Practice for the Exams exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A global pharmaceutical company operates a hybrid cloud network. Its primary AWS workloads run in the us-west-2 Region, . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A global pharmaceutical company operates a hybrid cloud network. Its primary AWS workloads run in the us-west…
- A ride-hailing startup has launched a mobile app that matches passengers with nearby drivers based on real-ti…
- A transportation logistics company runs a shipment tracking application on Amazon EC2 instances with an Amazo…
- A developer in your company has set up a classic 2 tier architecture consisting of an Application Load Balanc…
- A company's business logic is built on several microservices that are running in the on-premises data center…
- A streaming media company operates a high-traffic content delivery platform on AWS. The application backend i…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A global pharmaceutical company operates a hybrid cloud network. Its primary AWS workloads run in the us-west-2 Region, connected to its on-premises data center via an AWS Direct Connect connection. After acquiring a biotech firm headquart…
Answer: D. Connect both Direct Connect links to a shared Direct Connect gateway. Attach each Region's virtual private gateway (VGW) to the Direct Connect gateway, enabling transitive routing between the VPCs and the on-premises networks across Regions
A Direct Connect gateway connects Direct Connect links to VPCs across different Regions, enabling scalable hybrid transit. Inter-Region VPC peering lacks transitive routing, and third-party VPNs require excessive operational overhead.
Q2. A ride-hailing startup has launched a mobile app that matches passengers with nearby drivers based on real-time GPS coordinates. The application backend uses an Amazon RDS for PostgreSQL instance with read replicas to store the latitude an…
Answer: B. Place an Amazon ElastiCache for Redis cluster in front of the PostgreSQL database. Modify the application to cache recent location reads and updates in Redis, using a TTL-based eviction strategy
Amazon ElastiCache for Redis provides sub-millisecond latency and natively supports geospatial data, making it perfect for handling frequent GPS updates. The other options fail to address the high-frequency write bottleneck, as read replicas and multi-AZ deployments do not offload rapid write operations.
Q3. A transportation logistics company runs a shipment tracking application on Amazon EC2 instances with an Amazon Aurora MySQL database cluster. The application is experiencing rapid growth due to increased demand from mobile app users queryi…
Answer: C. Integrate Amazon ElastiCache for Redis between the application and Aurora. Cache frequently accessed query results in Redis to reduce the number of identical read requests hitting the database
Amazon ElastiCache for Redis acts as an in-memory caching layer to serve repeated reads directly, significantly reducing identical database queries. Adding Aurora read replicas is less cost-effective here because it still routes repeated queries to the database, consuming unnecessary resources.
Q4. A developer in your company has set up a classic 2 tier architecture consisting of an Application Load Balancer and an Auto Scaling group (ASG) managing a fleet of Amazon EC2 instances. The Application Load Balancer is deployed in a subnet…
Answer: B. Add a rule to authorize the security group of the Application Load Balancer
Referencing a security group directly inside an inbound rule ensures strict traffic isolation between associated resources. Allowing specific CIDR blocks is less secure because any resource within that network range could bypass the intended load balancer perimeter.
Q5. A company's business logic is built on several microservices that are running in the on-premises data center. They currently communicate using a message broker that supports the MQTT protocol. The company is looking at migrating these appl…
Answer: B. Amazon MQ
Amazon MQ provides a managed message broker service that supports industry-standard protocols including MQTT for seamless migrations. AWS native services like SQS and SNS rely on proprietary APIs, requiring you to rewrite application logic during cloud migration.
Q6. A streaming media company operates a high-traffic content delivery platform on AWS. The application backend is deployed on Amazon EC2 instances within an Auto Scaling group across multiple Availability Zones in a VPC. The team has observed…
Answer: C. Use predictive scaling for the Auto Scaling group to analyze daily and weekly patterns, and configure dynamic scaling with target tracking policies to respond to real-time traffic changes
Predictive scaling uses machine learning to analyze historical traffic and provision capacity proactively before demand spikes occur. Combining it with target tracking ensures the system reacts dynamically to real-time changes, whereas step or scheduled scaling reactively handles traffic.
Q7. A company uses Application Load Balancers in multiple AWS Regions. The Application Load Balancers receive inconsistent traffic that varies throughout the year. The engineering team at the company needs to allow the IP addresses of the Appl…
Answer: D. Set up AWS Global Accelerator. Register the Application Load Balancers in different Regions to the AWS Global Accelerator. Configure the on-premises firewall's rule to allow static IP addresses associated with the AWS Global Accelerator
AWS Global Accelerator provides static anycast IP addresses that serve as fixed entry points for regional load balancers. Using Lambda scripts or migrating to Network Load Balancers creates administrative overhead because underlying IP addresses frequently change.
Q8. A social media company wants the capability to dynamically alter the size of a geographic area from which traffic is routed to a specific server resource. Which feature of Amazon Route 53 can help achieve this functionality?
Answer: B. Geoproximity routing
Geoproximity routing uses a bias value to dynamically expand or shrink the geographic boundary routing traffic to resources. Geolocation routing maps fixed boundaries to resources, lacking the dynamic bias sizing feature.
Q9. A retail company is using AWS Site-to-Site VPN connections for secure connectivity to its AWS cloud resources from its on-premises data center. Due to a surge in traffic across the VPN connections to the AWS cloud, users are experiencing s…
Answer: D. Create an AWS Transit Gateway with equal cost multipath routing and add additional VPN tunnels
AWS Transit Gateway supports equal cost multi-path routing, allowing multiple VPN tunnels to aggregate throughput beyond single tunnel limits. Virtual private gateways lack ECMP support, making them incapable of increasing VPN bandwidth.
