AWS Practice Questions & Quiz

In AWS, which central service manages users and role permissions based on the principle of least privilege?

Answer: IAM

IAM manages users, groups, roles, and policies. In practice, using roles and avoiding long-term access keys is a basic design principle.

In AWS, which logically isolated network is used to place resources such as EC2 and RDS?

Answer: VPC

A VPC is where you design AWS networking with subnets, route tables, security groups, NACLs, and NAT Gateways.

In Amazon S3, which feature helps recover from accidental deletion or overwrites?

Answer: Versioning

S3 Versioning keeps multiple versions of an object, which helps with recovery from accidental deletion, overwrites, and some ransomware scenarios.

In AWS, which service records API activity for auditing?

Answer: CloudTrail

CloudTrail records API calls made in an AWS account and helps answer who did what during audits and investigations.

In AWS, which service is commonly used to collect metrics and logs and configure alarms?

Answer: CloudWatch

CloudWatch is used for monitoring with metrics, logs, alarms, and dashboards.

Which set is part of the AWS Well-Architected Framework pillars?

Answer: Security, Reliability, Performance Efficiency, Cost Optimization, Operational Excellence, Sustainability

The AWS Well-Architected Framework provides pillars for reviewing designs from operational, security, reliability, performance, cost, and sustainability perspectives.

In AWS, you want to launch a virtual server and manage the OS and middleware yourself. Which service is representative?

Answer: EC2

EC2 is AWS's virtual server service. You choose instance types, AMIs, storage, networking, security groups, and related settings.

In AWS, you want to run short pieces of code in response to events without managing servers. Which service is appropriate?

Answer: Lambda

Lambda runs functions serverlessly. It can be triggered by API Gateway, S3 events, schedules, and other event sources.

In AWS, you want to distribute web or API traffic across multiple EC2 instances or similar targets. Which service is representative?

Answer: Elastic Load Balancing

Elastic Load Balancing distributes traffic across multiple targets. Application Load Balancer is commonly used for web and API workloads.

Which AWS service is commonly used as a private registry for container images?

Answer: ECR

ECR, Elastic Container Registry, stores and manages container images. It is commonly used with ECS, EKS, and CI/CD pipelines.

In AWS, what is used to add metadata such as environment or owner to resources for search and cost allocation?

Answer: Tag

Tags are key-value metadata attached to AWS resources. They help organize environment, system name, owner team, and cost allocation.

An EC2 instance in a private subnet needs outbound internet access for package updates, but it must not be directly reachable from the internet. Which design is common?

Answer: Place a NAT Gateway in a public subnet and route the private subnet through it

A NAT Gateway is a typical way to provide outbound internet access from private subnets. Return traffic is allowed, but it is not used to accept new inbound connections from the internet.

A web API runs on EC2 instances across multiple Availability Zones. You want traffic routed only to healthy instances based on HTTP checks. What is appropriate?

Answer: Application Load Balancer target group health checks

Application Load Balancer is suitable for HTTP/HTTPS load balancing. Target group health checks can remove unhealthy targets from traffic routing.

An application uses RDS. The database should not be exposed to the internet, and only the application should connect to it. Which design is appropriate?

Answer: Place RDS in private subnets and allow only the application security group in the database security group

A common design places RDS in private subnets and uses security group references to allow access only from the application layer. Public reachability and credential handling should be considered separately.

You want to deliver static assets stored in S3 using a custom domain and HTTPS, with caching for users worldwide. Which service is central to this design?

Answer: CloudFront

CloudFront is a CDN that can deliver content from origins such as S3 through global edge locations. Custom domains, TLS certificates, and caching behavior are part of the design.

A CI system such as GitHub Actions deploys to AWS. You want to avoid long-term access keys in the repository and use temporary permissions. What approach is recommended?

Answer: Use OIDC federation to assume an IAM role

For CI/CD, OIDC federation with IAM role assumption helps avoid distributing long-term access keys. Trust policies and permission policies should be designed with least privilege.

You are designing a new web service on AWS. To keep the service running during a single Availability Zone failure, which basic approach is most appropriate?

Answer: Deploy the application across multiple AZs and use a load balancer plus Multi-AZ capable data stores

To tolerate a single-AZ failure, both application and data layers should be designed for multiple AZs. Load balancers, Auto Scaling, and RDS Multi-AZ are common building blocks.

An order API invokes email sending and inventory updates. You want a loosely coupled design so slow downstream processing is less likely to stop order intake. Which design is appropriate?

