AWS Certified Solutions Architect – Associate — Practice Set 1

Question 1

A company is deploying a web application on Amazon EC2 instances in a public subnet. The application must accept HTTPS traffic from the internet and connect to an Amazon RDS MySQL database. The security team requires that the database be inaccessible from the internet and only reachable from the application tier. Which architecture MOST securely meets these requirements?

Accepted Answer

Placing Amazon RDS in a private subnet (with no route to an internet gateway) ensures it is unreachable from the internet at the network level. Restricting the RDS security group to allow inbound MySQL traffic only from the EC2 security group adds a second layer of defense. Option A places RDS in a public subnet, creating internet exposure even if the security group is restrictive. Option C is also in a public subnet — encryption at rest does not prevent network access. Option D adds unnecessary Lambda complexity and still leaves RDS in a public subnet.

Question 2

A solutions architect is designing an application that requires EC2 instances to call the Amazon S3 API and the Amazon DynamoDB API without embedding long-term credentials in the application code. The company has a strict policy against storing AWS access keys on EC2 instances. Which approach BEST meets these requirements?

Accepted Answer

Attaching an IAM role to EC2 instances allows the AWS SDK to automatically retrieve short-lived temporary credentials from the EC2 instance metadata service (IMDSv2) — no long-term credentials are ever stored on the instance. Option A retrieves keys at startup but still results in long-term credentials on the instance. Option B hard-codes credentials, violating the company policy. Option D distributes credentials via S3 and still results in static keys being placed on instances.

Question 3

A company is designing a multi-account AWS environment with separate accounts for development, staging, and production. The security team needs a centralized view of security findings — such as GuardDuty alerts, Inspector findings, and Macie discoveries — across all accounts from a single pane of glass. Which AWS service MOST directly provides this capability?

Accepted Answer

AWS Security Hub aggregates, normalizes, and prioritizes security findings from across multiple AWS accounts and services — including Amazon GuardDuty, Amazon Inspector, Amazon Macie, and third-party tools — into a single centralized dashboard. AWS Config tracks resource configuration states but does not aggregate security findings from other services. AWS CloudTrail records API calls. Amazon Detective helps investigate and analyze root causes of security issues but requires findings to already exist in GuardDuty.

Question 4

A company runs a web application behind an Application Load Balancer. The security team has discovered that certain geographic regions are the source of repeated SQL injection and cross-site scripting attacks. The team wants to block traffic from those regions and filter malicious request patterns with LEAST operational overhead. Which solution BEST meets these requirements?

Accepted Answer

AWS WAF integrates directly with an Application Load Balancer, allowing geo-match rules to block traffic by country with no IP range maintenance, and AWS Managed Rule Groups (such as the SQL injection and XSS rule set) automatically filter known attack patterns with minimal configuration. Network ACLs require manually maintaining IP CIDR lists, which is operationally expensive for geographic blocking. Amazon GuardDuty detects threats but does not block traffic. EC2 security groups operate at the instance level and cannot match geographic location or HTTP request patterns.

Question 5

A company stores sensitive financial records in Amazon S3. A compliance audit requires that all data be encrypted at rest using keys that the company controls, and that all key usage be fully auditable. The company's security policy prohibits using AWS-managed keys. Which encryption approach BEST meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key (CMK) in AWS KMS gives the company full control over the key policy, rotation, and usage — and every key usage event is automatically logged in AWS CloudTrail, providing complete auditability. SSE-S3 uses AWS-managed keys, violating the policy. Client-side encryption with a locally stored key avoids AWS key management entirely but loses the CloudTrail audit trail for key usage and is operationally complex. S3 Transfer Acceleration improves upload speeds and is unrelated to encryption key control.

Question 6

A company's application runs on Amazon EC2 instances and must call a third-party payment API over the internet. The security team requires that outbound traffic from the EC2 instances to the internet be routed through a single, auditable egress point so that the company can control and log all outbound connections. The EC2 instances must not have public IP addresses. Which architecture BEST meets these requirements?

