Practice for the Exams exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A healthcare company has deployed its web application on Amazon Elastic Container Service (Amazon ECS) container instanc. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect – Associate practice test →
What you will practice
- A healthcare company has deployed its web application on Amazon Elastic Container Service (Amazon ECS) contai…
- The DevOps team at an IT company is provisioning a two-tier application in a VPC with a public subnet and a p…
- A data analytics company manages an application that stores user data in a Amazon DynamoDB table. The develop…
- An e-commerce company uses Microsoft Active Directory to provide users and groups with access to resources on…
- A financial services company has recently migrated from on-premises infrastructure to AWS Cloud. The DevOps t…
- A company is transferring a significant volume of data from on-site storage to AWS, where it will be accessed…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A healthcare company has deployed its web application on Amazon Elastic Container Service (Amazon ECS) container instances running behind an Application Load Balancer. The website slows down when the traffic spikes and the website availabi…
Answer: D. Configure AWS Auto Scaling to scale out the Amazon ECS cluster when the ECS service's CPU utilization rises above a threshold
Amazon ECS service auto scaling uses CloudWatch metrics from your specific ECS service, such as average CPU utilization, to add or remove tasks dynamically. Load balancers and generic CloudWatch alarms do not directly trigger ECS service scaling policies.
Q2. The DevOps team at an IT company is provisioning a two-tier application in a VPC with a public subnet and a private subnet. The team wants to use either a Network Address Translation (NAT) instance or a Network Address Translation (NAT) ga…
Answer: B,C,E. Security Groups can be associated with a NAT instance || NAT instance can be used as a bastion server || NAT instance supports port forwarding
A NAT instance operates as a standard EC2 instance, meaning it can be used as a bastion server, supports port forwarding, and utilizes security groups. A managed NAT gateway is a highly available service that does not support these specific features.
Q3. A data analytics company manages an application that stores user data in a Amazon DynamoDB table. The development team has observed that once in a while, the application writes corrupted data in the Amazon DynamoDB table. As soon as the is…
Answer: B. Use Amazon DynamoDB point in time recovery to restore the table to the state just before corrupted data was written
Amazon DynamoDB point-in-time recovery (PITR) provides continuous backups with per-second granularity, allowing you to restore a table to a specific state before data corruption occurred. On-demand backups are manual snapshots and cannot recover unscheduled mid-write errors.
Q4. An e-commerce company uses Microsoft Active Directory to provide users and groups with access to resources on the on-premises infrastructure. The company has extended its IT infrastructure to AWS in the form of a hybrid cloud. The engineer…
Answer: A. AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD)
AWS Managed Microsoft AD allows you to run directory-aware workloads in the cloud and establish trust relationships with your on-premises Active Directory. Simple AD lacks trust support, and AD Connector merely proxies requests to your existing infrastructure.
Q5. A financial services company has recently migrated from on-premises infrastructure to AWS Cloud. The DevOps team wants to implement a solution that allows all resource configurations to be reviewed and make sure that they meet compliance g…
Answer: B. Use AWS Config to review resource configurations to meet compliance guidelines and maintain a history of resource configuration changes
AWS Config is designed specifically to assess resource configurations for compliance and maintain a detailed history of changes over time. CloudTrail logs API actions, while CloudWatch monitors performance metrics, neither providing configuration state histories.
Q6. A company is transferring a significant volume of data from on-site storage to AWS, where it will be accessed by Windows, Mac, and Linux-based Amazon EC2 instances within the same AWS region using both SMB and NFS protocols. Part of this d…
Answer: B. Set up an Amazon FSx for ONTAP instance. Configure an FSx for ONTAP file system on the root volume and migrate the data to the FSx for ONTAP volume
Amazon FSx for NetApp ONTAP provides multi-protocol access to both SMB and NFS clients natively. FSx for OpenZFS and EFS only support NFS, eliminating them for environments requiring simultaneous Windows and Linux access.
Q7. A media streaming startup is building a set of backend APIs that will be consumed by external mobile applications. To prevent API abuse, protect downstream resources, and ensure fair usage across clients, the architecture must enforce rate…
Answer: D. Use Amazon API Gateway and configure usage plans with API keys to apply rate limits and quotas per client
Amazon API Gateway natively supports per-client rate limiting and usage quotas through API keys tied to usage plans. Load balancers operate at the network layer and do not provide built-in application-layer quota management for external consumers.
Q8. An e-commerce company runs its web application on Amazon EC2 instances in an Auto Scaling group and it's configured to handle consumer orders in an Amazon Simple Queue Service (Amazon SQS) queue for downstream processing. The DevOps team h…
Answer: B. Use a target tracking scaling policy based on a custom Amazon SQS queue metric
A target tracking scaling policy uses a custom backlog per instance metric to dynamically adjust capacity based on real demand. Simple or step scaling policies react slower to sudden traffic spikes, leading to degraded application performance.
Q9. An IT consultant is helping a small business revamp their technology infrastructure on the AWS Cloud. The business has two AWS accounts and all resources are provisioned in the us-west-2 region. The IT consultant is trying to launch an Ama…
Answer: A. Use Availability Zone (AZ) ID to uniquely identify the Availability Zones across the two AWS Accounts
AWS maps availability zone names differently across individual accounts for resource distribution. To ensure instances align in the exact same physical location across accounts, you must reference the unique Availability Zone ID.
Q10. An application running on an Amazon EC2 instance needs to access an Amazon DynamoDB table in the same AWS account. Which of the following solutions should a solutions architect configure for the necessary permissions?
Answer: A. Set up an IAM service role with the appropriate permissions to allow access to the Amazon DynamoDB table. Configure an instance profile to assign this IAM role to the Amazon EC2 instance
Assigning an IAM role via an instance profile is the secure AWS best practice for granting EC2 instances access to other AWS services. Hardcoding IAM user credentials in local storage or S3 buckets poses a severe security risk and violates AWS security principles.