Answer: Place a queue such as SQS between components and process downstream work with asynchronous workers

A queue such as SQS separates intake from downstream processing. It helps with retries, buffering, and independently scaling workers.

You are designing disaster recovery for a production system. To judge whether RTO and RPO can be met, what should be clarified first?

Answer: The acceptable recovery time and the acceptable amount of data loss

In DR design, RTO and RPO are prerequisites for choosing a recovery approach. They directly influence choices such as backups, replication, and warm standby.

Internal reports are stored in S3 and should be viewable only through a specific application. Which design is appropriate to avoid a public bucket and restrict the access path?

Answer: Block S3 public access and allow only required paths such as an application IAM role or CloudFront OAC

S3 access should be designed with Block Public Access, bucket policies, IAM roles, and possibly CloudFront OAC. Obscure names are not access control.

You want to separate development, test, and production environments on AWS. Which design reduces accidental operations, mixed permissions, and unclear billing?

Answer: Separate accounts with AWS Organizations and govern them with OUs and SCPs

Separate accounts provide a strong boundary for environment separation. Organizations, OUs, SCPs, billing management, and IAM Identity Center help governance.

You want to continuously identify S3 buckets or IAM roles that can be accessed from outside your organization. Which service is appropriate?

Answer: IAM Access Analyzer

IAM Access Analyzer analyzes resource policies and identifies resources accessible from outside a defined zone of trust. It helps detect unintended external sharing.

You want to analyze AWS activity and network signals to detect suspicious credential use or possible cryptocurrency mining. Which service is appropriate?

Answer: Amazon GuardDuty

GuardDuty is a managed threat detection service that analyzes multiple AWS log and signal sources. Findings can be reviewed by severity and routed through services such as EventBridge.

You want to securely store an application database password and automate periodic rotation. Which service is most appropriate?

Answer: AWS Secrets Manager

Secrets Manager supports secret storage, controlled retrieval, encryption, and rotation. Applications should use IAM roles with access only to the required secrets.

You want to limit excessive requests to a public API by source while reducing impact on normal users. Which AWS WAF rule should you use?

Answer: Rate-based rule

AWS WAF rate-based rules count requests over a time window and can limit excessive traffic. Scope-down conditions should be designed to avoid blocking legitimate users unnecessarily.

You need to encrypt sensitive data, separate key users from key administrators, and audit key operations. Which service is central to this design?

Answer: AWS KMS

AWS KMS provides cryptographic key management and encryption operations. Key policies and IAM support separation of duties, while CloudTrail can audit key usage.

You want operational access to EC2 without exposing SSH to the internet, using auditable sessions. Which service feature is appropriate?

Answer: AWS Systems Manager Session Manager

Session Manager can connect to EC2 through SSM Agent and IAM permissions without bastions or public SSH, and session logging can be designed.

You want to regularly apply patches to EC2 and manage missing patches. Which AWS Systems Manager capability is used?

Answer: Patch Manager

Patch Manager applies patches to managed nodes, schedules patching, and checks compliance, often with maintenance windows.

You want to record AWS resource configuration history and continuously evaluate compliance with rules such as required encryption. Which service is appropriate?

Answer: AWS Config

AWS Config records resource configurations, tracks changes, and evaluates compliance using Config rules. CloudTrail records API activity.

You want to centrally manage backups for services such as EC2, EBS, and RDS using policies. Which service is appropriate?

Answer: AWS Backup

AWS Backup centrally manages backup plans, retention, and recovery points across multiple AWS services.

You want to route S3 object creation events to downstream processing such as Lambda or Step Functions in a decoupled way. Which service is central?

Answer: Amazon EventBridge

EventBridge routes events from AWS services and applications using rules to targets such as Lambda, Step Functions, and SQS.

You want to continuously detect known vulnerabilities in EC2, container images, and Lambda functions. Which service is appropriate?

Answer: Amazon Inspector

Amazon Inspector helps detect vulnerabilities in EC2, ECR images, and Lambda. Macie focuses mainly on sensitive data discovery in S3.

You want to automatically discover personal information or credential-like data stored in S3 to understand leakage risk. Which service is appropriate?

Answer: Amazon Macie

Amazon Macie uses machine learning and pattern matching to discover sensitive data in S3 and support data protection.

EC2 instances in private subnets need outbound internet access for updates, but should not accept direct inbound internet connections. Which design is common?

