Practice for the Exams exam with 19 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A social photo-sharing web application is hosted on Amazon Elastic Compute Cloud (Amazon EC2) instances behind an Elasti. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A social photo-sharing web application is hosted on Amazon Elastic Compute Cloud (Amazon EC2) instances behin…
- An enterprise uses a centralized Amazon S3 bucket to store logs and reports generated by multiple analytics s…
- A company is looking at storing their less frequently accessed files on AWS that can be concurrently accessed…
- An e-commerce application uses an Amazon Aurora Multi-AZ deployment for its database. While analyzing the per…
- A video conferencing platform serves users worldwide through a globally distributed deployment of Amazon EC2…
- A company has recently launched a new mobile gaming application that the users are adopting rapidly. The comp…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A social photo-sharing web application is hosted on Amazon Elastic Compute Cloud (Amazon EC2) instances behind an Elastic Load Balancer. The app gives the users the ability to upload their photos and also shows a leaderboard on the homepag…
Answer: D. Attach the appropriate IAM role to the Amazon EC2 instance profile so that the instance can access Amazon S3 and Amazon DynamoDB
Attaching an IAM role to an EC2 instance profile uses temporary credentials to grant secure access to AWS services. Hardcoding long-term access keys on instances is a security risk, eliminating the options relying on manual credentials.
Q2. An enterprise uses a centralized Amazon S3 bucket to store logs and reports generated by multiple analytics services. Each service writes to and reads from a dedicated prefix (folder path) in the bucket. The company wants to enforce fine-g…
Answer: C. Configure individual S3 access points for each analytics service. Attach access point policies that restrict access to only the relevant prefix in the S3 bucket
Amazon S3 Access Points provide scalable and manageable access control for shared datasets. By attaching distinct policies to dedicated access points, you isolate prefix-level permissions perfectly without maintaining massive bucket policies.
Q3. A company is looking at storing their less frequently accessed files on AWS that can be concurrently accessed by hundreds of Amazon EC2 instances. The company needs the most cost-effective file storage service that provides immediate acces…
Answer: A. Amazon Elastic File System (EFS) Standard–IA storage class
Amazon EFS Standard-Infrequent Access provides cost-effective, concurrent file storage for less frequently accessed data. Object storage lacks file system semantics, and EBS volumes cannot be mounted concurrently by hundreds of instances.
Q4. An e-commerce application uses an Amazon Aurora Multi-AZ deployment for its database. While analyzing the performance metrics, the engineering team has found that the database reads are causing high input/output (I/O) and adding latency to…
Answer: D. Set up a read replica and modify the application to use the appropriate endpoint
Aurora read replicas offload read traffic via the cluster reader endpoint, reducing I/O contention on the writer instance. Options mentioning standby instances or built-in caching confuse Aurora with standard RDS or ElastiCache.
Q5. A video conferencing platform serves users worldwide through a globally distributed deployment of Amazon EC2 instances behind Network Load Balancers (NLBs) in several AWS Regions. The platform's architecture currently allows clients to con…
Answer: C. Deploy a standard accelerator in AWS Global Accelerator and register the existing regional NLBs as endpoints. Use the accelerator to route user requests through AWS's global edge network to the closest healthy Regional NLB
AWS Global Accelerator routes TCP and UDP traffic through the AWS global network, reducing latency for real-time applications using Network Load Balancers. CloudFront cannot cache Layer 4 traffic, making it unsuitable here.
Q6. A company has recently launched a new mobile gaming application that the users are adopting rapidly. The company uses Amazon RDS MySQL as the database. The engineering team wants an urgent solution to this issue where the rapidly increasin…
Answer: C. Enable storage auto-scaling for Amazon RDS MySQL
Enabling storage auto-scaling on an existing RDS database automatically expands capacity with zero administrative effort. Migrating to Aurora or DynamoDB requires unnecessary downtime and engineering overhead.
Q7. An IT company has built a solution wherein an Amazon Redshift cluster writes data to an Amazon S3 bucket belonging to a different AWS account. However, it is found that the files created in the Amazon S3 bucket using the UNLOAD command fro…
Answer: A. By default, an Amazon S3 object is owned by the AWS account that uploaded it. So the Amazon S3 bucket owner will not implicitly have access to the objects written by the Amazon Redshift cluster
By default, Amazon S3 objects are owned by the AWS account that uploaded them, even when the destination bucket is owned by another account. The bucket owner must explicitly grant object ownership or use cross-account IAM roles to access the unloaded files.
Q8. A financial institution is transitioning its critical back-office systems to AWS. These systems currently rely on Microsoft SQL Server databases hosted on on-premises infrastructure. The data is highly sensitive and subject to regulatory c…
Answer: C. Migrate the SQL Server databases to a Multi-AZ Amazon RDS for SQL Server deployment. Enable encryption at rest by using an AWS Key Management Service (AWS KMS) managed key
Amazon RDS for SQL Server provides a fully managed relational database, significantly reducing operational overhead compared to EC2. A Multi-AZ deployment ensures high availability, and AWS KMS encryption easily meets stringent security and compliance requirements.
Q9. Upon a security review of your AWS account, an AWS consultant has found that a few Amazon RDS databases are unencrypted. As a Solutions Architect, what steps must be taken to encrypt the Amazon RDS databases?
Answer: B. Take a snapshot of the database, copy it as an encrypted snapshot, and restore a database from the encrypted snapshot. Terminate the previous database
Amazon RDS does not allow you to enable encryption on an existing unencrypted database instance directly. You must create a snapshot of the database, copy it with encryption enabled, restore a new instance from the encrypted snapshot, and delete the old one.
