instance. By creating a read replica, you get a read-only copy of your database that is updated asynchronously from the source. Directing the reporting queries to the read replica isolates this workload, ensuring that the performance of write operations on the primary DB instance is not affected. This solution directly addresses the requirement to separate read and write traffic to maintain performance.

B: You cannot place a standard RDS DB instance behind an Elastic Load Balancer to scale it horizontally. This architecture is not supported and does not solve the read/write workload separation issue.

C: Scaling up (vertical scaling) provides more resources to a single instance but does not isolate workloads. An intensive reporting query can still consume shared resources and impact write performance.

D: A standby DB instance is part of a Multi-AZ deployment for high availability and disaster recovery. It is not accessible for read traffic and only becomes active if the primary instance fails.

1. AWS Documentation - Amazon RDS User Guide: "Working with Amazon RDS read replicas" - This document states

"You can reduce the load on your source DB instance by routing read queries from your applications to the read replica. Read replicas allow you to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads." It also explicitly mentions

"One common use for read replicas is for business intelligence (BI) reporting."

2. AWS Documentation - Amazon RDS User Guide: "High availability (Multi-AZ) for Amazon RDS" - This guide clarifies the purpose of a standby instance: "The primary benefit of a Multi-AZ deployment is high availability... You can't use a standby replica to serve read traffic." This directly refutes the solution proposed in option D.

3. AWS Documentation - Amazon RDS User Guide: "DB instance classes" - This section describes modifying an instance class (scaling up). While this increases capacity

it does not provide the workload isolation required by the question

making it a less suitable solution than read replicas for this specific use case.

AWS IAM Identity Center (formerly AWS SSO) is designed for centrally managing Single Sign-On (SSO) access to multiple AWS accounts and applications. It integrates with AWS Organizations to provide a single point of administration. By configuring the existing on-premises Active Directory as the identity source (typically via AWS Directory Service AD Connector), the company can allow employees to use their current credentials. IAM Identity Center has built-in capabilities to enforce multi-factor authentication (MFA). Permissions are managed centrally by creating permission sets and assigning Active Directory groups to these sets for specific AWS accounts, fulfilling all the stated requirements in a streamlined and recommended manner.

A. This approach is decentralized and inefficient. Managing IAM identity providers and roles in each account separately defeats the purpose of central management, which is a core benefit of IAM Identity Center.

B. This solution creates a new, separate directory instead of using the existing on-premises Active Directory, which directly violates a primary requirement of the company.

D. This describes a complex, custom synchronization solution that creates duplicate IAM users. This is an anti-pattern that increases management overhead and security risks compared to using federation with IAM Identity Center.

1. AWS IAM Identity Center User Guide - How it works: "IAM Identity Center is integrated with AWS Organizations

which helps you to centrally manage the billing

apply policies

and simplify access management across multiple AWS accounts... You can choose to manage your users and groups in IAM Identity Center

or manage them in a connected directory

including AWS Directory Service

or an external identity provider." This supports the central management and identity source aspects of option C.

Source: AWS IAM Identity Center User Guide

"What is AWS IAM Identity Center?"

"How it works" section.

2. AWS IAM Identity Center User Guide - Choose your identity source: "When you use Active Directory as your identity source

your users can sign in to the AWS access portal with their Active Directory credentials. You can connect to your self-managed Active Directory in your on-premises data center..." This confirms the ability to use an existing on-premises AD.

Source: AWS IAM Identity Center User Guide

"Manage your identity source"

"Choose your identity source" section.

3. AWS IAM Identity Center User Guide - Multi-factor authentication: "You can enable multi-factor authentication (MFA) for your users in IAM Identity Center... When MFA is enabled

users are prompted for an MFA code from their authenticator app when they sign in to the AWS access portal." This confirms the MFA enforcement capability.

Source: AWS IAM Identity Center User Guide

"Security"

"Multi-factor authentication" section.

4. AWS Directory Service Administration Guide - AD Connector: "AD Connector is a directory gateway with which you can redirect directory requests to your on-premises Microsoft Active Directory without caching any information in the cloud." This explains the mechanism for connecting the on-premises AD.

Source: AWS Directory Service Administration Guide

"What is AWS Directory Service?"

"AD Connector" section.

