CCNA Design for New Solutions Questions — Page 6 of 7

376

MCQhard

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

A.S3 bucket policies cannot enforce encryption; you must use bucket default encryption

B.The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

C.The policy does not apply to objects uploaded using AWS KMS managed keys

D.The policy does not deny requests that omit the encryption header

AnswerD

If no encryption header is present, the condition evaluates to false, so Deny does not apply.

Why this answer

The bucket policy only requires encryption but does not explicitly deny requests that omit the `x-amz-server-side-encryption` header. Without a `Deny` effect for requests lacking the header, the policy is effectively a statement of intent rather than an enforcement mechanism. S3 bucket policies can enforce encryption by using a `Deny` statement with a condition key like `s3:x-amz-server-side-encryption` set to `AES256`.

Exam trap

The trap here is that candidates assume a policy with a `Condition` that requires encryption is sufficient, but without an explicit `Deny` for requests that omit the header, the policy is only a 'soft' requirement and does not block unencrypted uploads.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies can enforce encryption using a `Deny` effect with the `s3:x-amz-server-side-encryption` condition key; bucket default encryption is a separate, simpler mechanism but not the only way. Option B is wrong because the condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce a specific KMS key, not to require AES256 encryption; the correct key for AES256 is `s3:x-amz-server-side-encryption` with value `AES256`. Option C is wrong because the policy can apply to objects uploaded with AWS KMS managed keys if the condition key is set appropriately (e.g., `s3:x-amz-server-side-encryption` with value `aws:kms`), but the issue here is the lack of a `Deny` for missing headers, not the key type.

Practice this question →

377

Multi-Selectmedium

A company is designing a new serverless application using AWS Lambda. The application must process files uploaded to an S3 bucket. Each file can be up to 1 GB in size. The processing time for each file is expected to be up to 15 minutes. The company wants to minimize cost and operational overhead. Which TWO configuration choices should the company make? (Choose TWO.)

Select 2 answers

A.Mount an Amazon EFS file system to the Lambda function for temporary storage.

B.Use S3 event notifications to send the file content directly to Lambda.

C.Extend the Lambda function timeout to 30 minutes.

D.Configure S3 to send event notifications to the Lambda function.

E.Set the Lambda function timeout to 15 minutes.

AnswersD, E

S3 can trigger Lambda directly via event notifications when a new object is created, which is a simple and cost-effective integration.

Why this answer

S3 event notifications can be configured to invoke a Lambda function when an object is created, providing an event-driven architecture that eliminates the need for polling or custom triggers. Option E is correct because the maximum execution timeout for AWS Lambda is 15 minutes (900 seconds), and setting it to 15 minutes allows the function to process files up to the expected processing time without exceeding the service limit.

Exam trap

The trap here is that candidates may confuse S3 event notifications with sending file content directly to Lambda, or assume Lambda timeouts can be extended beyond 15 minutes, but AWS enforces a hard 15-minute maximum for synchronous and asynchronous invocations.

Practice this question →

378

MCQeasy

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

A.The template will create an S3 bucket with versioning enabled.

B.The template will create an S3 bucket with a random name.

C.The template will fail because the bucket name is not globally unique.

D.The template will create an S3 bucket with versioning disabled.

AnswerA

Correct: The template explicitly enables versioning via VersioningConfiguration set to Enabled.

Why this answer

The CloudFormation template snippet includes the `VersioningConfiguration` property set to `Enabled` within the `AWS::S3::Bucket` resource. This explicitly enables versioning when the stack is deployed. The template also specifies a `BucketName`, so CloudFormation uses that name rather than generating a random one.

Option B is incorrect because the bucket name is explicitly provided, not randomly generated. Option C is incorrect because the template will only fail if the bucket name is already taken, but that is not guaranteed. Option D is incorrect because versioning is explicitly enabled.

Exam trap

The trap is that candidates might think versioning is disabled by default, but here it is explicitly enabled. Also, candidates may assume a missing BucketName causes failure, but the template includes a name, so the name is not random.

How to eliminate wrong answers

Option B is wrong because, while CloudFormation does generate a random bucket name when no `BucketName` property is provided, the template also enables versioning, so the bucket is not created with versioning disabled; the statement is incomplete. Option C is wrong because the template does not specify a `BucketName`, so CloudFormation automatically generates a globally unique name, preventing a failure due to non-uniqueness. Option D is wrong because the template explicitly sets `VersioningConfiguration` to `Enabled`, so versioning is enabled, not disabled.

Practice this question →

379

MCQmedium

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

A.Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.

B.Use client-side encryption with the AWS SDK.

