Practice for the Exams exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A startup is building a serverless microservices architecture where client applications (web and mobile) authenticate us. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A startup is building a serverless microservices architecture where client applications (web and mobile) auth…
- The engineering team at a social media company wants to use Amazon CloudWatch alarms to automatically recover…
- An e-commerce company is using Elastic Load Balancing (ELB) for its fleet of Amazon EC2 instances spread acro…
- A national logistics company has a dedicated AWS Direct Connect connection from its corporate data center to…
- A financial services company is migrating their messaging queues from self-managed message-oriented middlewar…
- A legacy application is built using a tightly-coupled monolithic architecture. Due to a sharp increase in the…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A startup is building a serverless microservices architecture where client applications (web and mobile) authenticate users via a third-party OIDC-compliant identity provider. The backend APIs must validate JSON Web Tokens (JWTs) issued by…
Answer: A. Use Amazon API Gateway HTTP API with a native JWT authorizer configured to validate tokens from the OIDC provider
Amazon API Gateway HTTP APIs support native JWT authorizers, enabling automatic validation of tokens from an OIDC provider. REST APIs require custom Lambda authorizers, increasing latency and costs.
Q2. The engineering team at a social media company wants to use Amazon CloudWatch alarms to automatically recover Amazon EC2 instances if they become impaired. The team has hired you as a solutions architect to provide subject matter expertise…
Answer: C,E. If your instance has a public IPv4 address, it retains the public IPv4 address after recovery || A recovered instance is identical to the original instance, including the instance ID, private IP addresses, Elastic IP addresses, and all instance metadata
Automatic instance recovery preserves the instance ID, private IP addresses, Elastic IP addresses, and public IPv4 address. Terminated instances cannot be recovered, and in-memory data is lost during the recovery process because the underlying hardware has failed.
Q3. An e-commerce company is using Elastic Load Balancing (ELB) for its fleet of Amazon EC2 instances spread across two Availability Zones (AZs), with one instance as a target in Availability Zone A and four instances as targets in Availabilit…
Answer: D. With cross-zone load balancing enabled, one instance in Availability Zone A receives 20% traffic and four instances in Availability Zone B receive 20% traffic each. With cross-zone load balancing disabled, one instance in Availability Zone A receives 50% traffic and four instances in Availability Zone B receive 12.5% traffic each
With cross-zone load balancing enabled, traffic is distributed evenly across all registered targets, giving each instance twenty percent of the load. When disabled, each load balancer node routes strictly within its local Availability Zone, heavily skewing traffic distribution.
Q4. A national logistics company has a dedicated AWS Direct Connect connection from its corporate data center to AWS. Within its AWS account, the company operates 25 Amazon VPCs in the same Region, each supporting different regional distributi…
Answer: A,E. Create an AWS Transit Gateway and attach all 25 VPCs to it. Enable route propagation for each attachment to automatically manage inter-VPC routing || Create a transit virtual interface (VIF) from the Direct Connect connection and associate it with the transit gateway
A transit gateway centralizes routing and enables transitive peering between attached VPCs. Associating a Direct Connect transit VIF with the transit gateway extends this hub-and-spoke model to on-premises networks, eliminating the operational overhead of managing individual private VIFs.
Q5. A financial services company is migrating their messaging queues from self-managed message-oriented middleware systems to Amazon Simple Queue Service (Amazon SQS). The development team at the company wants to minimize the costs of using Am…
Answer: C. Use SQS long polling to retrieve messages from your Amazon SQS queues
Amazon SQS long polling reduces the number of empty responses by waiting for messages to arrive before returning. Short polling immediately returns empty responses, increasing API call costs.
Q6. A legacy application is built using a tightly-coupled monolithic architecture. Due to a sharp increase in the number of users, the application performance has degraded. The company now wants to decouple the architecture and adopt AWS micro…
Answer: B. Configure Amazon Simple Queue Service (Amazon SQS) queue to decouple microservices running faster processes from the microservices running slower ones
Amazon SQS effectively decouples microservices by buffering messages, allowing slower consumers to process tasks from faster producers. SNS pushes messages immediately without buffering.
