PAS-C01 Technology Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An Application Load Balancer is configured to route traffic to an Auto Scaling group of web servers. The health check for the target group is failing. The web servers are healthy and running, but the health check endpoint is returning a 503 status code because the application cannot connect to the database. The database is an Amazon RDS instance in the same VPC. Which action should the solutions architect take to resolve the health check failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the health check endpoint to a static page that does not require database connectivity.. The health check endpoint should validate the web server's ability to serve traffic, not the database's availability. By changing the health check to a static page (e.g., /health.html) that does not depend on database connectivity, the load balancer will correctly assess the web server's health independently. This decouples the health check from the database, preventing cascading failures where a database outage causes all web servers to be marked unhealthy and removed from the target group.

Answer

Restart the web server instances to reset the database connection.

Answer

Modify the application's health check endpoint to return a 200 OK status even when the database is unavailable.

Answer

Increase the health check interval to allow more time for the database to respond.

Question 2

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent high latency, and the operations team suspects that the load balancer is not distributing traffic evenly. Which configuration should the team check to confirm or rule out uneven traffic distribution?

Accepted Answer

Verify that cross-zone load balancing is enabled on the ALB. Uneven traffic distribution across EC2 instances behind an ALB is most commonly caused by cross-zone load balancing being disabled. By default, ALBs have cross-zone load balancing enabled, which distributes traffic evenly across all registered instances in all enabled Availability Zones. If it is disabled, each ALB node distributes traffic only to instances in its own Availability Zone, leading to imbalances when instance counts or capacities differ across zones. Verifying this setting directly addresses the suspected uneven distribution.

Answer

Configure slow start on the target group

Answer

Increase the deregistration delay on the target group

Answer

Enable sticky sessions (session affinity) on the target group

Question 3

A company is designing a multi-tier web application on AWS. The web tier must scale based on CPU utilization, and the application tier must scale based on request count. Both tiers are deployed in a VPC with public and private subnets. Which combination of AWS services should the company use?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. The web tier requires an Application Load Balancer (ALB) to distribute HTTP/HTTPS traffic and can scale based on CPU utilization using an Auto Scaling group with a target tracking policy. The application tier needs a Network Load Balancer (NLB) to handle high request counts at the transport layer (TCP/UDP), which is ideal for scaling based on request count per target. This combination allows each tier to use the most appropriate load balancer for its scaling metric and protocol requirements.

Answer

Classic Load Balancer for both tiers

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

Amazon API Gateway for the web tier and Application Load Balancer for the application tier

Question 4

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application currently uses an Oracle database with complex stored procedures. The company wants to minimize changes to the application code during migration. Which database migration strategy should the company use?

Accepted Answer

Replatform the application by migrating the Oracle database to Amazon RDS for Oracle. The company wants to minimize changes to the application code during migration. By replatforming the Oracle database to Amazon RDS for Oracle, the application can continue to use the same Oracle database engine, stored procedures, and SQL dialect with minimal or no code changes. This approach avoids the need to rewrite complex stored procedures or adapt to a different database engine, which would be required with other migration strategies.

Answer

Migrate the database to Amazon Aurora with PostgreSQL compatibility using the AWS Database Migration Service (DMS)

Answer

Store the data in Amazon S3 and use Athena for querying

Answer

Refactor the application to use Amazon DynamoDB as the database

Question 5

A company runs a stateful web application on EC2 instances in an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The application maintains session state in memory on each instance. Users report that they are frequently logged out and lose their session data during scaling events. What should the company do to resolve this issue?

Accepted Answer

Modify the application to store session state in an Amazon ElastiCache cluster. Storing session state externally in ElastiCache decouples session data from individual EC2 instances. This ensures that when instances are terminated or added during scaling events, users retain their session state regardless of which instance serves their request. ElastiCache provides a low-latency, in-memory cache that is ideal for session persistence in stateful web applications.

Answer

Change the scaling policy to a simple scaling policy instead of dynamic scaling

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer

Answer

Increase the cooldown period for the Auto Scaling group

Question 6

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances in a single AWS Region. The application uses an Amazon RDS MySQL Multi-AZ DB instance. The company wants to achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes for both compute and database tiers. Which TWO options should the company implement? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance in the secondary Region. A cross-Region read replica for RDS MySQL can be promoted to a standalone primary in the secondary Region within minutes, meeting the 15-minute RTO. The asynchronous replication lag is typically under 1 minute, satisfying the 1-minute RPO. This provides a managed, low-latency DR database tier without needing to restore from backups.

Answer

Use Amazon EBS snapshots of the EC2 instances and copy them to the secondary Region every minute

Answer

Migrate the database to Amazon Aurora MySQL and configure an Aurora Global Database

Answer

Enable cross-Region automated backups for the RDS Multi-AZ DB instance

Question 7

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet high availability and low latency requirements. The company expects traffic to spike unpredictably. Which THREE strategies should the company implement to ensure the application can handle the load? (Choose THREE.)