C.Use S3 server-side encryption with customer-provided keys (SSE-C).

D.Use S3 server-side encryption with S3 managed keys (SSE-S3).

AnswerA

Customer managed keys can be rotated automatically yearly.

Why this answer

SSE-KMS with customer managed keys (CMKs) meets the compliance requirements because it allows the company to manage the encryption key lifecycle, including automatic annual rotation. AWS KMS supports automatic key rotation for customer managed keys, which can be configured to rotate every year, satisfying the mandate for company-managed keys with automatic rotation.

Exam trap

The trap here is that candidates often confuse SSE-C (customer-provided keys) with customer managed keys, but SSE-C does not support automatic rotation and requires the customer to manage key material outside AWS, whereas SSE-KMS with customer managed keys provides automatic rotation and is the correct choice for company-managed keys with rotation.

How to eliminate wrong answers

Option B is wrong because client-side encryption encrypts data before it reaches S3, but the key management and rotation are handled by the client application, not by AWS, and the compliance requirement specifies that the key must be managed by the company but does not require client-side control; also, automatic rotation would require custom implementation. Option C is wrong because SSE-C requires the company to provide and manage their own encryption keys, but AWS does not support automatic key rotation for SSE-C—the customer must manually rotate keys and re-encrypt data. Option D is wrong because SSE-S3 uses AWS-managed keys (Amazon S3 managed keys), which are not managed by the company, violating the requirement that the key must be managed by the company.

Practice this question →

380

Multi-Selecthard

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

Select 3 answers

A.Amazon Kinesis Data Analytics

B.AWS Lambda

C.Amazon EMR

D.AWS Glue

E.Amazon Redshift

AnswersB, D, E

Lambda can trigger on S3 events for late-arriving data.

Why this answer

AWS Lambda is correct because it can be triggered by S3 events to process late-arriving data in near real-time, transforming and loading it into Amazon Redshift. Lambda's serverless nature allows it to handle variable data arrival patterns without managing infrastructure, ensuring data consistency through idempotent processing logic.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Analytics for batch processing or assume Amazon EMR is required for any transformation, overlooking the serverless, event-driven capabilities of AWS Lambda and AWS Glue for S3-to-Redshift pipelines.

Practice this question →

381

MCQhard

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

A.Use Amazon EBS with a multi-attach enabled volume.

B.Use Amazon EFS with provisioned throughput.

C.Use Amazon S3 with S3 File Gateway to present as a file system.

D.Use Amazon FSx for Windows File Server with a single file system.

AnswerB

EFS provides a shared NFS file system that scales throughput and is accessible across AZs.

Why this answer

Amazon EFS with provisioned throughput is the correct choice because it provides a fully managed, scalable, shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones simultaneously. It uses the NFSv4.1 protocol, delivers high throughput and low latency, and allows you to provision throughput independently of storage size to meet performance requirements.

Exam trap

The trap here is that candidates often confuse Amazon EBS multi-attach with a true shared file system, overlooking its single-AZ limitation and low instance count cap, while also underestimating EFS's ability to handle hundreds of concurrent NFS clients across multiple AZs with provisioned throughput.

How to eliminate wrong answers

Option A is wrong because Amazon EBS multi-attach volumes can only be attached to a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, not hundreds across multiple AZs, and they do not provide a shared file system interface. Option C is wrong because Amazon S3 with S3 File Gateway presents an SMB or NFS file system but is designed for hybrid cloud caching and does not natively provide the low-latency, high-throughput performance required for hundreds of concurrent EC2 instances across AZs; it also introduces gateway latency and throughput limitations. Option D is wrong because Amazon FSx for Windows File Server supports only Windows-based clients via SMB protocol and is not optimized for the high-throughput, low-latency requirements of hundreds of Linux-based EC2 instances across multiple AZs; it also has a single file system that can be accessed across AZs but is not designed for the scale and performance profile described.

Practice this question →

382

MCQeasy

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

A.Use AWS Snowball to transfer the database files to RDS.

B.Use an RDS read replica from the on-premises database.

C.Use AWS Database Migration Service (DMS) with ongoing replication.

D.Export the database to Amazon S3 and import into RDS.

AnswerC

DMS supports full load and CDC replication with minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports both a full load of the 500 GB database and continuous change data capture (CDC) using the MySQL binary log (binlog) to replicate ongoing changes with minimal downtime. DMS can perform the initial load while the source remains operational, then switch to CDC to keep the target in sync until cutover.

Exam trap

The trap here is that candidates often confuse the one-time bulk transfer capability of Snowball or S3 with the need for ongoing replication, failing to recognize that minimal downtime requires a continuous change capture mechanism like DMS CDC, not just an initial data load.

