AWS Certified Solutions Architect – Professional — Practice Set 1

Question 1

A global enterprise operates across 12 AWS accounts within an AWS Organizations structure. Each account belongs to one of three organizational units (OUs): Production, Development, and Sandbox. The security team requires that all Production accounts must: (1) never allow EC2 instances with public IP addresses, (2) block creation of IAM users (only IAM Identity Center users are permitted), and (3) prevent deletion of AWS CloudTrail trails. These guardrails must be enforced centrally and cannot be overridden by individual account administrators. Sandbox accounts must have no restrictions. Development accounts need restriction (3) only. The company wants to apply these controls with the LEAST administrative overhead. Which approach BEST meets all requirements?

The company currently uses AWS Config rules in each account but finds them difficult to scale. The security team wants preventive controls, not detective controls.

Accepted Answer

AWS Organizations Service Control Policies (SCPs) are preventive controls — they deny API actions at the organizational level regardless of IAM permissions within the account. An SCP on the Production OU denying ec2:RunInstances (with a condition for public IP), iam:CreateUser, and cloudtrail:DeleteTrail enforces all three requirements and cannot be overridden by account admins. A separate SCP on the Development OU denying only cloudtrail:DeleteTrail covers requirement (3) for Development. Sandbox accounts inherit only the root FullAWSAccess SCP and are unrestricted. This requires three SCP documents and three attachments — minimal administrative overhead. Option A uses AWS Config rules, which are detective (they detect violations after the fact) not preventive (they do not block the API call). Option C uses CloudFormation StackSets to deploy IAM permission boundaries and Config rules, which are more complex to maintain and still do not provide true preventive controls. Option D AWS Control Tower Guardrails is a valid approach but requires enrolling all accounts in Control Tower (which may require migration) and has less flexibility for custom SCP conditions.

Question 2

A multinational corporation manages 200 AWS accounts across five continents using AWS Organizations. The networking team needs all accounts to use a centralised, transit-based network where VPCs in any account can communicate with shared services (Active Directory, DNS resolvers, monitoring tools) hosted in a dedicated Network Services account. Each regional group of accounts must be able to communicate with each other within the region, but cross-region communication between accounts must be blocked by default. New accounts must automatically be peered to the regional transit network without manual configuration. The solution must MINIMISE cost and operational overhead.

The existing network uses VPC peering between accounts, which has become unmanageable at scale. The team wants to consolidate to a hub-and-spoke model.

Accepted Answer

AWS Transit Gateway acts as a regional hub that can connect up to 5,000 VPCs and accounts. Sharing a Transit Gateway via AWS RAM using AWS Organizations integration automatically makes it available to all existing and newly joined member accounts in the specified OU or organisation, eliminating manual peering for new accounts. Separate route tables per region (or per OU) enforce the requirement that cross-region communication is blocked by default — simply do not create cross-region TGW peering attachments, or use route table policies to block inter-region routes. Option B full-mesh VPC peering at 200 accounts within a region requires up to n*(n-1)/2 = 19,900 peering connections per region — completely unmanageable and exactly the problem being solved. Option C routing all inter-account traffic through on-premises introduces hairpin latency, bandwidth constraints, and Direct Connect cost for intra-AWS traffic. Option D Amazon VPC Lattice is designed for service-to-service communication at the application layer (HTTP/gRPC), not for low-level network transit between entire VPC address spaces.

Question 3

A company with 50 AWS accounts uses AWS IAM Identity Center (formerly AWS SSO) for centralised access management. The company recently acquired another organisation that has its own Okta identity provider and 20 AWS accounts not part of the original AWS Organizations structure. The security team requires that acquired company employees must use their existing Okta credentials to access all AWS accounts (both original and acquired). The acquired company's accounts must be brought into the AWS Organizations structure. Access assignments must be auditable. The solution must NOT require employees to maintain separate AWS IAM user credentials.

The company currently has a corporate Active Directory connected to IAM Identity Center. The acquired company uses Okta exclusively.

Accepted Answer

AWS IAM Identity Center supports multiple identity sources including external SAML 2.0 identity providers like Okta alongside an existing Active Directory connection (though typically only one identity source is configured at a time — for mixed environments, Okta can be configured as an external IdP with SCIM provisioning, or Active Directory can federate Okta through AD). Once the acquired accounts are joined to AWS Organizations, IAM Identity Center can assign permission sets to Okta user groups across all 70 accounts centrally. All access assignments are logged in AWS CloudTrail, providing the required audit trail. No IAM users are created. Option B creates IAM users, which directly violates the requirement to not maintain separate AWS IAM user credentials. Option C cross-account IAM role trust with direct SAML from Okta requires per-account configuration across all 70 accounts and does not use IAM Identity Center's centralised assignment model. Option D merging Okta into AD is a complex directory migration that may not be feasible without disrupting acquired employees' existing access to non-AWS Okta applications.

