AWS SAA-C03 真题演练卷 · 第 02 份

To ensure that only HTTPS traffic reaches the EC2 instances, the correct approach is to modify the Application Load Balancer's security group to allow inbound traffic only on port 443, which is used for HTTPS. This ensures that any non-HTTPS traffic is blocked before it reaches the ALB, aligning with the company's requirement for secure communication.

为了确保只有 HTTPS 流量到达 EC2 实例，正确的方法是修改 Application Load Balancer 的安全组，以仅允许用于 HTTPS 的端口 443 上的入站流量。这可确保任何非 HTTPS 流量在到达 ALB 之前被阻止，从而符合公司对安全通信的要求。

To secure network traffic, security groups are the primary tool for controlling inbound and outbound traffic to and from resources. Here, the EC2 instance requires an inbound rule on port 443 for HTTPS traffic from external clients, while the RDS instance should only allow inbound traffic from the EC2 instance on port 3306. Additionally, the EC2 instance needs an outbound rule to connect to the RDS instance on port 3306. Network ACL rules are not required in this scenario since security groups provide sufficient control.

为了保护网络流量，安全组是控制进出资源的入站和出站流量的主要工具。在此，EC2 实例需要在端口 443 上针对来自外部客户端的 HTTPS 流量制定入站规则，而 RDS 实例应仅允许在端口 3306 上来自 EC2 实例的入站流量。此外，EC2 实例需要在端口 3306 上连接到 RDS 实例的出站规则。在此场景中不需要网络 ACL 规则，因为安全组提供了足够的控制。

To securely access an S3 bucket from EC2 instances in a private subnet, the best approach is to use an IAM role for authorization and a VPC endpoint for S3 to ensure all traffic stays within the AWS network. This approach adheres to AWS security best practices by avoiding the storage of sensitive credentials and minimizing exposure to the public Internet.

要从私有子网中的 EC2 实例安全地访问 S3 存储桶，最好的方法是使用 IAM 角色进行授权并使用 S3 的 VPC 终端节点，以确保所有流量保留在 AWS 网络内。此方法通过避免存储敏感凭证并最大程度地减少对公共互联网的暴露，遵循 AWS 安全最佳实践。

Amazon Cognito is the best solution for providing secure application access without the need to manage a custom identity solution. It integrates seamlessly with the Application Load Balancer and can handle user authentication, authorization, and user management. Other options either do not provide authentication and authorization (e.g., AWS WAF and IAM roles) or require additional operational and security effort (e.g., custom authentication logic).

Amazon Cognito 是提供安全应用程序访问且无需管理自定义身份解决方案的最佳解决方案。它与 Application Load Balancer 无缝集成，可以处理用户认证、授权和用户管理。其他选项要么不提供身份验证和授权（例如，AWS WAF 和 IAM 角色），要么需要额外的操作和安全工作（例如，自定义身份验证逻辑）。

Enabling authentication on the Application Load Balancer (ALB) and integrating it with the company's SAML-based identity provider is the most secure and scalable solution. This approach enforces user authentication through SSO before granting access to the web application, which aligns with the company's requirements. Other options either do not provide user-level authentication or introduce unnecessary complexity without addressing the specific need for SAML-based SSO.

在 Application Load Balancer (ALB) 上启用身份验证并将其与公司基于 SAML 的身份提供商集成是最安全且可扩展的解决方案。此方法在授予对 Web 应用程序的访问权限之前通过 SSO 强制执行用户身份验证，这符合公司的要求。其他选项要么不提供用户级身份验证，要么引入不必要的复杂性，而无法满足基于 SAML 的 SSO 的特定需求。

The most secure and operationally efficient way to grant a Lambda function access to a DynamoDB table is by assigning an IAM role to the Lambda function. This eliminates the need to manage credentials manually and adheres to AWS best practices for secure application access. By leveraging IAM roles, you can define fine-grained permissions and ensure that the Lambda function only has the access it needs.

授予 Lambda 函数对 DynamoDB 表的访问权限的最安全、最高效的方法是将 IAM 角色分配给 Lambda 函数。这样就无需手动管理凭证，并遵守 AWS 安全应用程序访问最佳实践。通过利用 IAM 角色，您可以定义细粒度的权限并确保 Lambda 函数仅具有其所需的访问权限。

The company needs to address three specific requirements: user authentication and authorization, threat detection, and sensitive data monitoring. Amazon Cognito provides user authentication and authorization capabilities, Amazon GuardDuty monitors for security threats in the AWS environment, and Amazon Macie identifies and protects sensitive data in Amazon S3. These services together meet the scenario's requirements effectively, while AWS WAF and IAM, although valuable for other purposes, are not the best fit for the described use cases.