How to eliminate wrong answers

Option A is wrong because AWS Snowball is designed for offline bulk data transfer of large datasets (e.g., terabytes to petabytes) and cannot provide ongoing replication; it would require a separate replication mechanism for changes after the initial load, defeating the minimal-downtime goal. Option B is wrong because an RDS read replica can only be created from an existing RDS instance, not from an on-premises database; it uses MySQL's asynchronous replication which requires the source to be an RDS MySQL instance. Option D is wrong because exporting the database to Amazon S3 and importing into RDS is a one-time, offline process that does not capture ongoing changes, so it would result in significant downtime while the export and import occur, and it lacks CDC capabilities.

Practice this question →

383

Multi-Selecthard

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Select 2 answers

A.Increase the number of shards in the Kinesis data stream

B.Increase the batch size in the event source mapping

C.Change the data source from Kinesis to an Amazon SQS queue

D.Increase the Lambda function memory to 1024 MB

E.Increase the Lambda function's reserved concurrency to a higher value

AnswersA, B

More shards allow more Lambda executions in parallel, improving throughput.

Why this answer

Increasing the number of shards in the Kinesis data stream (Option A) increases parallelism because each shard can be processed by one concurrent Lambda instance, allowing the pipeline to handle higher data volumes. Increasing the batch size in the event source mapping (Option B) allows each Lambda invocation to process more records at once, reducing the number of invocations and lowering per-record overhead. Together, these two strategies directly improve throughput and reduce latency.

Option D (increasing memory) can improve performance for compute-bound functions but does not directly address parallelism or batching, and is not one of the two best choices for this scenario.

Exam trap

The trap here is that candidates may think increasing reserved concurrency (Option E) is the key to scaling, but without increasing shards, Lambda cannot process more data in parallel because each shard is processed by only one concurrent Lambda instance at a time.

Practice this question →

384

Multi-Selectmedium

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

Select 2 answers

A.Amazon DynamoDB Streams

B.Amazon SNS

C.Amazon Kinesis Data Streams

D.Amazon SQS

E.Amazon Simple Email Service (SES)

AnswersB, D

Lambda can use SNS as a DLQ for asynchronous invocations.

Why this answer

Amazon SNS and Amazon SQS are the two supported destinations for Lambda's dead-letter queue (DLQ) configuration, but only for asynchronous invocations. When a Lambda function is invoked asynchronously and fails after the configured number of retries, the event can be redirected to an SNS topic or an SQS queue for later reprocessing or analysis. This ensures no data is lost during burst traffic, as failed events are persisted in the DLQ.

Synchronous invocations do not support DLQ.

Exam trap

The trap here is that candidates often confuse Lambda's event sources (like DynamoDB Streams or Kinesis) with supported DLQ destinations, but Lambda only allows SQS and SNS as DLQ targets for asynchronous invocations.

Practice this question →

385

MCQmedium

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

A.Amazon CloudFront

B.Amazon Route 53

C.Auto Scaling groups

D.Elastic Load Balancing

AnswerC

Auto Scaling can scale EC2 instances based on metrics.

Why this answer

Auto Scaling groups (Option C) are the correct service because they directly manage the automatic scaling of EC2 instances based on defined policies, such as a target CPU utilization threshold. When CPU utilization exceeds the threshold, the Auto Scaling group launches new instances to handle the load, and it terminates instances when utilization drops, ensuring the web tier scales automatically.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancing with automatic scaling, but ELB only distributes traffic and does not add or remove instances; the Auto Scaling group is the service that actually scales the compute capacity.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations to reduce latency, not a service that scales compute resources based on CPU utilization. Option B is wrong because Amazon Route 53 is a DNS web service that routes end users to internet applications, but it does not provide automatic scaling of compute capacity. Option D is wrong because Elastic Load Balancing distributes incoming traffic across multiple targets (e.g., EC2 instances), but it does not automatically scale the number of instances; it works in conjunction with Auto Scaling groups to distribute traffic to scaled instances.

Practice this question →

386

Multi-Selecteasy

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Select 2 answers

A.Use a Network Load Balancer instead of an ALB

B.Use an Application Load Balancer with a single target group

C.Configure a health check on the ALB for the target group

D.Use an Auto Scaling group with a minimum of two instances across two Availability Zones

E.Launch all EC2 instances in a single Availability Zone

AnswersC, D

Health checks allow ALB to detect unhealthy instances and stop routing traffic.