Q11. A retail organization is moving some of its on-premises data to AWS Cloud. The DevOps team at the organization has set up an AWS Managed IPSec VPN Connection between their remote on-premises network and their Amazon VPC over the internet…
Answer: B. Create a virtual private gateway (VGW) on the AWS side of the VPN and a Customer Gateway on the on-premises side of the VPN
For an AWS Site-to-Site VPN, the virtual private gateway anchors the AWS side, while the customer gateway represents the on-premises router. Placing the virtual private gateway on-premises fails because that component is strictly an AWS-managed VPC endpoint.
Q12. A company recently experienced a database outage in its on-premises data center. The company now wants to migrate to a reliable database solution on AWS that minimizes data loss and stores every transaction on at least two nodes. Which of…
Answer: D. Set up an Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data
Amazon RDS Multi-AZ deployments provide high availability by synchronously replicating data to a standby instance in a different Availability Zone. Read replicas rely on asynchronous replication, making them unsuitable for meeting strict data loss prevention requirements.
Q13. A software company manages a fleet of Amazon EC2 instances that support internal analytics applications. These instances use an IAM role with custom policies to connect to Amazon RDS and AWS Secrets Manager for secure access to credentials…
Answer: C. Enable Default Host Management Configuration in AWS Systems Manager Quick Setup
Systems Manager Default Host Management Configuration automatically configures EC2 instances with required permissions for patching without altering existing IAM roles. Detaching or replacing roles risks application disruption, while cron jobs and hybrid activations add administrative overhead.
Q14. The application maintenance team at a company has noticed that the production application is very slow when the business reports are run on the Amazon RDS database. These reports fetch a large amount of data and have complex queries with m…
Answer: D. Create a read replica and connect the report generation tool/application to it
Routing heavy business reporting queries to an Amazon RDS read replica offloads read traffic from the primary database, keeping production applications unaffected. Multi-AZ standby instances cannot serve read traffic, and upgrading instances unnecessarily increases costs.
Q15. A leading online gaming company is migrating its flagship application to AWS Cloud for delivering its online games to users across the world. The company would like to use a Network Load Balancer to handle millions of requests per second…
Answer: A. Traffic is routed to instances using the primary private IP address specified in the primary network interface for the instance
When registering targets via instance IDs, a Network Load Balancer routes traffic using the primary private IP address of the instance's primary network interface. Public and Elastic IP addresses are ignored for internal routing to maintain VPC network boundaries.
Q16. A global pharmaceutical company wants to move most of the on-premises data into Amazon S3, Amazon Elastic File System (Amazon EFS), and Amazon FSx for Windows File Server easily, quickly, and cost-effectively. As a solutions architect, whi…
Answer: C. Use AWS DataSync to automate and accelerate online data transfers to the given AWS storage services
AWS DataSync automates and accelerates online migrations directly into Amazon S3, Amazon EFS, and Amazon FSx. AWS Transfer Family and File Gateway lack support for all three services, while Snowball Edge is strictly an offline physical migration appliance.
Q17. The DevOps team at an IT company has created a custom VPC (V1) and attached an Internet Gateway (I1) to the VPC. The team has also created a subnet (S1) in this custom VPC and added a route to this subnet's route table (R1) that directs in…
Answer: C. Internet Gateway (I1)
An Internet Gateway performs network address translation for instances assigned public IPv4 addresses in a public subnet. A NAT instance translates traffic for private subnet instances, so it is unnecessary and unused when the destination is already internet routable.
Q18. A company has its application servers in the public subnet that connect to the database instances in the private subnet. For regular maintenance, the database instances need patch fixes that need to be downloaded from the internet. Conside…
Answer: C. Configure a Network Address Translation gateway (NAT gateway) in the public subnet of the VPC
A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet while preventing inbound connections. The question specifies a fully managed service, which eliminates the unmanaged NAT instance, and IPv4, which eliminates the IPv6-only egress-only gateway.
Q19. An AWS Organization is using Service Control Policies (SCPs) for central control over the maximum available permissions for all accounts in their organization. This allows the organization to ensure that all accounts stay within the organi…
Answer: B,C,D. If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable service control policy (SCP), the user or role can't perform that action || Service control policy (SCP) affects all users and roles in the member accounts, including root user of the member accounts || Service control policy (SCP) does not affect service-linked role
Service Control Policies act as guardrails that set the maximum available permissions for an organization, overriding even the root user of member accounts. The key trap is that SCPs never affect service-linked roles, and any IAM policy granting access is rendered invalid if denied by an SCP.
Q20. An engineering lead is designing a VPC with public and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs) for high availability. An interne…
Answer: C. Set up three NAT gateways, one in each public subnet in each AZ. Create a custom route table for each AZ that forwards non-local traffic to the NAT gateway in its AZ
NAT gateways must be deployed in public subnets to provide outbound internet access to private subnets. To maintain high availability across Availability Zones, you must deploy a NAT gateway in the public subnet of each specific Availability Zone rather than sharing one.
Q21. A video conferencing application is hosted on a fleet of EC2 instances which are part of an Auto Scaling group. The Auto Scaling group uses a Launch Template (LT1) with "dedicated" instance tenancy but the VPC (V1) used by the Launch Templ…
Answer: A. The instances launched by both Launch Template LT1 and Launch Template LT2 will have dedicated instance tenancy
EC2 instance tenancy becomes dedicated if either the launch template or the VPC specifies dedicated tenancy. If either layer forces dedicated hardware, the resulting instance inherits it.
More AWS Certified Solutions Architect – Associate drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.