CCNA Design for New Solutions Questions — Page 5 of 7

301

MCQmedium

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

A.S3 Standard

B.S3 Intelligent-Tiering

C.S3 Glacier Deep Archive

D.S3 One Zone-Infrequent Access

AnswerB

Automatically optimizes costs for unknown or changing access patterns, with millisecond retrieval.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves data between two access tiers (frequent and infrequent access) based on changing access patterns, with no retrieval fees. This matches the unpredictable access pattern described—data accessed frequently for a few days then rarely—while ensuring data is available within minutes (milliseconds latency). It minimizes storage costs by charging lower rates for infrequently accessed data without requiring manual lifecycle management.

Exam trap

The trap here is that candidates often choose S3 Standard for its low latency and availability, overlooking the cost savings of Intelligent-Tiering for unpredictable access patterns, or mistakenly select S3 Glacier Deep Archive thinking it is the cheapest option without considering the retrieval time requirement of 'within minutes'.

How to eliminate wrong answers

Option A is wrong because S3 Standard is designed for frequently accessed data and would be cost-inefficient for data that becomes rarely accessed after a few days, as it charges the same rate regardless of access frequency. Option C is wrong because S3 Glacier Deep Archive has retrieval times of 12 hours or more (not minutes) and is intended for archival data that is accessed at most once or twice per year, making it unsuitable for data that needs availability within minutes. Option D is wrong because S3 One Zone-Infrequent Access stores data in a single Availability Zone, which risks data loss if that zone fails, and it does not automatically adapt to changing access patterns, requiring manual lifecycle transitions to avoid higher costs when data becomes rarely accessed.

Practice this question →

302

Multi-Selectmedium

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

Select 3 answers

A.SSE-C

B.Client-side encryption

C.SSE-S3

D.SSE-KMS

E.AWS IAM

AnswersA, C, D

Server-side encryption with customer-provided keys.

Why this answer

SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows you to encrypt data at rest in S3 using your own encryption keys, which you manage outside of AWS. You provide the encryption key as part of your PUT request, and S3 uses it to encrypt the object before writing it to disk, then discards the key from memory. This method gives you full control over the key lifecycle while still leveraging S3's server-side encryption infrastructure.

Exam trap

The trap here is that candidates may confuse client-side encryption (which happens before data reaches S3) with server-side encryption at rest, or incorrectly assume that IAM provides encryption capabilities when it only controls access permissions.

Practice this question →

303

MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

A.Configure an Amazon CloudFront distribution with session affinity.

B.Store session data in Amazon ElastiCache and use a cookie to reference it.

C.Enable sticky sessions on the ALB using duration-based cookies.

D.Use a Network Load Balancer (NLB) with cross-zone load balancing.

AnswerC

ALB supports sticky sessions via cookies.

Why this answer

Application Load Balancers natively support sticky sessions (session affinity) using duration-based cookies. The ALB generates a cookie (AWSALB) that binds a user's session to a specific target instance for the duration of the cookie's lifetime, ensuring consistent user experience without external dependencies.

Exam trap

The trap here is that candidates often confuse stateless session management (e.g., ElastiCache) with ALB sticky sessions, or incorrectly assume that CloudFront or NLB can provide HTTP-level session affinity, when only ALB duration-based cookies directly satisfy the requirement for sticky sessions on the load balancer.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront session affinity (using the CloudFront-Viewer-Address header or cookies) is designed for content delivery and does not integrate with ALB sticky sessions; it would not ensure the ALB routes requests to the same EC2 instance. Option B is wrong because storing session data in ElastiCache with a cookie reference is a valid stateless architecture pattern, but the question explicitly requires sticky sessions on the ALB, not external session storage. Option D is wrong because Network Load Balancers do not support sticky sessions at Layer 4; they operate at the transport layer (TCP/UDP) and cannot inspect or manage HTTP cookies for session affinity.

Practice this question →

304

MCQhard

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

A.Use AWS Lake Formation to define column-level permissions and masking policies.

B.Create separate S3 buckets for each masking policy and copy data accordingly.

C.Use AWS Glue ETL jobs to mask data based on user role at query time.

D.Store masked data in separate prefixes in the same bucket and use S3 bucket policies.

AnswerA

Lake Formation provides fine-grained access control without data duplication.

Why this answer

AWS Lake Formation provides native column-level security and dynamic masking policies that can be applied per user or role without duplicating data. This approach minimizes storage costs because the data remains in a single location, and masking is applied at query time based on the requesting principal's permissions, satisfying the requirement for different masking policies per user.

Exam trap

The trap here is that candidates often confuse S3 bucket policies or Glue ETL jobs with the ability to perform dynamic, per-user column masking at query time, when in fact only Lake Formation provides this capability without data duplication or batch processing.

How to eliminate wrong answers

Option B is wrong because creating separate S3 buckets for each masking policy would multiply storage costs and require complex data synchronization, violating the cost minimization requirement. Option C is wrong because AWS Glue ETL jobs process data in batch, not at query time; masking at query time requires a service like Lake Formation or a query engine that supports dynamic data masking. Option D is wrong because S3 bucket policies cannot apply column-level masking or differentiate masking rules per user; they control access at the object or prefix level, not at the column or row level within a file.

Practice this question →

305

MCQeasy

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

A.OK

B.ALARM

C.INSUFFICIENT_DATA

D.ERROR

AnswerB

2 consecutive periods of breaching threshold.

Why this answer

The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Exam trap

The trap here is that candidates may confuse the alarm state with the metric value itself, assuming that a high metric value automatically means ALARM, but they must verify that the threshold and evaluation periods are met; however, in this case, the CLI explicitly shows the state as ALARM, so the answer is straightforward.

How to eliminate wrong answers

Option A is wrong because OK state would indicate that the metric is within the threshold (e.g., CPU utilization below 80%), but 85% exceeds it. Option C is wrong because INSUFFICIENT_DATA means there is not enough data to determine the alarm state (e.g., missing metric data points), but the CLI shows data is present and the alarm has evaluated to ALARM. Option D is wrong because ERROR is not a valid CloudWatch alarm state; the valid states are OK, ALARM, and INSUFFICIENT_DATA.

Practice this question →

306

Multi-Selectmedium

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

Select 2 answers

A.Enable S3 Versioning on the bucket.

B.Enable S3 Block Public Access settings at the account or bucket level.

C.Enable default encryption using SSE-S3.

D.Enable S3 server access logging for the bucket.

E.Configure a bucket policy that denies access unless the request originates from a specific VPC or IP range.

AnswersB, E

Block Public Access prevents any public access, improving security.

Why this answer

S3 Block Public Access settings provide a centralized, account- or bucket-level control that overrides any bucket policies or object ACLs that would grant public access, effectively preventing data exposure. Option E is correct because a bucket policy condition that restricts access to requests originating from a specific VPC or IP range limits the attack surface by ensuring only authorized network paths can reach the bucket, which is a key security best practice for sensitive data.

Exam trap

The trap here is that candidates often confuse data protection features like Versioning and encryption with access control mechanisms, leading them to select options that protect data integrity or confidentiality at rest but do not prevent unauthorized access or exposure.

Practice this question →

307

MCQhard

A gaming company is designing a new real-time multiplayer game backend on AWS. The game requires low-latency communication between players (< 50 ms) and the ability to handle up to 100,000 concurrent players. The backend must manage game state, player matchmaking, and chat. The company wants to use managed AWS services to reduce operational overhead. Which solution should a Solutions Architect recommend?

A.Use Amazon DynamoDB for game state, AWS Lambda for game logic, and API Gateway for client communication.

B.Use Amazon GameLift for session-based game server hosting, with its built-in matchmaking and fleet management.

C.Deploy game servers on EC2 instances behind a Network Load Balancer. Use ElastiCache for Redis for game state and SQS for chat messages.

D.Use Amazon ECS with Fargate to run game server containers, and use Application Auto Scaling to handle load.

AnswerB

GameLift is purpose-built for multiplayer games, handles scaling, matchmaking, and low-latency.

Why this answer

Amazon GameLift is purpose-built for session-based multiplayer game hosting, providing integrated matchmaking, fleet management, and auto-scaling to handle up to 100,000 concurrent players with low latency. Option A is incorrect because although DynamoDB can store game state, AWS Lambda is not ideal for real-time game logic due to cold start latency and limited execution duration, and API Gateway adds latency overhead, making it unsuitable for sub-50 ms requirements. Option C is incorrect because deploying game servers on EC2 instances requires manual management of scaling, patching, and fleet health, increasing operational overhead, and while ElastiCache Redis can handle game state and SQS can handle chat, the overall solution lacks a managed game server hosting service.

Option D is incorrect because Amazon ECS with Fargate abstracts infrastructure management but does not provide built-in session management, matchmaking, or low-latency optimization for gaming workloads, and containers may introduce latency overhead.

Practice this question →

308

MCQhard

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

A.Amazon Kinesis Data Streams + AWS Lambda

B.Amazon S3 + AWS Lambda

C.Amazon Kinesis Data Firehose + Amazon Redshift

D.Amazon SQS + AWS Lambda

AnswerA

Kinesis Data Streams provides low-latency ingestion with replay capability; Lambda processes records in real time.

Why this answer

Amazon Kinesis Data Streams can ingest and buffer millions of events per second with sub-100 ms latency, and AWS Lambda can process each record in near real-time as it arrives in the stream. This combination meets the low-latency requirement and allows events to be replayed from the stream's retention window (up to 365 days with extended retention).

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (which is near-real-time with batching) with Kinesis Data Streams (which is true real-time), or assume SQS can handle high-throughput streaming with replay, but SQS lacks ordered delivery and long-term retention for replay.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service with eventual consistency and no built-in real-time streaming capability, making it unsuitable for sub-100 ms event processing. Option C is wrong because Amazon Kinesis Data Firehose delivers data in batches (typically 60 seconds or 1 MB) and Amazon Redshift is a data warehouse optimized for analytical queries, not real-time per-event processing under 100 ms. Option D is wrong because Amazon SQS is a message queue with at least once delivery and typical latencies in the tens to hundreds of milliseconds, but it lacks the ordered replay and high-throughput streaming capabilities required for millions of events per second.

Practice this question →

309

MCQmedium

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

A.Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.

B.Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

C.Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

D.Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

AnswerA

Reserved concurrency ensures the function can scale, and SQS event source mapping provides at-least-once processing.

Why this answer

Configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Exam trap

The trap here is that candidates often assume increasing the batch size or using a dead-letter queue alone prevents message loss, but they overlook the critical need for reserved concurrency to guarantee scaling capacity during sudden spikes.

How to eliminate wrong answers

Option B is wrong because SQS cannot invoke Lambda asynchronously; Lambda must be configured as an event source mapping that synchronously pulls messages from the queue, and setting a 5-minute timeout does not address scaling or message loss. Option C is wrong because a 30-second visibility timeout is too short for Lambda processing, risking messages becoming visible again before processing completes, leading to duplicate processing; while a dead-letter queue captures failures, it does not prevent message loss during scaling. Option D is wrong because using a FIFO queue with a reserved concurrency of 1 severely limits throughput and prevents scaling to handle a sudden increase in messages, as FIFO queues process messages in order with limited concurrency.

Practice this question →

310

Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

Select 2 answers

A.Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.

B.Attach a transit gateway to the shared VPC and to each business unit's VPC.

C.Configure VPC endpoints in each business unit VPC to access the shared VPC.

D.Create VPC peering connections between the shared VPC and each business unit's VPC.

E.Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.

AnswersA, B

AWS RAM allows sharing subnets with other accounts in the organization.