Q7. The DevOps team at a multi-national company is helping its subsidiaries standardize Amazon EC2 instances by using the same Amazon Machine Image (AMI). Some of these subsidiaries are in the same AWS region but use different AWS accounts whe…
Answer: B,E,F. You can copy an Amazon Machine Image (AMI) across AWS Regions || You can share an Amazon Machine Image (AMI) with another AWS account || Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot cannot result in an unencrypted target snapshot
Amazon Machine Images can be copied across AWS Regions and shared between AWS Accounts. Additionally, copying an encrypted snapshot will always result in an encrypted target snapshot.
Q8. The DevOps team at an IT company has recently migrated to AWS and they are configuring security groups for their two-tier application with public web servers and private database servers. The team wants to understand the allowed configurat…
Answer: A. You can use an Internet Gateway ID as the custom source for the inbound rule
Security group inbound rules require a valid source, such as an IP range or another security group. Internet Gateway IDs cannot be used as a source in security group rules.
Q9. A company wants to improve its gaming application by adding a leaderboard that uses a complex proprietary algorithm based on the participating user's performance metrics to identify the top users on a real-time basis. The technical require…
Answer: C,D. Use Amazon ElastiCache to improve the performance of compute-intensive workloads || Use Amazon ElastiCache to improve latency and throughput for read-heavy application workloads
Amazon ElastiCache accelerates read-heavy and compute-intensive workloads by serving frequently accessed data from memory. It is not optimal for write-heavy applications or complex relational joins.
Q10. A company has hired you as an AWS Certified Solutions Architect – Associate to help with redesigning a real-time data processor. The company wants to build custom applications that process and analyze the streaming data for its specialized…
Answer: C. Use Amazon Kinesis Data Streams to process the data streams as well as decouple the producers and consumers for the real-time data processor
Amazon Kinesis Data Streams enables custom applications to process and analyze streaming data in real time. SNS and SQS lack native streaming capabilities, while Kinesis Data Firehose is designed to load data directly into destinations rather than supporting custom processing logic.
Q11. A gaming company uses Application Load Balancers in front of Amazon EC2 instances for different services and microservices. The architecture has now become complex with too many Application Load Balancers in multiple AWS Regions. Security…
Answer: B. Launch AWS Global Accelerator and create endpoints for all the Regions. Register the Application Load Balancers of each Region to the corresponding endpoints
AWS Global Accelerator provides two static anycast IP addresses that front Application Load Balancers across multiple regions, simplifying firewall rules. Elastic IPs cannot be assigned to Application Load Balancers, and Layer 3 load balancing introduces unnecessary operational complexity.
Q12. A financial services company wants to move their Windows file server clusters out of their data centers. They are looking for cloud file storage offerings that provide full Windows compatibility. Can you identify the AWS storage services t…
Answer: B,E. File Gateway Configuration of AWS Storage Gateway || Amazon FSx for Windows File Server
Amazon FSx for Windows File Server provides fully managed native Windows file storage. The File Gateway configuration of AWS Storage Gateway also offers SMB protocol access, seamlessly bridging on-premises environments with Amazon S3.
Q13. A startup has recently moved their monolithic web application to AWS Cloud. The application runs on a single Amazon EC2 instance. Currently, the user base is small and the startup does not want to spend effort on elaborate disaster recover…
Answer: C. Configure an Amazon CloudWatch alarm that triggers the recovery of the Amazon EC2 instance, in case the instance fails. The instance, however, should only be configured with an Amazon EBS volume
Configuring an Amazon CloudWatch alarm to automatically recover an EC2 instance provides a cost-effective solution for system failures. The recovery action requires the instance to use Amazon EBS volumes, as instances relying on ephemeral instance store volumes cannot be restored.
Q14. An IT training company hosted its website on Amazon S3 a couple of years ago. Due to COVID-19 related travel restrictions, the training website has suddenly gained traction. With an almost 300% increase in the requests served per day, the…
Answer: B. Configure Amazon CloudFront to distribute the data hosted on Amazon S3 cost-effectively
Configuring Amazon CloudFront to distribute website content reduces both user latency and data transfer costs. Serving data directly from CloudFront edge locations is significantly cheaper than standard Amazon S3 outbound internet data transfer rates.
