40 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended AWS resources →
In AWS, which central service manages users and role permissions based on the principle of least privilege?
Answer: IAM
IAM manages users, groups, roles, and policies. In practice, using roles and avoiding long-term access keys is a basic design principle.
In AWS, which logically isolated network is used to place resources such as EC2 and RDS?
Answer: VPC
A VPC is where you design AWS networking with subnets, route tables, security groups, NACLs, and NAT Gateways.
In Amazon S3, which feature helps recover from accidental deletion or overwrites?
Answer: Versioning
S3 Versioning keeps multiple versions of an object, which helps with recovery from accidental deletion, overwrites, and some ransomware scenarios.
In AWS, which service records API activity for auditing?
Answer: CloudTrail
CloudTrail records API calls made in an AWS account and helps answer who did what during audits and investigations.
In AWS, which service is commonly used to collect metrics and logs and configure alarms?
Answer: CloudWatch
CloudWatch is used for monitoring with metrics, logs, alarms, and dashboards.
Which set is part of the AWS Well-Architected Framework pillars?
Answer: Security, Reliability, Performance Efficiency, Cost Optimization, Operational Excellence, Sustainability
The AWS Well-Architected Framework provides pillars for reviewing designs from operational, security, reliability, performance, cost, and sustainability perspectives.
In AWS, you want to launch a virtual server and manage the OS and middleware yourself. Which service is representative?
Answer: EC2
EC2 is AWS's virtual server service. You choose instance types, AMIs, storage, networking, security groups, and related settings.
In AWS, you want to run short pieces of code in response to events without managing servers. Which service is appropriate?
Answer: Lambda
Lambda runs functions serverlessly. It can be triggered by API Gateway, S3 events, schedules, and other event sources.
In AWS, you want to distribute web or API traffic across multiple EC2 instances or similar targets. Which service is representative?
Answer: Elastic Load Balancing
Elastic Load Balancing distributes traffic across multiple targets. Application Load Balancer is commonly used for web and API workloads.
Which AWS service is commonly used as a private registry for container images?
Answer: ECR
ECR, Elastic Container Registry, stores and manages container images. It is commonly used with ECS, EKS, and CI/CD pipelines.
In AWS, what is used to add metadata such as environment or owner to resources for search and cost allocation?
Answer: Tag
Tags are key-value metadata attached to AWS resources. They help organize environment, system name, owner team, and cost allocation.
An EC2 instance in a private subnet needs outbound internet access for package updates, but it must not be directly reachable from the internet. Which design is common?
Answer: Place a NAT Gateway in a public subnet and route the private subnet through it
A NAT Gateway is a typical way to provide outbound internet access from private subnets. Return traffic is allowed, but it is not used to accept new inbound connections from the internet.
A web API runs on EC2 instances across multiple Availability Zones. You want traffic routed only to healthy instances based on HTTP checks. What is appropriate?
Answer: Application Load Balancer target group health checks
Application Load Balancer is suitable for HTTP/HTTPS load balancing. Target group health checks can remove unhealthy targets from traffic routing.
An application uses RDS. The database should not be exposed to the internet, and only the application should connect to it. Which design is appropriate?
Answer: Place RDS in private subnets and allow only the application security group in the database security group
A common design places RDS in private subnets and uses security group references to allow access only from the application layer. Public reachability and credential handling should be considered separately.
You want to deliver static assets stored in S3 using a custom domain and HTTPS, with caching for users worldwide. Which service is central to this design?
Answer: CloudFront
CloudFront is a CDN that can deliver content from origins such as S3 through global edge locations. Custom domains, TLS certificates, and caching behavior are part of the design.
A CI system such as GitHub Actions deploys to AWS. You want to avoid long-term access keys in the repository and use temporary permissions. What approach is recommended?
Answer: Use OIDC federation to assume an IAM role
For CI/CD, OIDC federation with IAM role assumption helps avoid distributing long-term access keys. Trust policies and permission policies should be designed with least privilege.
You are designing a new web service on AWS. To keep the service running during a single Availability Zone failure, which basic approach is most appropriate?
Answer: Deploy the application across multiple AZs and use a load balancer plus Multi-AZ capable data stores
To tolerate a single-AZ failure, both application and data layers should be designed for multiple AZs. Load balancers, Auto Scaling, and RDS Multi-AZ are common building blocks.
An order API invokes email sending and inventory updates. You want a loosely coupled design so slow downstream processing is less likely to stop order intake. Which design is appropriate?
Answer: Place a queue such as SQS between components and process downstream work with asynchronous workers
A queue such as SQS separates intake from downstream processing. It helps with retries, buffering, and independently scaling workers.
You are designing disaster recovery for a production system. To judge whether RTO and RPO can be met, what should be clarified first?
Answer: The acceptable recovery time and the acceptable amount of data loss
In DR design, RTO and RPO are prerequisites for choosing a recovery approach. They directly influence choices such as backups, replication, and warm standby.
Internal reports are stored in S3 and should be viewable only through a specific application. Which design is appropriate to avoid a public bucket and restrict the access path?
Answer: Block S3 public access and allow only required paths such as an application IAM role or CloudFront OAC
S3 access should be designed with Block Public Access, bucket policies, IAM roles, and possibly CloudFront OAC. Obscure names are not access control.
