Practice for the Exams exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A wildlife research organization uses IoT-based motion sensors attached to thousands of migrating animals to monitor the. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A wildlife research organization uses IoT-based motion sensors attached to thousands of migrating animals to…
- A company has historically operated only in the us-east-1 region and stores encrypted data in Amazon S3 using…
- A media company is migrating its flagship application from its on-premises data center to AWS for improving t…
- A machine learning research group uses a proprietary computer vision application hosted on an Amazon EC2 inst…
- Your company has a monthly big data workload, running for about 2 hours, which can be efficiently distributed…
- A manufacturing analytics company has a large collection of automated scripts that perform data cleanup, vali…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A wildlife research organization uses IoT-based motion sensors attached to thousands of migrating animals to monitor their movement across regions. Every few minutes, a sensor checks for significant movement and sends updated location data…
Answer: B. Create an Amazon Simple Queue Service (Amazon SQS) queue to buffer the incoming location data. Configure the backend application to poll the queue and process messages
An Amazon SQS queue decouples the ingestion layer from the processing layer, providing a buffer for traffic surges. Distractors like Firehose or custom queues introduce higher latency or unnecessary operational overhead.
Q2. A company has historically operated only in the us-east-1 region and stores encrypted data in Amazon S3 using SSE-KMS. As part of enhancing its security posture as well as improving the backup and recovery architecture, the company wants t…
Answer: C. Create a new Amazon S3 bucket in the us-east-1 region with replication enabled from this new bucket into another bucket in us-west-1 region. Enable SSE-KMS encryption on the new bucket in us-east-1 region by using an AWS KMS multi-region key. Copy the existing data from the current Amazon S3 bucket in us-east-1 region into this new Amazon S3 bucket in us-east-1 region
AWS KMS multi-region keys allow data to be encrypted and decrypted across different regions without re-encryption. Existing single-region keys cannot be converted or shared, so you must create a new multi-region key and copy the data to a new bucket for replication.
Q3. A media company is migrating its flagship application from its on-premises data center to AWS for improving the application's read-scaling capability as well as its availability. The existing architecture leverages a Microsoft SQL Server d…
Answer: B. Leverage Amazon Aurora MySQL with Multi-AZ Aurora Replicas and create the dev database by restoring from the automated backups of Amazon Aurora
Amazon Aurora MySQL provides high availability and read scaling through Multi-AZ Aurora Replicas. You can restore the development database from continuous, incremental automated backups without impacting primary database performance.
Q4. A machine learning research group uses a proprietary computer vision application hosted on an Amazon EC2 instance. Every time the instance needs to be stopped and started again, the application takes about 3 minutes to start as some auxili…
Answer: D. Use Amazon EC2 Instance Hibernate
Amazon EC2 instance hibernation saves the RAM contents to the EBS root volume upon stopping. When the instance restarts, the operating system and previously running applications resume instantly, bypassing the lengthy bootstrap process.
Q5. Your company has a monthly big data workload, running for about 2 hours, which can be efficiently distributed across multiple servers of various sizes, with a variable number of CPUs. The solution for the workload should be able to withsta…
Answer: C. Run the workload on a Spot Fleet
A Spot Fleet automatically maintains target capacity by launching replacement instances if interruptions occur. Individual Spot Instances lack automatic fleet replenishment, while Reserved Instances and Dedicated Hosts are too expensive for intermittent workloads.
Q6. A manufacturing analytics company has a large collection of automated scripts that perform data cleanup, validation, and system integration tasks. These scripts are currently run by a local Linux cron scheduler and have an execution time o…
Answer: B. Package the scripts into a container image. Use Amazon EventBridge Scheduler to define cron-based recurring schedules. Configure EventBridge Scheduler to invoke AWS Fargate tasks using Amazon ECS
Amazon EventBridge Scheduler combined with AWS Fargate provides a serverless, cron-based container execution environment without underlying infrastructure management. AWS Lambda is disqualified here because its fifteen-minute timeout cannot handle thirty-minute scripts.
Q7. A multinational logistics company is migrating its core systems to AWS. As part of this migration, the company has built an Amazon S3–based data lake to ingest and analyze supply chain data from external carriers and vendors. While some ve…
Answer: D. Deploy a fully managed AWS Transfer Family endpoint with SFTP enabled. Configure it to store uploaded files directly in an Amazon S3 bucket. Set up IAM roles mapped to each vendor for secure bucket or prefix access
AWS Transfer Family provides a managed SFTP endpoint that maps users to IAM roles for secure direct-to-S3 uploads. Option A incorrectly focuses on bucket policies and Cognito, blurring the primary managed integration.
Q8. An enterprise organization is expanding its cloud footprint and needs to centralize its security event data from various AWS accounts and services. The goal is to evaluate security posture across all environments and improve threat detecti…
Answer: B. Use Amazon Security Lake to create a centralized data lake that automatically collects security-related logs and events from AWS services and third-party sources. Store the data in an Amazon S3 bucket managed by Security Lake
Amazon Security Lake automatically centralizes and normalizes security data, minimizing development effort. The other options require custom integrations and lack built-in native log collection, or use the wrong service for security data.
