PAS-C01 Technology — 100 Questions

Question 1

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. During a flash sale, the application experiences a sudden spike in traffic, but the Auto Scaling group does not scale out quickly enough, causing some requests to fail. Which solution would improve the scaling responsiveness?

Accepted Answer

Add a scheduled scaling action to increase capacity before the flash sale.. Option B is correct because a scheduled scaling action proactively increases capacity before the flash sale, eliminating the lag inherent in dynamic scaling policies. Dynamic scaling reacts to metrics like average CPU utilization, which can take minutes to trigger and propagate, causing request failures during sudden spikes. By pre-scaling, the Auto Scaling group has sufficient instances ready to handle the traffic surge immediately.

Answer

Increase the cooldown period for the dynamic scaling policy.

Answer

Decrease the cooldown period for the dynamic scaling policy.

Answer

Disable scale-in to prevent the Auto Scaling group from terminating instances during the sale.

Question 2

A company is migrating a legacy application to AWS. The application uses a custom TCP protocol and requires session persistence. The application runs on a fleet of EC2 instances behind a Network Load Balancer (NLB). The current configuration uses a TCP listener with 'source IP' stickiness. However, some clients are being routed to different instances mid-session, causing application errors. What is the most likely cause and solution?

Accepted Answer

Clients are behind a NAT gateway, so the source IP changes between requests, breaking stickiness. Use a 'stitched' cookie or switch to an Application Load Balancer.. Option B is correct because clients behind a NAT gateway will have their source IP address translated to the NAT gateway's public IP, which remains consistent for all requests from that gateway. However, if multiple clients share the same NAT gateway, the source IP is the same, but the NLB's source IP stickiness is based on the client's source IP as seen by the NLB. If the NAT gateway uses multiple public IPs or if clients are behind different NAT gateways, the source IP can change between requests, breaking stickiness. The solution is to use a 'stitched' cookie or switch to an Application Load Balancer, which supports cookie-based session persistence independent of source IP.

Answer

The NLB does not support source IP stickiness; use a Classic Load Balancer instead.

Answer

The NLB has cross-zone load balancing enabled, which distributes traffic across instances in different Availability Zones.

Answer

The idle timeout of the NLB is too low, causing the NLB to close connections prematurely.

Question 3

A solutions architect is designing a disaster recovery plan for a critical application that runs on Amazon RDS for PostgreSQL. The application requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which RDS deployment option meets these requirements?

Accepted Answer

A Multi-AZ deployment with synchronous replication.. Amazon RDS Multi-AZ deployments with synchronous replication provide automatic failover to a standby instance in a different Availability Zone, ensuring data is committed to both primary and standby before acknowledging a write. This achieves an RPO of effectively zero (less than 5 seconds) and an RTO typically under 1 minute, meeting the stated requirements.

Answer

A single-AZ deployment with cross-Region automated backups.

Answer

A single-AZ deployment with a standby instance manually promoted.

Answer

A Multi-AZ deployment with a Read Replica in a different Region.

Question 4

A company is using AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a stack that updates an existing RDS DB instance's DB engine version. The update requires a replacement of the database. Which CloudFormation stack policy setting allows the update to proceed while preventing other resources from being replaced or updated?

Accepted Answer

Set a stack policy that allows updates to the specific RDS DB instance resource.. Option B is correct because a stack policy in AWS CloudFormation can be set to explicitly allow updates to a specific resource (e.g., the RDS DB instance) while denying updates to all other resources by default. Since the update requires a replacement of the database, the policy must permit the update action on that exact resource logical ID, ensuring the DB engine version change proceeds without risking unintended modifications to other stack resources.

Answer

Set a stack policy that allows updates to RDS resources only.

Answer

Set a stack policy that denies all updates.

Answer

Set a stack policy that allows all updates.

Question 5

A company is running a stateful application on EC2 instances in an Auto Scaling group. The instances store session state locally. The group uses a simple scaling policy based on network traffic. The company notices that when instances are terminated during scale-in, active sessions are lost. What is the MOST effective way to preserve session state during scaling events?

Accepted Answer

Use a lifecycle hook to gracefully drain sessions before instance termination.. A lifecycle hook is the most effective solution because it pauses the instance termination process during scale-in, allowing the application to drain active sessions (e.g., by transferring session state to a shared data store like ElastiCache or DynamoDB) before the instance is fully terminated. This preserves session continuity without requiring architectural changes to the application's stateful design.

Answer

Use a step scaling policy instead of a simple scaling policy.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Use a launch configuration that enables termination protection.

Question 6

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and be accessible only within the VPC. Which TWO steps should the solutions architect take to meet these requirements? (Choose TWO.)

