60 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended AWS Solutions Architect Associate resources →
You deliver static S3 content through CloudFront and must prevent users from accessing S3 directly. Which design is appropriate?
Answer: Block public S3 access and allow reads only from CloudFront OAC
OAC and a bucket policy allow CloudFront to retrieve content while the S3 bucket remains private.
Operators in another AWS account need temporary monitoring access to production. Which approach avoids sharing long-term access keys?
Answer: Allow them to assume an IAM role with an appropriate trust policy
Cross-account IAM roles are a standard way to grant least-privilege access with temporary credentials.
ECS tasks need database credentials that must not be embedded in code and should rotate periodically. Which design is appropriate?
Answer: Store them in Secrets Manager and grant the task role only the required retrieval permission
Secrets Manager with an ECS task role supports controlled retrieval and rotation without embedding secrets in images.
Sensitive S3 data must use a customer-managed key with separate key administrators and data users. Which service is central?
Answer: AWS KMS
KMS customer-managed keys support separation of key administration and cryptographic use through key policies and IAM.
You want to protect a public web application from SQL injection and known malicious request patterns in front of an ALB. Which service should you use?
Answer: AWS WAF
AWS WAF inspects and controls HTTP/HTTPS requests using web ACLs and managed rules.
EC2 instances in private subnets need S3 access without traversing the internet or a NAT Gateway. Which option is appropriate?
Answer: A Gateway VPC Endpoint for S3
Associating an S3 Gateway Endpoint with route tables provides S3 connectivity over the AWS network.
A web application must continue during a single-AZ failure. Which EC2-tier design is appropriate?
Answer: Place a multi-AZ Auto Scaling group behind an ALB
An ALB with a multi-AZ Auto Scaling group can continue routing traffic to healthy instances in available AZs.
You need higher availability for RDS for MySQL with automatic failover after primary failure. Which option is appropriate?
Answer: Multi-AZ deployment
RDS Multi-AZ maintains a synchronous standby and provides automatic failover.
You need to decouple an order API from downstream work and absorb temporary delays or failures. Which design is appropriate?
Answer: Use an SQS queue with a DLQ and asynchronous workers
SQS decouples intake from processing, while a DLQ isolates messages that repeatedly fail.
A web application runs in two Regions, and DNS should switch to the standby only when the primary Region fails. Which option is appropriate?
Answer: Route 53 failover routing with health checks
Failover routing defines primary and secondary records and switches responses based on health checks.
Critical S3 objects must be replicated to another Region for regional disaster recovery. Which feature is required?
Answer: Enable Versioning and configure Cross-Region Replication
S3 replication requires Versioning. CRR replicates objects to a bucket in another Region.
You need low-latency global delivery of images from S3 while reducing origin load. Which service is appropriate?
Answer: CloudFront
CloudFront uses edge caches to deliver content with low latency and reduce requests to S3.
A DynamoDB workload has very frequent reads of the same data and requires microsecond response times. Which service should be considered?
Answer: DynamoDB Accelerator (DAX)
DAX is a DynamoDB-compatible in-memory cache that accelerates read-heavy workloads.
Linux EC2 instances across multiple AZs need a concurrently mounted shared file system that scales capacity automatically. Which service is appropriate?
Answer: Amazon EFS
EFS is a managed NFS file system for multiple Linux clients, supporting multi-AZ access and elastic capacity.
You need to ingest real-time events from many devices and feed multiple processing consumers. Which service is appropriate?
Answer: Amazon Kinesis Data Streams
Kinesis Data Streams ingests high-throughput streaming data for processing by multiple consumers.
Aurora read traffic is growing. You need to scale reads horizontally without changing the writer. Which option is appropriate?
Answer: Add Aurora Replicas and use the reader endpoint
Aurora Replicas and the reader endpoint distribute read connections across replicas.
S3 logs become rarely accessed after 30 days and must be deleted after seven years. Which feature supports cost optimization?
Answer: Use S3 Lifecycle to transition storage classes and expire objects
S3 Lifecycle automates storage-class transitions and deletion after the required retention period.
Steady compute usage across EC2 and Fargate is expected for more than a year, while flexibility across instance choices is desired. Which pricing option is appropriate?