Why this answer

AWS Resource Access Manager (RAM) allows you to share subnets from a centrally owned VPC with other AWS accounts within your AWS Organization. This enables business units to launch resources directly into the shared subnets while the VPC and its networking configuration remain managed centrally. Option B is correct because attaching a transit gateway to the shared VPC and to each business unit's VPC provides the necessary network connectivity between the shared VPC and the business unit VPCs, allowing traffic to flow while maintaining isolation through separate route tables and security group boundaries.

Together, these steps enable both resource sharing in the shared subnets and network connectivity with isolation.

Exam trap

The trap here is that candidates might think that VPC peering (option D) or AWS PrivateLink (option E) are required for connectivity, but a transit gateway is more scalable and manageable for connecting multiple VPCs while maintaining network isolation. Additionally, some may mistakenly believe that VPC sharing (via RAM) alone provides connectivity, which it does not; it only allows resource placement in shared subnets.

Practice this question →

311

MCQhard

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

A.Remove the condition from the bucket policy.

B.Add an IAM policy that allows s3:PutObject to the role.

C.Include the x-amz-server-side-encryption header with value aws:kms in the upload request.

D.Grant the role permission to use the KMS key.

AnswerC

The condition requires that header.

Why this answer

The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Exam trap

The trap here is that candidates often assume the failure is due to missing KMS key permissions (Option D) or missing IAM permissions (Option B), but the actual cause is the bucket policy condition requiring the encryption header, which is a common S3 security pattern tested on the SAP-C02 exam.

How to eliminate wrong answers

Option A is wrong because removing the condition would weaken security by allowing unencrypted uploads, but the question asks what users must do to successfully upload, not how to change the policy. Option B is wrong because the role already has an IAM policy allowing `s3:PutObject`; the failure is due to the bucket policy condition, not a lack of IAM permissions. Option D is wrong because the bucket policy condition only requires the encryption header to be set to `aws:kms`; it does not require the role to have KMS key permissions, and the upload fails at the S3 condition check before any KMS authorization is evaluated.

Practice this question →

312

MCQmedium

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

A.Amazon RDS with read replicas

B.Amazon DynamoDB with DAX

C.Amazon RDS with Multi-AZ deployment

D.Amazon ElastiCache for Redis

AnswerA

Read replicas scale read capacity.

Why this answer

Amazon RDS with read replicas is the correct choice because the application is read-heavy and requires low latency. Read replicas offload read traffic from the primary database instance, scaling read capacity and reducing latency for read operations by distributing the load across multiple copies of the data.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments with read replicas, assuming Multi-AZ also improves read performance, but Multi-AZ only provides failover redundancy and does not offload read traffic.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB with DAX is a NoSQL key-value and document database, not a relational database, and the question explicitly requires a relational database. Option C is wrong because Amazon RDS with Multi-AZ deployment provides high availability and failover support, but does not increase read capacity or reduce read latency; it only maintains a standby replica for disaster recovery. Option D is wrong because Amazon ElastiCache for Redis is an in-memory data store, not a relational database, and while it can cache data to improve read performance, it does not serve as the primary relational database itself.

Practice this question →

313

MCQmedium

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

A.Objects are transitioned to Glacier

B.The lifecycle rule is not applied because no prefix is specified

C.Objects are archived to S3 Standard-IA

D.Objects are permanently deleted

AnswerD

ExpirationInDays causes deletion after 30 days.

Why this answer

The CloudFormation template defines a lifecycle rule with an expiration action that deletes objects after 30 days. Since no prefix is specified, the rule applies to all objects in the bucket. After 30 days, objects are permanently deleted, not transitioned to another storage class.

Exam trap

The trap here is that candidates often confuse expiration (deletion) with transition (moving to another storage class) and may incorrectly assume a prefix is mandatory for lifecycle rules to apply.

How to eliminate wrong answers

Option A is wrong because the lifecycle rule specifies an 'Expiration' action, not a 'Transition' action, so objects are deleted, not moved to Glacier. Option B is wrong because a lifecycle rule without a prefix applies to the entire bucket; a prefix is optional and not required for the rule to be effective. Option C is wrong because the rule does not include a transition to S3 Standard-IA; it only has an expiration action that deletes objects.

Practice this question →

314

MCQhard

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

A.Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries

B.Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

C.Store data in Amazon EMR on EC2 and query with Hive

D.Store data in Amazon Redshift and query with Redshift Spectrum

AnswerA

S3 provides cost-effective storage with lifecycle management, and Athena can query data directly.

Why this answer

Amazon S3 lifecycle policies allow automatic transition of objects between storage classes (e.g., S3 Standard to S3 Standard-IA to S3 Glacier Deep Archive) based on age, optimizing cost for varying access patterns. Amazon Athena enables serverless SQL querying directly on data stored in S3, making it ideal for a petabyte-scale data lake without managing infrastructure.

Exam trap

The trap here is that candidates may confuse S3 Select with Athena, not realizing S3 Select is limited to single-object filtering and cannot perform joins or aggregations across multiple files, which is required for SQL queries on a data lake.

How to eliminate wrong answers

Option B is wrong because S3 Select is designed for simple filtering of single objects (e.g., retrieving a subset of rows/columns from a CSV file), not for running complex SQL queries across multiple objects or petabytes of data. Option C is wrong because storing data in Amazon EMR on EC2 requires provisioning and managing clusters, which is less cost-effective and more operationally complex than a serverless approach for a data lake. Option D is wrong because Amazon Redshift is a data warehouse optimized for structured, aggregated data, not a cost-effective storage layer for raw, diverse data at petabyte scale; Redshift Spectrum can query S3 but still requires a Redshift cluster, incurring additional costs.

Practice this question →

315

Multi-Selecteasy

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

Select 2 answers

A.Amazon Simple Notification Service (SNS)

B.AWS Direct Connect

C.Amazon Route 53

D.Amazon Simple Queue Service (SQS)

E.Amazon ElastiCache

AnswersA, D

SNS is a pub/sub service for decoupling.

Why this answer

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables microservices to communicate asynchronously. One service can publish a message to an SNS topic, and multiple subscriber services (e.g., Lambda, SQS, HTTP endpoints) can receive and process that message independently, decoupling the producer from the consumers.

Exam trap

The trap here is that candidates often confuse caching services (ElastiCache) or network services (Direct Connect, Route 53) with messaging services, failing to recognize that decoupling requires asynchronous communication via queues or pub/sub topics.

Practice this question →

316

MCQmedium

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

A.Use Amazon API Gateway in front of each service to throttle requests and protect against traffic spikes.

B.Implement retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code.

C.Convert all inter-service communication to asynchronous messaging using Amazon SQS or SNS.

D.Deploy multiple instances of each service across multiple Availability Zones and use an Application Load Balancer.

AnswerB

Circuit breakers and retries isolate failures and prevent cascading, a standard resilience pattern.

Why this answer

Implementing retry logic with exponential backoff, circuit breakers, and timeouts is the standard pattern to handle transient faults and prevent cascading failures in synchronous microservices communication. Circuit breakers stop calls to a failing service, allowing it to recover, while retries with backoff avoid overwhelming the service. Option A is wrong because API Gateway throttling only protects API Gateway itself, not cascading failures between internal services.

Option C is wrong because converting to asynchronous messaging is an architectural change that may not be suitable for synchronous REST APIs and does not directly address failure cascading without additional patterns. Option D is wrong because deploying multiple instances across AZs improves availability but does not protect against failures within a single service instance; it does not prevent cascading failures.

Practice this question →

317

MCQeasy

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

A.Amazon ElastiCache for Redis

B.Amazon Redshift

C.Amazon RDS for PostgreSQL

D.Amazon DynamoDB

AnswerD

DynamoDB is fully managed, serverless, and scales automatically, ideal for microservices.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Exam trap

The trap here is that candidates often choose Amazon RDS for PostgreSQL because they assume relational databases are required for structured data, but the question emphasizes minimizing operational overhead, and DynamoDB's serverless, fully managed nature eliminates the need for schema management, scaling, and patching that RDS still requires.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable primary data store; it is designed for caching, session management, and real-time analytics, not for persistent storage of microservice data. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries on large datasets, not for transactional or operational data storage required by individual microservices. Option C is wrong because Amazon RDS for PostgreSQL, while a fully managed relational database, introduces operational overhead for schema management, connection pooling, and scaling that contradicts the goal of minimizing operational overhead for microservices, and its relational model is less flexible for the independent data persistence patterns of microservices.

Practice this question →

318

MCQhard

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

A.Amazon Athena

B.Amazon EMR

C.Amazon Redshift Spectrum

D.AWS Glue Data Catalog

AnswerD

Glue Data Catalog automatically crawls data sources and stores metadata.

Why this answer

AWS Glue Data Catalog automatically discovers and catalogs metadata from data stored in Amazon S3, making it searchable. Option A, Amazon Athena, is a serverless query service that uses the Glue Data Catalog but does not itself catalog data. Option B, Amazon EMR, is a big data processing service using frameworks like Spark and Hadoop, not a catalog.

Option C, Amazon Redshift Spectrum, allows querying data in S3 from Redshift but does not provide a catalog.

Practice this question →

319

MCQeasy

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

A.Amazon EBS

B.Amazon S3

C.Amazon EFS

D.Amazon RDS

AnswerB

S3 is object storage optimized for high availability and low latency.

Why this answer

Amazon S3 is ideal for storing and serving static content like images with low latency. Option A (Amazon EBS) is block storage for EC2, Option C (Amazon EFS) is file storage, and Option D (Amazon RDS) is a relational database.

Practice this question →

320

MCQeasy

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

A.Simple scaling with step adjustments

B.Target tracking scaling policy based on average CPU utilization

C.Scheduled scaling

D.Manual scaling

AnswerB

Automatically adjusts capacity to maintain a target metric, cost-effective.

Why this answer

Target tracking scaling policy is the correct choice because it automatically adjusts the desired capacity of the Auto Scaling group to maintain a target metric (e.g., average CPU utilization at 50%) without requiring manual thresholds or step adjustments. This policy is ideal for variable traffic patterns as it dynamically scales in response to real-time demand, optimizing cost by adding or removing instances only as needed.

Exam trap

The trap here is that candidates often confuse simple scaling with step adjustments as being more granular, but target tracking is actually more responsive and cost-effective for variable traffic because it continuously adjusts capacity based on a single target value rather than fixed thresholds.

How to eliminate wrong answers

Option A is wrong because simple scaling with step adjustments requires predefined thresholds and step adjustments, which can lead to over-provisioning or under-provisioning during sudden traffic spikes due to lack of dynamic responsiveness. Option C is wrong because scheduled scaling is designed for predictable traffic patterns (e.g., time-of-day peaks) and cannot handle sudden, unpredictable spikes. Option D is wrong because manual scaling requires human intervention to adjust capacity, which is not cost-effective or responsive for variable traffic patterns.

Practice this question →

321

MCQhard

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

A.Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.

B.Use AWS Lake Formation to set up the data lake and use its built-in catalog.

C.Use Amazon Athena to create tables and partitions directly from S3.

D.Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.

AnswerA

Glue provides a data catalog and ETL capabilities.

Why this answer

AWS Glue provides a fully managed data catalog that integrates with Amazon Athena and Amazon Redshift Spectrum, making it the central metadata repository for the data lake. It can run ETL jobs for both streaming data (via Glue Streaming ETL) and batch data (via Glue Crawlers and Jobs), satisfying the requirement to catalog and prepare data from Kinesis Data Streams and Snowball. This combination directly meets the need for a unified catalog and query readiness.

Exam trap

The trap here is that candidates often assume Lake Formation (Option B) is the primary catalog service, but it actually uses the Glue Data Catalog as its foundation, and the question requires ETL capabilities that Lake Formation does not natively provide.