Accepted Answer

A NAT Gateway in a public subnet provides a single managed egress point for EC2 instances in private subnets, allowing outbound internet access without assigning public IPs to the instances. VPC Flow Logs on the NAT Gateway subnet can audit all outbound connections. Option A assigns public IPs to instances, violating the requirement. Internet gateways cannot be attached directly to private subnets — the private subnet lacks a route to the IGW. AWS PrivateLink creates private connectivity to AWS or partner services with VPC endpoints, but third-party payment APIs are not typically available via PrivateLink.

Question 7

A company is deploying a new application and needs to give its development team the ability to create and manage Amazon S3 buckets in a specific AWS account, but not in any other account. The company uses AWS Organizations. Which mechanism provides the MOST precise control over this permission?

Accepted Answer

Combining IAM policies (granting S3 permissions in the designated account) with AWS Organizations Service Control Policies (SCPs — which can restrict S3 actions to a specific account's OU) provides the most precise and enforceable multi-account permission boundary. Granting root access is a severe security violation. S3 bucket policies control who can access specific buckets, not which account developers can operate in. S3 Block Public Access is a security feature to prevent public bucket exposure, unrelated to cross-account permission scoping.

Question 8

A company wants to provide its on-premises employees with single sign-on (SSO) access to AWS accounts using existing corporate Active Directory credentials, without creating separate IAM users for each employee. Which AWS service BEST enables this federated access?

Accepted Answer

AWS IAM Identity Center supports SAML 2.0-based federation with corporate Active Directory, allowing employees to sign in once with their existing AD credentials and access multiple AWS accounts without separate IAM users. Long-term access keys for each employee are a security anti-pattern and require managing credentials outside AD. Amazon Cognito user pools are for customer-facing application authentication, not corporate SSO to AWS accounts. AWS Directory Service extends AD to AWS but still requires mapping IAM users or roles, and does not provide the portal-based SSO experience of IAM Identity Center.

Question 9

A company runs a production web application on a single Amazon EC2 instance in one Availability Zone. The application must remain available if an entire Availability Zone fails. A solutions architect must redesign the architecture with the LEAST operational overhead. Which solution BEST meets this requirement?

Accepted Answer

An Auto Scaling group spanning multiple AZs with an Application Load Balancer provides automatic distribution of traffic and automatic replacement of failed instances with no manual intervention — the lowest operational overhead for multi-AZ availability. Daily EBS snapshots require manual restoration, causing extended downtime and significant operational effort. Route 53 health checks with manual intervention introduce human delay in failover. Vertical scaling (upgrading instance size) does not address the single-AZ single point of failure.

Question 10

A company hosts a critical database on Amazon RDS for MySQL with a Multi-AZ deployment. The database is used by an application that can tolerate up to 30 seconds of downtime during a failover. The team wants to ensure read-heavy analytics queries do not impact the primary database's write performance. Which solution BEST addresses BOTH requirements?

Accepted Answer

Amazon RDS Multi-AZ provides automatic failover to a standby replica typically within 60–120 seconds, satisfying the 30-second tolerance window (AWS targets under 2 minutes and often under 35 seconds). Adding Read Replicas offloads analytics queries to a separate instance, protecting write performance on the primary. ElastiCache caches data in memory but cannot serve complex analytics SQL queries directly. DynamoDB is a NoSQL database requiring application redesign. In a Multi-AZ deployment, the standby instance is not accessible for reads — only for failover.

Question 11

A company has a microservices application where services communicate synchronously via REST API calls. During peak load, a slow downstream service causes cascading failures across the entire application. A solutions architect must redesign the communication pattern to improve resilience. Which approach MOST effectively addresses this problem?