This solution provides the most operationally efficient and automated method to meet the requirements. When a user requests data deletion, an event triggers an AWS Lambda function. This function updates the specific user's item in the DynamoDB table by adding or updating a TTL attribute with a timestamp set for one month in the future. With TTL enabled on the table, DynamoDB's managed background process automatically checks for and deletes items whose TTL timestamp has passed. This approach is serverless, requires no custom scheduling or scanning logic, and leverages a built-in DynamoDB feature designed for this exact purpose, ensuring the least operational overhead.

A. DynamoDB TTL expirations do not natively emit events to Amazon EventBridge. This architecture proposes a non-existent trigger mechanism.

B. A DynamoDB stream is populated after an item is deleted by TTL. The Lambda function's described purpose—to delete the data—is redundant as the deletion has already occurred.

D. AWS Config is a service for assessing and auditing resource configurations (e.g., table settings), not for tracking or reacting to item-level data plane operations like TTL deletions.

1. AWS DynamoDB Developer Guide

"Expiring Items by Using DynamoDB Time to Live (TTL)": This document explains the core mechanism. It states

"Time to Live (TTL) for Amazon DynamoDB automatically deletes expired items from your tables... You can set a specific timestamp for an item to be deleted... DynamoDB deletes expired items on a best-effort basis... at no extra cost." This directly supports the use of TTL as the deletion mechanism in option C.

2. AWS DynamoDB Developer Guide

"TTL and DynamoDB Streams": This section clarifies the interaction between TTL and other services. It notes

"Each item deleted by TTL is removed from the table. If you have DynamoDB Streams enabled on the table

a delete stream record is generated for each item that is deleted by the TTL process." This confirms that the deletion happens first

making the logic in option B incorrect.

3. AWS Lambda Developer Guide

"Using AWS Lambda with Amazon DynamoDB": This guide details how to trigger Lambda functions from user actions or API calls to interact with DynamoDB. Section "Tutorial: Using an API Gateway REST API to access DynamoDB" shows a common pattern where an API call (like a user request) invokes a Lambda function that then performs an action on a DynamoDB table

which aligns with the workflow in option C.

4. AWS Config Developer Guide

"AWS Resource and Property Types Reference": Under the AWS::DynamoDB::Table resource type

the trackable properties are listed. These include AttributeDefinitions

KeySchema

and TimeToLiveSpecification

but not individual item deletions. This confirms that AWS Config is not the correct tool for this task

invalidating option D.

To decrease latency for a global user base, an edge-optimized API endpoint is the best choice. This endpoint type leverages the Amazon CloudFront content delivery network (CDN) to route requests to the nearest edge location, minimizing network latency. Enabling API caching serves frequently requested data from the cache at the edge, further reducing latency by avoiding calls to the backend Lambda function. Additionally, enabling content encoding compresses the API payload, which reduces the amount of data transferred over the network. This smaller payload size decreases transfer time, directly contributing to lower overall latency for the end-user.

B. A Regional API endpoint is not suitable for a global user base as it does not use the CloudFront CDN, leading to higher latency for users geographically distant from the deployment region.

C. Reserved concurrency for Lambda manages execution capacity and prevents throttling; it does not directly reduce network transfer latency, which is the primary concern for a global audience.

D. This option combines two suboptimal choices: a Regional endpoint, which increases network latency for global users, and reserved concurrency, which does not address the core issue of transfer latency.

1. AWS API Gateway Developer Guide

"Choosing an API endpoint type to set up": This document states

"An edge-optimized API endpoint is best for geographically distributed clients. API requests are routed to the nearest CloudFront Point of Presence (POP)." This supports the choice of an edge-optimized endpoint for a worldwide user base.

2. AWS API Gateway Developer Guide

"Enable payload compression for an API": This guide explains

"When a client enables compression

the client can receive the API's response with a compressed payload... This can reduce the size of the response payload

which can reduce the latency of your API." This validates the use of content encoding.

3. AWS API Gateway Developer Guide

"Enabling API caching to enhance responsiveness": This source details how caching works: "You can enable API caching in Amazon API Gateway to cache your endpoint's responses. With caching

you can reduce the number of calls made to your endpoint and also improve the latency of requests to your API."

4. AWS Lambda Developer Guide

"Configuring reserved concurrency": This document clarifies the purpose of reserved concurrency: "To guarantee that a specific function can scale to a certain number of concurrent executions without being throttled

you can configure reserved concurrency." This shows it's for performance and availability

not network latency reduction.