How to eliminate wrong answers

Option B is wrong because AWS Lake Formation is a service that simplifies data lake setup and security, but it relies on the AWS Glue Data Catalog as its underlying catalog; it does not provide a separate built-in catalog, and the question specifically asks for cataloging and querying, not just setup. Option C is wrong because Amazon Athena can create tables and partitions directly from S3 using DDL statements, but it lacks the ETL capabilities needed to process and transform streaming data from Kinesis Data Streams and batch data from Snowball; it is a query engine, not an ETL or catalog management service. Option D is wrong because Amazon Kinesis Data Firehose can deliver streaming data to S3, but it cannot catalog the data or handle batch data from Snowball; Athena alone cannot perform ETL or manage a unified catalog for both streaming and batch sources.

Practice this question →

322

MCQmedium

A developer ran the AWS CLI command shown in the exhibit. The instance has an attached EBS volume with 'DeleteOnTermination' set to false. The instance will be started again soon. What will happen to the EBS volume when the instance is stopped?

A.The EBS volume is detached but the data is preserved.

B.The EBS volume is deleted.

C.The EBS volume is deleted because the instance is stopped.

D.The EBS volume remains attached to the instance and the data persists.

AnswerD

Stopping an instance does not affect attached EBS volumes; data is preserved.

Why this answer

Stopping an EC2 instance does not affect the attached EBS volumes; they remain attached and their data persists. The 'DeleteOnTermination' attribute only controls behavior when the instance is terminated, not stopped. Since the instance will be started again soon, the volume stays attached with its data intact.

Exam trap

The trap here is that candidates confuse the 'stop' and 'terminate' actions, incorrectly assuming that 'DeleteOnTermination' applies to both, when in fact it only applies to termination.

How to eliminate wrong answers

Option A is wrong because stopping an instance does not detach the EBS volume; the volume remains attached and available when the instance is started again. Option B is wrong because the EBS volume is not deleted when the instance is stopped; deletion only occurs on instance termination if 'DeleteOnTermination' is set to true, which it is not. Option C is wrong because the volume is not deleted due to the instance being stopped; the 'DeleteOnTermination' attribute is irrelevant during a stop operation.

Practice this question →

323

MCQmedium

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

A.Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key

B.Use AWS Trusted Advisor to check bucket encryption

C.Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

D.Use AWS Config rules to detect non-compliant buckets and send alerts

AnswerA

SCPs enforce across all accounts in the organization.

Why this answer

A service control policy (SCP) can deny the s3:PutBucketEncryption action unless the encryption setting specifies the required KMS key. This centrally enforces the encryption requirement across all accounts in the AWS Organization, preventing any account from creating or modifying a bucket with non-compliant encryption, regardless of IAM permissions within that account.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config, Trusted Advisor) with preventive controls (SCP), or they mistakenly think IAM policies attached to users can enforce encryption at the bucket level across all accounts and principals.

How to eliminate wrong answers

Option B is wrong because AWS Trusted Advisor only provides reactive checks and alerts; it cannot enforce or prevent non-compliant actions, so buckets could be created without the required encryption before any alert is acted upon. Option C is wrong because an IAM policy attached to users does not apply to roles or service principals (e.g., AWS services, cross-account roles), and it only controls s3:PutObject, not the bucket-level encryption configuration set via s3:PutBucketEncryption. Option D is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets and trigger remediation, but they cannot block the initial creation or modification of a bucket with non-compliant encryption.

Practice this question →

324

MCQhard

A healthcare company is designing a new system on AWS to store and analyze patient health records. The system must comply with HIPAA regulations. Data includes structured lab results and unstructured clinical notes. The company needs to run complex SQL queries on the structured data and perform natural language processing (NLP) on the unstructured data. The solution should be cost-effective and minimize administrative overhead. Which solution should a Solutions Architect recommend?

A.Store structured data in Amazon RDS for PostgreSQL, store unstructured data in S3, and use AWS Glue to run NLP jobs.

B.Store all data in S3, use Amazon Athena for SQL queries and Amazon Textract for NLP.

C.Store structured data in DynamoDB, store unstructured data in S3, use Amazon SageMaker to build custom NLP models.

D.Store structured data in Amazon Redshift, store unstructured data in S3, and use Amazon Comprehend Medical for NLP.

AnswerD

Redshift is for analytics; Comprehend Medical is HIPAA-eligible and designed for medical NLP.

Why this answer

Amazon Redshift is a fully managed, petabyte-scale data warehouse service that is ideal for running complex SQL queries on structured data, and it supports HIPAA compliance. Amazon Comprehend Medical is a HIPAA-eligible natural language processing (NLP) service specifically designed to extract medical information from unstructured clinical text. Storing unstructured data in Amazon S3 is cost-effective and scalable.

This combination minimizes administrative overhead with managed services. Option A is incorrect because Amazon RDS for PostgreSQL is not optimized for complex analytics at scale and may require additional setup for performance. Option B is incorrect because Amazon Athena is best for ad-hoc queries and not ideal for frequent, complex SQL workloads; moreover, Amazon Textract is for document extraction (e.g., OCR), not NLP.

Option C is incorrect because Amazon DynamoDB is a NoSQL database not suited for complex SQL queries, and Amazon SageMaker would require custom model building, increasing overhead compared to using a managed NLP service like Comprehend Medical.

Practice this question →

325

MCQmedium

A company is designing a new application on AWS that processes real-time IoT sensor data from thousands of devices. The data must be ingested, processed, and stored for analysis. The company wants to use a serverless architecture to reduce operational overhead. The processing includes filtering, aggregation, and transformation. Which solution should a Solutions Architect recommend?

A.Use Amazon Kinesis Data Streams to ingest data, use Kinesis Data Firehose to deliver data to S3, and use Athena for queries.

B.Use Amazon Kinesis Data Streams to ingest data, trigger a Lambda function for processing, and store results in DynamoDB.

C.Use Amazon SQS to ingest sensor data, trigger a Lambda function for processing, and store results in DynamoDB.

D.Use AWS IoT Core to ingest data, use IoT rules to route data to Kinesis Data Analytics for real-time processing, and store results in S3.

AnswerD

IoT Core is designed for IoT; Kinesis Data Analytics provides real-time SQL processing; S3 is cost-effective storage.

Why this answer

AWS IoT Core is purpose-built for ingesting data from IoT devices, its rules engine can route data to Kinesis Data Analytics for real-time processing using SQL, and results can be stored in S3 for analysis. Option A is incorrect because Kinesis Data Firehose delivers data in batches, not real-time processing as required. Option B is incorrect because while Lambda can process, it may have concurrency limits and is less optimal for high-throughput streaming compared to Kinesis Data Analytics.

Option C is incorrect because SQS is not designed for real-time streaming ingestion from IoT devices; it's a message queue, not a streaming service.

Practice this question →

326

MCQmedium

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

A.Amazon Kinesis Data Firehose for ingestion and delivery to Amazon S3, then use AWS Glue for ETL into Amazon Redshift.

B.Amazon DynamoDB Streams for ingestion, AWS Lambda for processing, and Amazon Redshift for storage.

C.Amazon SQS for ingestion, AWS Lambda for processing, and Amazon DynamoDB for storage.

D.Amazon Kinesis Data Streams for ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon S3 as a staging area before loading into Amazon Redshift.

AnswerD

Kinesis Data Streams handles high throughput, Data Analytics processes in real-time, and S3 integrates with Redshift.

Why this answer

Amazon Kinesis Data Streams can ingest millions of events per second with durable, ordered shards, while Kinesis Data Analytics provides real-time SQL or Apache Flink processing on the stream. Amazon S3 acts as a staging layer before loading into Amazon Redshift via COPY or Redshift Spectrum, enabling scalable analytics without throttling the ingestion pipeline.

Exam trap

The SAP-C02 exam often tests the distinction between Kinesis Data Streams (real-time, sub-second) and Kinesis Data Firehose (near-real-time, minutes of latency), leading candidates to choose Firehose for real-time requirements.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a near-real-time delivery service with a minimum buffer interval of 60 seconds, which cannot meet the sub-second real-time processing requirement for millions of events per second. Option B is wrong because DynamoDB Streams are designed for change data capture from a DynamoDB table, not for direct ingestion of high-throughput streaming data from IoT devices, and DynamoDB Streams have a limited retention period (24 hours) and throughput constraints. Option C is wrong because Amazon SQS is a message queue with at-least-once delivery and no native ordering guarantees (unless using FIFO, which limits throughput to 300 TPS), making it unsuitable for high-velocity, ordered streaming data; DynamoDB is not a data warehouse optimized for complex analytics queries.

Practice this question →

327

Multi-Selecthard

A company is deploying a containerized application on Amazon EKS. The application requires persistent storage that can be shared across multiple pods in different Availability Zones. Which TWO storage solutions meet this requirement? (Choose TWO.)

Select 2 answers

A.Amazon EBS with io2 volumes

B.Amazon S3

C.Amazon EC2 Instance Store

D.Amazon FSx for Lustre

E.Amazon EFS

AnswersD, E

FSx for Lustre is a high-performance file system that can be shared across multiple clients in different AZs.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple Amazon EKS pods across different Availability Zones, making it suitable for shared persistent storage. Amazon FSx for Lustre is a high-performance file system optimized for workloads like machine learning and HPC, and it supports concurrent access from multiple clients across AZs, meeting the requirement for shared storage.

Exam trap

The trap here is that candidates often assume EBS volumes can be shared across pods because they are persistent, but EBS is a block device with a single-attach limitation, making it unsuitable for multi-pod shared access across AZs.

Practice this question →

328

MCQmedium

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

A.Use Amazon Kinesis Data Streams and an AWS Lambda function

B.Use an SQS queue and an EC2 Auto Scaling group to poll and process messages

C.Use an SQS queue as an event source for an AWS Lambda function

D.Use SQS to send messages to Amazon SNS, which triggers a Lambda function

AnswerC

Lambda scales automatically with the SQS queue and charges per execution, minimizing cost and overhead.

Why this answer

Using an SQS queue as an event source for AWS Lambda enables real-time, low-latency processing of messages without any polling infrastructure to manage. Lambda automatically scales to handle variable processing times (100 ms to 5 seconds) and charges only for compute time used, minimizing both cost and operational overhead. This serverless approach eliminates the need for EC2 instances or Auto Scaling groups, aligning perfectly with the requirements for minimal latency and reduced management effort.

Exam trap

The trap here is that candidates often assume EC2 Auto Scaling is required for variable processing times, overlooking Lambda's native ability to scale instantly and cost-effectively for SQS-triggered workloads, or they mistakenly add unnecessary services like SNS or Kinesis that increase latency and cost without benefit.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams is designed for streaming large volumes of data with shard-level throughput limits, not for individual message processing with variable latency, and it introduces higher cost and operational complexity compared to SQS-Lambda integration. Option B is wrong because using an EC2 Auto Scaling group to poll SQS adds significant operational overhead for managing instances, scaling policies, and polling logic, and it cannot match the sub-second scaling and cost efficiency of Lambda for variable processing times. Option D is wrong because adding Amazon SNS between SQS and Lambda introduces unnecessary latency and complexity; SQS can directly trigger Lambda without SNS, and SNS is typically used for fan-out to multiple subscribers, not for simple message processing.

Practice this question →

329

Multi-Selecthard

A company is designing a new application on AWS that requires a highly available and durable NoSQL database. The database must be able to scale horizontally for both reads and writes. Which TWO AWS services meet these requirements? (Choose two.)