Question 4

An enterprise runs hundreds of AWS Lambda functions, Amazon EC2 instances, and Amazon ECS tasks across five production accounts. The security team has implemented AWS Security Hub with CIS AWS Foundations Benchmark controls aggregated into a central Security account using a delegated administrator. A penetration test reveals that many resources have overly permissive IAM roles. The security team wants to identify all IAM roles with administrator-level access across all accounts without manually reviewing each account.

The security team needs a scalable, automated solution that runs continuously rather than as a one-time report.

Accepted Answer

The AWS Config managed rule iam-policy-no-statements-with-admin-access continuously evaluates all IAM policies in an account and flags any policy containing Effect:Allow with Action:* and Resource:*. Deploying this rule to all five production accounts via CloudFormation StackSets and aggregating non-compliant findings into a central AWS Config aggregator in the Security account provides a continuously updated, centralised view of over-permissive IAM roles without manual review. Option A IAM Access Analyzer identifies external access (cross-account or public) to resources, not overly permissive internal IAM policies. Option C CloudTrail Lake querying detects IAM actions that were actually used, not IAM roles that have the permission, missing dormant over-permissive roles. Option D credential report analysis identifies dormant credentials and password age, not policy-level administrator permissions.

Question 5

A company hosts a critical SaaS application used by 500 enterprise customers. Each customer requires complete data isolation — their data must be stored in separate Amazon RDS databases and separate Amazon S3 prefixes, and no customer should be able to access another customer's data even in the event of a misconfiguration. The company currently manages all customers in a single AWS account and is experiencing IAM policy management complexity. The architecture team wants to reduce the risk of cross-customer data leakage at the AWS account boundary level.

Cost is a concern — the company cannot afford a completely dedicated AWS account per customer. Customer data volumes range from 10 GB to 5 TB each. The solution must support 500 customers and must scale to 2,000 customers within 18 months.

Accepted Answer

At 500–2,000 customers, a fully dedicated account per customer is operationally viable with Control Tower but may have service quota implications (e.g., default limit is 10 accounts per Organisation, raiseable but complex at 2,000). A tiered model — dedicated accounts for the highest-risk largest customers where data leakage impact is greatest, and grouped shared accounts for smaller customers with database-level and S3 prefix-level isolation — balances true account-boundary isolation for highest-risk tenants with cost efficiency for smaller ones. This is a standard SaaS tiering pattern. Option B RAM shares resources across accounts (the opposite of isolation) and KMS CMKs protect confidentiality but do not prevent a misconfigured IAM policy from giving one customer access to another's data within the same account. Option C all 500 accounts would each require their own RDS instance (minimum ~$25/month per db.t3.micro), totalling $12,500/month minimum for small customers — cost-prohibitive at scale. Option D row-level security and S3 conditions at the application layer can be bypassed by a single misconfiguration in the Lambda authoriser, and the question explicitly states the risk to be mitigated is misconfiguration.

Question 6

A company uses AWS Organizations and wants all member accounts to send VPC Flow Logs, AWS CloudTrail logs, and Amazon GuardDuty findings to a centralised Security Logs account for immutable storage and SIEM ingestion. The logs must be tamper-proof even against the member account's root user. New accounts joining the organisation must automatically begin sending logs without any manual configuration by the member account team.

The company has tried using CloudFormation StackSets but found that drift in member accounts resulted in some accounts stopping log delivery without alerting the security team.

Accepted Answer

AWS Organizations CloudTrail organisation trails can only be created and managed from the management account and cannot be disabled or modified by member accounts — even by their root users. Delegating Amazon GuardDuty to the Security account via the GuardDuty multi-account feature means member accounts cannot disable GuardDuty. An SCP denying ec2:DeleteFlowLogs prevents member accounts from disabling VPC Flow Logs. Amazon S3 Object Lock in Compliance mode prevents deletion of log objects even by the S3 bucket owner, ensuring tamper-proof storage. AWS Control Tower Account Factory automates the configuration for new accounts joining the organisation. Option A relies on manual configuration per account and EventBridge detection is reactive (detective) after the fact. Option C nightly polling is not real-time and a Lambda function cannot enforce that member accounts have logging enabled. Option D AWS Config conformance packs detect non-compliance (detective) but cannot prevent a member account from disabling CloudTrail between Config evaluations, and S3 Cross-Region Replication from member accounts can be deleted by member account admins.

