AWS Certified Solutions Architect Professional Practice Exam Questions and Answers – Part 13/16

Answer: C. Write TypeScript or Python code that will define AWS resources. Convert these codes to AWS CloudFormation templates by using AWS Cloud Development Kit (AWS CDK). Create CloudFormation stacks using AWS CDK. Create an AWS CodeBuild job that includes AWS CDK and add this stage to AWS CodePipeline.

The AWS Cloud Development Kit lets developers define cloud infrastructure using familiar programming languages like Python, which it then compiles into CloudFormation templates for deployment. This avoids the need to learn CloudFormation's JSON or YAML syntax while integrating smoothly with existing CodePipeline CI/CD workflows.

Answer: B. Use the EC2Rescue tool to diagnose and troubleshoot problems on your EC2 Linux and Windows Server instances. Run the tool automatically by using the AWS Systems Manager Automation and the AWSSupport-ExecuteEC2Rescue document.

The AWSSupport-ExecuteEC2Rescue Systems Manager Automation document securely automates the execution of the EC2Rescue tool to troubleshoot impaired instances. Relying on AWS Lambda with custom scripts is an anti-pattern here, as maintaining bespoke code introduces unnecessary operational overhead compared to managed SSM runbooks.

Answer: A. Use a CloudFront web distribution and an Application Load Balancer in front of an Auto Scaling group of EC2 instances. Use Amazon Cognito for user authentication. The web servers will process the user's vote and pass the result in an SQS queue. Set up an IAM Role to grant the EC2 instances permissions to write to the SQS queue. A group of EC2 instances will then retrieve and process the items from the queue. Finally, store the results in a DynamoDB table.

Amazon Cognito integrates natively with social identity providers to authenticate millions of users, while SQS decouples vote ingestion to absorb massive traffic spikes safely. Writing custom authentication services or attempting to use IAM directly for end-user social login introduces unnecessary complexity and fails to scale reliably.

Answer: B. Create a new IAM role for cross-account access which allows the online auditing system account to assume the role. Assign it a policy that allows only the actions required for the compliance audit.

Cross-account IAM roles provide temporary credentials following the principle of least privilege. Creating IAM users with long-term access keys for external parties violates security best practices and makes credential rotation difficult.

Answer: B. Stop the custom cluster controller instance and move it to the existing placement group.

You can simply stop an EC2 instance and move it into an existing cluster placement group to immediately gain low-latency benefits. Terminating instances or changing to a spread placement group is unnecessary and counterproductive to high-performance computing requirements.

Answer: B. A single AWS Direct Connect and an AWS managed VPN connection to connect your data center with Amazon VPC

Using a single Direct Connect for primary traffic and an AWS managed VPN as a backup provides a highly available, cost-effective hybrid setup. Direct Connect lacks built-in failover, so relying on a single connection without a VPN backup introduces unacceptable risk.

Answer: B,C. Update the CloudFront distribution and create a new behavior that will forward to the origin of the static assets based on path pattern. || Edit the CloudFront distribution and create another origin for serving the static assets.

You must configure CloudFront with multiple origins and path-pattern behaviors to correctly route static assets to S3 and dynamic traffic to the ALB. Relying on the Application Load Balancer to forward requests violates the S3 bucket's OAC restrictions, resulting in access errors.

Answer: D. Use Amazon WorkDocs for document storage and utilize its user access management, version control, and built-in encryption. Integrate the Amazon WorkDocs Content Manager to the external custom applications. Develop a rollback feature to replace the current document version with the previous version from Amazon WorkDocs.

Amazon WorkDocs provides a secure, fully managed content management solution with built-in version control and granular access management, exposed via an API. Using Amazon S3 and sharing client-side encryption keys across multiple customers violates least privilege principles, creating a massive security risk.

Answer: D. Launch an IAM Role that has the required permissions to read and write from the DynamoDB table. Reference the IAM Role as a property inside the AWS::IAM::InstanceProfile of the application instance.

Assigning an IAM role to an instance profile grants EC2 instances secure, temporary credentials to access AWS services like DynamoDB. Hardcoding access keys in CloudFormation parameters or user data violates security best practices and introduces significant long-term credential management risks.

Answer: D. Implement Step Functions to orchestrate batch processing workflows. Use the AWS Management Console to monitor workflow status and manage failure reprocessing.

AWS Step Functions provides managed state machines that naturally orchestrate complex workflows, handle retries automatically, and visualize execution status in the console. Building a custom polling mechanism with RDS and Lambda introduces unnecessary operational overhead and database connection management challenges.

Answer: A. Use CloudWatch for the monitoring and configure the scaling in policy of the Auto Scaling group to terminate one EC2 instance when the CPU Utilization is 15% or below.

CloudWatch alarms trigger simple scaling policies to terminate instances automatically based on real-time metrics like CPU utilization. Scheduled actions are unsuitable for unpredictable traffic patterns, and using Lambda or SNS for manual termination introduces unnecessary operational overhead instead of relying on built-in Auto Scaling capabilities.

Answer: C. Create a dedicated VPC for outbound internet traffic with a NAT gateway on it. Connect this VPC to the existing AWS Transit Gateway. Configure an AWS Network Firewall firewall for the rule-based filtering. Modify all the default routes in each account to point to the Network Firewall endpoint.

A centralized egress VPC with AWS Network Firewall connected to Transit Gateway provides managed, stateful inspection for all accounts. Deploying custom proxy appliances on EC2 instances introduces unnecessary operational overhead and scaling complexity compared to native services.

Answer: A. Create a pipeline in AWS CodePipeline that is triggered automatically for commits on the private GitHub repository. Have the pipeline create a change set and execute the CloudFormation template. Add an AWS CodeBuild stage on the pipeline to build and run test scripts to verify the new stack.

CodePipeline can monitor GitHub and automatically deploy CloudFormation changes using change sets. CodeDeploy is designed for application code deployment, not infrastructure, making it an invalid distractor for managing CloudFormation stack updates.

Answer: B,C. Create an AWS Lambda function to update the database IP addresses on the Systems Manager Parameter Store. Create an Amazon EC2 bootstrap script that will retrieve the database IP address from SSM Parameter Store. Update the local configuration files with the parameters. || Provision a pool of Elastic Network Interfaces (ENIs). Request a license file for each ENI from the software vendor. Store the license files on an Amazon S3 bucket and use bootstrap scripts to retrieve an unused license file and attach corresponding ENI when provisioning EC2 instances.

Storing IP addresses in Systems Manager Parameter Store allows bootstrap scripts to configure static IPs dynamically. Pre-provisioning Elastic Network Interfaces secures static MAC addresses for rigid licensing while allowing Auto Scaling group flexibility.

Answer: A. Launch a CloudFront web distribution with the URL of the on-premises web application as the origin. Offload the DNS to AWS to handle CloudFront traffic.

Amazon CloudFront can cache heavy media assets at edge locations using the on-premises application as a custom origin. Rehosting infrastructure to AWS fails the urgent timeline, whereas caching immediately offloads traffic.

Answer: C. Use an AWS Config Managed Rule and specify a list of approved AMI IDs. This rule will check whether running EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification for non-compliant instances.

AWS Config Managed Rules evaluate running instances for approved AMIs and send notifications without blocking initial deployments. Service Control Policies act as preventative guardrails, which contradicts allowing deployments and remediating later.