该公司需要满足三个具体要求：用户身份验证和授权、威胁检测以及敏感数据监控。 Amazon Cognito 提供用户身份验证和授权功能，Amazon GuardDuty 监控 AWS 环境中的安全威胁，Amazon Macie 识别和保护 Amazon S3 中的敏感数据。这些服务共同有效地满足了场景的要求，而 AWS WAF 和 IAM 虽然对于其他目的很有价值，但并不是最适合所描述的用例。

To address the requirements, Amazon Macie is used to identify and classify sensitive data, such as PII, in S3 buckets. Amazon GuardDuty complements this by detecting anomalies in access patterns or unauthorized access attempts to the data. Together, they provide robust data security and anomaly detection for sensitive information stored in Amazon S3.

为了满足这一需求，使用 Amazon Macie 对 S3 存储桶中的敏感数据（例如 PII）进行识别和分类。 Amazon GuardDuty 通过检测访问模式中的异常或对数据的未经授权的访问尝试来补充这一点。它们共同为 Amazon S3 中存储的敏感信息提供强大的数据安全性和异常检测。

To meet the company's requirements: 1) Amazon GuardDuty detects unusual activities such as unauthorized access or API misuse, 2) Amazon Macie identifies and classifies sensitive information in S3 buckets, and 3) Amazon Cognito provides user authentication for their mobile app. Together, these services address the specific security needs described in the scenario.

为了满足公司的要求：1) Amazon GuardDuty 检测异常活动，例如未经授权的访问或 API 滥用，2) Amazon Macie 识别 S3 存储桶中的敏感信息并对其进行分类，3) Amazon Cognito 为其移动应用程序提供用户身份验证。这些服务共同满足场景中描述的特定安全需求。

To mitigate external threat vectors like DDoS and SQL injection, AWS provides managed services that minimize administrative overhead while offering robust protection. AWS Shield Standard protects against DDoS attacks at no additional cost for all AWS customers. AWS WAF allows you to create rules to filter out specific types of malicious traffic, such as SQL injection attempts. By integrating AWS WAF with an Application Load Balancer, you can centralize protection for your application while maintaining scalability and ease of management. These solutions are cost-effective and align with AWS best practices for security.

为了减轻 DDoS 和 SQL 注入等外部威胁媒介，AWS 提供托管服务，最大限度地减少管理开销，同时提供强大的保护。 AWS Shield 标准可防止所有 AWS 客户免受 DDoS 攻击，无需支付额外费用。 AWS WAF 允许您创建规则来过滤掉特定类型的恶意流量，例如 SQL 注入尝试。通过将 AWS WAF 与 Application Load Balancer 集成，您可以集中保护您的应用程序，同时保持可扩展性和易于管理。这些解决方案具有成本效益，并且符合 AWS 安全最佳实践。

To mitigate external threats like DDoS attacks and SQL injection, AWS provides specialized tools such as AWS Shield and AWS WAF. AWS Shield Standard is included by default and helps protect against DDoS attacks, while AWS WAF enables you to create custom rules to detect and block malicious traffic, such as SQL injection attempts. Other options, such as using GuardDuty or Security Groups, are helpful for monitoring or controlling traffic but are not comprehensive solutions for these specific threats.

为了缓解 DDoS 攻击和 SQL 注入等外部威胁，AWS 提供了 AWS Shield 和 AWS WAF 等专用工具。默认情况下包含 AWS Shield 标准版，有助于防止 DDoS 攻击，而 AWS WAF 使您能够创建自定义规则来检测和阻止恶意流量，例如 SQL 注入尝试。其他选项（例如使用 GuardDuty 或安全组）有助于监视或控制流量，但并不是针对这些特定威胁的全面解决方案。

To effectively protect against external threats like DDoS attacks and SQL injection, the company should use AWS WAF to block attack patterns, enable AWS Shield Advanced to defend against DDoS attacks, and configure security groups to restrict access to trusted IP ranges. These measures collectively enhance the security posture while maintaining application availability. Amazon GuardDuty and AWS Config are useful for monitoring and compliance but do not directly protect against these specific threat vectors in this scenario.

