Practice for the Exams exam with 19 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A media production studio is building a content rendering and editing platform on AWS. The editing workstations and rend. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A media production studio is building a content rendering and editing platform on AWS. The editing workstatio…
- An application is currently hosted on four Amazon EC2 instances (behind Application Load Balancer) deployed i…
- An e-commerce company operates multiple AWS accounts and has interconnected these accounts in a hub-and-spoke…
- An HTTP application is deployed on an Auto Scaling Group, is accessible from an Application Load Balancer (AL…
- A startup has just developed a video backup service hosted on a fleet of Amazon EC2 instances. The Amazon EC2…
- Amazon EC2 Auto Scaling needs to terminate an instance from Availability Zone (AZ) us-east-1a as it has the m…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A media production studio is building a content rendering and editing platform on AWS. The editing workstations and rendering tools require access to shared files over the SMB (Server Message Block) protocol. The studio wants a managed sto…
Answer: B. Provision an Amazon FSx for Windows File Server file system. Mount the file system using the SMB protocol on the media servers
Amazon FSx for Windows File Server provides fully managed shared storage with native SMB protocol support. It automates administrative tasks like patching, backups, and replication, minimizing operational overhead for the media studio.
Q2. An application is currently hosted on four Amazon EC2 instances (behind Application Load Balancer) deployed in a single Availability Zone (AZ). To maintain an acceptable level of end-user experience, the application needs at least 4 instan…
Answer: A. Deploy the instances in three Availability Zones (AZs). Launch two instances in each Availability Zone (AZ)
Distributing six instances across three Availability Zones maintains the required capacity of four instances if one zone fails. This architecture provides high availability without the excessive costs of over-provisioning instances.
Q3. An e-commerce company operates multiple AWS accounts and has interconnected these accounts in a hub-and-spoke style using an AWS Transit Gateway. Amazon Virtual Private Cloud (Amazon VPCs) have been provisioned across these AWS accounts to…
Answer: B. Build a shared services Amazon Virtual Private Cloud (Amazon VPC)
A shared services VPC centralizes resources like directory services and VPC endpoints when using AWS Transit Gateway. Fully meshed peering or transit VPCs introduce massive administrative overhead and additional data transfer charges.
Q4. An HTTP application is deployed on an Auto Scaling Group, is accessible from an Application Load Balancer (ALB) that provides HTTPS termination, and accesses a PostgreSQL database managed by Amazon RDS. How should you configure the securit…
Answer: B,D,E. The security group of Amazon RDS should have an inbound rule from the security group of the Amazon EC2 instances in the Auto Scaling group on port 5432 || The security group of the Application Load Balancer should have an inbound rule from anywhere on port 443 || The security group of the Amazon EC2 instances should have an inbound rule from the security group of the Application Load Balancer on port 80
Security groups must follow the exact traffic flow, restricting inbound access to only the necessary ports and originating security groups. The load balancer accepts traffic on port 443, instances accept port 80 from the load balancer, and the database accepts port 5432 from the instances.
Q5. A startup has just developed a video backup service hosted on a fleet of Amazon EC2 instances. The Amazon EC2 instances are behind an Application Load Balancer and the instances are using Amazon Elastic Block Store (Amazon EBS) Volumes for…
Answer: A,B. Mount Amazon Elastic File System (Amazon EFS) on all Amazon EC2 instances. Write a one time job to copy the videos from all Amazon EBS volumes to Amazon EFS. Modify the application to use Amazon EFS for storing the videos || Write a one time job to copy the videos from all Amazon EBS volumes to Amazon S3 and then modify the application to use Amazon S3 standard for storing the videos
Using shared storage like Amazon S3 or Amazon EFS ensures data remains centrally accessible regardless of which load-balanced instance handles the request. Block storage like EBS is locally attached to one instance, causing data dispersion when traffic is distributed across multiple instances.
Q6. Amazon EC2 Auto Scaling needs to terminate an instance from Availability Zone (AZ) us-east-1a as it has the most number of instances amongst the Availability Zone (AZs) being used currently. There are 4 instances in the Availability Zone (…
Answer: D. Instance B
The default termination policy prioritizes instances using older launch configurations before those using launch templates. Proximity to the next billing hour is an outdated legacy criterion that no longer applies to modern AWS billing.
Q7. A health-care solutions company wants to run their applications on single-tenant hardware to meet regulatory guidelines. Which of the following is the MOST cost-effective way of isolating their Amazon Elastic Compute Cloud (Amazon EC2) ins…
Answer: C. Dedicated Instances
Dedicated Instances run on single-tenant hardware without offering visibility into the physical server sockets. Dedicated Hosts provide additional control for licensing but are more expensive and unnecessary unless you specifically need to manage instance placement.
Q8. A security consultant is designing a solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Since the individual developers will ha…
Answer: D. Set up a service control policy (SCP) that prohibits changes to AWS CloudTrail, and attach it to the developer accounts
Service control policies enforce maximum permission boundaries across AWS Organizations member accounts, completely restricting even the root user. IAM policies attached to the root user fail because the root user can simply modify or detach those policies.
