SAP-C02 Exam Dumps - AWS Certified Solutions Architect - Professional

Create a Transit Gateway:

In the shared services account, create a new AWS Transit Gateway. This serves as a central hub to connect multiple VPCs, simplifying the network topology and management.

Configure Transit Gateway Attachments:

Attach the VPC containing the Aurora DB cluster to the transit gateway. This allows the shared services VPC to communicate through the transit gateway.

Create Resource Share with AWS RAM:

Use AWS Resource Access Manager (AWS RAM) to create a resource share for the transit gateway. Share this resource with all development accounts. AWS RAM allows you to securely share your AWS resources across AWS accounts without needing to duplicate them.

Accept Resource Shares in Development Accounts:

Instruct each development team to log into their respective AWS accounts and accept the transit gateway resource share. This step is crucial for enabling cross-account access to the shared transit gateway.

Configure VPC Attachments in Development Accounts:

Each development account needs to attach their VPC to the shared transit gateway. This allows their VPCs to route traffic through the transit gateway to the Aurora DB cluster in the shared services account.

Update Route Tables:

Update the route tables in each VPC to direct traffic intended for the Aurora DB cluster through the transit gateway. This ensures that network traffic is properly routed between the development VPCs and the shared services VPC.

Using a transit gateway simplifies the network management and reduces operational overhead by providing a scalable and efficient way to interconnect multiple VPCs across different AWS accounts.

References

AWS Database Blog on RDS Proxy for Cross-Account Access【48】.

AWS Architecture Blog on Cross-Account and Cross-Region Aurora Setup【49】.

DEV Community on Managing Multiple AWS Accounts with Organizations【51】.

By creating an AMI that has Grafana pre-installed and storing the existing dashboards in Amazon Elastic File System (Amazon EFS) it allows for faster and more efficient scaling, and by creating an Auto Scaling group that uses the new AMI and setting the Auto Scaling group's minimum, desired, and maximum number of instances to one and creating an Application Load Balancer that serves at least two Availability Zones, it ensures high availability and minimized downtime.

Comprehensive and Detailed Explanation From Exact Extract:

The workload is a real-time leaderboard that needs extremely low latency: microsecond reads and single-digit millisecond writes. It also needs rapid failover (accepting writes in less than a minute after a primary node failure) and minimal operational overhead. Additionally, the data must be durable enough to persist and be used later for analytics through a data pipeline.

Amazon MemoryDB for Redis is a Redis-compatible, durable, in-memory database service designed for microsecond read latency and low-millisecond write latency while also providing durability through a distributed transaction log. MemoryDB is designed to be a primary database rather than a cache and supports Multi-AZ configurations with fast failover. These characteristics match the leaderboard’s latency requirements and the availability requirement to resume writes quickly after a failure. Because MemoryDB is fully managed, it has less operational overhead than running Redis on EC2.

Option C is the best choice because MemoryDB provides Redis compatibility, in-memory performance, Multi-AZ high availability, and durability that supports data persistence for downstream processing. The durability aspect is especially important for feeding analytics pipelines, because the data is not only cached but is retained as a database record.

Option A is not the best choice because Amazon ElastiCache for Redis is primarily used as a cache. While it can be configured for replication and can achieve low latency, it is not positioned as a durable primary data store in the same way as MemoryDB for Redis. For requirements that explicitly combine extremely low latency with persistence and database-like durability, MemoryDB is the more appropriate managed service with lower operational overhead than building custom durability mechanisms.

Option B is not suitable because Amazon RDS for MySQL typically cannot meet microsecond read latency, and write latencies are usually higher than single-digit milliseconds for non-trivial workloads. Also, read replicas do not provide multi-writer capability and do not ensure sub-minute write availability in all failure scenarios without additional architecture and failover handling.

Option D has the highest operational overhead because it requires the company to operate Redis on EC2: instance management, patching, scaling, replication, failover automation, monitoring, and backup/restore processes. This does not meet the requirement for the least operational overhead compared to fully managed services.

Therefore, an Amazon MemoryDB cluster in Multi-AZ mode provides the required ultra-low latency, rapid failover for write availability, durability for persistence, and least operational overhead.

https://aws.amazon.com/premiumsupport/knowledge-center/waf-analyze-count-action-rules/

Edit the Trust Policy:

Go to the IAM console in the parent account and locate the role that the EC2 instance needs to assume.

Edit the trust policy of the role to ensure that it correctly allows the sts

action for the role ARN in the child account.

Update the Role ARN:

Verify that the target role ARN specified in the trust policy matches the role ARN created by the CloudFormation stack in the child account.

If necessary, update the ARN to reflect the correct role in the child account.

Save and Test:

Save the updated trust policy and ensure there are no syntax errors.

Test the setup by attempting to assume the role from the EC2 instance in the child account. Verify that the instance can successfully assume the role and perform the required actions.

This ensures that the EC2 instance in the child account can assume the role in the parent account, resolving the permission issue.

References

AWS IAM Documentation on Trust Policies【51】.

B: Archiving inactive user uploads toGlacier Deep Archiveoffers the lowest storage cost.

E: Since the users are in Europe only, usingPrice Class 200reduces CloudFront delivery cost without affecting performance.

A (expiration) deletes data — not suitable.

C is invalid (App Runner does not support Spot).

D might save little unless read traffic is high.

Comprehensive and Detailed Explanation From Exact Extract:

The company wants three things: minimize client-to-broker latency within the same Availability Zone, increase available bandwidth, and increase the scaling speed of the MSK cluster. The current brokers are Standard brokers (two per AZ). Clients use default settings, which means they are not explicitly configured for rack awareness or AZ affinity.

A common way to reduce latency in multi-AZ Kafka deployments is to enable rack awareness on clients and brokers so clients prefer brokers in the same “rack,” which can map to an Availability Zone. In Kafka, the client.rack setting allows the client to include rack information so the broker can return metadata that helps the client select replicas that are closest, reducing cross-AZ traffic and improving latency.

To increase bandwidth and improve scaling speed, the most direct approach in the choices is to move from Standard brokers to Express brokers. Express brokers are designed to provide higher throughput and faster scaling characteristics compared to standard broker types. Since the question explicitly calls out increasing available bandwidth and scaling speed, the broker type change is the key lever, and it can be combined with client.rack configuration to minimize cross-AZ latency.

Option C matches these requirements: it replaces Standard brokers with Express brokers (to improve throughput/bandwidth and scaling speed) and sets client.rack to the Availability Zone identifier (az_id) to improve locality and reduce latency between clients and brokers in the same AZ.

Option A is not appropriate because MSK does not use EC2 Auto Scaling predictive scaling in that manner, and Kafka clients/brokers are not “associated” with an EC2 placement group as a primary latency solution in MSK. Placement groups are for EC2 instance placement; MSK broker placement is managed by the service.

Option B introduces a proxy layer and MSK Connect in a way that increases complexity and does not directly guarantee lower latency or higher bandwidth. MSK Connect is for Kafka Connect workloads, not as a general-purpose low-latency routing proxy for Kafka clients. Cruise Control is used for partition rebalancing and cluster optimization, but it does not replace the benefits of higher-throughput broker types and client rack awareness for AZ locality.

Option D increases broker size and introduces PrivateLink endpoints. PrivateLink is about private connectivity from VPCs to services and does not inherently ensure AZ-local broker selection or reduce latency between clients and brokers in the same AZ. Also, resizing to xlarge increases capacity but does not address scaling speed and locality as directly as express brokers plus rack configuration.

Therefore, option C best meets all requirements.