Practice for the Exams exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A global insurance company is modernizing its infrastructure by migrating multiple line-of-business applications from it. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A global insurance company is modernizing its infrastructure by migrating multiple line-of-business applicati…
- A research organization is running a high-performance computing (HPC) workload using Amazon EC2 instances tha…
- A company wants to adopt a hybrid cloud infrastructure where it uses some AWS services such as Amazon S3 alon…
- You started a new job as a solutions architect at a company that has both AWS experts and people learning AWS…
- An e-commerce company has copied 1 petabyte of data from its on-premises data center to an Amazon S3 bucket i…
- You are working for a software as a service (SaaS) company as a solutions architect and help design solutions…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A global insurance company is modernizing its infrastructure by migrating multiple line-of-business applications from its on-premises data centers to AWS. These applications will be deployed across several AWS accounts, all governed under…
Answer: D. Deploy AWS IAM Identity Center and configure it to use AWS Directory Service for Microsoft Active Directory (Enterprise Edition). Establish a two-way trust relationship between the managed directory and the on-premises Active Directory to enable federated authentication across all AWS accounts
AWS IAM Identity Center centrally manages single sign-on access across multiple AWS accounts. By connecting it to an AWS Managed Microsoft AD with a two-way trust to your on-premises directory, users can federate seamlessly without duplicating identity stores.
Q2. A research organization is running a high-performance computing (HPC) workload using Amazon EC2 instances that are distributed across multiple Availability Zones (AZs) within a single AWS Region. The workload requires access to a shared fi…
Answer: A. Create EFS mount targets in each AZ and mount the EFS file system to EC2 instances in the same AZ as the mount target
Provisioning an Amazon EFS mount target in each Availability Zone ensures instances access local resources, yielding the lowest possible latency. Deploying a single target forces cross-AZ traffic, increasing delay, while using Mountpoint for S3 confuses object storage with shared file systems.
Q3. A company wants to adopt a hybrid cloud infrastructure where it uses some AWS services such as Amazon S3 alongside its on-premises data center. The company wants a dedicated private connection between its on-premises data center and AWS. I…
Answer: B,C. Use AWS Direct Connect connection as a primary connection || Use AWS Site-to-Site VPN as a backup connection
AWS Direct Connect provides a dedicated private network path for a primary connection. To guarantee uptime over the public internet during a failure, an encrypted AWS Site-to-Site VPN serves as the standard backup layer. Egress-only gateways are for IPv6 VPC outbound traffic, not hybrid connectivity.
Q4. You started a new job as a solutions architect at a company that has both AWS experts and people learning AWS. Recently, a developer misconfigured a newly created Amazon RDS database which resulted in a production outage. How can you ensur…
Answer: A. Use AWS CloudFormation to manage Amazon RDS databases
AWS CloudFormation allows you to provision resources using infrastructure as code, ensuring reusable templates with standardized best practices. The other options are incorrect because they rely on reactive monitoring, generic alerts, or unrelated IAM policies instead of using a proactive template.
Q5. An e-commerce company has copied 1 petabyte of data from its on-premises data center to an Amazon S3 bucket in the us-west-1 Region using an AWS Direct Connect link. The company now wants to set up a one-time copy of the data to another Am…
Answer: A,E. Set up Amazon S3 batch replication to copy objects across Amazon S3 buckets in another Region using S3 console and then delete the replication configuration || Copy data from the source bucket to the destination bucket using the aws S3 sync command
The AWS CLI sync command efficiently copies large datasets between S3 buckets without duplicating existing files. S3 batch replication is the second valid choice because it enables you to replicate existing objects on demand, which can be deleted afterward for a one-time migration.
Q6. You are working for a software as a service (SaaS) company as a solutions architect and help design solutions for the company's customers. One of the customers is a bank and has a requirement to whitelist a public IP when the bank is acces…
Answer: B. Use a Network Load Balancer with an Auto Scaling Group
A Network Load Balancer provides a static, predictable IP address required for strict whitelisting. Application and Classic Load Balancers expose dynamic DNS names, making them unsuitable for fixed IP whitelisting requirements.
Q7. A company has developed a popular photo-sharing website using a serverless pattern on the AWS Cloud using Amazon API Gateway and AWS Lambda. The backend uses an Amazon RDS PostgreSQL database. The website is experiencing high read traffic…
Answer: A. Use Amazon RDS Read Replicas
Amazon RDS Read Replicas scale read capacity horizontally without modifying application database logic. ElastiCache requires code changes, and Multi-AZ strictly provides availability and disaster recovery failover.
Q8. The engineering team at a global e-commerce company is currently reviewing their disaster recovery strategy. The team has outlined that they need to be able to quickly recover their application stack with a Recovery Time Objective (RTO) of…
Answer: A. Create an Amazon Machine Image (AMI) after installing the software and copy the AMI across all Regions. Use this Region-specific AMI to run the recovery process in the respective Regions
Pre-baked Amazon Machine Images launch instances in minutes to meet strict Recovery Time Objectives. AMIs are Regional resources, so they must be copied to target Regions to enable rapid multi-Region disaster recovery.
Q9. A Pharmaceuticals company is looking for a simple solution to connect its VPCs and on-premises networks through a central hub. As a Solutions Architect, which of the following would you suggest as the solution that requires the LEAST opera…
Answer: B. Use AWS Transit Gateway to connect the Amazon VPCs to the on-premises networks
AWS Transit Gateway provides a fully managed, highly available hub-and-spoke model connecting VPCs and on-premises networks. VPC peering is eliminated because it lacks transitive routing required for on-premises connectivity.