Q10. A big data consulting firm needs to set up a data lake on Amazon S3 for a healthcare client. The data lake is split into raw and refined zones. For compliance reasons, the source data needs to be kept for a minimum of 5 years. The source d…
Answer: A,C. Use AWS Glue ETL job to write the transformed data in the refined zone using a compressed file format || Setup a lifecycle policy to transition the raw zone data into Amazon S3 Glacier Deep Archive after 1 day of object creation
A lifecycle policy moves infrequently accessed raw data into Amazon S3 Glacier Deep Archive to minimize long-term storage costs. Writing refined data in a compressed format reduces storage expenses and improves Amazon Athena query performance.
Q11. The DevOps team at a major financial services company uses Multi-Availability Zone (Multi-AZ) deployment for its MySQL Amazon RDS database in order to automate its database replication and augment data durability. The DevOps team has sched…
Answer: A. Any database engine level upgrade for an Amazon RDS database instance with Multi-AZ deployment triggers both the primary and standby database instances to be upgraded at the same time. This causes downtime until the upgrade is complete
Major database engine upgrades require downtime on Amazon RDS because both the primary and standby instances are upgraded simultaneously. This ensures they remain perfectly synchronized, ruling out options claiming zero downtime.
Q12. Your company has an on-premises Distributed File System Replication (DFSR) service to keep files synchronized on multiple Windows servers, and would like to migrate to AWS cloud. What do you recommend as a replacement for the DFSR?
Answer: D. Amazon FSx for Windows File Server
Amazon FSx for Windows File Server natively supports Windows environments and integrates with Microsoft Active Directory. It fully supports Distributed File System Replication, making it the ideal replacement for on-premises Windows file servers.
Q13. An IT company wants to optimize the costs incurred on its fleet of 100 Amazon EC2 instances for the next year. Based on historical analyses, the engineering team observed that 70 of these instances handle the compute services of its flagsh…
Answer: C. Purchase 70 reserved instances (RIs) and 30 spot instances
Reserved Instances provide significant discounts for steady-state workloads requiring continuous availability. Spot Instances offer the lowest cost for flexible, interruptible tasks like batch processing, making this combination the most cost-optimal.
Q14. A Hollywood studio is planning a series of promotional events leading up to the launch of the trailer of its next sci-fi thriller. The executives at the studio want to create a static website with lots of animations in line with the theme…
Answer: D. Build the website as a static website hosted on Amazon S3. Create an Amazon CloudFront distribution with Amazon S3 as the origin. Use Amazon Route 53 to create an alias record that points to your Amazon CloudFront distribution
Static websites are best hosted on Amazon S3 paired with Amazon CloudFront for low-latency global content delivery. Using Route 53 alias records ensures seamless domain routing, while eliminating servers minimizes costs.
Q15. A SaaS company is modernizing one of its legacy web applications by migrating it to AWS. The company aims to improve the availability of the application during both normal and peak traffic periods. Additionally, the company wants to implem…
Answer: A. Deploy the application on multiple Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones. Place an Application Load Balancer (ALB) in front of the group. Associate AWS WAF with the ALB
An Auto Scaling group across multiple Availability Zones ensures elasticity and fault tolerance. Integrating AWS WAF directly with an Application Load Balancer inspects Layer 7 traffic to block web exploits without managing underlying infrastructure.
Q16. A financial services company runs a Kubernetes-based microservices application in its on-premises data center. The application uses the Advanced Message Queuing Protocol (AMQP) to interact with a message queue. The company is experiencing…
Answer: C,D. Deploy the containerized application to Amazon Elastic Kubernetes Service (Amazon EKS) using AWS Fargate to avoid managing EC2 nodes || Replace the current messaging system with Amazon MQ, a fully managed broker that supports AMQP natively. Integrate the application with the Amazon MQ endpoint without modifying the existing message format
Amazon EKS with AWS Fargate removes the need to manage underlying worker nodes for Kubernetes workloads. Amazon MQ provides a fully managed message broker that natively supports AMQP, minimizing code changes and operational overhead.
Q17. A developer needs to implement an AWS Lambda function in AWS account A that accesses an Amazon Simple Storage Service (Amazon S3) bucket in AWS account B. As a Solutions Architect, which of the following will you recommend to meet this req…
Answer: B. Create an IAM role for the AWS Lambda function that grants access to the Amazon S3 bucket. Set the IAM role as the AWS Lambda function's execution role. Make sure that the bucket policy also grants access to the AWS Lambda function's execution role
Cross-account access requires granting permissions in both the IAM role and the S3 bucket policy. The Lambda execution role allows the function to assume permission, while the bucket policy explicitly trusts the cross-account role.
Q18. You have a team of developers in your company, and you would like to ensure they can quickly experiment with AWS Managed Policies by attaching them to their accounts, but you would like to prevent them from doing an escalation of privilege…
Answer: D. For each developer, define an IAM permission boundary that will restrict the managed policies they can attach to themselves
IAM permission boundaries set the maximum permissions an entity can ever attain, preventing privilege escalation. Boundaries can only be applied directly to IAM users or roles, not to IAM groups.
Q19. A global media agency is developing a cultural analysis project to explore how major sports stories have evolved over the last five years. The team has collected thousands of archived news bulletins and magazine spreads stored in PDF forma…
Answer: C. Send the extracted text to Amazon Comprehend for entity detection and sentiment analysis. Store the results in Amazon S3 for further access or visualization.
Amazon Comprehend provides pre-trained natural language processing for sentiment analysis and entity recognition directly from text. Pairing it with Amazon Textract creates a fully managed, serverless pipeline requiring no custom model training.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.