Why this answer

Configuring a health check on the ALB for the target group allows the load balancer to periodically send health check requests to each registered EC2 instance. If an instance fails to respond with a healthy status (e.g., HTTP 200) within the configured interval and threshold, the ALB automatically deregisters it and stops routing traffic to it, ensuring high availability and fault tolerance.

Exam trap

The trap here is that candidates often think simply using an ALB or a single target group automatically provides health-based traffic routing, but without explicitly configuring a health check on the target group, the ALB will continue sending traffic to failed instances.

Practice this question →

387

MCQmedium

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

A.The --filters parameter is incorrectly formatted.

B.The --query parameter is used without specifying --output.

C.The tag value is missing.

D.The AWS CLI version is outdated.

AnswerD

This is correct. Outdated AWS CLI versions do not support the --query parameter. If the version is older than 1.6.0, --query is not a known option, leading to the 'Unknown options' error. Upgrading the AWS CLI resolves the issue.

Why this answer

The 'Unknown options: --query' error occurs when the AWS CLI version is outdated and does not recognize the --query parameter. The --query parameter was introduced in AWS CLI version 1.6.0. If the CLI version is older, it will treat --query as an unknown option.

While it is true that --query often requires --output for proper formatting, the error for missing --output would be different, not 'Unknown options'. Therefore, the most likely cause is an outdated AWS CLI version.

Exam trap

The 'Unknown options: --query' error is most commonly caused by an outdated AWS CLI version that does not support the --query parameter, not by a missing --output parameter. Candidates often incorrectly assume that --query requires explicit --output specification.

How to eliminate wrong answers

Option A is wrong because the `--filters` parameter is correctly formatted in the command (Name=tag:Name,Values=MyInstance) and would not cause an 'Unknown options' error; an incorrectly formatted filter would produce a different error like 'Bad value' or 'Invalid filter'. Option C is wrong because the tag value 'MyInstance' is explicitly provided in the command, so a missing tag value is not the issue. Option D is wrong because the 'Unknown options: --query' error is not related to CLI version; both AWS CLI v1 and v2 support `--query`, but the error occurs only when `--output` is omitted, regardless of version.

Practice this question →

388

MCQhard

A company is designing a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda function sometimes experiences throttling, causing messages to be sent to the dead-letter queue (DLQ). The company wants to minimize throttling and ensure that messages are processed in order. What should the solutions architect do?

A.Use a standard SQS queue and configure a Lambda function with a higher concurrency limit.

B.Use an SQS FIFO queue with provisioned concurrency on the Lambda function.

C.Increase the batch size in the Lambda event source mapping and use a standard queue.

D.Use a FIFO SQS queue and configure the Lambda function with reserved concurrency.

AnswerD

FIFO queues preserve order. Reserved concurrency prevents throttling by ensuring enough capacity.

Why this answer

Using an SQS FIFO queue guarantees strict message ordering, and reserved concurrency on the Lambda function prevents throttling by allocating a fixed number of concurrent executions exclusively for this function. This combination ensures messages are processed in order without being throttled, avoiding unnecessary DLQ deliveries.

Exam trap

The trap here is confusing provisioned concurrency (which reduces cold starts) with reserved concurrency (which guarantees execution capacity), and assuming standard queues can maintain order when they only offer best-effort ordering.

How to eliminate wrong answers

Option A is wrong because a standard SQS queue does not guarantee message ordering, and simply raising the concurrency limit does not prevent throttling if the account-level concurrency pool is exhausted. Option B is wrong because provisioned concurrency is used to pre-warm execution environments for latency-sensitive workloads, not to prevent throttling; it does not reserve capacity away from other functions. Option C is wrong because increasing the batch size does not address ordering requirements (standard queues lack ordering) and does not mitigate throttling, which is a concurrency management issue.

Practice this question →

389

MCQmedium

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

A.Amazon EMR

B.Amazon Athena

C.Amazon Redshift

D.AWS Glue

AnswerB

Athena allows serverless SQL queries on S3.

Why this answer

Amazon Athena is a serverless, interactive query service that allows you to run standard SQL queries directly against data stored in Amazon S3 without needing to move or transform the data. It uses Presto under the hood and charges only for the data scanned per query, making it ideal for ad-hoc SQL analysis on a data lake.

Exam trap

The trap here is that candidates often confuse AWS Glue (which catalogs and transforms data but does not run SQL queries) with Athena, or they assume Amazon EMR is required for SQL-on-S3, overlooking Athena's serverless and direct-query capability.