Question 7

A financial services company is building a real-time fraud detection system. The system must process 100,000 credit card transactions per second with end-to-end latency under 100ms from ingestion to fraud decision. Each transaction triggers a feature lookup (customer history, merchant profile) and a call to an ML inference endpoint. The architecture must be highly available across two AWS Regions with automatic failover. The solution must handle traffic spikes of up to 10x peak without pre-provisioning.

The company's existing rule engine runs on Amazon EC2 and cannot meet the latency requirements at scale. The ML model is already trained and deployed. The company wants to eliminate as much server management as possible.

Accepted Answer

This architecture is fully serverless and natively auto-scales. Amazon Kinesis Data Streams with enhanced fan-out delivers records to Lambda consumers with dedicated 2 MB/s throughput per consumer, minimising latency. AWS Lambda scales to handle 10x traffic spikes without pre-provisioning and has no servers to manage. Amazon DynamoDB global tables provide sub-millisecond feature lookups with multi-Region active-active replication for the required cross-Region HA. Amazon SageMaker real-time endpoints can be deployed in two Regions. Amazon Route 53 latency-based routing with health checks provides automatic failover. The end-to-end path (Kinesis → Lambda → DynamoDB + SageMaker → DynamoDB write) is achievable within 100ms for a well-tuned implementation. Option B uses batch processing every minute, which cannot meet the under-100ms real-time requirement. Option C EC2 Auto Scaling does not eliminate server management and cold starts during scale-out events may cause latency spikes. Option D Amazon EKS requires cluster management (nodes, control plane) and Amazon Aurora Global Database write latency is higher than DynamoDB for the feature lookup pattern.

Question 8

A company wants to build a multi-tenant data sharing platform where data providers can publish datasets to a centralised catalogue and data consumers in other AWS accounts can subscribe to and query the datasets without copying the data into their own accounts. The platform must support fine-grained access control at the table and column level. Data must remain in the provider's Amazon S3 bucket and must never be physically copied to the consumer's account. The solution must scale to hundreds of providers and thousands of consumers.

The company currently uses Amazon S3 cross-account bucket policies, which do not support column-level access control and are complex to manage at scale.

Accepted Answer

AWS Lake Formation cross-account data sharing allows provider accounts to share Data Catalog resources (databases, tables) with specific consumer accounts without moving any data. Lake Formation enforces column-level permissions — consumer queries through Amazon Athena see only the permitted columns, with all data reads going directly to the provider's S3 bucket. This is the only option that satisfies the no-data-copy requirement with column-level access control. Option B uses S3 Replication which physically copies data to consumer accounts, violating the no-copy requirement. Option C AWS Data Exchange is designed for commercial data marketplace publishing and always copies data to the consumer's S3 bucket, violating the requirement. Option D centralises all data in a single Redshift cluster (creating a data copy and a single point of failure/administration) and does not keep data in the provider's S3 bucket.

Question 9

A company is re-architecting a monolithic e-commerce application into microservices. The application must handle 50,000 orders per day with peak bursts of 5,000 orders per hour during flash sales. Individual services include: Order Service, Inventory Service, Payment Service, and Notification Service. The architecture team requires: (1) each service can fail independently without affecting others, (2) payment processing must be exactly-once (no duplicate charges), (3) all events must be retained for 30 days for audit replay, and (4) the solution must require MINIMAL operational overhead.

The team is choosing between an event-driven architecture using Amazon SQS and Amazon SNS fan-out versus Apache Kafka on Amazon MSK.

Accepted Answer

This SNS + SQS fan-out pattern provides all required properties: (1) each SQS queue per service decouples failures — if Notification Service is down, its queue buffers events without affecting Payment Service; (2) SQS FIFO queues provide exactly-once message delivery using message deduplication IDs, preventing duplicate payment charges; (3) Kinesis Data Firehose delivers all events to Amazon S3 where they can be retained for 30 days and replayed through Athena queries or by reprocessing the S3 objects; (4) SNS, SQS, and Kinesis are fully managed services with zero operational overhead. Option B Amazon MSK requires cluster management (broker sizing, ZooKeeper/KRaft configuration, scaling), which is significant operational overhead. Option C Amazon EventBridge Archive supports replay but EventBridge does not natively support exactly-once delivery semantics for the payment exactly-once requirement. Option D Step Functions Express Workflows do not support exactly-once execution semantics (Standard Workflows do with idempotency tokens, but synchronous orchestration of four services eliminates the independence required by requirement (1)).

Question 10

A media streaming company serves video content to 10 million users globally. The platform must deliver 4K video with sub-second start times, handle 50,000 concurrent streams during live sports events, and protect premium content from unauthorised sharing. The content library contains 2 PB of videos stored in Amazon S3. A CDN is already in use but the company wants to migrate to AWS-native services to reduce cost and improve integration with their AWS-based encoding pipeline.