Select 2 answers

A.Amazon Neptune

B.Amazon DynamoDB

C.Amazon RDS for MySQL with Multi-AZ

D.Amazon DocumentDB (with MongoDB compatibility)

E.Amazon ElastiCache for Memcached

AnswersB, D

DynamoDB is a fully managed NoSQL database with horizontal scaling and high durability.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides high availability and durability by automatically replicating data across multiple Availability Zones in an AWS Region. It supports horizontal scaling for both reads and writes through its partitioning mechanism and on-demand or provisioned capacity modes, making it ideal for applications requiring consistent performance at any scale.

Exam trap

The trap here is that candidates may confuse Amazon DocumentDB with a self-managed MongoDB deployment or assume that any database with 'Document' in the name lacks horizontal scaling, while in reality DocumentDB provides automatic replication and read scaling similar to DynamoDB.

Practice this question →

330

MCQmedium

A company is designing a microservices architecture on AWS. Each service needs its own DynamoDB table, and services must be fully isolated. Which networking design ensures that services can only communicate through APIs and not directly to each other's databases?

A.Place all services in a single VPC with security groups to control traffic.

B.Use a transit VPC with VPN connections to each service's VPC.

C.Create a separate VPC for each service, with VPC peering only between the API gateway and each service VPC.

D.Use a single VPC with public and private subnets; place databases in private subnets and services in public subnets.

AnswerC

This ensures each service's database is isolated and only accessible via the API.

Why this answer

Creating a separate VPC for each service enforces full network isolation, and using VPC peering only between the API Gateway and each service VPC ensures that services can only communicate through APIs. This design prevents any direct network-level access between service databases, as there is no peering or routing between the service VPCs themselves, aligning with the microservices principle of strict isolation.

Exam trap

The trap here is that candidates often assume a single VPC with security groups or subnets is sufficient for isolation, but they overlook that network-level isolation requires separate VPCs to prevent any direct routing between services, which is a key nuance in the SAP-C02 exam for microservices architectures.

How to eliminate wrong answers

Option A is wrong because placing all services in a single VPC with security groups still allows potential direct network access between services and their databases if security groups are misconfigured, and it does not enforce API-only communication. Option B is wrong because a transit VPC with VPN connections introduces unnecessary complexity and still allows potential routing between service VPCs, which could enable direct database access. Option D is wrong because using a single VPC with public and private subnets places databases in private subnets and services in public subnets, but services in public subnets can still directly access databases in private subnets via internal routing, violating the requirement for API-only communication.

Practice this question →

331

MCQeasy

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

A.Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.

B.Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.

C.Store logs in Amazon S3 Glacier and use S3 Select to query directly.

D.Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.

AnswerB

S3 Standard-IA offers lower cost for infrequent access with retrieval available.

Why this answer

Amazon Kinesis Data Firehose can stream logs directly to Amazon S3, and S3 Lifecycle policies allow automatic transition to S3 Standard-IA after 30 days, which reduces storage costs for infrequently accessed data while still allowing occasional queries. This combination meets the one-year retention requirement cost-effectively, as S3 Standard-IA has lower storage costs than S3 Standard for data accessed less frequently, and the lifecycle transition avoids manual intervention.

Exam trap

The trap here is that candidates often choose CloudWatch Logs (Option D) because it seems like the natural logging service, but they overlook the high cost of storing large volumes of log data for a year in CloudWatch Logs compared to S3 with lifecycle transitions.

How to eliminate wrong answers

Option A is wrong because storing logs on EBS volumes attached to a single EC2 instance is not cost-effective for 3.65 TB of logs (10 GB/day × 365 days) — EBS volumes incur high costs for storage and provisioned IOPS, and the single instance creates a single point of failure and limits query scalability. Option C is wrong because S3 Glacier is designed for archival storage with retrieval times of minutes to hours, and S3 Select cannot query data in Glacier directly — S3 Select only works on objects in S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Glacier Instant Retrieval, not in S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive. Option D is wrong because Amazon CloudWatch Logs is optimized for real-time monitoring and operational analytics, not for long-term cost-effective storage — storing 3.65 TB of logs in CloudWatch Logs for 365 days would be significantly more expensive than S3, and CloudWatch Logs charges per GB ingested and per GB stored, making it less cost-effective for occasional querying.

Practice this question →

332

Multi-Selectmedium

Which TWO design patterns help ensure data durability in Amazon S3?

Select 2 answers

A.Enable Cross-Region Replication (CRR).

B.Enable S3 Versioning.

C.Enable MFA Delete.

D.Use S3 Standard-IA storage class.

E.Configure lifecycle policies to transition to Glacier.

AnswersA, B

Replicates objects to another region for durability against regional failures.

Why this answer

Options A and B are correct. Versioning protects against accidental deletion or overwrite, ensuring data durability. Cross-Region Replication (CRR) replicates objects to another region, protecting against region-level failures and enhancing durability.

Option C is incorrect because MFA Delete is a security feature that requires multi-factor authentication to delete objects, but it does not increase the number of copies or protect against data loss. Option D is incorrect because S3 Standard-IA is a storage class designed for infrequently accessed data with lower cost, but it has the same durability as S3 Standard (11 nines) and does not provide additional durability. Option E is incorrect because lifecycle policies manage data lifecycle and cost optimization, not durability; transitioning to Glacier does not increase durability.

Practice this question →

333

Multi-Selecthard

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

Select 2 answers

A.Use Amazon Aurora Global Database for the database tier.

B.Use a cross-region read replica for RDS and promote it during disaster.

C.Use EC2 AMI copy to another region and launch instances from the AMI.

D.Use RDS cross-region snapshots and restore in the DR region.

E.Configure RDS Multi-AZ in the primary region.

AnswersA, B

Aurora Global Database provides low RPO/RTO cross-region.

Why this answer

Amazon Aurora Global Database supports cross-region replication with typical RPO of less than 1 second and RTO of less than 1 minute, easily meeting the 15-minute RTO and 1-hour RPO. The primary region writes are asynchronously replicated to up to five secondary regions, and in a disaster, you can promote a secondary region to full read/write in under a minute.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which can meet the RPO/RTO if properly configured and promoted quickly) with cross-region snapshots (which are too slow), or they mistakenly think Multi-AZ provides cross-region DR when it only protects against AZ failures within a single region.

Practice this question →

334

MCQhard

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

A.Use an Application Load Balancer (ALB) with an Elastic IP address.

B.Use Amazon Route 53 with a weighted routing policy.

C.Use a Network Load Balancer (NLB) with an Elastic IP address.

D.Use a Classic Load Balancer (CLB) with an Elastic IP address.

AnswerC

NLB supports Elastic IPs and is highly available across AZs.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Exam trap

The trap here is that candidates often assume an ALB can use Elastic IPs because it is a modern load balancer, but ALBs are DNS-based and cannot be assigned static IPs, making the NLB the only correct choice for fixed IP whitelisting with high availability.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support Elastic IP addresses; it uses a DNS name and its IP addresses can change, making it unsuitable for fixed IP whitelisting. Option B is wrong because Amazon Route 53 with a weighted routing policy distributes traffic across multiple endpoints but does not provide a single fixed IP address for whitelisting; it relies on DNS resolution which can change. Option D is wrong because a Classic Load Balancer (CLB) can be assigned an Elastic IP, but it is a legacy service that does not support multiple Availability Zones natively and lacks the high availability and performance features of an NLB.

Practice this question →

335

MCQmedium

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

A.The policy has no effect because the condition is invalid.

B.The request is denied unless there is another explicit deny.

C.The request is denied.

D.The request is allowed.

AnswerD

The IP matches the condition.

Why this answer

The IAM policy is attached to the IAM user and includes a condition that denies access unless the request originates from a specific IP address range (e.g., 10.0.0.0/16). Since the request comes from IP 10.0.1.5, which falls within that allowed range, the condition is satisfied, and the policy's effect is to allow the s3:GetObject action. Therefore, the download is permitted.

Exam trap

The trap here is that candidates often assume any condition automatically denies access, but conditions only restrict when they are not met; if the condition is satisfied, the allow takes effect.

How to eliminate wrong answers

Option A is wrong because the condition is valid; AWS IAM supports the 'aws:SourceIp' condition key for IP-based restrictions, and the IP 10.0.1.5 matches the allowed range. Option B is wrong because the policy explicitly allows the action under the condition, and there is no explicit deny present; an explicit deny would override an allow, but here the condition is met, so the allow stands. Option C is wrong because the request is not denied; the condition is satisfied, so the policy grants access.

Practice this question →

336

MCQeasy

A solutions architect is designing a disaster recovery plan for a critical application. The application runs on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which approach meets these requirements?

A.Use backup and restore: take hourly snapshots of EBS volumes and copy to us-west-2, then restore EC2 instances from snapshots.

B.Implement a pilot light strategy: replicate data to us-west-2 and keep a minimal stack running.

C.Deploy a multi-site active-active configuration with full capacity in both regions.

D.Use a warm standby: maintain a scaled-down copy of the environment in us-west-2 that can be scaled up within 15 minutes.

AnswerD

Warm standby allows quick scaling to full capacity within RTO.

Why this answer

A warm standby strategy meets the RTO of 15 minutes and RPO of 1 hour by maintaining a scaled-down copy of the environment in us-west-2 that can be rapidly scaled up to full production capacity. This approach ensures data replication (e.g., using Amazon RDS cross-Region replication or EBS snapshots) meets the 1-hour RPO, while the pre-provisioned but smaller infrastructure allows scaling within the 15-minute RTO, unlike a pilot light which requires more time to provision resources.

Exam trap

The trap here is that candidates often confuse pilot light with warm standby, assuming a minimal running stack can be scaled within 15 minutes, but pilot light typically requires provisioning compute and networking resources (e.g., launching EC2 instances, configuring ALB) which takes longer than the RTO, whereas warm standby already has those resources running in a scaled-down state.

How to eliminate wrong answers

Option A is wrong because backup and restore with hourly EBS snapshots copied to us-west-2 cannot achieve a 15-minute RTO, as restoring EC2 instances from snapshots involves launching new instances, attaching volumes, and configuring the ALB, which typically takes longer than 15 minutes. Option B is wrong because a pilot light strategy keeps only core data and minimal services running (e.g., a small database), requiring significant time to provision full EC2 instances, ALB, and scale-out, which exceeds the 15-minute RTO. Option C is wrong because a multi-site active-active configuration with full capacity in both regions is overkill and unnecessarily costly for an RTO of 15 minutes and RPO of 1 hour, and it does not align with the requirement for a disaster recovery plan that can be activated on demand.

Practice this question →

337

MCQmedium

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

A.Use Amazon EventBridge cross-account event buses in each target account

B.Publish events to an AWS Lambda function in each target account

C.Use Amazon Kinesis Data Streams with cross-account access

D.Create an Amazon SNS topic in the central account and subscribe SQS queues in each target account

AnswerA

EventBridge natively supports cross-account event routing.

Why this answer

Amazon EventBridge cross-account event buses allow a central account to route events directly to event buses in target accounts using resource-based policies. This approach is serverless, fully managed, and scales horizontally without any intermediate components, making it the most scalable and secure solution. It avoids the complexity and potential bottlenecks of Lambda invocations, Kinesis stream management, or SNS-to-SQS fan-out across accounts.

Exam trap

The trap here is that candidates often default to SNS or SQS for cross-account messaging, but EventBridge's native cross-account event bus feature is specifically designed for this use case and is more scalable and secure because it uses resource-based policies and avoids intermediate services.