Answer: Compute Savings Plans
Compute Savings Plans discount eligible EC2, Fargate, and Lambda usage in exchange for a consistent spend commitment.
An image metadata update runs only a few times per day and finishes in seconds. You want to avoid paying for idle servers. Which option is appropriate?
Answer: Event-driven AWS Lambda
For short, infrequent event processing, Lambda usage-based billing avoids idle server cost.
A private-subnet data workload frequently accesses S3, causing rising NAT Gateway processing charges. Which improvement is appropriate?
Answer: Use an S3 Gateway VPC Endpoint
An S3 Gateway Endpoint keeps S3 traffic off the NAT Gateway, providing private access while reducing NAT processing cost.
An app on EC2 must access S3. What is the most secure way to provide credentials?
Answer: Attach an IAM role to the EC2 instance
An IAM role supplies and rotates temporary credentials automatically, avoiding embedded long-lived keys.
You need stateless allow/deny rules at the subnet level. Which feature fits?
Answer: Network ACL (NACL)
NACLs apply stateless allow/deny at the subnet boundary; security groups are stateful and instance-level.
You must encrypt data at rest and centrally manage and rotate keys. Which service fits?
Answer: AWS KMS
KMS creates, manages, and rotates encryption keys and integrates with many services such as S3 and EBS.
You want to store DB credentials securely with automatic rotation. Which service fits?
Answer: AWS Secrets Manager
Secrets Manager stores secrets encrypted and can automatically rotate credentials for supported databases.
Which is the recommended baseline principle for IAM permission design?
Answer: Grant only the minimum permissions needed (least privilege)
Following least privilege, granting only required actions limits the blast radius of any compromise.
You want higher RDS availability during maintenance or failures. Which configuration fits?
Answer: Enable a Multi-AZ deployment
Multi-AZ keeps a standby in another AZ and fails over automatically, improving availability.
You want EC2 capacity to scale automatically with load. Which service fits?
Answer: An Auto Scaling group
Auto Scaling adjusts instance count by metrics or schedule, balancing availability and cost efficiency.
You want to distribute traffic across EC2 instances and remove unhealthy ones. Which service fits?
Answer: Elastic Load Balancing (ELB)
ELB distributes load to healthy targets based on health checks, improving availability.
In Route 53 you want automatic switching to a standby when the primary is down. Which feature fits?
Answer: Failover routing using health checks
Failover routing uses health-check results to switch to the secondary automatically on failure.
You want to decouple components and buffer sudden request spikes. Which service fits?
Answer: Amazon SQS
SQS holds messages in a queue, decoupling producers and consumers and absorbing load spikes.
For a read-heavy app, you want to reduce DB load and speed up responses. Which service fits?
Answer: Amazon ElastiCache
ElastiCache (Redis/Memcached) serves frequent data from in-memory cache, reducing database load.
You want low-latency delivery of content to global users. Which service fits?
Answer: Amazon CloudFront
CloudFront caches and serves content from edge locations near users for low latency.
You want to scale read traffic on RDS. Which approach fits?
Answer: Add read replicas
Read replicas offload read queries, scaling read-heavy workloads.
You want faster uploads of large files to S3 from distant regions. Which feature fits?
Answer: S3 Transfer Acceleration
Transfer Acceleration routes uploads through optimized CloudFront edge paths to speed long-distance transfers.
When you need very high, consistent IOPS beyond gp3, which EBS volume type fits?
Answer: Provisioned IOPS SSD (io1/io2)
io1/io2 let you provision the exact IOPS needed, suited to databases demanding high, steady IOPS.
You want the lowest cost for interruptible, restartable batch jobs. Which purchase option fits?
Answer: Spot Instances
Spot uses spare capacity at deep discounts but can be interrupted, ideal for fault-tolerant workloads.
You want a discount on steady EC2/Fargate usage while keeping flexibility. Which fits?
Answer: Savings Plans
Savings Plans give discounts for committing to a usage amount, applying flexibly across instance types.
You want old logs to move automatically to cheaper archival storage after a period. Which feature fits?
Answer: S3 lifecycle rules
Lifecycle rules transition objects to Glacier or expire them after a period, optimizing storage cost.