The company uses AWS Elemental MediaConvert for video encoding. Content protection requires DRM (Digital Rights Management). The CDN must serve content from the nearest edge location to minimise latency.

Accepted Answer

Amazon CloudFront has over 450 edge locations globally for minimal viewer latency and is deeply integrated with the AWS Elemental media stack. CloudFront signed URLs with short expiration prevent unauthorised URL sharing (link sharing protection). Origin Access Control prevents users from bypassing the CDN and accessing S3 directly. AWS Elemental MediaPackage with SPEKE (Secure Packager and Encoder Key Exchange) integration provides standards-based DRM packaging (Widevine, PlayReady, FairPlay) that is required for 4K premium content on major devices. Option B AWS Global Accelerator routes TCP/UDP traffic to AWS Regional endpoints; it is not a CDN and does not cache or serve video at the edge. S3 presigned URLs provide temporary access but do not prevent the URL from being shared before expiration. Option C EC2-based origin servers add significant operational overhead for a 2 PB content library. Option D AWS Elemental MediaStore is optimised for live video origination, not for a 2 PB VOD library stored in Amazon S3, and IAM resource-based policies do not provide user-level content protection.

Question 11

A company is building a multi-Region active-active web application that must achieve an RTO of less than 1 minute and an RPO of less than 5 seconds. The application tier is stateless and runs on AWS Lambda. The data tier uses a relational database. The application serves millions of users who must be routed to the nearest healthy Region automatically. The company wants to MINIMISE the number of managed services and custom failover logic.

The company has previously used Amazon RDS Multi-AZ, which provides single-Region HA but does not meet the multi-Region RPO requirement.

Accepted Answer

Amazon Aurora Global Database continuously replicates data to a secondary Region with typical replication lag under 1 second, meeting the RPO < 5 seconds requirement. Amazon Route 53 Application Recovery Controller provides automated, reliable traffic routing with readiness checks that verify the secondary Region is truly ready (database replication state, Lambda concurrency limits, etc.) before routing traffic — meeting the RTO < 1 minute requirement. Option B DynamoDB global tables provide excellent RPO (~1 second) for key-value/document workloads but DynamoDB does not support complex relational SQL queries, and the scenario implies a relational database requirement. Option C RDS cross-Region read replicas require manual promotion (RTO measured in minutes, not seconds) and are not true active-active. Option D AWS Elastic Disaster Recovery replicates application-layer servers (EC2), but the application is already Lambda-based (stateless), making DRS unnecessary; Aurora Serverless v2 cross-Region replicas require managed failover, similar to Aurora Global Database but with less Route 53 ARC integration.

Question 12

A company wants to build a serverless REST API that must handle 1 million requests per day. Each request requires: authentication via JWT tokens, input validation, business logic that takes 500ms on average, and writes to an Amazon DynamoDB table. The business logic can run in parallel with no dependencies between requests. The company wants the MOST cost-effective architecture that also handles traffic spikes up to 5x the average without manual intervention.

The company currently runs the API on a fleet of Amazon EC2 instances with an Application Load Balancer, paying for capacity 24/7 even though traffic is only high during business hours.

Accepted Answer

Amazon API Gateway HTTP API is significantly cheaper than REST API (up to 71% cost reduction) while supporting JWT authorisers natively, making it the MOST cost-effective API Gateway option. AWS Lambda scales automatically and nearly instantaneously to handle 5x spikes without manual intervention, and you pay only for the 500ms execution time of each invocation (not for idle capacity). Amazon DynamoDB scales on-demand with no pre-provisioning needed. Option A uses REST API instead of HTTP API, which is more expensive for this straightforward use case (REST API is needed for features like request transformation, caching, VPC links — none of which are mentioned as requirements). Option B Amazon ECS Fargate auto scaling is slower than Lambda (takes minutes to scale new tasks) and you pay for minimum running tasks during low-traffic hours. Option D AWS AppSync is purpose-built for GraphQL and real-time subscriptions — using it for a simple REST API adds unnecessary complexity and cost.

Question 13

A telecommunications company is building an IoT platform for 10 million smart meters that report energy consumption every 15 minutes. Each reading is a 200-byte JSON message. The platform must: (1) ingest all readings reliably, (2) detect anomalies in real time (readings more than 3 standard deviations from the device's historical baseline), (3) store readings for 5 years for regulatory compliance at the LOWEST possible cost, and (4) allow utility analysts to run ad-hoc SQL queries against the last 90 days of data with response times under 30 seconds.

The team has evaluated Amazon Kinesis Data Streams but is concerned about shard management at 10 million devices.