How to eliminate wrong answers

Option B is wrong because publishing events to a Lambda function in each target account introduces a single point of failure and scaling bottleneck per function, and requires managing cross-account IAM roles for each invocation, which is less scalable and more complex than native EventBridge cross-account routing. Option C is wrong because Amazon Kinesis Data Streams is designed for real-time data streaming with consumer-based processing, not for event routing to multiple accounts; it would require custom consumers and cross-account access policies, adding operational overhead and latency compared to EventBridge's direct push model. Option D is wrong because creating an SNS topic in the central account and subscribing SQS queues in each target account requires SQS to poll from SNS, which introduces latency and does not support event filtering or schema validation natively; also, SNS does not natively support cross-account subscriptions without additional SQS policy configuration, making it less secure and more complex than EventBridge's resource-based policies.

Practice this question →

338

MCQmedium

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

A.Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.

B.Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

C.Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

D.Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

AnswerA

This option provides serverless, decoupled, and scalable components ideal for unpredictable spikes.

Why this answer

It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Exam trap

The trap here is that candidates often choose Kinesis Data Streams (Option C) thinking it provides better decoupling, but they overlook that SQS is specifically designed for asynchronous message buffering with per-message visibility timeouts, which is more appropriate for microservices decoupling than Kinesis's shard-based streaming model.

How to eliminate wrong answers

Option B is wrong because it relies on EC2 Auto Scaling and ALB, which have slower scaling response times (minutes) compared to Lambda's sub-second scaling, making it less resilient to sudden spikes. Option C is wrong because Kinesis Data Streams is designed for real-time streaming analytics with shard-level scaling, not for decoupling request-response microservices; it lacks the buffering and visibility timeout features of SQS that are critical for resilient decoupling. Option D is wrong because RDS with read replicas introduces a relational database bottleneck that does not scale horizontally for unpredictable write-heavy spikes, and ECS with Fargate still requires container startup time and task definition management, which is less elastic than Lambda's instant scaling.

Practice this question →

339

Multi-Selecteasy

A company is designing a new data processing pipeline that must transform data from JSON to Parquet format. The pipeline should run daily and handle data up to 10 GB. Which TWO AWS services can be used to perform this transformation?

Select 2 answers

A.Amazon EMR

B.AWS Lambda

C.AWS Glue

D.Amazon Athena (CTAS queries)

E.Amazon Kinesis Data Firehose

AnswersC, D

Serverless ETL service.

Why this answer

AWS Glue is correct because it provides a fully managed ETL service that can natively read JSON and write Parquet, with built-in transforms and schema inference. Glue jobs run on Apache Spark under the hood, making them suitable for daily batch processing of up to 10 GB without managing any infrastructure.

Exam trap

The trap here is that candidates often choose Lambda for small-to-medium batch jobs without considering the 15-minute timeout and 10 GB memory limit, which makes it impractical for transforming 10 GB of data in a single run.

Practice this question →

340

MCQeasy

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

A.The upload request does not include the required ACL header.

B.The resource ARN is incorrect.

C.The bucket policy denies the request.

D.The user does not have s3:PutObject permission.

AnswerA

The condition enforces the ACL header.

Why this answer

When an IAM user in Account A uploads objects to an S3 bucket in Account B, the bucket policy must explicitly grant the cross-account principal `s3:PutObject` permission. However, if the bucket is configured to require the `bucket-owner-full-control` canned ACL (or a specific ACL header) for uploaded objects, the request must include that ACL header. Without it, S3 denies the upload even if the IAM policy and bucket policy otherwise allow the action.

This is a common requirement when the bucket owner wants to ensure they retain full control of objects uploaded by other accounts.

Exam trap

The trap here is that candidates assume cross-account S3 access failures are always due to missing IAM or bucket policy permissions, but AWS often tests the subtle requirement of including the `bucket-owner-full-control` ACL header to ensure object ownership transfers to the bucket owner.

How to eliminate wrong answers

Option B is wrong because the resource ARN in the IAM policy is used to specify which S3 bucket the policy applies to; if the ARN were incorrect, the policy would not match the bucket and the user would get an implicit deny, but the question states the policy is attached and the bucket is owned by another account, so the ARN is likely correct. Option C is wrong because the bucket policy is the mechanism that grants cross-account access; if the bucket policy denied the request, it would explicitly state a Deny effect, but the most common cause of failure in cross-account uploads is the missing ACL header, not a deny statement. Option D is wrong because the IAM policy attached to the user explicitly grants `s3:PutObject` permission (as implied by the exhibit), so the user does have that permission; the failure is due to the missing ACL requirement, not a lack of permission.

Practice this question →

341

MCQeasy

A developer runs the above AWS CLI command. What is the expected output?

A.A list of public IP addresses

B.A list of instance IDs for running web-server instances

C.All instance IDs regardless of state

D.An error because the query syntax is incorrect

AnswerB

The command returns InstanceIds of running instances with the specified tag.

Why this answer

The AWS CLI command uses `describe-instances` with a `--filters` parameter to select only instances with a tag `Name=web-server` and a state of `running`. The `--query` parameter then extracts the `InstanceId` values from the result. Therefore, the output is a list of instance IDs for running web-server instances, making option B correct.

Exam trap

The trap here is that candidates may overlook the `--filters` parameter and assume the command returns all instance IDs, or they may misinterpret the JMESPath query as invalid, when in fact it is a standard pattern for extracting nested fields in AWS CLI output.

How to eliminate wrong answers

Option A is wrong because the command does not query for public IP addresses; it filters for instances with a specific tag and state, and the query extracts only InstanceId, not network attributes. Option C is wrong because the filter `Name=instance-state-name,Values=running` explicitly limits the output to running instances, excluding stopped, terminated, or other states. Option D is wrong because the query syntax is valid: `Reservations[*].Instances[*].InstanceId` correctly uses JMESPath to flatten and extract the InstanceId from the nested structure returned by describe-instances.

Practice this question →

342

MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

A.Manual scaling

B.Scheduled scaling

C.Target tracking scaling policies

D.Simple scaling policies

AnswerC

Target tracking automatically adjusts capacity to maintain a target metric value.

Why this answer

Target tracking scaling policies are the correct choice because they allow Auto Scaling to automatically adjust capacity based on a target value for a specific CloudWatch metric (e.g., average CPU utilization or request count per target). This approach handles sudden traffic spikes without manual intervention by continuously monitoring the metric and adding or removing EC2 instances to maintain the target, making it ideal for unpredictable workloads.

Exam trap

The trap here is that candidates often confuse simple scaling policies with target tracking, assuming any policy based on CloudWatch alarms is sufficient, but simple scaling's cooldown period and single-step adjustment make it inadequate for sudden, sustained spikes that require rapid, continuous scaling.

How to eliminate wrong answers

Option A is wrong because manual scaling requires human intervention to adjust capacity, which cannot handle sudden spikes without delay and defeats the purpose of automation. Option B is wrong because scheduled scaling adjusts capacity at predetermined times, which is ineffective for unexpected traffic spikes that do not follow a predictable pattern. Option D is wrong because simple scaling policies only perform a single scaling adjustment based on a CloudWatch alarm breach and then must wait for a cooldown period, making them slower to react to rapid, sustained spikes compared to target tracking's continuous adjustment.

Practice this question →

343

Multi-Selectmedium

A company is designing a new microservices architecture that requires service discovery and API management. Which THREE services can be used together to achieve this? (Choose THREE.)

Select 3 answers

A.Amazon Route 53

B.Amazon API Gateway

C.Application Load Balancer

D.Amazon VPC Lattice

E.AWS Cloud Map

AnswersB, C, E

API Gateway creates and manages APIs.

Why this answer

Amazon API Gateway (B) is correct because it provides a fully managed API management layer that handles API creation, publishing, monitoring, and security, enabling microservices to expose RESTful or WebSocket APIs. Application Load Balancer (C) is correct as it can distribute incoming traffic across multiple microservice targets (e.g., ECS tasks, Lambda functions) and supports path-based routing, which is essential for service discovery and traffic management. AWS Cloud Map (E) is correct because it offers a service registry that allows microservices to dynamically discover each other by name, using DNS or HTTP API calls, and integrates with health checks to ensure only healthy endpoints are returned.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's DNS-based service discovery with the full service registry and API management capabilities required, or they mistakenly think VPC Lattice can replace both API Gateway and Cloud Map, when in fact VPC Lattice focuses on network-layer connectivity and does not provide API management features like authentication, throttling, or request transformation.

Practice this question →

344

MCQmedium

A company is designing a multi-tier web application on AWS. The application must be highly available and scale automatically based on traffic. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier also uses EC2 instances. Which solution meets these requirements with the LEAST operational overhead?

A.Use Amazon ECS with Fargate for both tiers, with an Application Load Balancer.

B.Use AWS Global Accelerator with a single Auto Scaling group for both tiers.

C.Use Network Load Balancer with Auto Scaling groups for both tiers.

D.Use Auto Scaling groups for both web and application tiers, and route traffic through an Application Load Balancer.

AnswerD

Auto Scaling groups provide automatic scaling and health checks, ALB distributes traffic, low overhead.

Why this answer

Using Auto Scaling groups for both web and application tiers with an Application Load Balancer provides automatic scaling and high availability with minimal operational overhead. Auto Scaling groups handle instance health and scaling based on demand, while the ALB distributes HTTP traffic. Option A is incorrect because ECS with Fargate introduces container management complexity, increasing operational overhead compared to EC2 Auto Scaling groups.

Option B is incorrect because AWS Global Accelerator does not provide automatic scaling for instances; it only improves traffic routing and latency. Option C is incorrect because a Network Load Balancer is designed for TCP/UDP traffic and does not natively support HTTP-layer features needed for a web application, and it does not integrate with Auto Scaling for automatic scaling as seamlessly as an ALB.

Practice this question →

345

MCQhard

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

A.The function is invoked via two different triggers

B.The function is configured with two different reserved concurrency settings

C.The function has two versions: $LATEST and version 1

D.The function is deployed in two different regions

AnswerC

Each version has its own metric.

Why this answer

The CLI output shows two metrics for the Errors metric because the function has two versions: $LATEST (the unpublished, mutable version) and version 1 (the published, immutable version). The alias 'prod' points to version 1, but CloudWatch metrics are emitted per version, so both $LATEST and version 1 generate separate error metric streams. This is why two distinct data points appear for the same metric name.

Exam trap

The trap here is that candidates assume the alias 'prod' consolidates all metrics into a single stream, but AWS CloudWatch emits separate metric dimensions for each version, even when an alias points to a specific version, causing two distinct error metric lines.

How to eliminate wrong answers

Option A is wrong because multiple triggers (e.g., S3, API Gateway) would invoke the same function version, not create separate metric streams; CloudWatch aggregates errors per version, not per trigger. Option B is wrong because reserved concurrency settings affect throttling behavior, not the number of metric streams; they do not create separate error metrics. Option D is wrong because the function is deployed in a single region (implied by the CLI output), and cross-region deployments would require separate function ARNs and would not appear as two metrics under the same function name in a single region's CloudWatch console.

Practice this question →

346

Multi-Selectmedium

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

Select 3 answers

A.Amazon Kinesis Data Firehose to deliver events to destinations.

B.AWS Lambda functions to consume events from queues and process them.

C.AWS AppSync to provide real-time subscriptions for events.

D.Amazon SQS FIFO queues to ensure exactly-once processing.

E.Amazon EventBridge to ingest events and route them based on rules.

AnswersB, D, E

Lambda can poll SQS queues and process events.

Why this answer

AWS Lambda functions are correct because they can be triggered by Amazon SQS FIFO queues to process messages one at a time, preserving the order and enabling idempotent processing. Lambda integrates natively with SQS, automatically scaling the number of concurrent executions based on the queue depth, which supports the exactly-once processing requirement when combined with FIFO queues.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose with Amazon Kinesis Data Streams, assuming Firehose supports exactly-once processing, but Firehose only provides at-least-once delivery and lacks the FIFO ordering and deduplication capabilities required for this use case.