How to eliminate wrong answers

Option A is wrong because Amazon EMR is a managed big data platform that requires you to provision and configure clusters (e.g., Hadoop, Spark) to run SQL via tools like Hive or Presto, which adds operational overhead and does not allow querying data directly without moving it into a separate processing framework. Option C is wrong because Amazon Redshift is a fully managed data warehouse that requires you to load data into its columnar storage before querying, which contradicts the requirement of not moving data to a separate database. Option D is wrong because AWS Glue is a serverless data integration service primarily used for ETL (extract, transform, load) and cataloging metadata via the Glue Data Catalog; it does not provide a direct SQL query engine against S3 data.

Practice this question →

390

MCQhard

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

A.Amazon EFS with One Zone storage classes

B.Amazon EBS with gp3 volume type

C.Amazon S3 with Mountpoint for S3

D.Amazon FSx for Lustre

AnswerC

Correct. S3 with Mountpoint provides highly available, durable shared storage accessible by multiple pods concurrently.

Why this answer

Amazon S3 with Mountpoint for S3 is the correct choice because it provides a fully managed, highly available, and durable object storage that can be accessed by multiple Amazon EKS pods simultaneously via a file system interface. S3 is designed for 99.999999999% durability and 99.99% availability, and Mountpoint allows concurrent read/write access from multiple pods, meeting the RWX access mode requirement. Amazon EFS One Zone (Option A) is not highly available as it resides in a single Availability Zone, Amazon EBS gp3 (Option B) supports only RWO, and Amazon FSx for Lustre (Option D) is optimized for high-performance computing and is not a general-purpose shared storage solution.

Exam trap

The trap is that many candidates choose EFS One Zone, thinking it is highly available, but it is only durable within a single AZ. They overlook that S3 with Mountpoint can also serve as shared, highly available storage for EKS pods.

How to eliminate wrong answers

Option B is wrong because Amazon EBS volumes support only ReadWriteOnce (RWO) access mode, meaning they can be attached to a single pod at a time, not multiple pods simultaneously as required. Option C is wrong because Mountpoint for S3 provides a file-system-like interface to Amazon S3 but does not support POSIX semantics or concurrent write access from multiple pods; it is designed for read-heavy workloads and lacks the consistency guarantees needed for shared persistent storage. Option D is wrong because Amazon FSx for Lustre is a high-performance file system optimized for compute-intensive workloads like HPC and machine learning, not for general-purpose shared storage with high availability and durability requirements; it is typically used with scratch or persistent deployments that are not designed for multi-pod concurrent access in Kubernetes.

Practice this question →

391

Multi-Selectmedium

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

Select 3 answers

A.Configure Amazon RDS Multi-AZ deployments.

B.Use a single Availability Zone for EC2 instances to simplify failover.

C.Implement a Pilot Light strategy by replicating data to a secondary region and launching resources on failover.

D.Store backups in Amazon S3 Glacier.

E.Use Amazon EBS cross-region snapshot copy to replicate data.

AnswersA, C, E

Multi-AZ provides automatic failover with RTO typically under 1 minute and RPO of seconds.

Why this answer

Amazon RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone, enabling automatic failover with an RTO typically under 1-2 minutes and an RPO of effectively zero, which meets the 15-minute RTO and 1-minute RPO requirements for the database tier.

Exam trap

The trap here is that candidates often confuse Pilot Light with Warm Standby or Multi-Site, and may incorrectly assume that using a single AZ or Glacier backups can meet aggressive RTO/RPO targets, when in fact they introduce unacceptable latency or single points of failure.

Practice this question →

392

MCQeasy

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

A.Use AWS Global Accelerator with endpoints pointing to the S3 bucket.

B.Deploy EC2 instances in multiple Regions and use a load balancer.

C.Use Amazon CloudFront with the S3 bucket as the origin.

D.Host the content directly from the S3 bucket and use S3 Transfer Acceleration.

AnswerC

CloudFront caches content at edge locations, reducing latency and data transfer costs.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.

Exam trap

The trap here is that candidates confuse AWS Global Accelerator (which optimizes network path but does not cache) with a CDN like CloudFront, or mistakenly think S3 Transfer Acceleration improves download performance for end users when it only accelerates uploads to S3.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves TCP/UDP traffic performance via the AWS global network but does not cache content; it would still require all requests to reach the S3 bucket, increasing latency and costs compared to a CDN. Option B is wrong because deploying EC2 instances in multiple Regions to serve static content introduces unnecessary compute costs, management overhead, and complexity, while a CDN like CloudFront provides caching at edge locations more efficiently. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache or accelerate downloads for end users; it would not reduce latency for serving content globally and can incur higher costs per GB transferred.