Q9. A retail company wants to roll out and test a blue/green deployment for its global application in the next 48 hours. Most of the customers use mobile phones which are prone to Domain Name System (DNS) caching. The company has only two days…
Answer: A. Use AWS Global Accelerator to distribute a portion of traffic to a particular deployment
AWS Global Accelerator shifts traffic using static IP addresses, bypassing client DNS caching for immediate blue/green transitions. Route 53 weighted routing is unreliable for rapid deployments because mobile devices cache DNS records for extended periods.
Q10. A systems administrator has created a private hosted zone and associated it with a Virtual Private Cloud (VPC). However, the Domain Name System (DNS) queries for the private hosted zone remain unresolved. As a Solutions Architect, can you…
Answer: C. Enable DNS hostnames and DNS resolution for private hosted zones
Private hosted zones require both DNS resolution and DNS hostnames to be enabled on the VPC. The VPC resolver uses these settings to intercept and route internal domain queries to the correct Route 53 records.
Q11. A social media application is hosted on an Amazon EC2 fleet running behind an Application Load Balancer. The application traffic is fronted by an Amazon CloudFront distribution. The engineering team wants to decouple the user authenticatio…
Answer: B. Use Amazon Cognito Authentication via Cognito User Pools for your Application Load Balancer
Application Load Balancers natively support integrating with Amazon Cognito User Pools to offload user authentication. This allows your backend EC2 instances to focus solely on application business logic without handling custom authentication code.
Q12. An engineering team wants to examine the feasibility of the user data feature of Amazon EC2 for an upcoming project. Which of the following are true about the Amazon EC2 user data configuration? (Select two)
Answer: A,E. By default, user data runs only during the boot cycle when you first launch an instance || By default, scripts entered as user data are executed with root user privileges
Amazon EC2 user data scripts execute with root user privileges and run only during the initial boot cycle when an instance is first launched. These defaults simplify automated configuration tasks without requiring sudo commands.
Q13. A financial services company has developed its flagship application on AWS Cloud with data security requirements such that the encryption key must be stored in a custom application running on-premises. The company wants to offload the data…
Answer: A. Server-Side Encryption with Customer-Provided Keys (SSE-C)
Server-Side Encryption with Customer-Provided Keys (SSE-C) lets Amazon S3 manage the encryption process while you retain full control over the encryption keys. This offloads storage processing without surrendering custom key management.
Q14. To improve the performance and security of the application, the engineering team at a company has created an Amazon CloudFront distribution with an Application Load Balancer as the custom origin. The team has also set up an AWS Web Applica…
Answer: A. Create an IP match condition in the AWS WAF to block the malicious IP address
AWS WAF allows you to block specific malicious IP addresses using IP match conditions within your web ACL. Security groups only support allow rules, and network ACLs do not scale well for edge protection.
Q15. A media publishing company is migrating its legacy content management application to AWS. Currently, the application and its MySQL database run on a single on-premises virtual machine, which creates a single point of failure and limits sca…
Answer: B. Migrate the application to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Use Amazon Aurora Serverless v2 for MySQL to manage the database layer with auto-scaling and built-in high availability
Aurora Serverless v2 provides automatic scaling and high availability for MySQL-compatible workloads while minimizing operational overhead. Option D is viable but lacks the database auto-scaling requested, making Aurora Serverless v2 the strongest answer.
Q16. You have multiple AWS accounts within a single AWS Region managed by AWS Organizations and you would like to ensure all Amazon EC2 instances in all these accounts can communicate privately. Which of the following solutions provides the cap…
Answer: C. Create a virtual private cloud (VPC) in an account and share one or more of its subnets with the other accounts using Resource Access Manager
Sharing subnets across accounts using AWS Resource Access Manager avoids transit gateway fees and complex peering meshes. Instances deployed in the same shared subnet communicate locally without extra costs.
Q17. You would like to use AWS Snowball to move on-premises backups into a long term archival tier on AWS. Which solution provides the MOST cost savings?
Answer: B. Create an AWS Snowball job and target an Amazon S3 bucket. Create a lifecycle policy to transition this data to Amazon S3 Glacier Deep Archive on the same day
Snowball jobs must target a standard S3 bucket, where a zero-day lifecycle policy immediately moves data to Glacier Deep Archive for the lowest archival cost. Snowball cannot write directly to Glacier classes.
Q18. You are establishing a monitoring solution for desktop systems, that will be sending telemetry data into AWS every 1 minute. Data for each system must be processed in order, independently, and you would like to scale the number of consumer…
Answer: A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO (First-In-First-Out) queue, and make sure the telemetry data is sent with a Group ID attribute representing the value of the Desktop ID
Using an SQS FIFO queue with a Message Group ID matching the Desktop ID preserves per-system ordering while allowing multiple consumers to process messages concurrently. Without a Group ID, throughput is bottlenecked.
Q19. A retail company wants to share sensitive accounting data that is stored in an Amazon RDS database instance with an external auditor. The auditor has its own AWS account and needs its own copy of the database. Which of the following would…
Answer: D. Create an encrypted snapshot of the database, share the snapshot, and allow access to the AWS Key Management Service (AWS KMS) encryption key
Sharing an encrypted RDS snapshot and granting KMS key access lets the auditor securely restore a private database copy. Options involving direct S3 exports or cross-account read replicas fail security or isolation requirements.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.