Q10. A company runs a popular dating website on the AWS Cloud. As a Solutions Architect, you've designed the architecture of the website to follow a serverless pattern on the AWS Cloud using Amazon API Gateway and AWS Lambda. The backend uses a…
Answer: B,D. Attach an AWS Identity and Access Management (IAM) role to AWS Lambda || Use IAM authentication from AWS Lambda to Amazon RDS PostgreSQL
IAM database authentication allows AWS Lambda to use temporary tokens to access Amazon RDS for PostgreSQL. You must attach an execution role to the function to grant permissions to generate these tokens, while security groups only control network access.
Q11. A company has migrated its application from a monolith architecture to a microservices based architecture. The development team has updated the Amazon Route 53 simple record to point "myapp.mydomain.com" from the old Load Balancer to the n…
Answer: D. The Time To Live (TTL) is still in effect
DNS resolvers cache records for the duration of the Time To Live, or TTL. If the TTL has not expired, clients will continue using the cached IP address of the old load balancer instead of querying Route 53 for the updated record.
Q12. A CRM company has a software as a service (SaaS) application that feeds updates to other in-house and third-party applications. The SaaS application and the in-house applications are being migrated to use AWS services for this inter-applic…
Answer: B. Use Amazon EventBridge to decouple the system architecture
Amazon EventBridge is the ideal service to asynchronously decouple a SaaS application because it natively integrates with third-party providers. While SNS and SQS decouple systems, they lack built-in partner integrations for this specific SaaS requirement.
Q13. An e-commerce analytics company is preparing to archive several years of transaction records and customer analytics reports in Amazon S3 for long-term storage. To meet compliance requirements, the archived data must be encrypted at rest. A…
Answer: B. Use AWS Key Management Service (KMS) to create a customer managed key with automatic rotation enabled. Configure the S3 bucket's default encryption to use the customer managed key. Migrate the data to the S3 bucket
A customer managed KMS key with automatic rotation satisfies the strict compliance requirement for auditable annual key rotation. SSE-S3 handles encryption transparently but does not allow you to control or track the key rotation schedule.
Q14. An Elastic Load Balancer has marked all the Amazon EC2 instances in the target group as unhealthy. Surprisingly, when a developer enters the IP address of the Amazon EC2 instances in the web browser, he can access the website. What could b…
Answer: B,C. The security group of the Amazon EC2 instance does not allow for traffic from the security group of the Application Load Balancer || The route for the health check is misconfigured
An Application Load Balancer marks targets as unhealthy if its health checks fail. This usually happens when the health check ping path is misconfigured or the target security group blocks traffic from the load balancer.
Q15. Amazon Route 53 is configured to route traffic to two Network Load Balancer nodes belonging to two Availability Zones (AZs): AZ-A and AZ-B. Cross-zone load balancing is disabled. AZ-A has four targets and AZ-B has six targets. Which of the…
Answer: A. Each of the four targets in AZ-A receives 12.5% of the traffic
Route 53 distributes traffic equally between the two Network Load Balancer nodes. With cross-zone load balancing disabled, each node routes its fifty percent of traffic strictly within its own zone, giving each target in the four-target zone exactly twelve point five percent.
Q16. An e-commerce company wants to migrate its on-premises application to AWS. The application consists of application servers and a Microsoft SQL Server database. The solution should result in the maximum possible availability for the databas…
Answer: B. Migrate the data to Amazon RDS for SQL Server database in a Multi-AZ deployment
Amazon RDS for SQL Server in a Multi-AZ deployment provides high availability through an automatic standby instance in another zone. This minimizes operational overhead compared to EC2, while avoiding the non-existent cross-region Multi-AZ configuration.
Q17. An enterprise has decided to move its secondary workloads such as backups and archives to the AWS cloud. The CTO wishes to move the data stored on physical tapes to the cloud, without changing their current tape backup workflows. The compa…
Answer: A. Use Tape Gateway, which can be used to move on-premises tape data onto AWS Cloud. Then, Amazon S3 archiving storage classes can be used to store data cost-effectively for years
Tape Gateway presents cloud-backed virtual tapes to on-premises backup applications without changing existing workflows. It archives this data directly into low-cost Amazon S3 Glacier or Glacier Deep Archive storage classes, minimizing long-term storage costs.
Q18. A financial services firm has traditionally operated with an on-premises data center and would like to create a disaster recovery strategy leveraging the AWS Cloud. As a Solutions Architect, you would like to ensure that a scaled-down vers…
Answer: D. Warm Standby
A warm standby disaster recovery strategy keeps a scaled-down but fully functional version of your environment always running in the cloud. This differs from a pilot light, which only keeps core services active while scaling others during a failover event.
Q19. A development team has configured Elastic Load Balancing for host-based routing. The idea is to support multiple subdomains and different top-level domains. The rule *.example.com matches which of the following?
Answer: D. test.example.com
In Elastic Load Balancing host-based routing, an asterisk wildcard matches zero or more characters before the specified domain. Therefore, the pattern asterisk dot example dot com matches test dot example dot com, but it does not match the exact apex domain example dot com.
Q20. A fintech startup hosts its real-time transaction metadata in Amazon DynamoDB tables. During a recent system maintenance event, a junior engineer accidentally deleted a production table, resulting in major service downtime and irreversible…
Answer: B. Enable deletion protection on DynamoDB tables
Enabling deletion protection on a DynamoDB table prevents accidental table deletion by blocking the destructive API call entirely. Point-in-time recovery is a reactive backup mechanism that helps restore deleted data but does not prevent the initial deletion or resulting downtime.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.