Practice this question →

347

Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

Select 1 answer

A.Use S3 Cross-Region Replication for application data and launch EC2 instances from AMIs copied to the secondary Region

B.Take hourly snapshots of EBS volumes and copy them to another Region; use AWS CloudFormation to launch instances from the snapshots

C.Use Amazon Aurora Global Database for the database and deploy EC2 instances with an Application Load Balancer that has cross-Region load balancing enabled

D.Use Amazon DynamoDB global tables for the database and deploy EC2 instances in a warm standby configuration in another Region

E.Configure an Active-Passive failover using Route 53 with health checks within the same Region

AnswersD

Amazon DynamoDB global tables replicate data across Regions with an RPO of seconds, meeting the 15-minute RPO. A warm standby setup with EC2 instances in the secondary Region, combined with Route 53 DNS failover, can achieve the 2-hour RTO. This strategy is correct.

Why this answer

Amazon DynamoDB global tables provide automatic, asynchronous replication across multiple AWS Regions with an RPO of typically less than 1 second, easily meeting the 15-minute RPO. Combined with a warm standby configuration of EC2 instances in the secondary Region, you can quickly fail over within the 2-hour RTO using Route 53 or other DNS mechanisms. Option C is incorrect because Application Load Balancers (ALBs) are regional in scope and do not support cross-Region load balancing.

ALB cannot directly route traffic to targets in another Region, so the described architecture would not achieve cross-Region failover as intended. Options A and B involve replication mechanisms (S3 CRR and EBS snapshots) that cannot guarantee the 15-minute RPO due to asynchronous delays and manual recovery steps. Option E describes an Active-Passive configuration within the same Region, which does not provide disaster recovery across Regions.

Exam trap

The trap is that candidates may assume Application Load Balancers can perform cross-Region load balancing, but ALBs are regional services and cannot forward traffic to targets in a different Region. For cross-Region failover, you must use DNS-based routing (e.g., Route 53) or a global load balancer like Global Accelerator. While managed databases like Aurora Global Database and DynamoDB global tables offer low RPO replication, the network tier must be designed correctly to achieve the required RTO and RPO.

Practice this question →

348

MCQmedium

A company is deploying a new microservices application on Amazon ECS using Fargate. The application consists of several services that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. Additionally, the company needs to ensure that traffic between services is encrypted in transit. The security team requires that all inter-service traffic uses TLS. Which combination of services should be used to meet these requirements?

A.Use AWS Cloud Map for service discovery and an Application Load Balancer for inter-service communication with TLS termination.

B.Use the built-in service discovery in Amazon ECS and encrypt traffic using AWS Certificate Manager (ACM) certificates.

C.Use an Application Load Balancer with target groups for each service and enable TLS on the load balancer.

D.Use AWS Cloud Map for service discovery and AWS App Mesh with TLS enforcement for inter-service communication.

AnswerD

Cloud Map provides DNS-based service discovery; App Mesh enables mTLS between services.

Why this answer

AWS Cloud Map provides service discovery, allowing ECS services to find each other by name. AWS App Mesh can enforce TLS encryption for inter-service traffic, meeting the security requirement. Option A is incorrect because an Application Load Balancer is used for external traffic and does not provide service discovery for internal service-to-service communication.

Option B is incorrect because ECS built-in service discovery (which relies on Cloud Map) does not automatically encrypt traffic; ACM certificates alone do not enforce TLS for all inter-service traffic. Option C is incorrect because an ALB is designed for load balancing external traffic, not for internal service discovery and mTLS.

Practice this question →

349

MCQmedium

A company is running a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the instance. The company wants to make the application highly available and fault-tolerant without rewriting the application code. What should the solutions architect do?

A.Replace the ALB with a Network Load Balancer (NLB) and enable cross-zone load balancing.

B.Move session state to Amazon ElastiCache and configure the ALB to use sticky sessions.

C.Configure the ALB with sticky sessions (session affinity) and use a custom cookie.

D.Use an Auto Scaling group to add more instances and distribute load.

AnswerC

Sticky sessions bind a user to a specific instance, preserving local state without code changes.

Why this answer

Configuring the ALB with sticky sessions (session affinity) using a custom cookie allows the ALB to consistently route requests from a user's session to the same EC2 instance, preserving the locally stored session state without requiring any application code changes. This approach leverages the ALB's built-in session affinity feature, which is transparent to the application and ensures high availability by distributing traffic across healthy instances while maintaining session continuity.

Exam trap

The trap here is that candidates often assume moving session state to an external store like ElastiCache is the only way to achieve fault tolerance, but the question explicitly prohibits rewriting application code, making sticky sessions the correct choice despite its limitations (e.g., uneven load distribution).

How to eliminate wrong answers

Option A is wrong because replacing the ALB with a Network Load Balancer (NLB) does not solve the session state problem; NLB operates at Layer 4 and does not support sticky sessions or cookie-based affinity, so it would not preserve session state stored locally on instances. Option B is wrong because moving session state to Amazon ElastiCache would require rewriting the application code to read/write session data from an external cache, which violates the requirement of not rewriting the application code. Option D is wrong because simply using an Auto Scaling group to add more instances and distribute load does not address the session affinity issue; without sticky sessions, subsequent requests from the same user may be routed to different instances, causing session data loss.

Practice this question →

350

Multi-Selectmedium

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Select 2 answers

A.Amazon Macie

B.Amazon GuardDuty

C.AWS KMS

D.AWS Config

E.AWS CloudTrail

AnswersC, E

Manages encryption keys for S3.

Why this answer

AWS KMS provides encryption keys for data at rest in S3, and AWS CloudTrail logs API calls for auditing purposes. Option A (Amazon Macie) is for sensitive data discovery, Option B (Amazon GuardDuty) is for threat detection, and Option D (AWS Config) is for resource configuration tracking.

Practice this question →

351

Multi-Selecthard

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. They need to ensure that the application can handle a sudden increase in traffic without losing any data or causing errors. Which THREE strategies should they implement?

Select 3 answers

A.Use DynamoDB on-demand capacity mode.

B.Decouple the application with Amazon SQS.

C.Enable DynamoDB auto scaling.

D.Use DynamoDB Accelerator (DAX) for caching.

E.Configure Lambda reserved concurrency.

AnswersA, C, E

On-demand handles unpredictable traffic without capacity planning.

Why this answer

To handle sudden traffic spikes without data loss or errors, the company should: Option A (DynamoDB on-demand capacity) automatically scales to handle unpredictable throughput; Option C (DynamoDB auto scaling) adjusts provisioned capacity based on demand; Option E (Lambda reserved concurrency) ensures a baseline of concurrent executions to prevent throttling. Option B (SQS) adds decoupling but is not strictly necessary for this requirement and can introduce latency; Option D (DAX) improves read performance but does not address write scaling or throughput spikes for write-intensive loads.

Practice this question →

352

MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

A.Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.

B.Stop all instances, launch new instances with the new version, and update the target group.

C.Update the existing target group's instances to the new version, one at a time.

D.Create a new ALB and update DNS to point to the new ALB.

AnswerA

This is the standard blue/green deployment with ALB.

Why this answer

Blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Exam trap

The trap here is confusing blue/green deployment with rolling updates or assuming that a new ALB and DNS change are required, when in fact ALB listener rule modifications provide immediate traffic switching without DNS propagation delays.

How to eliminate wrong answers

Option B is wrong because stopping all instances causes complete downtime, violating the requirement for minimal impact on users. Option C is wrong because updating instances one at a time in the existing target group is a rolling update strategy, not a blue/green deployment; it does not maintain two separate environments for instant switchover. Option D is wrong because creating a new ALB and updating DNS introduces DNS propagation delays and potential disruption, whereas blue/green with ALB should leverage listener rule changes for immediate traffic shift.

Practice this question →

353

Multi-Selectmedium

A company is designing a new cloud-native application that will run on Amazon ECS with Fargate. The application must store logs centrally for analysis. Which TWO services can be used to collect and analyze logs from ECS Fargate tasks?

Select 2 answers

A.Amazon CloudWatch Logs

B.AWS FireLens (Fluent Bit)

C.Amazon S3

D.AWS CloudTrail

E.Amazon Kinesis Data Analytics

AnswersA, B

ECS can send logs to CloudWatch Logs using the awslogs log driver.

Why this answer

Amazon CloudWatch Logs is the native log management service for AWS, and ECS Fargate tasks can be configured to send stdout/stderr logs directly to CloudWatch Logs using the 'awslogs' log driver. This provides centralized log collection, storage, and analysis with features like metric filters and log insights, making it a correct choice for collecting and analyzing logs from Fargate tasks.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs AWS API calls) with application-level logging, or they assume Amazon S3 alone can serve as a real-time log analysis solution, when in fact it lacks native query and analysis capabilities without additional services like Athena.

Practice this question →

354

MCQeasy

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

A.Amazon SNS

B.Amazon Kinesis Data Streams

C.Amazon EventBridge

D.Amazon SQS

AnswerD

SQS provides a durable, serverless queue that decouples producers and consumers, supports batch processing, and can retain messages on failure.

Why this answer

Amazon SQS is a serverless message queue that can buffer bursts and retain messages until the consumer processes them, with dead-letter queues for failures. Option A is wrong because Amazon SNS pushes messages to subscribers and does not support polling or batch processing. Option B is wrong because Kinesis Data Streams is for real-time streaming, not simple decoupling with batch processing.

Option C is wrong because EventBridge is for event routing, not a message queue.

Practice this question →

355

Multi-Selecthard

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Select 3 answers

A.Design each microservice with its own database.

B.Use a single shared database with separate schemas for each service.

C.Use AWS Database Migration Service (DMS) for ongoing replication.

D.Implement the Strangler Fig pattern to gradually migrate functionality.

E.Deploy all microservices on a single large EC2 instance.

AnswersA, C, D

Database per service is a microservices best practice.

Why this answer

Designing each microservice with its own database enforces the database-per-service pattern, which is essential for loose coupling and independent deployability. This approach prevents tight coupling at the data layer, allowing each microservice to choose the most appropriate database technology and schema without impacting other services. It directly supports the migration goal of breaking the monolithic application into autonomous components.

Exam trap

The trap here is that candidates often think a shared database with separate schemas is sufficient for microservices isolation, but it still creates tight coupling at the schema and transaction level, violating the database-per-service principle required for true decoupling.

Practice this question →

356

MCQmedium

A company is designing a serverless application using AWS Lambda and Amazon API Gateway. The application must handle sudden spikes in traffic and ensure that no requests are lost. Which of the following design choices will BEST meet these requirements?

A.Use Lambda provisioned concurrency to pre-warm the function and reduce cold starts.

B.Configure API Gateway with a usage plan and throttling, and set Lambda reserved concurrency to limit the function's maximum capacity.

C.Use AWS Step Functions to orchestrate the Lambda invocations and implement retry logic.

D.Use Amazon SQS to buffer requests and have Lambda poll the queue at a fixed rate.

AnswerB

Usage plans and throttling control the request rate, while reserved concurrency ensures the Lambda function has dedicated capacity to handle the allowed traffic without being throttled by other functions.

Why this answer

Configuring API Gateway with usage plans and throttling prevents overwhelming the backend, while Lambda reserved concurrency ensures a minimum capacity for the function. Option A is wrong because Lambda provisioned concurrency adds cost and is for reducing cold starts, not for handling spikes without loss. Option C is wrong because Step Functions add orchestration overhead and complexity, and while they can implement retry logic, they do not directly prevent request loss during sudden traffic spikes.

Option D is wrong because SQS buffers requests but does not prevent loss if the Lambda function fails to scale and process messages fast enough; it relies on the Lambda scaling and may still result in throttling if the queue grows too large.