Answer: Route outbound traffic through a NAT Gateway in a public subnet

A NAT Gateway enables outbound access from private subnets while avoiding direct inbound reachability from the internet.

An application in a VPC should access S3 through AWS networking without using a NAT Gateway. What should you consider?

Answer: Gateway VPC Endpoint for S3

A Gateway VPC Endpoint for S3 keeps VPC-to-S3 traffic on AWS networking and can reduce NAT Gateway data processing costs.

You want to distribute HTTP/HTTPS traffic to web apps on multiple EC2 instances and route by path. Which service is appropriate?

Answer: Application Load Balancer

Application Load Balancer provides layer 7 load balancing with host/path routing, health checks, and TLS termination.

You want to manage multiple steps such as task A, approval wait, and task B, including retries on failure. Which service is appropriate?

Answer: AWS Step Functions

Step Functions defines workflows as state machines and coordinates tasks such as Lambda or ECS with branching, retries, and waits.

You need a shared file system that multiple EC2 instances can mount concurrently. Which service is commonly used for Linux workloads?

Answer: Amazon EFS

Amazon EFS is managed NFS file storage for multiple clients. EBS is primarily block storage for a single instance.

You want applications to store messages in a queue so consumers can process them later even if temporarily stopped. Which service is appropriate?

Answer: Amazon SQS

SQS is a message queue that decouples producers and consumers. SNS is mainly pub/sub notification fan-out.

You want to fan out the same notification to many subscribers such as email, SQS, and Lambda. Which service is appropriate?

Answer: Amazon SNS

SNS is a pub/sub service that delivers messages from topics to multiple subscribers and is often combined with SQS for fan-out.

Across multiple AWS accounts, you want to prohibit service use outside approved Regions and prevent account administrators from removing the restriction. What is the core control?

Answer: Apply an AWS Organizations SCP to the target OU and validate it in stages

An SCP defines the maximum available permissions for an organization, OU, or account. It does not grant permissions; an action must also be allowed by the relevant IAM policies.

You need to centralize activity history across many AWS accounts so a compromised workload account cannot delete the audit records. Which design is most appropriate?

Answer: Deliver an organization CloudTrail trail to S3 in a dedicated log archive account with separated access

An organization trail and a dedicated log archive account centralize member-account activity while separating workload administration from log custody. Encryption, integrity validation, retention, and access monitoring should also be designed.

A third-party operations provider must assume a monitoring role in your AWS account. Which trust-policy condition helps prevent another customer from abusing the role ARN?

Answer: Validate a provider-issued per-customer External ID with an sts:ExternalId condition

For third-party cross-account delegation, trust the provider account and require a unique External ID for each customer. This reduces the cross-account confused deputy risk.

An IAM access key may be compromised, and CloudTrail shows actions from an unknown source. What is the most appropriate initial response?

Answer: Disable the key, investigate scope, rotate affected credentials, and restore legitimate processing

Suspected credentials should be contained promptly. Preserve evidence, investigate actions, persistence mechanisms, data access, and related secrets, then recover legitimate workloads.

Only order-processing pods on EKS should write to a specific DynamoDB table without granting the same permission to other pods on the node. Which design is appropriate?

Answer: Associate a least-privilege IAM role with the Kubernetes service account using EKS Pod Identity

EKS Pod Identity associates an IAM role with a namespace and service account and supplies temporary credentials to matching pods. This supports application-level least privilege without static keys or broad node-role permissions.

An application in a VPC must access a third-party service through private IP connectivity without internet access or shared routing between VPCs. Which mechanism is appropriate?

Answer: An AWS PrivateLink interface VPC endpoint

AWS PrivateLink exposes a service through private IP addresses in the consumer VPC using an interface endpoint. It avoids internet exposure and does not require transitive routing between VPCs.

On-premises DNS must resolve VPC private hosted zones, and VPC workloads must resolve on-premises domains. What is the central design?

Answer: Route 53 Resolver inbound and outbound endpoints with forwarding rules

Route 53 Resolver inbound endpoints accept queries from on premises, while outbound endpoints and rules forward selected domains from VPCs to on-premises DNS. Connectivity, redundancy, and source controls must also be designed.

Dozens of VPCs and on-premises sites are connected. You want to avoid a full mesh of VPC peering connections and manage routes centrally. Which service is appropriate?

Answer: AWS Transit Gateway

Transit Gateway acts as a hub for VPC, VPN, and Direct Connect Gateway attachments. Separate route tables can control reachability among production, development, and shared-service networks.