Practice this question →

393

Multi-Selecthard

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

Select 3 answers

A.EC2 instances with enhanced networking and high-throughput (e.g., p4d, p3dn)

B.VPC peering between multiple VPCs

C.AWS Global Accelerator

D.Placement Groups (Cluster Placement Group)

E.Elastic Fabric Adapter (EFA)

AnswersA, D, E

These instance types offer high network bandwidth and EFA support.

Why this answer

EC2 instances like p4d and p3dn are designed for HPC workloads, offering enhanced networking (up to 100 Gbps) and high-throughput capabilities. These instances support Elastic Fabric Adapter (EFA) and are optimized for tightly coupled inter-node communication, providing the low latency and high bandwidth required for HPC.

Exam trap

The trap here is that candidates may confuse VPC peering or Global Accelerator as solutions for inter-node latency, but these services address different problems (cross-VPC connectivity and global traffic optimization) and do not reduce latency for tightly coupled HPC communication within a single cluster.

Practice this question →

394

MCQeasy

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

A.Host the frontend and backend on a single EC2 instance using Amazon Lightsail.

B.Host the frontend on Amazon S3 with static website hosting and the backend as AWS Lambda functions behind Amazon API Gateway.

C.Host the frontend on EC2 instances behind an ALB and the backend on EC2 instances behind another ALB.

D.Host the frontend on S3 and the backend on Amazon Elastic Beanstalk with a load balancer.

AnswerB

Serverless architecture minimizes operational overhead and scales automatically.

Why this answer

S3 for static hosting and API Gateway with Lambda provides a serverless, scalable solution with low overhead. Option A is wrong because EC2 requires management. Option C is wrong because Lightsail has limited scalability.

Option D is wrong because Elastic Beanstalk has more overhead than serverless.

Practice this question →

395

MCQmedium

A company is designing a data lake on AWS using Amazon S3. They need to query the data using standard SQL without moving it to a separate analytics store. Which AWS service should they use?

A.Amazon Athena

B.AWS Glue

C.Amazon QuickSight

D.Amazon Redshift Spectrum

AnswerA

Athena is serverless, queries S3 directly with SQL.

Why this answer

Amazon Athena is correct because it is a serverless interactive query service that uses standard SQL to query data directly in Amazon S3 without requiring any infrastructure or data movement. Option B (AWS Glue) is primarily used for ETL and data cataloging, not for ad hoc querying. Option C (Amazon QuickSight) is a business intelligence tool for visualization, not direct SQL querying.

Option D (Amazon Redshift Spectrum) can query S3 data but requires an active Amazon Redshift cluster, making it not as simple or serverless as Athena for this use case.

Practice this question →

396

MCQmedium

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

A.Assign a public IP to the Lambda function and route through an Internet Gateway.

B.Configure the Lambda function to access the VPC and use a VPC endpoint for S3.

C.Use Lambda@Edge to process data at the edge location.

D.Place the Lambda function in a public subnet and use a NAT Gateway.

AnswerB

VPC access enables private connectivity to VPC resources; VPC endpoint keeps S3 traffic private.

Why this answer

It allows the Lambda function to be attached to a VPC, enabling it to access the VPC-hosted database securely over private IP addresses. Additionally, using a VPC endpoint for S3 ensures that data transfer between Lambda and the S3 buckets remains within the AWS network, avoiding public internet exposure and reducing data transfer costs.

Exam trap

The trap here is that candidates may think Lambda functions can be assigned public IPs or placed in public subnets like EC2 instances, but Lambda's VPC integration uses ENIs and requires private subnets, and the most secure way to access S3 from within a VPC is via a VPC endpoint, not a NAT Gateway.

How to eliminate wrong answers

Option A is wrong because assigning a public IP to a Lambda function is not supported; Lambda functions cannot have public IPs, and routing through an Internet Gateway would expose traffic to the public internet, violating security best practices. Option C is wrong because Lambda@Edge is designed for content distribution and edge processing with CloudFront, not for accessing VPC-hosted databases, and it cannot be configured to access VPC resources. Option D is wrong because placing a Lambda function in a public subnet is not possible; Lambda functions are attached to VPC subnets but do not have public IPs, and using a NAT Gateway would still route traffic through the public internet for S3 access, which is less secure and more costly than using a VPC endpoint.

Practice this question →

397

MCQhard

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

A.Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

B.Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

C.Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

D.Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.

AnswerD

Flink provides exactly-once processing and handles late data.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink provides built-in support for windowed aggregations, exactly-once processing semantics, and handling late-arriving data via allowed lateness and watermarking. It can output processed results directly to Amazon S3 using a Flink sink, meeting all requirements for a real-time analytics platform.