Practice this question →

357

MCQmedium

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

A.Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.

B.Place the Lambda function in a VPC with 1,024 MB memory for faster processing.

C.Set reserved concurrency to 1,000 and function memory to 256 MB.

D.Set function memory to 128 MB and leave concurrency at the account default of 1,000.

AnswerD

128 MB is sufficient for small files; default concurrency handles bursts.

Why this answer

The default account-level concurrency limit is 1,000 concurrent executions, which meets the burst requirement without additional cost. With files under 1 MB and a 10-second timeout, 128 MB memory is sufficient for lightweight processing, and provisioned or reserved concurrency would incur unnecessary charges since the workload is sporadic and does not require pre-warmed instances.

Exam trap

The trap here is that candidates often assume reserved or provisioned concurrency is required for high concurrency, but the default account limit already supports 1,000 concurrent executions, and paying extra for guaranteed capacity is wasteful for a sporadic burst workload.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency incurs costs even when not in use, and for a burst of 1,000 concurrent invocations, it would be overkill and expensive for sporadic workloads. Option B is wrong because placing the Lambda function in a VPC adds complexity and potential cold-start latency, and 1,024 MB memory is excessive for sub-1 MB files, increasing cost without performance benefit. Option C is wrong because reserved concurrency guarantees capacity but does not reduce cost; it can actually lead to throttling of other functions and is unnecessary when the default concurrency limit already supports 1,000 concurrent executions.

Practice this question →

358

MCQhard

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

A.Use AWS Lambda with Provisioned Concurrency for Service B and keep Service C as a Fargate service.

B.Use a step scaling policy for Service B based on CPU utilization and keep Service C as is.

C.Configure Service B with a target tracking scaling policy based on the SQS queue backlog and convert Service C to an AWS Lambda function triggered by DynamoDB Streams.

D.Increase the number of ECS tasks for Service B manually and use a scheduled scaling policy for Service C.

AnswerC

Target tracking scaling based on SQS backlog scales Service B appropriately; Lambda for Service C eliminates idle cost.

Why this answer

It addresses both scaling and cost issues: Service B's scaling is improved by using a target tracking scaling policy based on the SQS queue backlog (ApproximateNumberOfMessagesVisible), which directly correlates to the work demand, ensuring faster and more precise scaling. Converting Service C to a Lambda function triggered by DynamoDB Streams eliminates idle compute costs from a constantly running Fargate service, as Lambda only runs when new data appears in DynamoDB, reducing costs significantly.

Exam trap

The trap here is that candidates often choose CPU-based scaling (Option B) because it is familiar, but they fail to recognize that queue depth is a more direct and responsive metric for scaling message-processing services, and they overlook the cost savings of replacing an idle Fargate service with a Lambda function triggered by DynamoDB Streams.

How to eliminate wrong answers

Option A is wrong because using Lambda with Provisioned Concurrency for Service B would incur costs for pre-warmed instances even when idle, and it does not address the scaling issue with the SQS queue backlog; moreover, Lambda is not ideal for long-running polling tasks. Option B is wrong because a step scaling policy based on CPU utilization is an indirect metric that does not reflect the actual work queue depth, leading to delayed scaling and continued queue growth. Option D is wrong because manually increasing tasks for Service B is not automated or cost-effective for variable traffic, and using a scheduled scaling policy for Service C does not address its idle time—it would still run tasks when not needed, wasting resources.

Practice this question →

359

MCQmedium

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

A.Amazon Redshift Spectrum

B.Amazon EMR

C.Amazon Athena

D.Amazon QuickSight

AnswerC

Athena is serverless and can query S3 data with standard SQL, optimized by partitioning and columnar formats.

Why this answer

Amazon Athena is a serverless interactive query service that uses standard SQL to analyze data directly in Amazon S3. It is optimized for querying large datasets with a pay-per-query model, and it automatically minimizes data scanned by leveraging features like columnar data formats (Parquet, ORC), partitioning, and compression to reduce the amount of data read per query.

Exam trap

The trap here is that candidates often confuse Amazon Redshift Spectrum with Athena because both query S3 data, but Redshift Spectrum requires a running Redshift cluster and is not serverless, while Athena is fully serverless and designed specifically for minimizing data scanned in a data lake scenario.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift Spectrum is an extension of Amazon Redshift that allows querying data in S3, but it requires an active Redshift cluster and is designed for hybrid queries that combine local and external data, not for a standalone data lake query service with minimal data scanned. Option B is wrong because Amazon EMR is a managed big data platform that supports frameworks like Apache Spark and Hive, but it requires provisioning and managing clusters, and its primary focus is not on minimizing data scanned for ad-hoc SQL queries; it is more suited for complex ETL and processing jobs. Option D is wrong because Amazon QuickSight is a business intelligence (BI) and visualization service, not a SQL query engine for scanning large datasets; it relies on underlying data sources like Athena or Redshift for query execution.

Practice this question →

360

Drag & Dropmedium

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First identify failure, wait for failover, verify promotion, update endpoints, then investigate.

Practice this question →

361

Multi-Selecthard

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Select 2 answers

A.Use DynamoDB Streams to trigger the Lambda function for each record.

B.Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

C.Configure the Kinesis Data Stream with 10 shards.

D.Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

E.Configure the Lambda function to process records from each shard sequentially by setting the batch size to 1.

AnswersC, E

10 shards provide sufficient throughput and each shard maintains record order.

Why this answer

With a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Exam trap

The trap here is that candidates often assume Step Functions can enforce exactly-once delivery, but Step Functions is a state machine orchestrator and does not provide data-level deduplication; exactly-once processing must be implemented at the application layer with idempotent consumers.

Practice this question →

362

MCQmedium

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

A.AWS PrivateLink with VPC endpoint services.

B.Amazon Route 53 private hosted zones with DNS records for each service.

C.AWS Cloud Map with namespaces and service instances.

D.Elastic Load Balancing with internal load balancers for each service.

AnswerC

Cloud Map is designed for service discovery in microservices.

Why this answer

AWS Cloud Map is the correct choice because it is a cloud resource discovery service specifically designed for microservices architectures. It allows you to define custom namespaces (public, private DNS, or API-based) and register service instances with health checks. Services running on ECS with Fargate can then discover each other via DNS queries or API calls, enabling dynamic and secure communication without managing static IPs or load balancers.

Exam trap

The trap here is that candidates often confuse Route 53 private hosted zones (which only provide static DNS resolution) with AWS Cloud Map (which adds dynamic registration, health checks, and service instance management), leading them to choose Option B as a simpler but incorrect solution.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with VPC endpoint services is used to expose a service privately within a VPC or across accounts, not for service discovery via DNS names between microservices. Option B is wrong because Amazon Route 53 private hosted zones only provide DNS resolution for static records; they do not automatically register dynamic service instances or perform health checks, requiring manual updates for scaling or failures. Option D is wrong because Elastic Load Balancing with internal load balancers introduces a single point of load balancing and does not provide native DNS-based service discovery; it is designed for traffic distribution, not for services to find each other by name.

Practice this question →

363

MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

A.AWS Step Functions

B.Amazon SNS

C.Amazon SQS

D.Amazon Kinesis

AnswerC

SQS provides a message queue for asynchronous decoupling.

Why this answer

Amazon SQS is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, allowing them to send, store, and receive messages without direct coupling. Services can poll or receive messages from the queue at their own pace, ensuring that the producer and consumer are decoupled and can operate independently, even if one is temporarily unavailable.

Exam trap

The trap here is that candidates often confuse Amazon SNS (pub/sub) with Amazon SQS (queue), but SNS pushes messages to subscribers and does not provide a buffer for asynchronous decoupling, whereas SQS allows services to pull messages at their own pace, which is the key requirement for decoupling.

How to eliminate wrong answers

Option A is wrong because AWS Step Functions is a serverless orchestration service that coordinates multiple AWS services into a workflow, but it does not inherently decouple services asynchronously; it tightly couples the execution flow and is not a message queue. Option B is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, which still requires subscribers to be active and does not provide a buffer for asynchronous decoupling like a queue does. Option D is wrong because Amazon Kinesis is designed for real-time streaming data ingestion and processing, not for simple asynchronous decoupling of microservices; it introduces complexity with shards and retention periods that are unnecessary for basic decoupling needs.

Practice this question →

364

Multi-Selecthard

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

Select 3 answers

A.Pre-provision EC2 instances in the DR region with the application code and configuration.

B.Use Route 53 health checks with failover routing policy to direct traffic to the DR region.

C.Configure a cross-region read replica in the DR region and promote it during failover.

D.Take frequent snapshots of the Aurora cluster and copy them to the DR region.

E.Use Amazon Aurora Global Database for replication to the DR region.

AnswersA, B, E

Ensures compute capacity is ready for failover.

Why this answer

Pre-provisioning EC2 instances in the DR region with the application code and configuration ensures that compute capacity is ready to serve traffic immediately upon failover. This eliminates the time needed to launch and configure instances, which is critical for meeting the 15-minute RTO. Without pre-provisioning, the time to spin up and configure instances would likely exceed the RTO.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have higher replication lag and slower promotion) with Aurora Global Database (which provides low-latency, fast failover), leading them to select Option C instead of Option E.

Practice this question →

365

Multi-Selecthard

A company is designing a new data lake on AWS. The data lake will store raw data from various sources in Amazon S3. The data will be processed using AWS Glue ETL jobs and queried using Amazon Athena. To optimize costs and performance, which three practices should the solutions architect implement?

Select 3 answers

A.Store data in JSON format for flexibility.

B.Compress data using Snappy or Gzip compression.

C.Use columnar storage formats such as Parquet or ORC.

D.Store data in many small files to improve parallel processing.

E.Partition the data by date and other high-cardinality columns.

AnswersB, C, E

Compression reduces storage and scan costs.

Why this answer

Compressing data with Snappy or Gzip reduces storage costs in Amazon S3 and decreases the amount of data scanned by Athena, which charges per TB scanned. Snappy offers faster decompression for ETL workloads, while Gzip provides higher compression ratios. Both are natively supported by AWS Glue and Athena, making them optimal for cost and performance.

Exam trap

The trap here is that candidates often choose JSON for its flexibility without realizing its severe cost and performance penalties in analytics workloads, or they mistakenly believe many small files improve parallelism, when in fact they cause S3 request throttling and increased Athena query overhead.

Practice this question →

366

MCQmedium

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

A.Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL

B.Refactor the application into AWS Lambda functions using an API Gateway

C.Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern

D.Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL

AnswerC

App Runner allows running containerized applications with minimal configuration. The sidecar pattern enables adding microservices without altering the existing application code.

Why this answer

AWS App Runner allows you to run the existing monolithic application with minimal code changes by simply pointing it at a container image or source code, while new microservices can be added as separate App Runner services. The sidecar pattern enables you to attach auxiliary processes (e.g., logging, monitoring) without modifying the core application code, making this the most cost-effective and least disruptive approach for decoupling into microservices.

Exam trap

Candidates often assume that containerization (Option D) is necessary for decoupling into microservices. However, AWS App Runner allows running the existing monolithic application with minimal changes and adding new microservices as separate services, without needing to refactor the monolith first. Note that App Runner does not natively support the sidecar pattern (multiple containers per service), but the decoupling is achieved by deploying separate services.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk still runs the application as a monolith on a single EC2 instance or a small fleet, which does not decouple the application into microservices; it merely lifts and shifts the monolith with managed infrastructure. Option B is wrong because refactoring into AWS Lambda functions and API Gateway requires significant code changes to break the monolith into event-driven functions, which contradicts the requirement to minimize code changes. Option D is wrong because containerizing the application with Docker and running it on Amazon ECS with Fargate still treats the entire monolith as a single container; while it improves portability, it does not inherently decouple the application into microservices without additional refactoring, and the sidecar pattern is not natively supported in the same way as App Runner.