Accepted Answer

Replacing synchronous REST calls with Amazon SQS queues decouples producers from consumers: a slow downstream service only causes messages to queue rather than blocking and failing upstream services, preventing cascading failures. Increasing instance sizes (vertical scaling) does not eliminate the cascading failure pattern caused by synchronous coupling. CloudFront caches static content at the edge and is not applicable to microservice-to-microservice API calls. A Network Load Balancer provides TCP/IP load distribution but still results in synchronous calls that can cascade on slow downstream services.

Question 12

A company operates a global e-commerce platform with an RTO of 15 minutes and an RPO of 1 minute for its production database. The company wants to use AWS managed services to achieve this recovery target. Which disaster recovery strategy MOST cost-effectively meets BOTH the RTO and RPO requirements?

Accepted Answer

Amazon Aurora Global Database replicates data across Regions with typically less than 1 second lag (satisfying the 1-minute RPO) and supports managed failover in under 1 minute for the secondary Region (satisfying the 15-minute RTO). A warm standby keeps infrastructure pre-configured and ready, unlike pilot light. Backup and restore has recovery times measured in hours, far exceeding a 15-minute RTO. Pilot light requires spinning up and promoting a Read Replica during disaster, which may exceed the 15-minute RTO. Multi-site active-active meets the requirements but is significantly more expensive and complex than a warm standby approach.

Question 13

A company's application uses Amazon S3 to store user-uploaded files. The company is concerned that accidental deletions by application bugs could cause permanent data loss. The recovery solution must allow restoring any version of a file from the past 30 days with MINIMAL operational overhead. Which solution BEST meets these requirements?

Accepted Answer

Amazon S3 Versioning preserves every version of every object automatically, making any previous version recoverable instantly. A Lifecycle rule expiring non-current versions after 30 days controls storage costs while maintaining the 30-day recovery window. This is a fully managed, zero-code solution with minimal operational overhead. A daily Lambda backup function introduces code maintenance, and objects created or deleted within 24 hours might be missed. Cross-Region Replication synchronizes data to another Region but replicates deletions as well, so it does not protect against accidental application-level deletes. AWS Backup for S3 provides daily snapshots but the granularity may miss objects created between snapshot intervals.

Question 14

A company is designing a serverless order processing system. Orders submitted to the system must be processed exactly once, and the system must handle occasional duplicate submissions from the client application without processing an order twice. Which solution architecture MOST effectively addresses the duplicate-processing requirement?

Accepted Answer

Amazon SQS FIFO queues guarantee exactly-once processing using a message deduplication ID: if the same deduplication ID is submitted within a 5-minute window, SQS discards the duplicate, preventing double processing. SQS Standard queues offer at-least-once delivery and can deliver duplicates, which this use case cannot tolerate. Amazon SNS is a publish/subscribe notification service that does not deduplicate messages. Amazon Kinesis Data Streams delivers each record to a consumer but does not provide built-in deduplication by message ID.

Question 15

A company's e-commerce application stores product catalog data in an Amazon RDS database. The application runs database queries for every page load, causing high latency and database CPU usage during peak traffic. The product catalog data changes only once every few hours. Which solution MOST effectively reduces database load and improves response time?

Accepted Answer

Amazon ElastiCache for Redis provides an in-memory caching layer that serves repeated read queries in microseconds, dramatically reducing database load and improving response times for infrequently changing data like a product catalog. Scaling the RDS instance increases database capacity but does not reduce the volume of queries or improve read latency as effectively as caching. Multi-AZ improves availability through automatic failover but does not reduce read load. Amazon Redshift is a data warehouse optimized for analytical queries, not a low-latency transactional cache for web application reads.

Question 16

A company needs to process millions of IoT sensor readings per second in real time and feed the processed data into a machine learning model for anomaly detection. The solution must handle variable throughput with no data loss and LEAST operational overhead. Which AWS service BEST handles the ingestion and streaming layer?