Exam trap

The trap here is that candidates often choose AWS Lambda or Kinesis Data Firehose for simplicity, overlooking the need for stateful windowed aggregations and exactly-once processing, which are not natively supported by those services.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a near-real-time ingestion service that does not support custom windowed aggregations or exactly-once processing; it delivers data with at-least-once semantics. Option B is wrong because Amazon EMR with Spark Streaming can process streaming data but does not natively provide exactly-once processing semantics without additional configuration (e.g., checkpointing and idempotent sinks), and it is not the simplest managed service for this use case. Option C is wrong because AWS Lambda processes records from Kinesis Data Streams but has a maximum execution timeout of 15 minutes and does not support stateful windowed aggregations or exactly-once processing; it is designed for lightweight, stateless transformations.

Practice this question →

398

MCQhard

A company is designing a multi-region active-active application using Amazon Aurora Global Database. The application writes to a custom domain endpoint that routes to the primary cluster. To minimize write latency, the application should write to the nearest region. Which configuration should the solutions architect use?

A.Configure Aurora Global Database with multiple primary clusters, each in a different region, and use Route 53 to route writes.

B.Use Amazon DynamoDB global tables instead of Aurora Global Database, as DynamoDB supports multi-region writes.

C.Use Aurora cross-region read replicas and failover to a secondary region for writes.

D.Use Route 53 latency-based routing to direct writes to the nearest region. Each region has its own Aurora cluster.

AnswerB

DynamoDB global tables allow active-active multi-region writes. Aurora Global Database does not.

Why this answer

Amazon Aurora Global Database does not support multi-region writes; it has a single primary (writer) cluster and multiple read-only secondary regions. Amazon DynamoDB global tables, however, natively support active-active multi-region writes, allowing the application to write to the nearest region and achieve low write latency. Therefore, DynamoDB global tables are the correct service for this requirement.

Exam trap

The trap here is that candidates assume Aurora Global Database supports multi-region writes because of the word 'Global,' but it actually enforces a single-writer model, making DynamoDB global tables the only AWS-managed relational-like service that supports active-active multi-region writes.

How to eliminate wrong answers

Option A is wrong because Aurora Global Database does not support multiple primary clusters; it has exactly one primary cluster that handles all writes, and secondary regions are read-only. Option C is wrong because Aurora cross-region read replicas are read-only and cannot accept writes; failover promotes a read replica to a primary, but that does not enable simultaneous multi-region writes. Option D is wrong because Route 53 latency-based routing to separate Aurora clusters in each region would create independent databases with no cross-region replication, leading to data inconsistency; Aurora Global Database is designed for a single writer, not active-active writes.

Practice this question →

399

Multi-Selecteasy

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Select 3 answers

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS AppConfig

D.Amazon DynamoDB

E.Amazon S3

AnswersA, B, C

AWS Secrets Manager is purpose-built for storing and rotating secrets, meeting the requirements for secrets management.

Why this answer

AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration.

Option D (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Practice this question →

400

MCQmedium

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

A.Amazon DynamoDB with global tables

B.Amazon Aurora with Multi-AZ and Aurora Replicas

C.Amazon ElastiCache for Redis with replication groups

D.Amazon RDS for MySQL with Multi-AZ and Read Replicas

AnswerB

Aurora provides Multi-AZ with automatic failover and up to 15 Aurora Replicas for read scaling.

Why this answer

Amazon Aurora with Multi-AZ and Aurora Replicas (Option B) is the correct choice because it provides a single integrated solution where Aurora Replicas serve as both read replicas for scaling read queries and automatic failover targets. In contrast, Amazon RDS for MySQL with Multi-AZ and Read Replicas (Option D) uses a separate Multi-AZ standby for failover and read replicas that are not automatically promoted; while it technically meets the individual requirements, it does not provide the combined failover and read scaling within the same tier, making Aurora the preferred solution. Option A is a NoSQL database, not relational.

Option C is a caching service, not a relational database.

Exam trap

A common trap is selecting Amazon RDS for MySQL with Multi-AZ and Read Replicas, thinking it provides an equivalent solution; however, Aurora's architecture integrates read replicas and failover, whereas RDS requires separate configurations and manual promotion of read replicas.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value/document database, not a relational database, and global tables provide multi-region replication but not read replicas for scaling read queries in the same region. Option C is wrong because Amazon ElastiCache for Redis is an in-memory data store, not a relational database, and replication groups provide high availability and read replicas but do not support SQL queries or automatic failover in the same sense as a relational database Multi-AZ deployment.

Practice this question →

401

MCQhard

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

A.Configure Amazon RDS for MySQL with a cross-Region read replica and automatic failover.