The scenario requires distributing static media files (videos, images) from an Amazon S3 bucket to a large, global user base while reducing the load on the S3 origin. Amazon CloudFront is a Content Delivery Network (CDN) specifically designed for this purpose. It caches copies of the S3 content at edge locations worldwide, physically closer to the users. When a user requests a file, it is served from the nearest edge location, which significantly reduces latency and improves performance. This caching mechanism also minimizes direct requests to the S3 bucket, thereby reducing origin load and often lowering data transfer costs.

A. AWS Global Accelerator improves network pathing to application endpoints but does not cache content. It would not reduce the request load on the S3 origin.

C. Amazon ElastiCache (Redis OSS) is an in-memory caching service used to accelerate applications and databases, not for distributing static web content globally to end-users.

D. Amazon ElastiCache (Memcached) is also an in-memory cache for application-level data. It is not a CDN and is unsuitable for this use case.

1. Amazon CloudFront Developer Guide: "Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content

such as .html

.css

.js

and image files

to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations... If the content is not in that edge location

CloudFront retrieves it from an origin that you've defined—such as an Amazon S3 bucket..." (Source: AWS Documentation

"What is Amazon CloudFront?"

Introduction).

2. AWS Global Accelerator Developer Guide: "AWS Global Accelerator and Amazon CloudFront are separate services that use the AWS global network and its edge locations... CloudFront improves performance for both cacheable content (such as images and videos) and dynamic content... Global Accelerator improves performance for a wide range of applications over TCP or UDP..." (Source: AWS Documentation

"Comparing AWS Global Accelerator and Amazon CloudFront"

Section: "When to use Global Accelerator or CloudFront").

3. Amazon ElastiCache User Guide: "Common use cases for ElastiCache include caching database query results

sessions

and other data that is accessed frequently to improve application performance. It is not designed to serve as a content delivery network (CDN) for static assets like images and videos to end-users." (Source: AWS Documentation

"What is Amazon ElastiCache?"

Section: "Common Use Cases").

4. AWS Well-Architected Framework

Performance Efficiency Pillar (Dec 2023): "For static assets that are accessed frequently

use a content delivery network (CDN). A CDN places your content in multiple locations worldwide

which reduces the latency to retrieve these assets. It also reduces the load on your origin servers because requests are served from the cache in the CDN." (Source: AWS Whitepaper

"AWS Well-Architected Framework

Performance Efficiency Pillar"

Page 26

Section: "Use caching to reduce latency").

Predictive scaling is the optimal solution as it is designed for workloads with recurring, cyclical patterns, such as the weekly batch jobs described. It uses machine learning to analyze historical CloudWatch metrics (like CPU utilization) to forecast future capacity needs. This allows it to proactively launch the required number of instances in advance of the anticipated demand, directly meeting the requirement to provision capacity 30 minutes before the jobs run. This approach is fully automated, handles the variable transaction load by adjusting its forecast, and requires the least operational overhead as it eliminates the need for manual trend analysis and configuration.

A. A dynamic scaling policy is reactive. It would only scale out after CPU utilization has already reached 60%, failing the requirement to provision capacity 30 minutes in advance.

B. A scheduled scaling policy requires manually setting a fixed desired capacity. This is inefficient for a variable workload and contradicts the requirement of having no resources to analyze capacity trends.

D. This custom solution using EventBridge and Lambda is reactive, triggering only after high CPU usage. It also introduces significantly more development and maintenance overhead compared to a native Auto Scaling feature.

1. AWS Auto Scaling User Guide

"Predictive scaling for Amazon EC2 Auto Scaling": This document states

"Predictive scaling is well suited for applications that have recurring load patterns... It predicts future traffic... and provisions the right number of EC2 instances in advance of predicted changes." This directly supports the proactive and automated nature of the correct answer.

2. AWS Auto Scaling User Guide

"Scaling policy types": This section compares scaling policies. It describes dynamic scaling as a reactive method

while highlighting predictive scaling's ability to "proactively scale your Auto Scaling group." This contrast clarifies why option A is incorrect.

3. AWS Auto Scaling User Guide

"Scheduled scaling for Amazon EC2 Auto Scaling": This guide explains that for scheduled actions

you must specify the new values for minimum

maximum

and desired size. This confirms the manual input required

making it less suitable than predictive scaling for this scenario

as explained for option B.

4. AWS Auto Scaling User Guide

"Target tracking scaling policies for Amazon EC2 Auto Scaling": The documentation describes how target tracking works to keep a metric at or close to a specified target value. This confirms its reactive nature

as it adjusts capacity based on current

not future

load.