为了有效防御 DDoS 攻击、SQL 注入等外部威胁，企业应使用 AWS WAF 来拦截攻击模式，启用 AWS Shield Advanced 来防御 DDoS 攻击，并配置安全组来限制对可信 IP 范围的访问。这些措施共同增强了安全态势，同时保持了应用程序可用性。 Amazon GuardDuty 和 AWS Config 对于监控和合规性很有用，但在这种情况下不能直接防范这些特定的威胁向量。

To protect against external threats like DDoS and SQL injection, AWS Shield Advanced and AWS WAF are the recommended services. AWS Shield Advanced provides comprehensive DDoS protection, while AWS WAF enables application-layer security through custom or managed rules. Other options like VPC Flow Logs, Security Groups, and using S3 address different aspects of security but do not directly mitigate these specific threats.

为了防御 DDoS 和 SQL 注入等外部威胁，建议使用 AWS Shield Advanced 和 AWS WAF 服务。 AWS Shield Advanced 提供全面的 DDoS 保护，而 AWS WAF 通过自定义或托管规则实现应用层安全。其他选项（例如 VPC 流日志、安全组和使用 S3）可解决安全性的不同方面，但不能直接缓解这些特定威胁。

To meet the regulatory requirements, the company must ensure encryption both at rest and in transit, and restrict unauthorized access. Enabling server-side encryption with AWS KMS ensures encryption at rest, while forcing HTTPS connections secures data in transit. Restricting access using an S3 bucket policy prevents unauthorized access to the sensitive customer data. While other options like enabling versioning or using Amazon Macie are valuable for other purposes, they do not directly address the specific requirements in this scenario.

为了满足监管要求，公司必须确保静态和传输中的加密，并限制未经授权的访问。使用 AWS KMS 启用服务器端加密可确保静态加密，同时强制 HTTPS 连接可确保传输中数据的安全。使用 S3 存储桶策略限制访问可防止对敏感客户数据进行未经授权的访问。虽然启用版本控制或使用 Amazon Macie 等其他选项对于其他目的很有价值，但它们并不能直接解决此场景中的特定要求。

To meet the requirements, the company should use SSE-KMS with a customer-managed CMK to ensure that their compliance team manages the encryption keys. Additionally, enabling S3 Server Access Logging will provide the necessary access tracking for audit purposes. These solutions together fulfill both the encryption and compliance requirements effectively.

为了满足要求，公司应将 SSE-KMS 与客户管理的 CMK 结合使用，以确保其合规团队管理加密密钥。此外，启用 S3 服务器访问日志记录将为审计目的提供必要的访问跟踪。这些解决方案共同有效满足了加密和合规性要求。

To meet the requirements of encrypting data at rest and restricting access to specific IAM roles, enabling SSE-KMS with a customer-managed key ensures proper encryption with fine-grained control over key permissions. Additionally, using an S3 bucket policy to deny access to unauthorized users ensures that only specific IAM roles can access the data. These two measures together provide robust security controls for sensitive data stored in S3.

为了满足静态数据加密和限制对特定 IAM 角色的访问的要求，使用客户管理的密钥启用 SSE-KMS 可确保正确的加密以及对密钥权限的细粒度控制。此外，使用 S3 存储桶策略拒绝未经授权的用户访问可确保只有特定 IAM 角色才能访问数据。这两项措施共同为 S3 中存储的敏感数据提供强大的安全控制。

To secure sensitive financial data in an Amazon S3 bucket, encryption is required to protect the data at rest (achieved using SSE-KMS). Access must be restricted to specific employees, which can be implemented using IAM policies. Finally, access logs are essential for audit purposes, which can be enabled with S3 Server Access Logging or AWS CloudTrail. These controls together meet the company's security requirements.

为了保护 Amazon S3 存储桶中的敏感财务数据，需要加密来保护静态数据（使用 SSE-KMS 实现）。访问权限必须仅限于特定员工，这可以使用 IAM 策略来实现。最后，访问日志对于审计目的至关重要，可以通过 S3 服务器访问日志记录或 AWS CloudTrail 来启用。这些控制措施共同满足公司的安全要求。

To ensure high availability, fault tolerance, and scalability for the application, the backend should be deployed on EC2 instances behind an ALB with Auto Scaling. This setup handles traffic spikes and provides fault tolerance. For the database, Amazon RDS with Multi-AZ deployment ensures high availability, data durability, and seamless failover, aligning with the company's requirements.