Accepted Answer

Amazon Kinesis Data Streams is designed for real-time ingestion and processing of millions of records per second from IoT devices, retaining data for up to 365 days and supporting multiple consumers reading the same stream simultaneously (which is useful for routing to both ML anomaly detection and storage). SQS Standard is a queue for decoupling services but is not designed for high-throughput streaming analytics. Amazon MQ is a managed message broker for legacy protocols (AMQP, MQTT) and not optimized for high-scale streaming analytics. Amazon SNS is a pub/sub notification service without data retention for replay.

Question 17

A company's web application serves global users and hosts large media files in Amazon S3 in us-east-1. Users in Asia report slow download times for these files. The company wants to improve download performance for all global users with MINIMAL changes to the application architecture. Which solution BEST addresses this requirement?

Accepted Answer

Amazon CloudFront is a global CDN that caches content at edge locations close to end users worldwide, drastically reducing download latency for large media files without requiring application changes — just a CloudFront distribution pointing to the S3 origin. S3 Transfer Acceleration uses CloudFront edge locations to speed up uploads to S3, not downloads from S3. S3 Cross-Region Replication copies objects to additional Regions but requires either routing users to the nearest Region (complex) or maintaining multiple buckets. S3 does not have a provisioned throughput setting — it scales automatically.

Question 18

A company runs a high-traffic REST API on Amazon API Gateway backed by AWS Lambda functions. During peak hours, the API experiences elevated latency because Lambda functions are initializing (cold starts) frequently. The company wants to reduce cold start latency for the MOST critical API endpoints without significantly increasing cost. Which solution BEST addresses this requirement?

Accepted Answer

AWS Lambda Provisioned Concurrency keeps a specified number of Lambda function instances initialized and ready to respond instantly, eliminating cold starts for those invocations. It is applied selectively to the most critical functions, balancing latency improvement against cost. Maximizing memory allocation speeds up execution and initialization but does not eliminate cold starts for new concurrent invocations. Deploying behind a Network Load Balancer does not affect Lambda cold start behavior. Moving to Amazon ECS on Fargate is a significant architectural change that changes the compute model entirely and adds container management complexity.

Question 19

A company is designing a database layer for an application that requires single-digit millisecond read latency, support for 100 TB of data, automatic horizontal scaling, and no schema management overhead. The data is structured as key-value pairs with variable attributes. Which AWS database service MOST directly meets ALL of these requirements?

Accepted Answer

Amazon DynamoDB provides single-digit millisecond performance at any scale, stores schema-free key-value and document data with variable attributes, scales automatically to handle virtually unlimited data (including 100 TB+), and requires no schema management. Amazon RDS for PostgreSQL requires schema definition and scales vertically — horizontal read scaling is only for reads. Aurora Serverless v2 scales relational workloads but still requires schema management and is not a key-value store. Amazon Redshift is a columnar data warehouse optimized for analytical queries, not low-latency key-value reads.

Question 20

A company has a data pipeline that processes large files uploaded to Amazon S3. Each file triggers an AWS Lambda function. As files grow to 5 GB in size, Lambda functions are timing out before processing completes. The company wants a solution that can handle arbitrarily large files with LEAST operational overhead. Which solution BEST addresses this limitation?

Accepted Answer

AWS Glue is a fully managed serverless ETL service that can process files of any size without timeouts, and its jobs can be triggered automatically by Amazon S3 events via Amazon EventBridge with no infrastructure to manage. While Option A (maximum Lambda timeout of 15 minutes with 10 GB memory) might handle some large files, Lambda's hard 15-minute timeout cannot guarantee completion for arbitrarily large files. Amazon EMR is a managed Hadoop/Spark cluster but requires cluster provisioning and management. Pre-splitting files into chunks is client-side workaround requiring application changes and adds complexity.

Question 21

A company runs a batch data processing job every night between 2 AM and 6 AM. The job runs on a fleet of Amazon EC2 instances that can tolerate interruption and restart. The company wants to minimize compute costs. Which Amazon EC2 purchasing option is MOST cost-effective for this use case?