Q10. The engineering team at a social media company has recently migrated to AWS Cloud from its on-premises data center. The team is evaluating Amazon CloudFront to be used as a CDN for its flagship application. The team has hired you as an AWS…
Answer: A,C,F. Use field level encryption in Amazon CloudFront to protect sensitive data for specific content || Use an origin group with primary and secondary origins to configure Amazon CloudFront for high-availability and failover || Amazon CloudFront can route to multiple origins based on the content type
Amazon CloudFront uses cache behaviors to route requests to different origins based on path patterns or content type. Origin groups provide automatic failover for high availability, while field-level encryption protects specific sensitive data at the edge.
Q11. A company wants to grant access to an Amazon S3 bucket to users in its own AWS account as well as to users in another AWS account. Which of the following options can be used to meet this requirement?
Answer: D. Use a bucket policy to grant permission to users in its account as well as to users in another account
S3 bucket policies are resource-based policies that can easily grant cross-account access to an S3 bucket. However, the question is ambiguous because IAM user policies in the target account can also be used to assume a role for cross-account access.
Q12. A company has recently created a new department to handle their services workload. An IT team has been asked to create a custom VPC to isolate the resources created in this new department. They have set up the public subnet and internet ga…
Answer: B,E. Check if the route table is configured with internet gateway || Check if the security groups allow ping from the source
If you cannot ping an Amazon EC2 instance, you must verify that the route table directs internet traffic to the internet gateway. You must also ensure the security group allows inbound ICMP traffic, which is required for ping requests.
Q13. A niche social media application allows users to connect with sports athletes. As a solutions architect, you've designed the architecture of the application to be fully serverless using Amazon API Gateway and AWS Lambda. The backend uses a…
Answer: C. Use Amazon DynamoDB DAX
Amazon DynamoDB Accelerator (DAX) provides a fully managed in-memory cache that directly integrates with DynamoDB to resolve hot partition read issues transparently. Using ElastiCache would require significant application code refactoring, which violates the scenario constraints.
Q14. Your company is deploying a website running on AWS Elastic Beanstalk. The website takes over 45 minutes for the installation and contains both static as well as dynamic files that must be generated during the installation process. As a Sol…
Answer: C,D. Use Amazon EC2 user data to customize the dynamic installation parts at boot time || Create a Golden Amazon Machine Image (AMI) with the static installation components already setup
Baking static installation components into a custom Golden AMI drastically reduces boot times, while EC2 user data handles the remaining dynamic configuration. Attempting to run the entire forty-five minute installation process via user data alone violates the two-minute requirement.
Q15. A Big Data processing company has created a distributed data processing framework that performs best if the network performance between the processing machines is high. The application has to be deployed on AWS, and the company is only loo…
Answer: A. Use a Cluster placement group
A cluster placement group packs EC2 instances close together inside a single Availability Zone, delivering low-latency, high-throughput network performance for tightly coupled workloads. Spread placement groups intentionally isolate instances across hardware to reduce correlated failures, which hurts performance.
Q16. A retail company uses AWS Cloud to manage its technology infrastructure. The company has deployed its consumer-focused web application on Amazon EC2-based web servers and uses Amazon RDS PostgreSQL database as the data store. The PostgreSQ…
Answer: A. Configure Amazon RDS to use SSL for data in transit
Configuring Amazon RDS to use SSL or TLS encrypts the data in transit between the application and the database, fulfilling the end-to-end security requirement. Security groups, network ACLs, and IAM authentication manage access control rather than encrypting the network payload.
Q17. You have an Amazon S3 bucket that contains files in two different folders – s3://my-bucket/images and s3://my-bucket/thumbnails. When an image is first uploaded and new, it is viewed several times. But after 45 days, analytics prove that i…
Answer: C,E. Create a Lifecycle Policy to transition objects to Amazon S3 Standard IA using a prefix after 45 days || Create a Lifecycle Policy to transition all objects to Amazon S3 Glacier after 180 days
Amazon S3 Standard-IA provides high availability across multiple Availability Zones while lowering costs for infrequently accessed data. S3 One Zone-IA fails the availability requirement, and using a prefix for the 45-day transition isolates the image files from the actively viewed thumbnails.
Q18. A ride-sharing company wants to improve the ride-tracking system that stores GPS coordinates for all rides. The engineering team at the company is looking for a NoSQL database that has single-digit millisecond latency, can scale horizontal…
Answer: C. Amazon DynamoDB
Amazon DynamoDB is a serverless NoSQL database that delivers consistent single-digit millisecond latency and scales horizontally to handle high-frequency lookloads. ElastiCache is meant for caching rather than primary storage, while RDS and Neptune do not meet all the required constraints.
Q19. A ride-sharing company wants to use an Amazon DynamoDB table for data storage. The table will not be used during the night hours whereas the read and write traffic will often be unpredictable during day hours. When traffic spikes occur the…
Answer: C. Set up Amazon DynamoDB table in the on-demand capacity mode
DynamoDB on-demand capacity instantly accommodates unpredictable traffic spikes without relying on CloudWatch alarms or scaling delays. Provisioned capacity with auto-scaling reacts too slowly for rapid bursts, while global tables and secondary indexes address replication and queries rather than capacity.
Q20. An IT company runs a high-performance computing (HPC) workload on AWS. The workload requires high network throughput and low-latency network performance along with tightly coupled node-to-node communications. The Amazon EC2 instances are p…
Answer: A. Select a cluster placement group while launching Amazon EC2 instances
Cluster placement groups pack EC2 instances close together within a single Availability Zone to deliver the low-latency network performance required for tightly coupled HPC workloads. Dedicated tenancy, capacity reservations, and Elastic Inference address compliance, availability, and machine learning rather than network performance.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.