Accepted Answer

Use an internal Application Load Balancer to distribute traffic between services.. Option D is correct because an internal Application Load Balancer (ALB) operates within a VPC and does not expose a public endpoint, ensuring that traffic between microservices remains private. It distributes incoming requests to Fargate tasks based on defined rules, enabling secure, internal communication without internet access.

Answer

Attach an Internet Gateway to the VPC and configure route tables for the private subnets.

Answer

Place the Fargate tasks in public subnets to allow them to communicate with each other through the internet gateway.

Answer

Use AWS Cloud Map for service discovery and register a public DNS name for each service.

Question 7

A company is migrating a large on-premises NoSQL database to Amazon DynamoDB. The database has tables with uneven access patterns, and some items are accessed infrequently but must be retained for compliance. The company wants to optimize costs without sacrificing performance. Which THREE strategies should the solutions architect recommend? (Choose THREE.)

Accepted Answer

Use DynamoDB Standard-Infrequent Access (Standard-IA) table class for tables with infrequently accessed data.. DynamoDB Standard-IA table class is designed for tables where data is accessed less than once a month, offering lower storage costs than the Standard table class while maintaining the same single-digit millisecond latency. For the described scenario, where some items are accessed infrequently but must be retained for compliance, Standard-IA reduces storage costs without impacting performance for the infrequent access patterns.

Answer

Disable auto scaling and set a fixed provisioned capacity to avoid cost spikes.

Answer

Increase the write capacity units to handle peak loads and reduce latency.

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance. The EC2 instance has an Elastic IP address of 203.0.113.5 and is running in a VPC with CIDR 10.0.0.0/16. When the application on the instance tries to upload an object to the S3 bucket 'my-bucket', it receives an Access Denied error. What is the MOST likely cause?

Accepted Answer

The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.. When an EC2 instance communicates with S3 via a VPC endpoint, traffic uses private IP addresses from the VPC CIDR range (10.0.0.0/16), not the instance's Elastic IP (203.0.113.5). The IAM policy condition `aws:SourceIp` checks the source IP of the request, but because the traffic goes through the VPC endpoint, the source IP seen by S3 is a private IP, not the Elastic IP. This causes the condition to fail, resulting in an Access Denied error.

Answer

The policy does not allow the s3:PutObject action.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket without the asterisk.

Answer

The policy is missing a Deny statement for other IP addresses.

Question 9

Refer to the exhibit. An Application Load Balancer is configured to route traffic to an Auto Scaling group of web servers. The health check for the target group is failing. The web servers are healthy and running, but the health check endpoint is returning a 503 status code because the application cannot connect to the database. The database is an Amazon RDS instance in the same VPC. Which action should the solutions architect take to resolve the health check failure?

Accepted Answer

Change the health check endpoint to a static page that does not require database connectivity.. Option B is correct because the health check endpoint should validate the web server's ability to serve traffic, not the database's availability. By changing the health check to a static page (e.g., /health.html) that does not depend on database connectivity, the load balancer will correctly assess the web server's health independently. This decouples the health check from the database, preventing cascading failures where a database outage causes all web servers to be marked unhealthy and removed from the target group.

Answer

Restart the web server instances to reset the database connection.

Answer

Modify the application's health check endpoint to return a 200 OK status even when the database is unavailable.

Answer

Increase the health check interval to allow more time for the database to respond.

Question 10

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent high latency, and the operations team suspects that the load balancer is not distributing traffic evenly. Which configuration should the team check to confirm or rule out uneven traffic distribution?

Accepted Answer

Verify that cross-zone load balancing is enabled on the ALB. Uneven traffic distribution across EC2 instances behind an ALB is most commonly caused by cross-zone load balancing being disabled. By default, ALBs have cross-zone load balancing enabled, which distributes traffic evenly across all registered instances in all enabled Availability Zones. If it is disabled, each ALB node distributes traffic only to instances in its own Availability Zone, leading to imbalances when instance counts or capacities differ across zones. Verifying this setting directly addresses the suspected uneven distribution.

Answer

Configure slow start on the target group

Answer

Increase the deregistration delay on the target group

Answer

Enable sticky sessions (session affinity) on the target group

Question 11

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are also in private subnets. The security group for the RDS instance allows inbound traffic on port 3306 from the security group attached to the ECS tasks. However, the application cannot connect to the database. Which solution should the company implement to resolve this issue?

Accepted Answer

Attach the same security group to the ECS tasks and the RDS instance, and ensure the security group has an inbound rule allowing traffic from itself on port 3306. Option B is correct because when using security group IDs in inbound rules, the traffic is evaluated based on the source security group's network interfaces, not the IP addresses. However, for this to work, the security group must be attached to the ECS tasks' elastic network interfaces (ENIs). By attaching the same security group to both the ECS tasks and the RDS instance, and adding a self-referencing inbound rule for port 3306, the RDS instance will accept traffic from any resource that has that security group attached, including the ECS tasks. This resolves the connectivity issue because the security group rule correctly identifies the source by the security group ID, not by IP.