You want to separate development, test, and production environments on AWS. Which design reduces accidental operations, mixed permissions, and unclear billing?
Answer: Separate accounts with AWS Organizations and govern them with OUs and SCPs
Separate accounts provide a strong boundary for environment separation. Organizations, OUs, SCPs, billing management, and IAM Identity Center help governance.
You want to continuously identify S3 buckets or IAM roles that can be accessed from outside your organization. Which service is appropriate?
Answer: IAM Access Analyzer
IAM Access Analyzer analyzes resource policies and identifies resources accessible from outside a defined zone of trust. It helps detect unintended external sharing.
You want to analyze AWS activity and network signals to detect suspicious credential use or possible cryptocurrency mining. Which service is appropriate?
Answer: Amazon GuardDuty
GuardDuty is a managed threat detection service that analyzes multiple AWS log and signal sources. Findings can be reviewed by severity and routed through services such as EventBridge.
You want to securely store an application database password and automate periodic rotation. Which service is most appropriate?
Answer: AWS Secrets Manager
Secrets Manager supports secret storage, controlled retrieval, encryption, and rotation. Applications should use IAM roles with access only to the required secrets.
You want to limit excessive requests to a public API by source while reducing impact on normal users. Which AWS WAF rule should you use?
Answer: Rate-based rule
AWS WAF rate-based rules count requests over a time window and can limit excessive traffic. Scope-down conditions should be designed to avoid blocking legitimate users unnecessarily.
You need to encrypt sensitive data, separate key users from key administrators, and audit key operations. Which service is central to this design?
Answer: AWS KMS
AWS KMS provides cryptographic key management and encryption operations. Key policies and IAM support separation of duties, while CloudTrail can audit key usage.
You want operational access to EC2 without exposing SSH to the internet, using auditable sessions. Which service feature is appropriate?
Answer: AWS Systems Manager Session Manager
Session Manager can connect to EC2 through SSM Agent and IAM permissions without bastions or public SSH, and session logging can be designed.
You want to regularly apply patches to EC2 and manage missing patches. Which AWS Systems Manager capability is used?
Answer: Patch Manager
Patch Manager applies patches to managed nodes, schedules patching, and checks compliance, often with maintenance windows.
You want to record AWS resource configuration history and continuously evaluate compliance with rules such as required encryption. Which service is appropriate?
Answer: AWS Config
AWS Config records resource configurations, tracks changes, and evaluates compliance using Config rules. CloudTrail records API activity.
You want to centrally manage backups for services such as EC2, EBS, and RDS using policies. Which service is appropriate?
Answer: AWS Backup
AWS Backup centrally manages backup plans, retention, and recovery points across multiple AWS services.
You want to route S3 object creation events to downstream processing such as Lambda or Step Functions in a decoupled way. Which service is central?
Answer: Amazon EventBridge
EventBridge routes events from AWS services and applications using rules to targets such as Lambda, Step Functions, and SQS.
You want to continuously detect known vulnerabilities in EC2, container images, and Lambda functions. Which service is appropriate?
Answer: Amazon Inspector
Amazon Inspector helps detect vulnerabilities in EC2, ECR images, and Lambda. Macie focuses mainly on sensitive data discovery in S3.
You want to automatically discover personal information or credential-like data stored in S3 to understand leakage risk. Which service is appropriate?
Answer: Amazon Macie
Amazon Macie uses machine learning and pattern matching to discover sensitive data in S3 and support data protection.
EC2 instances in private subnets need outbound internet access for updates, but should not accept direct inbound internet connections. Which design is common?
Answer: Route outbound traffic through a NAT Gateway in a public subnet
A NAT Gateway enables outbound access from private subnets while avoiding direct inbound reachability from the internet.
An application in a VPC should access S3 through AWS networking without using a NAT Gateway. What should you consider?
Answer: Gateway VPC Endpoint for S3
A Gateway VPC Endpoint for S3 keeps VPC-to-S3 traffic on AWS networking and can reduce NAT Gateway data processing costs.
You want to distribute HTTP/HTTPS traffic to web apps on multiple EC2 instances and route by path. Which service is appropriate?
Answer: Application Load Balancer
Application Load Balancer provides layer 7 load balancing with host/path routing, health checks, and TLS termination.
You want to manage multiple steps such as task A, approval wait, and task B, including retries on failure. Which service is appropriate?
Answer: AWS Step Functions
Step Functions defines workflows as state machines and coordinates tasks such as Lambda or ECS with branching, retries, and waits.
You need a shared file system that multiple EC2 instances can mount concurrently. Which service is commonly used for Linux workloads?
Answer: Amazon EFS
Amazon EFS is managed NFS file storage for multiple clients. EBS is primarily block storage for a single instance.
You want applications to store messages in a queue so consumers can process them later even if temporarily stopped. Which service is appropriate?
Answer: Amazon SQS
SQS is a message queue that decouples producers and consumers. SNS is mainly pub/sub notification fan-out.
You want to fan out the same notification to many subscribers such as email, SQS, and Lambda. Which service is appropriate?
Answer: Amazon SNS
SNS is a pub/sub service that delivers messages from topics to multiple subscribers and is often combined with SQS for fan-out.