为了确保应用程序的高可用性、容错性和可扩展性，后端应部署在具有 Auto Scaling 功能的 ALB 后面的 EC2 实例上。此设置可以处理流量峰值并提供容错能力。对于数据库，采用多可用区部署的 Amazon RDS 可确保高可用性、数据持久性和无缝故障转移，符合公司的要求。

The correct answer is 'Enable Sticky Sessions (Session Affinity) on the ALB' because this feature ensures that user requests are consistently routed to the same target during their session, providing seamless session handling for the e-commerce website. Other options, while useful for different purposes, do not address the need for maintaining user sessions.

正确的答案是“在 ALB 上启用粘性会话（会话亲和性）”，因为此功能可确保用户请求在会话期间一致路由到同一目标，从而为电子商务网站提供无缝会话处理。其他选项虽然可用于不同的目的，但不能满足维护用户会话的需要。

The root cause of the issue is that files with the same name are being overwritten in the S3 bucket. Adding a timestamp or unique identifier to the file names ensures uniqueness and prevents overwrites. While S3 versioning can retain older versions of files, it does not stop overwrites from occurring, and other options like encryption or Lifecycle policies do not directly address the problem of naming conflicts.

该问题的根本原因是 S3 存储桶中的同名文件被覆盖。向文件名添加时间戳或唯一标识符可确保唯一性并防止覆盖。虽然 S3 版本控制可以保留旧版本的文件，但它并不能阻止覆盖的发生，并且加密或生命周期策略等其他选项不能直接解决命名冲突问题。

Configuring a target tracking scaling policy based on CPU utilization allows the Auto Scaling group to dynamically and automatically scale in or out depending on the current workload. This approach ensures that the web application can handle sudden traffic spikes while maintaining cost efficiency, as instances are added or removed only when necessary. The other options either lead to higher costs, miss critical application-level functionality, or require manual intervention, which is not ideal for scalability and high availability.

根据 CPU 利用率配置目标跟踪扩展策略，可以让 Auto Scaling 组根据当前工作负载动态自动扩展或扩展。这种方法确保 Web 应用程序可以处理突然的流量峰值，同时保持成本效率，因为仅在必要时添加或删除实例。其他选项要么导致更高的成本，错过关键的应用程序级功能，要么需要手动干预，这对于可扩展性和高可用性来说并不理想。

To meet the requirements of restricting access to specific IAM users and ensuring all access requests are logged, you need to implement an S3 bucket policy to manage access permissions, enable S3 server access logging for detailed bucket access logs, and enable AWS CloudTrail to capture API-level logs for auditing. These steps ensure data governance and security while meeting auditing requirements.

为了满足限制特定 IAM 用户的访问并确保记录所有访问请求的要求，您需要实施 S3 存储桶策略来管理访问权限，启用 S3 服务器访问日志记录详细的存储桶访问日志，并启用 AWS CloudTrail 捕获 API 级日志进行审计。这些步骤可确保数据治理和安全性，同时满足审计要求。

To meet the requirements, the company should implement an S3 bucket policy to restrict access to specific IAM roles, use S3 Server Access Logging to track all access requests, and enable AWS CloudTrail to log API calls to the bucket. These combined approaches ensure both access control and comprehensive auditing capabilities.

为了满足要求，公司应实施 S3 存储桶策略来限制对特定 IAM 角色的访问，使用 S3 服务器访问日志记录来跟踪所有访问请求，并启用 AWS CloudTrail 记录对存储桶的 API 调用。这些组合方法确保了访问控制和全面的审核功能。

To meet the requirements, the company needs to restrict access to the sensitive data and ensure all access requests are logged. A bucket policy restricting access to specific IAM users and roles satisfies the access control requirement. Enabling AWS CloudTrail fulfills the logging requirement by capturing all API requests made to the bucket. Other options, such as S3 Server Access Logging and Amazon Macie, are useful for other purposes but do not address both access control and logging requirements in this scenario.

为了满足要求，公司需要限制对敏感数据的访问并确保记录所有访问请求。限制对特定 IAM 用户和角色的访问的存储桶策略满足访问控制要求。启用 AWS CloudTrail 通过捕获对存储桶发出的所有 API 请求来满足日志记录要求。其他选项（例如 S3 服务器访问日志记录和 Amazon Macie）可用于其他目的，但不能同时满足此场景中的访问控制和日志记录要求。

To meet compliance requirements for data access and governance in Amazon S3, you need a combination of access control, monitoring, and auditing solutions. S3 Bucket Policies provide fine-grained access control, CloudTrail enables monitoring of API activity, and AWS Config ensures that any changes to the S3 bucket's configuration are tracked and can trigger alerts for non-compliance. S3 Versioning and unrestricted IAM role policies are not suitable solutions for this scenario.