Accepted Answer

Spot Instances provide up to 90% cost savings compared to On-Demand pricing and are ideal for fault-tolerant, interruptible batch workloads that can checkpoint and restart. Since the job runs only 4 hours per night and can tolerate interruption, the interruption risk is acceptable. On-Demand is the highest per-hour price with no commitment discount. Reserved Instances require a 1- or 3-year commitment and are cost-effective for steady-state workloads, not intermittent 4-hour nightly jobs. Dedicated Instances ensure physical host isolation for compliance and are the most expensive option.

Question 22

A company stores 200 TB of archive data in Amazon S3. The data was last accessed 18 months ago and is unlikely to be accessed again, but must be retained for 7 years for compliance. The company wants to minimize storage costs while maintaining the data in Amazon S3. Which Amazon S3 storage class is MOST cost-effective for this requirement?

Accepted Answer

Amazon S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for data that is retained for long periods (7–10 years) and rarely or never accessed. It costs approximately $0.00099 per GB per month, a fraction of S3 Standard's cost. S3 Standard is for frequently accessed data and is the most expensive class. S3 Standard-IA is cheaper than Standard but more expensive than Glacier classes. S3 Glacier Instant Retrieval is cheaper than Standard-IA and provides millisecond retrieval, but is still more expensive than Deep Archive for data with no retrieval urgency.

Question 23

A solutions architect is reviewing an AWS account and finds that 40 Amazon EC2 instances are consistently running at 8% CPU utilization or less throughout the month. The company is using On-Demand pricing. Which action MOST effectively reduces the cost of these underutilized instances?

Accepted Answer

Right-sizing instances to match actual workload requirements reduces the per-hour cost, and Compute Savings Plans provide up to 66% discount over On-Demand in exchange for a consistent compute spend commitment — together these deliver the most effective cost reduction for always-on, predictable workloads. Spot Instances are not appropriate for production workloads that must run continuously (they can be interrupted). Auto Scaling to zero during business hours would make production services unavailable. Migrating all EC2-based workloads to Lambda requires significant application refactoring and may not be technically feasible.

Question 24

A company runs a development environment with 30 Amazon EC2 instances that are used only during business hours (Monday–Friday, 8 AM–6 PM). The instances are currently running 24/7. A solutions architect wants to reduce costs by automatically starting and stopping instances outside business hours. Which solution achieves this with LEAST operational overhead?

Accepted Answer

AWS Instance Scheduler is an AWS solution that uses AWS CloudFormation, AWS Lambda, and Amazon DynamoDB to automate start/stop schedules for EC2 and RDS instances. It is designed for exactly this use case — running instances only during business hours — and requires minimal custom code or ongoing maintenance. A custom Lambda function (Option B) achieves the same result but requires writing, testing, and maintaining code, adding operational overhead. Manual start/stop relies on human action, is error-prone, and has the highest operational overhead. Reserved Instances reduce the per-hour cost but the instances still run 24/7 — the company would only save ~50% versus up to ~70% by actually stopping instances for 14+ hours per day.

Question 25

A company transfers 50 TB of data per month from its AWS workloads in us-east-1 to an on-premises data center over the internet. The high data transfer costs are a concern. A solutions architect needs to reduce these costs without impacting reliability. Which solution provides the MOST significant cost reduction for this data transfer scenario?

Accepted Answer

AWS Direct Connect provides a dedicated private connection from AWS to the on-premises network with significantly lower data transfer rates than internet-based transfer — often 50–80% less per GB — making it the most cost-effective solution for consistently high-volume monthly data transfers. Amazon CloudFront reduces latency and cost for content distribution to end users, not for on-premises data center transfers. Compression reduces data volume but applies to internet transfer rates, providing only marginal savings. AWS Snowball Edge is a physical transfer appliance suited for one-time large migrations or extremely high-volume transfers, not for 50 TB/month recurring operational transfers.

SAA-C03 — AWS Certified Solutions Architect - Associate