Practice this question →

367

MCQhard

A financial services company is designing a highly available architecture for a critical application on AWS. The application runs on EC2 instances and uses an Oracle database. The database must be resilient to an Availability Zone failure and must have automated failover. Which database solution meets these requirements?

A.Use Amazon Aurora (MySQL-compatible) with Multi-AZ.

B.Use Amazon RDS for Oracle with a Read Replica in another AZ.

C.Deploy Oracle on EC2 in two Availability Zones and use asynchronous replication.

D.Use Amazon RDS for Oracle with Multi-AZ deployment.

AnswerD

RDS Multi-AZ provides automatic failover and synchronous standby.

Why this answer

Amazon RDS for Oracle with Multi-AZ deployment provides automatic failover to a standby instance in a different Availability Zone, meeting the requirements for high availability and automated failover. Option A is incorrect because Amazon Aurora (MySQL-compatible) is not Oracle-compatible, so it cannot replace an Oracle database. Option B is incorrect because a Read Replica in another AZ does not provide automated failover; it is used for read scaling and requires manual promotion.

Option C is incorrect because deploying Oracle on EC2 with asynchronous replication requires manual failover management and does not provide automated failover.

Practice this question →

368

MCQhard

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application writes transaction logs to an Amazon EFS file system. The company needs to ensure that the logs are encrypted at rest using a customer-managed AWS KMS key. Additionally, the logs must be retained for 7 years and should not be accessible after that period. Which solution meets the encryption and retention requirements?

A.Store logs directly in Amazon S3 with default encryption. Use an S3 Lifecycle policy to delete objects older than 7 years.

B.Enable encryption at rest on the EFS file system using a customer-managed KMS key. Use a Lambda function to copy logs to Amazon S3 and apply an S3 Lifecycle policy to expire objects after 7 years.

C.Use Amazon CloudWatch Logs to stream logs from the application and set a retention policy of 7 years. Enable encryption using a customer-managed KMS key.

D.Enable encryption at rest on the EFS file system using an AWS managed key. Use a cron job on the EC2 instances to delete logs older than 7 years.

AnswerB

EFS encryption with customer KMS key meets encryption requirement; S3 Lifecycle enforces retention.

Why this answer

EFS supports encryption at rest using a customer-managed KMS key, and by copying logs to S3 and applying a lifecycle policy with expiration after 7 years, both encryption and retention requirements are met. Option A is incorrect because storing logs directly in S3 with default encryption uses S3-managed keys, not a customer-managed KMS key. Option C is incorrect because CloudWatch Logs is for real-time monitoring and not designed for long-term archival with the specified encryption and retention requirements.

Option D is incorrect because enabling encryption on EFS with an AWS managed key does not meet the customer-managed KMS key requirement, and deleting logs via a cron job on EC2 instances is not reliable and may not ensure complete deletion after exactly 7 years.

Practice this question →

369

Multi-Selectmedium

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Select 3 answers

A.Amazon SQS queues between services

B.Amazon API Gateway as a front end

C.Application Load Balancer (ALB) as a service mesh

D.AWS Cloud Map service discovery

E.Amazon DynamoDB as a communication channel

AnswersB, C, D

API Gateway can route to internal services.

Why this answer

Amazon API Gateway acts as a front-end proxy that can route requests to ECS Fargate services, enabling synchronous service-to-service communication via RESTful or WebSocket APIs. It handles authentication, throttling, and request transformation, making it a suitable mechanism for external or internal service calls.

Exam trap

The trap here is that candidates often confuse asynchronous messaging (SQS) or data stores (DynamoDB) with direct service-to-service communication, overlooking that microservices typically require synchronous HTTP/gRPC calls or service mesh patterns for real-time interactions.

Practice this question →

370

Multi-Selecteasy

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

Select 2 answers

A.A route table in the private subnet with a default route pointing to the NAT Gateway

B.An Internet Gateway attached to the VPC

C.A NAT Gateway in a public subnet

D.VPC Flow Logs

E.A virtual private gateway

AnswersA, C

The route table directs traffic to the NAT Gateway.

Why this answer

A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway is required to direct outbound internet traffic from the EC2 instances to the NAT Gateway. The NAT Gateway then forwards this traffic to the Internet Gateway, enabling the instances to download updates while remaining inaccessible from the internet.

Exam trap

The trap here is that candidates often assume an Internet Gateway alone suffices for all internet access, forgetting that instances in private subnets require a NAT device (NAT Gateway or NAT Instance) to translate their private IPs for outbound traffic.

Practice this question →

371

MCQmedium

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

A.Amazon Kinesis Data Firehose

B.Amazon SQS

C.Amazon Kinesis Data Analytics

D.AWS Lambda

AnswerC

Kinesis Data Analytics processes streaming data in real time.

Why this answer

Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose's ability to deliver data to S3 with the need for real-time transformations, overlooking that Firehose only supports basic transformations and not the complex, stateful stream processing that Kinesis Data Analytics provides.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a delivery service that can load streaming data into S3, but it only supports basic transformations (e.g., Lambda-based or built-in data format conversion) and cannot perform complex, real-time analytics or multi-step transformations natively. Option B is wrong because Amazon SQS is a message queue service for decoupling application components; it does not provide real-time data processing or transformation capabilities, nor does it directly integrate with S3 for streaming ingestion. Option D is wrong because AWS Lambda can process streaming data but is not designed for continuous, stateful stream processing; it has a maximum execution timeout of 15 minutes and is better suited for event-driven, short-lived tasks rather than persistent real-time transformations on unbounded streams.

Practice this question →

372

MCQmedium

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

A.RDS Storage Auto Scaling

B.Read Replicas

C.RDS Proxy

D.Multi-AZ deployment

AnswerC

RDS Proxy is a fully managed database proxy that pools and shares database connections, which helps applications scale and handle unpredictable surges in traffic. It reduces connection overhead and improves resilience during spikes, making it the best fit for variable workloads.

Why this answer

RDS Proxy is the correct choice because it acts as a connection pooling layer that efficiently manages database connections, allowing the application to handle variable workloads and predictable spikes without overwhelming the database. It reduces the overhead of connection management and improves scalability. RDS Storage Auto Scaling only scales storage capacity, not compute or connection handling, and thus does not address workload spikes.

Read Replicas are useful for offloading read traffic but do not provide automatic scaling for unpredictable spikes. Multi-AZ deployment ensures high availability and failover but does not scale the database for variable workloads.

Practice this question →

373

MCQhard

A company is designing a new application that must meet PCI DSS compliance requirements. The application will process credit card transactions and store encrypted data. Which AWS service should be used to manage the encryption keys?

A.AWS CloudHSM

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.Amazon S3 server-side encryption (SSE-S3)

AnswerA

Dedicated HSM for compliance with PCI DSS.

Why this answer

AWS CloudHSM is the correct choice because PCI DSS requires that encryption keys used to protect cardholder data be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated, and that the customer retains sole control over the keys. CloudHSM provides dedicated, single-tenant HSM appliances that you manage directly, ensuring you meet the key management and physical security requirements of PCI DSS without sharing the HSM with other AWS customers.

Exam trap

The trap here is that candidates often confuse AWS KMS with CloudHSM because both manage encryption keys, but the exam specifically tests the PCI DSS requirement for FIPS 140-2 Level 3 validation and sole customer control of the HSM, which only CloudHSM provides.

How to eliminate wrong answers

Option B (AWS KMS) is wrong because KMS uses a shared, multi-tenant HSM backend that is FIPS 140-2 Level 2 validated, not Level 3, and AWS retains the ability to manage and rotate the root keys, which does not satisfy PCI DSS requirement 3.5 for sole control of key management. Option C (AWS Secrets Manager) is wrong because it is a service for rotating and managing secrets (e.g., database credentials), not a dedicated key management service; it relies on KMS for encryption and does not provide direct HSM-level key storage or customer-managed HSMs. Option D (Amazon S3 server-side encryption with SSE-S3) is wrong because SSE-S3 uses AWS-managed keys where AWS controls the key material and rotation, offering no customer visibility or control over the keys, which fails PCI DSS requirement 3.6 for documented key management processes and sole control.

Practice this question →

374

MCQmedium

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to store session state data that must be highly available and low latency. The data is accessed frequently and can be recreated if lost. Which storage solution should the solutions architect recommend?

A.Store session state in Amazon DynamoDB.

B.Store session state in Amazon S3.

C.Store session state in Amazon ElastiCache for Redis.

D.Store session state in Amazon EFS.

AnswerC

ElastiCache for Redis provides ultra-low latency in-memory storage, ideal for session state that can be recreated.

Why this answer

Amazon ElastiCache for Redis is the ideal choice for storing session state data in a containerized ECS with Fargate environment because it provides in-memory caching with sub-millisecond latency, high availability through replication and automatic failover, and supports data persistence. Since the session data can be recreated if lost, the ephemeral nature of Redis is acceptable, and its low-latency access pattern perfectly matches the frequent read/write requirements of session state.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB (Option A) because it is a fully managed, highly available NoSQL database, but they overlook the specific requirement for 'low latency' and 'frequently accessed' data, which in-memory caching like Redis is designed to satisfy, not a disk-based database like DynamoDB.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB, while highly available and durable, introduces higher latency due to disk-based storage and eventual consistency models, making it less suitable for the frequent, low-latency access required for session state; it is better for persistent, structured data that must survive failures. Option B is wrong because Amazon S3 is an object store with high latency (typically tens to hundreds of milliseconds) and is designed for infrequent access patterns, not for the sub-millisecond reads and writes needed for session state; it also lacks native session expiration mechanisms. Option D is wrong because Amazon EFS is a network file system (NFS) that provides shared file storage but has higher latency compared to in-memory caching, and it is not optimized for the high-throughput, low-latency access patterns of session state; it is better suited for shared file systems or persistent storage that requires POSIX compliance.

Practice this question →

375

MCQhard

A startup is designing a data lake on AWS using Amazon S3. They expect to ingest hundreds of terabytes of data from IoT devices daily. Data is in JSON format and will be queried using Amazon Athena. Which combination of actions will optimize query performance and minimize costs?

A.Store data as gzip-compressed JSON in S3, partition by device_id, and use Athena with compression.

B.Convert data to Parquet, partition by date, and use S3 Intelligent-Tiering.

C.Convert data to Parquet format, partition by year/month/day, and use S3 Standard storage.

D.Store data as Parquet in S3 Glacier Deep Archive, unpartitioned, and query with Athena.

AnswerB

Parquet reduces scan, partitioning limits data, Intelligent-Tiering optimizes cost.

Why this answer

Converting data to Parquet format provides columnar storage and efficient compression, reducing the amount of data scanned by Athena. Partitioning by date (e.g., year/month/day) aligns with typical query patterns for time-series IoT data, allowing Athena to skip irrelevant partitions and minimize costs. S3 Intelligent-Tiering automatically moves data between access tiers to optimize storage costs without manual intervention.

Option A is incorrect because gzip-compressed JSON is not as efficient as Parquet in terms of compression and query performance, and partitioning by device_id would create too many small files (poor partitioning). Option C is incorrect because while Parquet and date partitioning are good, S3 Standard is more expensive for data that may not be accessed frequently after initial queries; Intelligent-Tiering is more cost-effective. Option D is incorrect because S3 Glacier Deep Archive has high retrieval costs and long retrieval times, making it unsuitable for frequent Athena queries, and lack of partitioning leads to full table scans.

Exam trap

Candidates often overlook the cost optimization of storage tiers like S3 Intelligent-Tiering for data lakes with variable access patterns.

Practice this question →