Q15. A retail company has connected its on-premises data center to the AWS Cloud via AWS Direct Connect. The company wants to be able to resolve Domain Name System (DNS) queries for any resources in the on-premises network from the AWS VPC and…
Answer: B,C. Create an outbound endpoint on Amazon Route 53 Resolver and then Amazon Route 53 Resolver can conditionally forward queries to resolvers on the on-premises network via this endpoint || Create an inbound endpoint on Amazon Route 53 Resolver and then DNS resolvers on the on-premises network can forward DNS queries to Amazon Route 53 Resolver via this endpoint
An inbound Route 53 Resolver endpoint allows on-premises networks to forward DNS queries to AWS. Conversely, an outbound endpoint uses conditional forwarding rules to resolve AWS VPC queries against your on-premises DNS infrastructure securely.
Q16. A company has set up AWS Organizations to manage several departments running their own AWS accounts. The departments operate from different countries and are spread across various AWS Regions. The company wants to set up a consistent resou…
Answer: C. Use AWS CloudFormation StackSets to deploy the same template across AWS accounts and regions
AWS CloudFormation StackSets extend stack functionality to deploy templates across multiple accounts and regions in a single operation. Standard templates and stacks lack this cross-account deployment capability, and AWS Resource Access Manager shares resources rather than deploying them.
Q17. A financial services company wants to identify any sensitive data stored on its Amazon S3 buckets. The company also wants to monitor and protect all data stored on Amazon S3 against any malicious activity. As a solutions architect, which o…
Answer: B. Use Amazon GuardDuty to monitor any malicious activity on data stored in Amazon S3. Use Amazon Macie to identify any sensitive data stored on Amazon S3
Amazon Macie uses machine learning to discover sensitive data like PII in S3, while Amazon GuardDuty analyzes logs for threats. GuardDuty handles threat detection, and Macie handles data classification and discovery.
Q18. A financial services company is modernizing its analytics platform on AWS. Their legacy data processing scripts, built for both Windows and Linux environments, require shared access to a file system that supports Windows ACLs and SMB proto…
Answer: A. Deploy Amazon FSx for Windows File Server and mount it using the SMB protocol from both Windows and Linux EC2 instances
Amazon FSx for Windows File Server natively supports SMB, NTFS permissions, and Active Directory integration for Windows and Linux instances. EFS and Lustre lack Windows ACL support, while Mountpoint for S3 is Linux-only and lacks file system features.
Q19. An IT company hosts Windows-based applications on its on-premises data center. The company is looking at moving the business to the AWS Cloud. The cloud solution should offer shared storage space that multiple applications can access witho…
Answer: B. Use Amazon FSx for Windows File Server as a shared storage solution
Amazon FSx for Windows File Server natively integrates with self-managed Active Directory and provides SMB shared storage. EFS and Lustre are Linux-based, and File Gateway acts as a hybrid bridge rather than a native shared file system.
Q20. A financial services firm runs a containerized risk analytics tool in its on-premises data center using Docker. The tool depends on persistent data storage for maintaining customer simulation results and operates on a single host machine w…
Answer: C. Use Amazon ECS with Fargate launch type. Provision an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS volume inside the container at runtime to provide persistent storage access
Amazon ECS with the Fargate launch type provides a fully managed, serverless compute environment that natively supports mounting Amazon EFS volumes for persistent storage. Options using EKS or manual EBS management violate the requirement to avoid infrastructure management.
Q21. A developer has configured inbound traffic for the relevant ports in both the Security Group of the Amazon EC2 instance as well as the Network Access Control List (Network ACL) of the subnet for the Amazon EC2 instance. The developer is, h…
Answer: C. Security Groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic
Security groups are stateful, automatically allowing return traffic for approved inbound connections. Network ACLs are stateless, requiring explicit outbound rules for ephemeral ports to complete the connection.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.