You want to optimize storage cost for data with unpredictable access, without operational effort. Which storage class fits?
Answer: S3 Intelligent-Tiering
Intelligent-Tiering moves objects between tiers automatically based on access, optimizing cost without manual work.
You want to control NAT egress cost from private subnets while keeping availability. Which approach fits?
Answer: Use NAT Gateway and route S3 and similar traffic through a VPC gateway endpoint
Gateway endpoints keep S3/DynamoDB traffic off NAT, cutting data-processing charges, while NAT Gateway stays highly available.
In AWS Organizations, you want to set an organization-wide permissions ceiling that prevents administrators in member accounts from using services outside approved Regions. Which approach is appropriate?
Answer: Apply a service control policy (SCP) to the target OU to restrict the prohibited actions
An SCP defines the maximum available permissions for an organization, OU, or account. It does not grant permissions, and an action denied by an SCP remains unavailable even when an IAM policy in a member account allows it.
Audit logs must be retained in Amazon S3 for seven years in WORM form so that nobody, including the root user, can overwrite or delete them during retention. Which configuration meets the requirement?
Answer: Configure S3 Object Lock in Compliance mode with a retention period
S3 Object Lock in Compliance mode protects object versions using a WORM model and prevents overwrites or deletion, even by the root user, until retention expires. Versioning alone does not prevent a sufficiently privileged user from permanently deleting versions.
To recover even if the production account is compromised, backups must be stored regularly in another AWS account and Region with centralized operations. Which architecture is appropriate?
Answer: Use an AWS Backup plan to copy recovery points to a backup vault in another account and Region
AWS Backup can copy recovery points for supported resources from a backup plan to vaults in another account or Region. Separating both the failure domain and administrative boundary improves resilience against Regional failures and production-account compromise.
Global users connect to a TCP application. You need static global IP addresses and want traffic to enter the AWS global network at an edge location near each user to improve latency. Which service fits?
Answer: AWS Global Accelerator
AWS Global Accelerator provides static anycast IP addresses and brings TCP/UDP traffic onto the AWS global network at an edge near the user, routing it to an optimal healthy Regional endpoint.
For many EC2 instances, you want automated rightsizing recommendations based on historical utilization metrics while also considering performance risk. Which service is appropriate?
Answer: AWS Compute Optimizer
Compute Optimizer analyzes resource configurations and CloudWatch utilization metrics to recommend rightsizing for resources such as EC2 while showing cost and performance-risk considerations. Business requirements and peak demand should still be reviewed before changes.
You want to route events from multiple AWS services and custom applications by event content to Lambda, SQS, and processors in another account while keeping components loosely coupled. Which service is appropriate?
Answer: An Amazon EventBridge event bus and rules
An EventBridge event bus receives events from multiple sources and uses pattern-matching rules to deliver them to targets. Producers do not need direct knowledge of consumers, making it suitable for loosely coupled event-driven architectures.
An order workflow must run inventory checks, payment, and shipping requests in sequence, with retries and alternate branches when steps fail. Which serverless service can visualize and orchestrate this workflow?
Answer: AWS Step Functions
Step Functions orchestrates distributed processing with state machines and declaratively supports sequencing, parallel execution, branches, Retry, and Catch behavior. It also tracks execution state, reducing coordination logic embedded in individual services.
You need to connect hundreds of VPCs and on-premises networks without building a large mesh of VPC peering connections, and you want centralized routing and segmentation. Which service is appropriate?
Answer: AWS Transit Gateway
Transit Gateway is a Regional transit hub connecting VPCs, VPNs, Direct Connect gateways, and other attachments. Its attachments and route tables centralize connectivity and segmentation more effectively than a full mesh of peering connections.
Short-lived connections from Lambda functions to Amazon RDS surge unpredictably, causing connection-limit and connection-establishment overhead. Which approach improves this with minimal application changes?
Answer: Use Amazon RDS Proxy to pool and reuse database connections
RDS Proxy accepts application connections and pools underlying database connections for reuse across clients. For bursty workloads such as Lambda, it reduces connection-establishment overhead and protects the database from connection oversubscription.
For an Aurora-compatible database with unpredictable demand, you want capacity to scale up and down in fine increments and reduce overprovisioning during idle periods. Which option is appropriate?