Accepted Answer

AWS IoT Core is purpose-built for massive IoT device ingestion with built-in MQTT support, device management, and Rules Engine — eliminating shard management concerns entirely. IoT Rules fan-out to both Kinesis Data Firehose (reliable S3 delivery for storage) and Kinesis Data Analytics for Apache Flink (real-time stream processing for anomaly detection using standard deviation functions over per-device windows). Amazon S3 with S3 Intelligent-Tiering automatically moves data to lower-cost tiers over 5 years, meeting the compliance retention requirement at the lowest cost. Amazon Athena queries S3 partitioned data by date, with columnar Parquet format easily achieving sub-30-second queries on 90 days of partitioned data. Option B Amazon Timestream provides excellent time-series query performance but is significantly more expensive than S3+Athena for 5-year retention; also Kinesis Data Streams at 10M devices generating readings every 15 min = ~11,000 msg/sec requires only ~11 shards, which is manageable. Option C Amazon API Gateway is not appropriate for MQTT-based IoT device communication, and RDS cannot scale cost-effectively for 10M devices × 5 years. Option D edge-based anomaly detection on meters adds firmware complexity and is not what the platform team controls; DynamoDB TTL for 90 days at 10M devices is expensive relative to S3+Athena.

Question 14

A large enterprise is migrating 500 on-premises virtual machines (VMs) to AWS over 12 months. The VMs run a mixture of Windows Server 2019 (150 VMs), Red Hat Enterprise Linux 8 (200 VMs), and Ubuntu 20.04 (150 VMs). The migration must minimise downtime — critical production workloads must have a cutover window under 1 hour. The company has a 10 Gbps AWS Direct Connect connection. The company's data centre is being decommissioned at the end of the 12 months, so all VMs must be migrated by then.

The migration team wants to minimise the need for manual VM reconfiguration after migration. The company has no prior AWS migration experience.

Accepted Answer

AWS Application Migration Service (AWS MGN) is the recommended primary migration service for lift-and-shift of servers. It installs a lightweight agent on each source VM and performs continuous block-level replication to AWS, keeping the target server continuously synchronised. This allows test launches at any time without disrupting production, and the final cutover syncs only the delta changes from the last sync — typically achievable in under 1 hour. MGN supports Windows Server, RHEL, and Ubuntu. The 10 Gbps Direct Connect connection provides ample bandwidth for 500 VMs. Option B AWS Server Migration Service (SMS) is the previous generation migration tool that AWS recommends replacing with MGN; it replicates snapshots (not continuous block-level) resulting in longer cutover windows. Option C AWS DMS is for database migration, not for whole-server/application lift-and-shift. Option D EC2 Image Builder creates images from templates and does not migrate live server state, data, or installed applications from on-premises VMs.

Question 15

A company is migrating a self-managed Apache Cassandra cluster (20 nodes, 10 TB of data) from on-premises to AWS. The Cassandra cluster serves as the primary datastore for a mobile application handling 50,000 writes per second. The migration must achieve near-zero data loss and allow the mobile application to cut over to the AWS database within a 2-hour weekend maintenance window. The company wants to reduce operational overhead post-migration.

The company is open to changing database technology if the replacement service is compatible with Cassandra's CQL interface.

Accepted Answer

Amazon Keyspaces is a fully managed, serverless Cassandra-compatible database that eliminates all operational overhead of managing Cassandra nodes. It supports CQL, so the application requires minimal code changes. The dual-write pattern (writing to both Cassandra and Keyspaces during migration) ensures near-zero data loss because all new writes are captured in Keyspaces in real time. The bulk historical data load via the Keyspaces data migrator (Spark-based) can be completed before the maintenance window. Cutover is switching reads to Keyspaces during the 2-hour window. Option B self-managed Cassandra on EC2 eliminates the operational overhead reduction goal. Option C AWS DMS does support Cassandra as a source but the target (DynamoDB) uses a completely different API than CQL, requiring significant application changes; also DynamoDB is not CQL-compatible. Option D Cassandra snapshot restore to EC2 is the same as Option B and does not reduce operational overhead; cross-cluster sync via Cassandra's native replication is complex to set up between on-premises and AWS within a 2-hour window.

Question 16

A company is migrating a monolithic .NET application from on-premises to AWS. The application has three tiers: a web front end, a business logic layer, and a Microsoft SQL Server database. The migration team has three options and must evaluate them for business risk and time-to-value. The company has a strict 6-month deadline due to a data centre lease expiring. Re-architecting the application as microservices is the long-term goal but is estimated to take 18 months.

The team must choose an interim migration strategy that meets the 6-month deadline and keeps the re-architecture option open.