To meet compliance requirements for data access and governance in Amazon S3, you need a combination of access control, monitoring, and auditing solutions. S3 Bucket Policies provide fine-grained access control, CloudTrail enables monitoring of API activity, and AWS Config ensures that any changes to the S3 bucket's configuration are tracked and can trigger alerts for non-compliance. S3 版本控制和无限制的 IAM 角色策略不适合此场景的解决方案。

The most effective solution for data recovery in this scenario is to enable RDS automated backups, which allow point-in-time recovery to restore the database to a specific state before accidental deletion or corruption. Manual snapshots provide an additional layer of protection by allowing the user to create backups at specific times.

在这种情况下，最有效的数据恢复解决方案是启用 RDS 自动备份，它允许时间点恢复将数据库恢复到意外删除或损坏之前的特定状态。手动快照允许用户在特定时间创建备份，从而提供额外的保护层。

To ensure data recovery for an Amazon RDS database, enabling automated backups and point-in-time recovery are critical as they allow you to restore the database to a state before any accidental deletion. Manual snapshots provide an additional backup option for specific points in time. Multi-AZ deployment does not address recovery from logical errors, and while exporting data to Amazon S3 may assist in long-term storage, it is not the most effective solution for immediate recovery scenarios.

为了确保 Amazon RDS 数据库的数据恢复，启用自动备份和时间点恢复至关重要，因为它们允许您将数据库恢复到任何意外删除之前的状态。手动快照为特定时间点提供了额外的备份选项。多可用区部署并不能解决逻辑错误的恢复问题，虽然将数据导出到 Amazon S3 可能有助于长期存储，但它并不是立即恢复场景的最有效解决方案。

By enabling Multi-AZ deployment for Amazon RDS, the company ensures that the database can fail over to a standby instance in a different Availability Zone during an outage, minimizing downtime and data loss. Additionally, configuring EC2 Auto Scaling across multiple Availability Zones ensures the application remains highly available even if an Availability Zone becomes unavailable. These actions together improve the company's data recovery and high availability strategy in line with AWS best practices.

通过为 Amazon RDS 启用多可用区部署，该公司确保数据库可以在中断期间故障转移到不同可用区中的备用实例，从而最大限度地减少停机时间和数据丢失。此外，跨多个可用区配置 EC2 Auto Scaling 可确保即使某个可用区不可用，应用程序仍保持高可用性。这些行动共同改进了公司的数据恢复和高可用性策略，符合 AWS 最佳实践。

The best solution to ensure minimal downtime and data loss in case of a Region-wide disaster is to create a cross-Region read replica for the RDS database. This allows the company to quickly promote the replica to a primary database in the event of a disaster, ensuring business continuity. Other options, such as Multi-AZ deployments or same-Region read replicas, do not address cross-Region requirements, while restoring from snapshots can lead to significant downtime and data loss.

确保在发生区域范围灾难时最大限度地减少停机时间和数据丢失的最佳解决方案是为 RDS 数据库创建跨区域只读副本。这使得公司能够在发生灾难时快速将副本升级为主数据库，确保业务连续性。其他选项（例如多可用区部署或同区域只读副本）无法满足跨区域要求，而从快照还原可能会导致严重的停机和数据丢失。

The company needs a solution that balances cost-effectiveness, durability, encryption, and compliance with a 7-year retention policy. Amazon S3 Glacier Deep Archive is the ideal storage class for long-term retention of infrequently accessed data due to its low cost and high durability. By using a lifecycle policy, the company can transition the data from the default S3 storage class to Glacier Deep Archive after the initial 30-day period of higher access frequency, reducing costs while meeting regulatory and security requirements.

该公司需要一种能够平衡成本效益、耐用性、加密和遵守 7 年保留政策的解决方案。 Amazon S3 Glacier Deep Archive 因其低成本和高耐用性而成为长期保留不经常访问的数据的理想存储类别。通过使用生命周期策略，该公司可以在最初 30 天的较高访问频率后将数据从默认的 S3 存储类别迁移到 Glacier Deep Archive，从而降低成本，同时满足监管和安全要求。

To meet the company's data retention requirements, Amazon S3 Standard can be used for the first year to ensure easy accessibility. After the first year, transitioning to S3 Glacier Flexible Retrieval using an S3 Lifecycle policy is the optimal solution as it balances cost-efficiency and retrieval times in hours, fulfilling both compliance and business needs. Other options either fail to meet the retrieval time requirement or are not cost-effective for long-term storage.