Answer: Aurora Serverless v2 with an appropriate minimum and maximum ACU range
Aurora Serverless v2 adjusts capacity in fine increments within a configured minimum and maximum ACU range based on load such as CPU, memory, and network usage. This helps capacity follow variable demand and reduces overprovisioning.
Users from a corporate identity provider need single sign-on access to multiple accounts in AWS Organizations. You want centralized job-based permissions without creating IAM users in every account. Which approach is appropriate?
Answer: Federate the IdP with IAM Identity Center and assign permission sets to the accounts
IAM Identity Center federates with an external IdP and centrally assigns permission sets to users and groups across AWS accounts. Corresponding IAM roles and temporary credentials are used in each account.
EC2 instances in private subnets have neither internet access nor a NAT Gateway. They must privately call the Secrets Manager API. Which configuration is appropriate?
Answer: Create an interface VPC endpoint for Secrets Manager and enable private DNS
An interface VPC endpoint powered by AWS PrivateLink lets EC2 reach the Secrets Manager API through private IP addresses. Private DNS maps the normal service hostname to the endpoint.
You want a managed service to continuously analyze sources such as CloudTrail, VPC Flow Logs, and DNS logs to detect compromised credentials and suspicious network activity. Which service is appropriate?
Answer: Amazon GuardDuty
GuardDuty uses AWS log sources, threat intelligence, and machine learning to identify threats such as credential compromise, anomalous API activity, malware, and suspicious network behavior.
You need to automatically discover objects that may contain personal information or credentials across many S3 buckets and understand where sensitive data resides. Which service is appropriate?
Answer: Amazon Macie
Macie evaluates S3 objects to discover and classify sensitive data such as personal, financial, and credential information. It also provides visibility and aggregated findings across buckets.
You need HTTPS for a website behind an Application Load Balancer and want to minimize public certificate renewal work. Which approach is appropriate?
Answer: Issue a public certificate in ACM and attach it to the ALB HTTPS listener
When an ACM public certificate is used with an integrated service such as an ALB, ACM manages renewal while validation requirements remain satisfied. TLS termination is centralized at the ALB, avoiding per-instance certificate distribution.
A large business system needs cross-Region disaster recovery with an RTO and RPO of minutes. A reduced but functional environment can run continuously in the recovery Region and scale to production size during a disaster. Which DR strategy fits?
Answer: Warm standby
Warm standby keeps a scaled-down but fully functional environment running in the recovery Region, then scales it out during failover. It can target RTO and RPO in minutes without the full steady-state cost of active/active.
Payment events are processed through a queue. Processing order must be preserved per customer, and duplicate processing from short-term retransmission must be prevented. Which configuration is appropriate?
Answer: Use an SQS FIFO queue with customer ID as MessageGroupId, plus deduplication IDs and idempotent processing
SQS FIFO preserves order within a MessageGroupId and provides deduplication. Consumer idempotency, such as recording payment IDs, is still required for exactly-once business effects across retries and failure boundaries.
Applications worldwide must read and write the same key-value data with low latency and continue in another Region if one Region fails. Which data store configuration is appropriate?
Answer: DynamoDB global tables with replicas in multiple Regions
DynamoDB global tables provide multi-Region, multi-active replication. Applications can read and write locally in each Region, supporting low global latency and continuity during a Regional failure.
Athena frequently aggregates several terabytes of access logs stored in S3 by date. Which improvement reduces both query time and bytes-scanned cost?
Answer: Convert to columnar Parquet, partition by date, and query only required columns and date ranges
Athena pricing is based on data scanned. Combining compressed columnar Parquet with date partition pruning avoids reading irrelevant columns and objects, improving performance and cost.
Multiple departments share one AWS account. You need monthly cost visibility by department, including shared resources, and notifications before budgets are exceeded. Which combination is appropriate?
Answer: Classify costs with cost allocation tags and Cost Categories, then use Cost Explorer and AWS Budgets for analysis and alerts
Activated cost allocation tags and Cost Categories classify spend by department and shared-cost rules. Cost Explorer analyzes trends, while AWS Budgets can notify when actual or forecast spend reaches thresholds.