Accepted Answer

When a hard 6-month deadline exists and re-architecting takes 18 months, the rehost (lift-and-shift) strategy using AWS MGN is the correct interim approach. It has the fastest time-to-value (typically weeks, not months), requires no application code changes, meets the deadline, and keeps the re-architecture option fully open on AWS after migration. Option A re-platforming to Elastic Beanstalk and RDS also meets the deadline and provides some managed-infrastructure benefits, but it requires application changes to fit Beanstalk's deployment model and database connection changes for RDS — adding risk and time compared to pure lift-and-shift. It would be a reasonable secondary choice, but rehosting is explicitly faster. Option C rebuilding as microservices in 6 months is unrealistic when the estimate is 18 months and risks delivering an incomplete product. Option D retaining on-premises and extending the lease violates the data centre decommissioning constraint.

Question 17

A company needs to transfer 2 PB of archival data from on-premises tape storage to Amazon S3 Glacier Deep Archive. The data centre has a 1 Gbps internet connection that is shared with production workloads. The transfer must complete within 45 days. The company has a single AWS Direct Connect connection at 10 Gbps, but it is fully utilised by production traffic during business hours (8am–6pm). How should a solutions architect plan this data transfer?

Accepted Answer

Feasibility analysis: 2 PB = 2,097,152 GB. At 1 Gbps (125 MB/s) internet connection, 2 PB would take 2,097,152 / 125 / 86,400 = ~194 days — far exceeding 45 days. Even using the 10 Gbps Direct Connect during 14 off-peak hours/day (1.25 GB/s × 14h × 45d = ~2.4 PB) is theoretically sufficient but assumes 100% utilisation of a production-critical Direct Connect link during all off-peak hours with no headroom. AWS Snowball Edge devices at 80 TB each require ~26 devices. Loading can be parallelised across devices (days to weeks), and shipping + ingest at AWS takes approximately 1–2 weeks per batch. Multiple shipment cycles within 45 days are achievable. This is the recommended AWS solution for multi-petabyte offline data migration within tight time windows. Option B at 1 Gbps off-peak only (14h/day): 0.125 GB/s × 50,400s/day × 45 days = 283 TB — far short of 2 PB. Option C at 10 Gbps off-peak (14h/day) is theoretically possible but risks production Direct Connect impact. Option D Transfer Acceleration uses the same 1 Gbps internet connection; it improves geographic routing but does not increase the available bandwidth beyond 1 Gbps.

Question 18

A company runs 200 Amazon EC2 instances in production, all of which run 24/7. The workloads are predictable with consistent CPU utilisation between 40% and 60% throughout the day. The company has been using On-Demand instances and wants to SIGNIFICANTLY reduce its EC2 bill without changing the applications or instance types. The company's finance team can commit to 1-year or 3-year payment terms.

The company also runs 20 Amazon EC2 instances for batch processing jobs that run sporadically and can tolerate interruption.

Accepted Answer

Compute Savings Plans provide up to 66% discount versus On-Demand for any EC2 instance type, family, size, OS, Region, or tenancy — the highest flexibility of all commitment options. A 3-year term provides the maximum savings rate. For 200 instances running 24/7 with predictable utilisation, a 3-year commitment is financially sound. Amazon EC2 Spot Instances provide up to 90% discount for interruption-tolerant batch workloads. Together these two options maximise savings across all 220 instances. Option A Convertible RIs provide about 54% savings versus On-Demand (less than Compute Savings Plans) with less flexibility (limited to same Region and instance family with conversion rights). Spot for batch is correct. Option B Standard RIs provide about 72% savings but are the least flexible (locked to a specific instance type, size, OS, and Region) — the question mentions no restriction on flexibility, but Compute Savings Plans provide nearly equal savings with far greater flexibility. Option D On-Demand Capacity Reservations do not provide any discount — they simply reserve capacity at On-Demand price.

Question 19

A company runs a data analytics platform on AWS that processes data from 50 different business units. Each business unit has its own AWS account under AWS Organizations. The CFO wants to understand how much each business unit is spending on AWS and allocate costs accurately. The platform uses shared services (Amazon VPC Transit Gateway, AWS Glue Data Catalog, Amazon S3 data lake) that benefit all business units but are deployed in a central platform account. How should a solutions architect implement cost allocation MOST accurately for the shared services?

