Practice for the Exams exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A US-based healthcare startup is building an interactive diagnostic tool for COVID-19 related assessments. The users wou. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A US-based healthcare startup is building an interactive diagnostic tool for COVID-19 related assessments. Th…
- A leading social media analytics company is contemplating moving its dockerized application stack into AWS Cl…
- A biotechnology firm runs genomics data analysis workloads using AWS Lambda functions deployed inside a VPC i…
- A new DevOps engineer has joined a large financial services company recently. As part of his onboarding, the…
- The IT department at a consulting firm is conducting a training workshop for new developers. As part of an ev…
- An Electronic Design Automation (EDA) application produces massive volumes of data that can be divided into t…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A US-based healthcare startup is building an interactive diagnostic tool for COVID-19 related assessments. The users would be required to capture their personal health records via this tool. As this is sensitive health information, the bac…
Answer: A. Use server-side encryption with AWS Key Management Service keys (SSE-KMS) to encrypt the user data on Amazon S3
Server-side encryption with AWS Key Management Service keys provides a detailed audit trail through AWS CloudTrail showing exactly when keys are used. SSE-S3 lacks this audit capability, while SSE-C and client-side encryption require the customer to manage keys.
Q2. A leading social media analytics company is contemplating moving its dockerized application stack into AWS Cloud. The company is not sure about the pricing for using Amazon ECS with the EC2 launch type compared to Amazon ECS with the Farga…
Answer: C. Amazon ECS with EC2 launch type is charged based on EC2 instances and EBS volumes used. Amazon ECS with Fargate launch type is charged based on vCPU and memory resources that the containerized application requests
Amazon ECS with the EC2 launch type bills for underlying infrastructure like EC2 and EBS volumes, while Fargate bills per vCPU and memory consumed. Understanding Fargate's serverless pricing model versus EC2 infrastructure management is key.
Q3. A biotechnology firm runs genomics data analysis workloads using AWS Lambda functions deployed inside a VPC in their central AWS account. The input data for these workloads consists of large files stored in an Amazon EFS that resides in a…
Answer: C. Use Amazon EFS resource policies to allow cross-account access to the file system from the central account. Attach the EFS mount target to a shared VPC or peered VPC, and mount the file system in the Lambda function configuration using an EFS access point
Amazon EFS supports cross-account mounting using resource policies and access points over a peered VPC. Lambda layers have size limits, proxy functions add latency, and copying large datasets to S3 creates unnecessary operational overhead.
Q4. A new DevOps engineer has joined a large financial services company recently. As part of his onboarding, the IT department is conducting a review of the checklist for tasks related to AWS IAM. As an AWS Certified Solutions Architect – Asso…
Answer: A,E. Configure AWS CloudTrail to log all AWS Identity and Access Management (AWS IAM) actions || Enable AWS Multi-Factor Authentication (AWS MFA) for privileged users
Enabling MFA for privileged users and logging actions via CloudTrail are foundational security best practices. Sharing credentials, granting maximum privileges, and using user credentials for EC2 instances violate least privilege principles.
Q5. The IT department at a consulting firm is conducting a training workshop for new developers. As part of an evaluation exercise on Amazon S3, the new developers were asked to identify the invalid storage class lifecycle transitions for obje…
Answer: B,E. Amazon S3 Intelligent-Tiering => Amazon S3 Standard || Amazon S3 One Zone-IA => Amazon S3 Standard-IA
S3 lifecycle transitions prohibit moving objects back to the Standard class or upgrading from One Zone-IA to Standard-IA. S3 uses a waterfall model where objects can move down to colder tiers, but never upward to warmer, more redundant classes.
Q6. An Electronic Design Automation (EDA) application produces massive volumes of data that can be divided into two categories. The 'hot data' needs to be both processed and stored quickly in a parallel and distributed fashion. The 'cold data'…
Answer: A. Amazon FSx for Lustre
Amazon FSx for Lustre is optimized for high-performance computing workloads like chip design, offering parallel processing for hot data and S3 integration for cold data. AWS Glue and EMR handle data analytics, while Windows File Server targets SMB workloads.