为了满足公司的数据保留要求，第一年可以使用 Amazon S3 标准，以确保易于访问。第一年后，使用 S3 生命周期策略过渡到 S3 Glacier 灵活检索是最佳解决方案，因为它可以平衡成本效率和以小时为单位的检索时间，满足合规性和业务需求。其他选项要么无法满足检索时间要求，要么对于长期存储来说不具有成本效益。

To meet the 7-year compliance requirement, the company needs to ensure that the data cannot be deleted or modified for the entire retention period. S3 Object Lock in Compliance mode is specifically designed for this purpose, as it enforces a write-once-read-many (WORM) model that prevents any changes to the data until the retention period expires. Other options, while useful for cost optimization or additional security, do not provide the necessary compliance guarantees.

为了满足 7 年的合规要求，公司需要确保数据在整个保留期内不能被删除或修改。合规模式下的 S3 对象锁定专门为此目的而设计，因为它强制执行一次写入多次读取 (WORM) 模型，可防止在保留期到期之前对数据进行任何更改。其他选项虽然对于成本优化或额外的安全性有用，但不提供必要的合规性保证。

To meet both data retention and classification requirements for compliance, Amazon S3 with Object Lock in compliance mode is the best solution. It ensures that data cannot be altered or deleted during the specified retention period. Additionally, S3 bucket policies can enforce strict access controls to support classification needs, making this solution suitable for sensitive financial data.

为了满足合规性的数据保留和分类要求，合规模式下具有对象锁定的 Amazon S3 是最佳解决方案。它确保数据在指定的保留期内不会被更改或删除。此外，S3 存储桶策略可以实施严格的访问控制来支持分类需求，使该解决方案适合敏感的财务数据。

The company needs a solution that ensures encryption at rest and gives them full control over the encryption keys to comply with regulations. S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and customer-managed keys meets these requirements by allowing the company to manage their own keys while leveraging AWS KMS for secure key storage, rotation, and auditing.

该公司需要一种解决方案，确保静态加密并让他们完全控制加密密钥以遵守法规。使用 AWS Key Management Service (SSE-KMS) 和客户管理密钥的 S3 服务器端加密满足了这些要求，允许公司管理自己的密钥，同时利用 AWS KMS 进行安全密钥存储、轮换和审核。

The company needs a solution that ensures encryption at rest and supports automatic key rotation with minimal operational overhead. SSE-KMS leverages AWS Key Management Service (KMS) to manage encryption keys, providing features like automatic key rotation and centralized management, making it the best choice for this scenario.

该公司需要一种解决方案，确保静态加密并支持自动密钥轮换，同时将运营开销降至最低。 SSE-KMS 利用 AWS Key Management Service (KMS)来管理加密密钥，提供密钥自动轮换、集中管理等功能，是该场景的最佳选择。

The company requires full control over encryption keys, including management and rotation, which is only possible with client-side encryption. This approach puts the responsibility for encryption and decryption entirely on the company, ensuring they retain full control over the keys. Other server-side encryption options, such as SSE-S3, SSE-KMS, and SSE-C, either rely on AWS-managed key infrastructure or do not provide full key management capabilities.

该公司要求完全控制加密密钥，包括管理和轮换，这只有通过客户端加密才能实现。这种方法将加密和解密的责任完全交给公司，确保他们保留对密钥的完全控制。其他服务器端加密选项（例如 SSE-S3、SSE-KMS 和 SSE-C）要么依赖于 AWS 托管的密钥基础设施，要么不提供完整的密钥管理功能。

The company requires complete control over encryption keys for data stored in Amazon S3 and encryption for data in transit. Option 3 (SSE-C) allows the company to manage their own encryption keys while AWS handles encryption and decryption. Option 4 (client-side encryption) also meets the requirements by allowing the company to encrypt data using their own keys before uploading it to S3. Both solutions combine with SSL/TLS to secure data in transit, fully meeting the requirements. Other options either do not provide full key control or violate encryption requirements.