Accepted Answer

AWS Cost and Usage Report (CUR) provides the most granular billing data in AWS, including resource-level costs, usage types, and all tag dimensions. Exporting to Amazon S3 and querying with Amazon Athena allows custom SQL-based cost analysis and allocation models. For shared platform services that cannot be cleanly tagged to a single BU (e.g., Transit Gateway data processing, Glue Data Catalog API calls), consumption-based allocation — distributing shared costs proportionally by bytes processed or API calls per BU — is the most accurate chargeback method and is a common FinOps pattern. Option A Cost Explorer tags work for resources exclusively owned by one BU but shared platform resources cannot be tagged to multiple BUs simultaneously, and Cost Explorer lacks the custom SQL logic needed for proportional distribution. Option C AWS Budgets sends spending alerts but does not allocate or attribute costs to business units. Option D Trusted Advisor identifies optimisation opportunities but does not provide cost attribution or chargeback.

Question 20

A company stores 5 PB of data in Amazon S3 Standard across multiple AWS accounts. A cost analysis shows that 80% of the data has not been accessed in over 90 days. The data access pattern is unknown for most objects — some data may be occasionally accessed, while other data may never be accessed again. The company wants to MINIMISE storage costs with MINIMAL operational overhead and without deleting any data. Which solution BEST meets these requirements?

Accepted Answer

S3 Intelligent-Tiering is purpose-built for data with unknown or unpredictable access patterns. It monitors access patterns per object and automatically moves objects between Frequent Access (same price as S3 Standard), Infrequent Access (40% cheaper), and optional Archive tiers (up to 95% cheaper), with no retrieval fees or performance impact for objects returned to Frequent Access. No lifecycle rules to write, no Lambda to maintain — minimal operational overhead. At 5 PB with 80% infrequently accessed, the expected savings are substantial. Option A S3 Glacier Deep Archive has 12-hour retrieval times and retrieval fees, which is inappropriate for data with uncertain access patterns. Option C requires building and maintaining custom Lambda automation on top of S3 Storage Lens analysis. Option D S3 One Zone-IA stores data in only one Availability Zone, reducing resilience; it also requires a Batch Operations migration job and deletion of originals, which is a one-time operation that doesn't handle future objects.

Question 21

A company runs an Amazon RDS for MySQL database (db.r5.4xlarge) that serves a web application. Over the past 3 months, the database has experienced increasing read latency (P99 > 2 seconds) during peak hours. Amazon CloudWatch shows CPU at 85%, ReadIOPS at the provisioned IOPS limit, and DatabaseConnections at 900 (max is 1,000). The application uses a connection pool of 50 connections per EC2 instance, and there are currently 18 EC2 instances. Adding a read replica has already been done but has not resolved the problem.

The development team has identified that 60% of all database queries are simple key-value lookups that return the same result for 5 minutes.

Accepted Answer

The scenario has two distinct bottlenecks that require two separate solutions. (1) 60% of queries are cacheable key-value lookups — adding Amazon ElastiCache for Redis as a read-through cache with a 5-minute TTL offloads 60% of read traffic from the database, directly reducing CPU, IOPS, and read latency. (2) 900/1,000 connections at peak means the database is near the connection limit; AWS RDS Proxy multiplexes connections from the 18 × 50 = 900 application connections down to a smaller pool of pinned database connections, providing immediate headroom. Together these address all three CloudWatch bottleneck signals. Option A upgrading the instance doubles cost and provides temporary headroom but does not address the architectural issues (cacheable queries hitting the database, connection exhaustion). Option C Performance Insights is useful for analysis but adding indexes cannot reduce latency when the bottleneck is IOPS and CPU from serving 60% unnecessary repeated queries. Option D migrating to Aurora MySQL is a valid long-term improvement but a migration introduces risk and takes weeks; it also does not solve the connection exhaustion problem.

Question 22

A company runs a web application on an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed in a single AWS Region. During a recent incident, an AWS Region experienced intermittent issues that caused 40% packet loss on the ALB. The company's SLA requires 99.99% availability. The team wants to add multi-Region resilience without significantly increasing operational complexity.

The company's application is stateless. Sessions are stored in Amazon ElastiCache for Redis. The database is Amazon Aurora with a global cluster already configured with a secondary Region. DNS is managed in Amazon Route 53.

Accepted Answer

Route 53 Application Recovery Controller (ARC) is designed specifically for this use case: multi-Region failover where the secondary Region must be verified as truly ready before traffic is shifted. Readiness checks validate Aurora replication lag (ensuring the secondary database is current), EC2 Auto Scaling capacity (ensuring instances are running), and ElastiCache availability in the secondary Region — preventing a failover to a Region that is not actually ready, which would worsen availability. Routing controls enable precise, auditable traffic shifting. Option A standard Route 53 failover health checks validate only the primary ALB endpoint health, not whether the secondary Region's database and cache are ready to serve traffic, risking a failed failover. Option B CloudFront origin failover automatically retries on the secondary origin but only for cacheable content — it does not handle stateful application failover, Aurora promotion, or verify database readiness. Option C AWS Global Accelerator detects endpoint health in seconds and shifts traffic rapidly (30 seconds), which is excellent for performance-based routing but Global Accelerator health checks also do not validate database replication readiness before failover.