Q7. An enterprise runs a microservices-based application on Amazon EKS, deployed on EC2 worker nodes. The application includes a frontend UI service that interacts with Amazon DynamoDB and a data-processing service that stores and retrieves fi…
Answer: A. Create separate Kubernetes service accounts for the UI and data services. Use IAM Roles for Service Accounts (IRSA) to map each service account to an IAM role with only the required permissions. Assign DynamoDB access to the UI Pods and S3 access to the data Pods
IAM Roles for Service Accounts provides granular IAM permissions to individual Kubernetes pods. The node instance profile trap grants every pod on the node identical access, violating the required least privilege isolation.
Q8. An organization wants to delegate access to a set of users from the development environment so that they can access some resources in the production environment which is managed under another AWS account. As a solutions architect, which of…
Answer: B. Create a new IAM role with the required permissions to access the resources in the production environment. The users can then assume this IAM role while accessing the resources from the production environment
Cross-account delegation relies on IAM roles to provide temporary security credentials. Sharing long-term IAM user credentials is an anti-pattern, and relying on it unnecessarily compromises your security posture across both environments.
Q9. A logistics company is building a multi-tier application to track the location of its trucks during peak operating hours. The company wants these data points to be accessible in real-time in its analytics platform via a REST API. The compa…
Answer: A. Leverage Amazon API Gateway with Amazon Kinesis Data Analytics
Amazon Kinesis Data Analytics processes streaming data in real-time, which pairs seamlessly with API Gateway to expose RESTful endpoints. Business intelligence tools and serverless compute services lack the native streaming integration required for real-time location tracking.
Q10. A new DevOps engineer has just joined a development team and wants to understand the replication capabilities for Amazon RDS Multi-AZ deployment as well as Amazon RDS Read-replicas. Which of the following correctly summarizes these capabil…
Answer: A. Multi-AZ follows synchronous replication and spans at least two Availability Zones (AZs) within a single region. Read replicas follow asynchronous replication and can be within an Availability Zone (AZ), Cross-AZ, or Cross-Region
Amazon RDS Multi-AZ deployments use synchronous replication across availability zones for high availability. Read replicas use asynchronous replication to scale read capacity and can span across availability zones or regions.
Q11. The flagship application for a gaming company connects to an Amazon Aurora database and the entire technology stack is currently deployed in the United States. Now, the company has plans to expand to Europe and Asia for its operations. It…
Answer: B. Use an Amazon Aurora Global Database for the games table and use Amazon Aurora for the users and games_played tables
Amazon Aurora Global Database replicates data globally with low latency, fulfilling the global table requirement. Maintaining regional data in Amazon Aurora minimizes application refactoring, whereas mixing in DynamoDB requires transitioning from SQL to NoSQL APIs.
Q12. The engineering team at a data analytics company has observed that its flagship application functions at its peak performance when the underlying Amazon Elastic Compute Cloud (Amazon EC2) instances have a CPU utilization of about 50%. The…
Answer: A. Configure the Auto Scaling group to use target tracking policy and set the CPU utilization as the target metric with a target value of 50%
Target tracking scaling policies automatically adjust capacity to maintain a specific metric, such as 50% CPU utilization. Step and simple scaling require manual CloudWatch alarms, lacking the continuous stabilization provided by target tracking.
Q13. A retail company's dynamic website is hosted using on-premises servers in its data center in the United States. The company is launching its website in Asia, and it wants to optimize the website loading times for new users in Asia. The web…
Answer: B. Use Amazon CloudFront with a custom origin pointing to the on-premises servers
Amazon CloudFront caches content at edge locations globally, reducing latency for international users while keeping the origin on-premises. Migrating to S3 fails the dynamic website requirement, and Route 53 routing alone cannot overcome the physical distance from the US servers.