该公司要求完全控制存储在 Amazon S3 中的数据的加密密钥以及传输中数据的加密。选项 3 (SSE-C) 允许公司管理自己的加密密钥，同时 AWS 处理加密和解密。选项 4（客户端加密）也满足要求，允许公司在将数据上传到 S3 之前使用自己的密钥对其进行加密。这两种解决方案都与 SSL/TLS 相结合来保护传输中的数据，完全满足要求。其他选项要么不提供完整的密钥控制，要么违反加密要求。

To design a resilient architecture, you must distribute resources across multiple Availability Zones to ensure high availability and fault tolerance. Deploying EC2 instances across multiple zones, enabling Multi-AZ for RDS, and using an Auto Scaling group that spans multiple zones ensures that your application can handle failures in a single Availability Zone and remain operational.

要设计弹性架构，您必须跨多个可用区分配资源，以确保高可用性和容错能力。跨多个区域部署 EC2 实例、为 RDS 启用多可用区并使用跨多个区域的 Auto Scaling 组可确保您的应用程序可以处理单个可用区中的故障并保持运行。

To design a resilient architecture, it is critical to avoid single points of failure. By deploying EC2 instances in multiple Availability Zones and using the Application Load Balancer to distribute traffic, the application can continue to serve requests even if one Availability Zone becomes unavailable. This approach ensures high availability and fault tolerance, which are key principles of resilient architecture design.

要设计弹性架构，避免单点故障至关重要。通过在多个可用区部署 EC2 实例并使用 Application Load Balancer 分配流量，即使一个可用区不可用，应用程序也可以继续服务请求。这种方法确保了高可用性和容错能力，这是弹性架构设计的关键原则。

To improve the resilience of the architecture without redesigning the application, enabling sticky sessions (session affinity) on the Application Load Balancer ensures that user requests are consistently routed to the same EC2 instance, preserving session data and avoiding disruptions during failover. This solution aligns with the requirement to maintain session persistence while enhancing resilience.

为了在不重新设计应用程序的情况下提高架构的弹性，在 Application Load Balancer 上启用粘性会话（会话亲和性）可确保用户请求一致路由到同一 EC2 实例，保留会话数据并避免故障转移期间的中断。该解决方案符合维持会话持久性同时增强弹性的要求。

To achieve high availability and fault tolerance, EC2 instances must be deployed in multiple Availability Zones, and Auto Scaling should be configured to span these zones. This ensures that the application remains operational even if an entire Availability Zone experiences a failure. The Application Load Balancer will route traffic to healthy instances in other zones as needed.

为了实现高可用性和容错能力，EC2 实例必须部署在多个可用区中，并且应将 Auto Scaling 配置为跨这些可用区。这可以确保即使整个可用区出现故障，应用程序也能保持运行。 Application Load Balancer 将根据需要将流量路由到其他区域中的健康实例。

To design a scalable and loosely coupled architecture, the combination of Amazon RDS with Multi-AZ, EC2 Auto Scaling, ELB, and Amazon SQS ensures high availability, fault tolerance, and the ability to handle unpredictable traffic spikes. These services work together to minimize operational overhead, decouple components, and provide a robust solution for the web application. Amazon EFS, while useful in other scenarios, is not relevant for this specific use case.

为了设计可扩展且松散耦合的架构，Amazon RDS 与多可用区、EC2 Auto Scaling、ELB 和 Amazon SQS 的组合可确保高可用性、容错性以及处理不可预测的流量峰值的能力。这些服务协同工作，最大限度地减少运营开销、解耦组件，并为 Web 应用程序提供强大的解决方案。 Amazon EFS 虽然在其他场景中有用，但与此特定用例无关。

To design a scalable and loosely coupled architecture, it is crucial to decouple components using services like Amazon SQS, configure Auto Scaling for dynamic capacity management, and ensure high availability for critical components like the database using Multi-AZ deployments. These measures allow the application to efficiently handle unpredictable traffic patterns while minimizing downtime and fostering loose coupling between components.

要设计可扩展且松散耦合的架构，至关重要的是使用 Amazon SQS 等服务解耦组件，配置 Auto Scaling 进行动态容量管理，并使用多可用区部署确保数据库等关键组件的高可用性。这些措施使应用程序能够有效地处理不可预测的流量模式，同时最大限度地减少停机时间并促进组件之间的松散耦合。

To create a scalable and loosely coupled architecture, using Amazon CloudFront reduces latency for static content, while Amazon SQS decouples services to handle traffic spikes more effectively. Deploying the application across multiple AWS Regions with Route 53 ensures fault tolerance and low-latency DNS routing for global users. These elements work together to meet the company's requirements for scalability, fault tolerance, and loose coupling.