Question 23

A company's operations team manages 500 Amazon EC2 instances across 10 AWS accounts. They spend significant time manually patching operating systems, which currently requires SSH access to each instance. The security team requires that all instances must have no direct inbound internet access (no security group rules allowing port 22 or 3389 from the internet) and that all patching must be logged and auditable. The team wants to automate patching and eliminate SSH/RDP access.

The instances run a mix of Windows Server 2019 and Amazon Linux 2.

Accepted Answer

AWS Systems Manager Patch Manager is purpose-built for automated OS patching across multiple instances and accounts. Patch baselines define which patches to apply (severity, classification), maintenance windows schedule patching during approved hours, and AWS-RunPatchBaseline documents apply and report compliance. SSM Session Manager provides browser-based or CLI-based shell access to instances without open inbound ports, satisfying the no-SSH requirement. All SSM actions are logged to AWS CloudTrail and optionally to Amazon S3/CloudWatch Logs for auditability. The AmazonSSMManagedInstanceCore IAM role is the only configuration needed per instance. Option B Lambda calling SSM Run Command works but adds unnecessary custom code complexity when Patch Manager already provides all required scheduling, compliance reporting, and rollback features natively. Option C Amazon Inspector is a vulnerability scanning tool that identifies missing patches but requires human review of findings; using it as an automated patching trigger is not a supported pattern. Option D AWS OpsWorks/Chef is a configuration management platform that adds significant operational complexity for patching compared to native SSM.

Question 24

A company's e-commerce website experiences significant performance degradation when its Amazon DynamoDB tables are accessed during peak sales events. DynamoDB is configured with provisioned capacity. During a recent flash sale, the application logged ProvisionedThroughputExceededException errors for 15% of write requests during a 30-minute burst. The company wants to handle burst writes without errors and without significantly increasing baseline provisioned capacity costs. The writes are idempotent.

The operations team wants to implement a solution that works automatically without manual intervention during future events.

Accepted Answer

An SQS queue acts as an elastic buffer that absorbs burst writes without any errors — the application writes to SQS (which has virtually unlimited throughput) immediately and receives a success response. The Lambda consumer reads from the queue at a controlled rate matching the DynamoDB provisioned throughput, naturally smoothing the burst over the 30-minute window. Since writes are idempotent, any SQS message reprocessed due to Lambda retries does not cause data duplication. This pattern is known as the SQS write buffer pattern for DynamoDB. Option A switching to On-Demand capacity eliminates errors but can be significantly more expensive than provisioned capacity for sustained high-throughput workloads — the question asks not to significantly increase baseline costs. Option C DynamoDB Auto Scaling reacts to sustained elevated traffic over a period of minutes; it cannot scale fast enough to prevent throttling during a 30-minute burst that starts suddenly. Option D permanently increasing WCUs for worst-case burst capacity means paying for maximum capacity 24/7, which significantly increases baseline costs.

Question 25

A company has a microservices application running on Amazon ECS with AWS Fargate. Each microservice is deployed as an ECS service and communicates with other services over HTTP within the same VPC using internal DNS (Amazon Route 53 Service Discovery). The operations team is struggling to trace errors that span multiple services — when a user reports a 500 error, the team cannot easily identify which microservice caused it or measure latency per service hop.

The team wants to implement distributed tracing with MINIMAL code changes and without deploying additional servers.

Accepted Answer

AWS X-Ray provides distributed tracing specifically for microservices architectures. The X-Ray daemon runs as a sidecar container in each ECS Fargate task (no separate servers required), collecting trace data via UDP. The X-Ray SDK instruments the application to emit segments, and the X-Ray trace header (X-Amzn-Trace-Id) is propagated across HTTP calls between services, automatically correlating segments into a single trace. The X-Ray Service Map visualises all service dependencies and latency per hop. The code change is adding the X-Ray SDK (typically a few lines per service), which is minimal. Option A CloudWatch Container Insights provides infrastructure metrics (CPU, memory, error counts) but not request-level distributed traces showing the path of a specific failed request through multiple services. Option C structured logging with correlation IDs is a valid approach but requires each service to correctly implement and propagate correlation IDs (custom code change), plus deploying and managing Amazon OpenSearch Service. Option D CloudTrail logs ECS control plane API calls (CreateTask, StartTask) not application-level HTTP request traces.

SAP-C02 — AWS Certified Solutions Architect – Professional