A Lambda concurrency spike causes Aurora PostgreSQL to reach its connection limit. Which mechanism reuses database connections with minimal application change?

Answer: Place RDS Proxy in front of the database and configure its connection pool and limits

RDS Proxy accepts application connections and pools and reuses underlying database connections. It helps absorb connection surges and protect the database from oversubscription.

For an Aurora cluster, reads should be distributed across replicas while writes follow writer failover. Which endpoint usage is appropriate?

Answer: Use the cluster endpoint for writes and the reader endpoint for reads, with reconnection handling

The Aurora cluster endpoint targets the current writer, and the reader endpoint distributes read connections across available replicas. Applications must handle DNS changes, disconnected sessions, and retries during failover.

A DynamoDB orders table uses only the date as its partition key, concentrating a day's writes in one partition. What is the best improvement?

Answer: Design a high-cardinality key using order IDs or write-sharding suffixes based on access patterns

DynamoDB distributes data and traffic by partition-key value. When writes concentrate on a small number of values, increase key cardinality or use write sharding while preserving required access patterns.

Concurrent processes update product inventory in DynamoDB, and later writes overwrite earlier changes. How should update conflicts be detected?

Answer: Store a version number and update only when a ConditionExpression matches the expected value

A conditional update succeeds only when the stored version still matches the version read by the caller. A mismatch becomes an explicit conflict for rereading or business-level reconciliation.

SQS invokes Lambda for order events. A timeout just before completion can redeliver the same order. Which design prevents duplicate charges?

Answer: Make processing idempotent using a message or order ID, and align the visibility timeout and DLQ policy with processing time

Duplicate delivery can occur with SQS and Lambda. Record completion using a business idempotency key so repeated processing produces the side effect once, and configure visibility timeout, retry limits, and a DLQ together.

A Lambda function processes a surge of events and overwhelms a downstream API's concurrency limit. Which setting should be considered first to protect the dependency?

Answer: Set Lambda reserved concurrency to downstream capacity and use a queue and bounded retry policy

Reserved concurrency can cap simultaneous function executions and control pressure on a dependency. Buffer events in a queue and design bounded retries, jitter, and a DLQ to avoid data loss.

After deploying a new task definition to an ECS service, tasks repeatedly fail health checks. Which setting automatically stops the failed deployment and returns to the last healthy version?

Answer: Enable rollback with the ECS deployment circuit breaker

The ECS deployment circuit breaker detects when a rolling deployment cannot reach steady state and marks it failed. With rollback enabled, ECS restores the most recent completed deployment.

Before updating a CloudFormation stack, you need to review replacements such as a database and identify configuration changed manually. What is the appropriate approach?

Answer: Review a change set and drift detection, assess replacement, permission, and data impact, then execute

A change set previews resources that will be added, modified, or replaced. Drift detection reveals differences between the live environment and the template so data retention, downtime, and IAM changes can be reviewed before execution.

An S3 bucket stores audit records that must not be overwritten or deleted during the retention period, including by administrators. Which feature should be considered?

Answer: S3 Object Lock in Compliance mode with Versioning

S3 Object Lock protects object versions using a WORM model. Compliance mode strongly enforces retention, so legal requirements, retention periods, time settings, and recovery procedures must be validated before use.

AWS spending is normally stable but spikes within hours after a configuration error. You want to detect unusual spend patterns without waiting for a monthly fixed-budget threshold. Which service is appropriate?

Answer: Configure monitors and alerts in AWS Cost Anomaly Detection

Cost Anomaly Detection uses historical spending patterns to identify unusual costs and alert by service, account, or other monitor scope. Combine it with fixed Budget thresholds and a defined investigation and containment process.

You are considering Savings Plans to reduce EC2 costs, but many instances may be oversized. What should be done first?

Answer: Use Compute Optimizer to evaluate utilization and performance risk, rightsize first, then consider commitments for stable remaining usage

A long-term commitment on oversized capacity can lock in unnecessary spend. Rightsize using utilization and performance requirements first, then apply Savings Plans or reservations to stable baseline usage that remains.

Daily AWS Backup jobs succeed, but you have not verified that recovery can finish within the target time. What should be done next?

Answer: Automate periodic restore tests and validate integrity, duration, dependencies, and recovery procedures

A successful backup does not prove recoverability or RTO compliance. Restore periodically into an isolated environment and validate application integrity, keys, permissions, DNS, procedures, and elapsed time.