Accepted Answer

Enable API Gateway caching with a suitable TTL. API Gateway caching stores responses from your endpoints, reducing the number of calls made to the backend Lambda function and DynamoDB. By setting a suitable TTL, you ensure that frequently accessed data is served from the cache, which lowers latency and offloads the backend during unpredictable traffic spikes. This directly supports high availability by preventing backend overload.

Answer

Set the Lambda function timeout to the maximum value of 15 minutes

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read and 10 write capacity units

Question 8

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application uses Auto Scaling and a MySQL RDS Multi-AZ DB instance. Users report intermittent connection timeouts, and CloudWatch metrics show CPUUtilization spikes to 90% on the DB instance. The application queries are read-heavy with occasional writes. What is the MOST cost-effective design change to improve performance?

Accepted Answer

Add an RDS read replica in the same region and configure the application to route read queries to the replica.. The most cost-effective design change because adding an RDS read replica offloads read-heavy queries from the primary DB instance, reducing CPU utilization without requiring a larger instance. Since the workload is read-heavy with occasional writes, a read replica handles SELECT traffic while the Multi-AZ primary manages writes, improving performance at a lower cost than scaling up.

Answer

Implement ElastiCache Redis cluster to cache query results and reduce DB load.

Answer

Enable RDS Performance Insights and create a CloudWatch alarm to reboot the DB instance on high CPU.

Answer

Switch the DB instance to a larger instance type to handle the load.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.. Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Answer

Use AWS Config rules to detect noncompliant buckets and send notifications.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

Question 10

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.

Question 11

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)

Accepted Answer

In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.. Referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.

Answer

In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.

Answer

Enable encryption at rest on the EC2 instances using EBS encryption.

Answer

Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.

Question 12

A company runs a production web application on AWS using an Application Load Balancer (ALB) with a target group of EC2 instances in an Auto Scaling group. The application uses a custom Amazon Machine Image (AMI) that includes the web server and application code. The Auto Scaling group has a launch template that references the AMI. The company updates the application code weekly and creates a new AMI version. The operations team manually updates the launch template to reference the new AMI and then initiates an instance refresh. Recently, a misconfiguration caused the launch template to point to an old AMI after an instance refresh, resulting in a rollback of the application code. The company wants to automate the deployment process to ensure that new AMIs are deployed consistently and safely. Which solution meets these requirements?

Accepted Answer

Use EC2 Image Builder to create and test the new AMI, then use AWS CodePipeline to automatically update the launch template and perform a rolling instance refresh.. EC2 Image Builder automates the creation, testing, and validation of AMIs, ensuring only compliant images are produced. AWS CodePipeline can then automatically update the launch template with the new AMI ID and trigger a rolling instance refresh, eliminating manual steps and preventing misconfigurations like pointing to an old AMI.

Answer

Use AWS CodePipeline to run a script that updates the launch template with the new AMI ID and triggers an instance refresh.

Answer

Use AWS CloudFormation with a custom resource that validates the AMI and updates the Auto Scaling group.

Answer

Use AWS CodeDeploy to deploy the application code directly to the existing instances, bypassing the AMI update.

Question 13

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Accepted Answer

Use Amazon ElastiCache to store session data instead of the database.. Storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Answer

Configure Amazon RDS Multi-AZ for high availability.

Answer

Use Auto Scaling for the web server tier to handle variable traffic.

Answer

Use Amazon RDS read replicas to offload read traffic from the primary database.

Question 14

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.. The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Answer

The S3 bucket has versioning enabled, which requires additional permissions.

Answer

The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

Answer

The bucket policy does not grant the s3:PutObject permission to the IAM role.

Question 15

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The operations team reports that the application becomes unresponsive for about 30 seconds every hour at the same time. The team checks the ALB access logs and notices that during the outage, the ALB returns HTTP 504 errors. The RDS monitoring shows a spike in CPU usage and active connections during the same period. The application team confirms there are no scheduled jobs during that time. What should the team do to diagnose the root cause?

Accepted Answer

Check the RDS Enhanced Monitoring metrics for the database instance to identify resource bottlenecks such as high memory pressure or disk I/O.. The symptoms—hourly 30-second unresponsiveness, HTTP 504 errors from the ALB, and a correlated spike in RDS CPU and active connections—point to a database-side bottleneck. RDS Enhanced Monitoring provides OS-level metrics (memory, disk I/O, CPU) that can reveal resource contention or throttling events (e.g., swap usage, IOPS exhaustion) not visible in standard CloudWatch metrics, enabling precise root cause identification.

Answer

Review the security group rules for the database to ensure the application can connect.

Answer

Review the ALB target group health checks and ensure the EC2 instances are passing the health check.

Answer

Increase the EC2 instance size to handle more concurrent connections.