Q14. A retail company has developed a REST API which is deployed in an Auto Scaling group behind an Application Load Balancer. The REST API stores the user data in Amazon DynamoDB and any static content, such as images, are served via Amazon Si…
Answer: C. Enable Amazon DynamoDB Accelerator (DAX) for Amazon DynamoDB and Amazon CloudFront for Amazon S3
Amazon DynamoDB Accelerator (DAX) delivers microsecond latency for DynamoDB reads without application code changes, while Amazon CloudFront provides low-latency access to static S3 assets. ElastiCache requires custom integration code, and Memcached cannot front S3 content.
Q15. The solo founder at a tech startup has just created a brand new AWS account. The founder has provisioned an Amazon EC2 instance 1A which is running in AWS Region A. Later, he takes a snapshot of the instance 1A and then creates a new Amazo…
Answer: C. 1 Amazon EC2 instance, 1 AMI and 1 snapshot exist in Region B
When an Amazon Machine Image is copied to a new region, the underlying Amazon EBS snapshot is also copied to that destination region. Launching the new instance from the copied AMI results in one instance, one AMI, and one snapshot residing in Region B.
Q16. The engineering team at an in-home fitness company is evaluating multiple in-memory data stores with the ability to power its on-demand, live leaderboard. The company's leaderboard requires high availability, low latency, and real-time pro…
Answer: A,D. Power the on-demand, live leaderboard using Amazon ElastiCache for Redis as it meets the in-memory, high availability, low latency requirements || Power the on-demand, live leaderboard using Amazon DynamoDB with DynamoDB Accelerator (DAX) as it meets the in-memory, high availability, low latency requirements
Amazon ElastiCache for Redis and Amazon DynamoDB with DAX both provide the required in-memory caching for real-time leaderboards. Standard DynamoDB, Aurora, and Neptune are not natively in-memory data stores.
Q17. A company runs a data processing workflow that takes about 60 minutes to complete. The workflow can withstand disruptions and it can be started and stopped multiple times. Which is the most cost-effective solution to build a solution for t…
Answer: C. Use Amazon EC2 spot instances to run the workflow processes
Amazon EC2 Spot Instances offer significant cost savings for workloads that are flexible and fault-tolerant. AWS Lambda has a strict fifteen-minute execution timeout, and both On-Demand and Reserved Instances are more expensive for interruptible tasks.
Q18. The development team at an e-commerce startup has set up multiple microservices running on Amazon EC2 instances under an Application Load Balancer. The team wants to route traffic to multiple back-end services based on the URL path of the…
Answer: C. Path-based Routing
Application Load Balancers use path-based routing to direct traffic based on the URL path, such as forward slashes for orders or products. Host-based routing relies on domain names, and query string routing uses URL parameters.
Q19. One of the biggest football leagues in Europe has granted the distribution rights for live streaming its matches in the USA to a silicon valley based streaming services company. As per the terms of distribution, the company must make sure…
Answer: A,E. Use Amazon Route 53 based geolocation routing policy to restrict distribution of content to only the locations in which you have distribution rights || Use georestriction to prevent users in specific geographic locations from accessing content that you're distributing through a Amazon CloudFront web distribution
Amazon Route 53 geolocation routing and Amazon CloudFront geo restriction enforce geographic content limits. Route 53 failover, latency, and weighted routing policies distribute traffic based on health or performance, not user location.
Q20. An e-commerce company is looking for a solution with high availability, as it plans to migrate its flagship application to a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances. The solution should allow for content-based routing…
Answer: D. Use an Application Load Balancer for distributing traffic to the Amazon EC2 instances spread across different Availability Zones (AZs). Configure Auto Scaling group to mask any failure of an instance
An Application Load Balancer operates at Layer 7 to enable content-based routing across multiple Availability Zones, fulfilling the high availability requirement. Network Load Balancers operate at Layer 4, and Auto Scaling groups alone cannot distribute traffic.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.