为了创建可扩展且松散耦合的架构，使用 Amazon CloudFront 可以减少静态内容的延迟，而 Amazon SQS 可以解耦服务以更有效地处理流量峰值。使用 Route 53 跨多个 AWS 区域部署应用程序可确保为全球用户提供容错和低延迟 DNS 路由。这些元素协同工作以满足公司对可扩展性、容错性和松散耦合的要求。

To meet the application's requirements for high availability, low latency, and the ability to handle traffic spikes, a combination of Amazon CloudFront for content delivery, Application Load Balancer with Auto Scaling for traffic management, and AWS Global Accelerator for global performance improvements is ideal. These services work together to ensure the application is resilient, responsive, and scalable.

为了满足应用程序对高可用性、低延迟和处理流量峰值的要求，用于内容交付的 Amazon CloudFront、用于流量管理的具有自动缩放功能的 Application Load Balancer 和用于全局性能改进的 AWS Global Accelerator 的组合是理想的选择。这些服务协同工作以确保应用程序具有弹性、响应能力和可扩展性。

Using Amazon RDS Read Replicas is the most effective solution for handling read-heavy traffic during peak times without significant application changes. Read replicas provide additional read capacity, which can reduce latency and improve performance without needing to scale the primary database instance vertically or migrate to a different database technology.

使用 Amazon RDS 只读副本是在高峰时段处理读取大量流量且无需进行重大应用程序更改的最有效解决方案。只读副本提供额外的读取容量，可以减少延迟并提高性能，而无需垂直扩展主数据库实例或迁移到不同的数据库技术。

The architecture relies on fault tolerance and high availability to meet business needs. Enabling S3 Versioning ensures data protection, Auto Scaling handles traffic spikes, deploying EC2 instances across multiple AZs adds redundancy, and enabling Cross-Region Replication ensures disaster recovery. These features together reduce operational overhead and enhance the system's resilience.

该架构依靠容错和高可用性来满足业务需求。启用 S3 版本控制可确保数据保护，Auto Scaling 可处理流量高峰，跨多个可用区部署 EC2 实例可增加冗余，启用跨区域复制可确保灾难恢复。这些功能共同减少了运营开销并增强了系统的弹性。

Amazon CloudFront is designed to improve performance by caching content at edge locations closer to users. This reduces latency for downloading files, especially when users are geographically distributed. The other options either address different problems (e.g., disaster recovery) or are not optimal for this specific use case.

Amazon CloudFront 旨在通过在更靠近用户的边缘位置缓存内容来提高性能。这可以减少下载文件的延迟，特别是当用户分布在不同的地理位置时。其他选项要么解决不同的问题（例如灾难恢复），要么对于该特定用例来说不是最佳选择。

Amazon API Gateway is a managed service designed for creating, publishing, and managing RESTful APIs. It integrates seamlessly with AWS IAM to provide robust authentication and authorization mechanisms. This makes it the best choice for creating a secure, serverless REST API that interacts with services such as DynamoDB. Using other services like EC2 or ALB would require additional effort and would not align with the intended serverless architecture.

Amazon API Gateway 是一项托管服务，旨在创建、发布和管理 RESTful API。它与 AWS IAM 无缝集成，提供强大的身份验证和授权机制。这使其成为创建与 DynamoDB 等服务交互的安全、无服务器 REST API 的最佳选择。使用 EC2 或 ALB 等其他服务需要额外的工作，并且不符合预期的无服务器架构。

Amazon API Gateway is designed to expose REST APIs in a scalable and cost-efficient manner. Combined with AWS Lambda, it allows you to handle backend logic without provisioning servers. AWS IAM enables fine-grained access control for API methods, ensuring security. API Gateway also integrates with CloudWatch for logging and monitoring, meeting all the requirements of scalability, security, and auditing.

Amazon API Gateway 旨在以可扩展且经济高效的方式公开 REST API。与 AWS Lambda 结合使用，您可以在不配置服务器的情况下处理后端逻辑。 AWS IAM 能够对 API 方法进行细粒度的访问控制，保证安全性。 API Gateway 还与 CloudWatch 集成以进行日志记录和监控，满足可扩展性、安全性和审计的所有要求。