Q9. An IT company is working on a client project to build a Supply Chain Management application. The web-tier of the application runs on an Amazon EC2 instance and the database tier is on Amazon RDS MySQL. For beta testing, all the resources a…
Answer: C. Deploy the web-tier Amazon EC2 instances in two Availability Zones (AZs), behind an Elastic Load Balancer. Deploy the Amazon RDS MySQL database in Multi-AZ configuration
Deploying instances across two Availability Zones behind an Elastic Load Balancer with a Multi-AZ database provides high availability. Read replicas do not provide availability, and Elastic Load Balancers cannot span across multiple regions.
Q10. An IT company has an Access Control Management (ACM) application that uses Amazon RDS for MySQL but is running into performance issues despite using Read Replicas. The company has hired you as a solutions architect to address these perform…
Answer: C. Use Amazon Aurora Global Database to enable fast local reads with low latency in each region
Amazon Aurora Global Database provides low-latency global reads while maintaining the existing relational database schema. Options involving DynamoDB or Redshift require changing the database schema, violating the requirements.
Q11. A media company has created an AWS Direct Connect connection for migrating its flagship application to the AWS Cloud. The on-premises application writes hundreds of video files into a mounted NFS file system daily. Post-migration, the comp…
Answer: A. Configure an AWS DataSync agent on the on-premises server that has access to the NFS file system. Transfer data over the AWS Direct Connect connection to an AWS PrivateLink interface VPC endpoint for Amazon EFS by using a private VIF. Set up an AWS DataSync scheduled task to send the video files to the Amazon EFS file system every 24 hours
AWS DataSync can efficiently transfer files over a private virtual interface to an Amazon EFS interface endpoint. The other options introduce unnecessary complexity or incorrectly use public VIFs and gateway endpoints for Direct Connect.
Q12. A financial services company has deployed its flagship application on Amazon EC2 instances. Since the application handles sensitive customer data, the security team at the company wants to ensure that any third-party Secure Sockets Layer c…
Answer: B. Leverage AWS Config managed rule to check if any third-party SSL/TLS certificates imported into ACM are marked for expiration within 30 days. Configure the rule to trigger an Amazon SNS notification to the security team if any certificate expires within 30 days
AWS Config managed rules check for imported ACM certificates nearing expiration, triggering SNS with minimal effort. ACM-generated certificates renew automatically, while CloudWatch requires more configuration overhead.
Q13. An application runs big data workloads on Amazon Elastic Compute Cloud (Amazon EC2) instances. The application runs 24×7 all round the year and needs at least 20 instances to maintain a minimum acceptable performance threshold and the appl…
Answer: C. Purchase 80 reserved instances (RIs). Provision additional on-demand and spot instances per the workload demand (Use Auto Scaling Group with launch template to provision the mix of on-demand and spot instances)
Reserved instances provide the highest cost optimization for steady-state workloads, offering significant savings over on-demand. Spikes are handled by on-demand and spot instances, whereas steady spot instances risk interruptions.
Q14. An enterprise is building a secure business intelligence API using Amazon API Gateway to serve internal users with confidential analytics data. The API must be accessible only from a set of trusted IP addresses that are part of the organiz…
Answer: A. Create a resource policy for the API Gateway API that explicitly denies access to all IP addresses except those listed in an allow list
API Gateway uses resource policies to restrict access based on IP addresses. Security groups cannot be attached to API Gateway because it is a managed service that does not deploy directly into your VPC subnets.
Q15. A silicon valley based startup has a content management application with the web-tier running on Amazon EC2 instances and the database tier running on Amazon Aurora. Currently, the entire infrastructure is located in us-east-1 region. The…
Answer: A,D. Create Amazon Aurora read replicas in the eu-west-1 region || Setup another fleet of Amazon EC2 instances for the web tier in the eu-west-1 region. Enable latency routing policy in Amazon Route 53
Cross-region Aurora read replicas scale database reads globally, while Route 53 latency routing directs users to the closest web tier. Failover and geolocation policies target disaster recovery and content restrictions, not performance.
Q16. The engineering team at a logistics company has noticed that the Auto Scaling group (ASG) is not terminating an unhealthy Amazon EC2 instance. As a Solutions Architect, which of the following options would you suggest to troubleshoot the i…
Answer: B,C,D. The instance maybe in Impaired status || The health check grace period for the instance has not expired || The instance has failed the Elastic Load Balancing (ELB) health check status
Amazon EC2 Auto Scaling relies on configured health checks, grace periods, and specific health status reporting to determine when to terminate instances. A failing ELB health check won't trigger termination if the ASG health check type is still set to EC2, and impaired instances are given time to recover.
Q17. A silicon valley based startup has a two-tier architecture using Amazon EC2 instances for its flagship application. The web servers (listening on port 443), which have been assigned security group A, are in public subnets across two Availa…
Answer: C,D. For security group B: Add an inbound rule that allows traffic only from security group A on port 1433 || For security group A: Add an inbound rule that allows traffic from all sources on port 443. Add an outbound rule with the destination as security group B on port 1433
Security groups enforce least privilege by restricting database access to specific ports and source security groups. The web tier allows public traffic on port 443 and restricts outbound traffic to the database on port 1433.
Q18. The engineering manager for a content management application wants to set up Amazon RDS read replicas to provide enhanced performance and read scalability. The manager wants to understand the data transfer charges while setting up Amazon R…
Answer: B. There are data transfer charges for replicating data across AWS Regions
There are no data transfer charges for replicating Amazon RDS data within the same AWS Region. Charges only apply when cross-Region replication is used. Regional or AZ-based replication options are incorrect because AWS does not bill for that traffic.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.