Answer

Configure the ECS task definition to assign a public IP address to the tasks and ensure the tasks have a route to the internet via a NAT gateway

Answer

Place both the ECS tasks and the RDS instance in the same public subnet to ensure network connectivity

Answer

Modify the RDS security group inbound rule to allow traffic from the CIDR block of the ECS tasks’ private subnets instead of the security group ID

Question 12

A company is designing a multi-tier web application on AWS. The web tier must scale based on CPU utilization, and the application tier must scale based on request count. Both tiers are deployed in a VPC with public and private subnets. Which combination of AWS services should the company use?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. Option A is correct because the web tier requires an Application Load Balancer (ALB) to distribute HTTP/HTTPS traffic and can scale based on CPU utilization using an Auto Scaling group with a target tracking policy. The application tier needs a Network Load Balancer (NLB) to handle high request counts at the transport layer (TCP/UDP), which is ideal for scaling based on request count per target. This combination allows each tier to use the most appropriate load balancer for its scaling metric and protocol requirements.

Answer

Classic Load Balancer for both tiers

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

Amazon API Gateway for the web tier and Application Load Balancer for the application tier

Question 13

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

Accepted Answer

Replatform the application by migrating the Oracle database to Amazon RDS for Oracle. Option D is correct because the company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Answer

Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

Answer

Store the data in Amazon S3 and use Athena for querying

Answer

Refactor the application to use Amazon DynamoDB as the database

Question 14

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

Accepted Answer

Modify the application to store session state in an Amazon ElastiCache cluster. Option C is correct because storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Answer

Change the scaling policy to a simple scaling policy instead of dynamic scaling

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer

Answer

Increase the cooldown period for the Auto Scaling group

Question 15

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances in a single AWS Region. The application uses an Amazon RDS MySQL Multi-AZ DB instance. The company wants to achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes for both compute and database tiers. Which TWO options should the company implement? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance in the secondary Region. Option A is correct because a cross-Region read replica for RDS MySQL can be promoted to a standalone primary in the secondary Region within minutes, meeting the 15-minute RTO. The asynchronous replication lag is typically under 1 minute, satisfying the 1-minute RPO. This provides a managed, low-latency DR database tier without needing to restore from backups.

Answer

Use Amazon EBS snapshots of the EC2 instances and copy them to the secondary Region every minute

Answer

Migrate the database to Amazon Aurora MySQL and configure an Aurora Global Database

Answer

Enable cross-Region automated backups for the RDS Multi-AZ DB instance

Question 16

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet high availability and low latency requirements. The company expects traffic to spike unpredictably. Which THREE strategies should the company implement to ensure the application can handle the load? (Choose THREE.)

Accepted Answer

Enable API Gateway caching with a suitable TTL. Option A is correct because API Gateway caching stores responses from your endpoints, reducing the number of calls made to the backend Lambda function and DynamoDB. By setting a suitable TTL, you ensure that frequently accessed data is served from the cache, which lowers latency and offloads the backend during unpredictable traffic spikes. This directly supports high availability by preventing backend overload.

Answer

Set the Lambda function timeout to the maximum value of 15 minutes

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read and 10 write capacity units

Question 17

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application uses Auto Scaling and a MySQL RDS Multi-AZ DB instance. Users report intermittent connection timeouts, and CloudWatch metrics show CPUUtilization spikes to 90% on the DB instance. The application queries are read-heavy with occasional writes. What is the MOST cost-effective design change to improve performance?

Accepted Answer

Add an RDS read replica in the same region and configure the application to route read queries to the replica.. Option C is the most cost-effective design change because adding an RDS read replica offloads read-heavy queries from the primary DB instance, reducing CPU utilization without requiring a larger instance. Since the workload is read-heavy with occasional writes, a read replica handles SELECT traffic while the Multi-AZ primary manages writes, improving performance at a lower cost than scaling up.

Answer

Implement ElastiCache Redis cluster to cache query results and reduce DB load.

Answer

Enable RDS Performance Insights and create a CloudWatch alarm to reboot the DB instance on high CPU.

Answer

Switch the DB instance to a larger instance type to handle the load.

Question 18

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.. Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Answer

Use AWS Config rules to detect noncompliant buckets and send notifications.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

Question 19

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.

Question 20

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)

Accepted Answer

In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.. Option C is correct because referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.

Answer

In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.

Answer

Enable encryption at rest on the EC2 instances using EBS encryption.

Answer

Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.