B.Use Route 53 health checks to detect regional failure and automatically update the Aurora Global Database endpoint.

C.Use the Aurora Global Database failover capability to promote the secondary region to primary.

D.Use Amazon RDS Multi-AZ with synchronous replication across Regions.

AnswerC

Aurora Global Database supports managed failover with low RPO/RTO.

Why this answer

Amazon Aurora Global Database provides a managed cross-Region failover capability that can promote a secondary region to primary with an RTO of as low as 1 minute and an RPO of typically less than 1 second, meeting the lowest possible RTO and RPO requirements for regional failures in an active-active architecture. This is achieved through storage-level replication that is asynchronous but very low latency, and the failover operation is a single API call or can be automated via Route 53 health checks, ensuring minimal data loss and downtime.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ (which is single-Region) with cross-Region replication, or assume that Route 53 health checks alone can handle the failover without understanding that the database failover must be explicitly managed via Aurora Global Database's promotion capability.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL with a cross-Region read replica does not support automatic failover; you must manually promote the read replica, resulting in higher RTO, and replication is asynchronous with potential for data loss (higher RPO). Option B is wrong because Route 53 health checks can detect regional failure and update DNS records, but they do not directly manage the Aurora Global Database endpoint; the failover must be initiated separately via the Aurora Global Database failover capability, and simply updating the endpoint does not promote the secondary region to primary. Option D is wrong because Amazon RDS Multi-AZ is designed for high availability within a single Region using synchronous replication, not across Regions; cross-Region synchronous replication is not supported, and Multi-AZ does not provide cross-Region failover.

Practice this question →

402

MCQeasy

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

A.Use a separate Amazon RDS instance for each microservice.

B.Use a single Amazon RDS instance shared by all microservices.

C.Use Amazon Aurora with RDS Proxy in front of it.

D.Use Amazon DynamoDB as a shared database for all microservices.

AnswerB

Minimizes application changes by preserving the existing relational database schema and joins.

Why this answer

The requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Exam trap

The trap here is that candidates often assume microservices require separate databases per service (database-per-service pattern) without considering the constraint of minimizing application changes, leading them to incorrectly choose option A.

How to eliminate wrong answers

Option A is wrong because using a separate RDS instance per microservice would require decomposing the monolithic database into multiple databases, breaking existing complex joins and forcing extensive application changes to handle cross-service data access. Option C is wrong because Amazon Aurora with RDS Proxy addresses connection pooling and scalability but does not change the fundamental need to share a single database; while it could be used with a shared instance, it is not a distinct strategy that minimizes changes compared to a single RDS instance. Option D is wrong because Amazon DynamoDB is a NoSQL database that does not support complex joins; migrating to it would require rewriting all queries and data access patterns, contradicting the goal of minimizing application changes.

Practice this question →

403

MCQhard

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

A.Server-side encryption with customer-provided keys (SSE-C)

B.Server-side encryption with AWS KMS managed keys (SSE-KMS)

C.Server-side encryption with S3 managed keys (SSE-S3)

D.Client-side encryption

AnswerC

SSE-S3 uses AWS-managed keys that are automatically rotated.

Why this answer

SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option B is wrong because SSE-KMS uses customer-managed KMS keys.

Option D is wrong because client-side encryption is managed by the customer.

Practice this question →

404

Multi-Selecthard

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Select 3 answers

A.AWS CloudFormation

B.AWS CodePipeline

C.AWS CodeCommit

D.AWS CodeBuild

E.AWS CodeDeploy

AnswersB, C, D

CodePipeline orchestrates the build, test, and deploy stages.

Why this answer

AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Exam trap

The trap here is that candidates may incorrectly select AWS CodeDeploy (Option E) because they assume it supports all deployment targets, including EKS, but CodeDeploy does not natively support Kubernetes clusters; instead, EKS deployments are typically handled via CodeBuild or a custom action in CodePipeline.

Practice this question →

405

Multi-Selectmedium

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Enable default encryption with SSE-KMS on the S3 bucket.

B.Use client-side encryption before uploading to S3.

C.Enable S3 server access logging.

D.Use a bucket ACL to grant access to the data lake.

E.Configure an S3 bucket policy that allows access only from specific IAM roles.

AnswersA, E

SSE-KMS encrypts objects at rest with managed keys.

Why this answer

Options A and E are correct. A: Enabling default encryption with SSE-KMS ensures data is encrypted at rest using AWS Key Management Service, providing control over encryption keys. E: A bucket policy that allows access only from specific IAM roles ensures only authorized users can access the data, following the principle of least privilege.

Option B (client-side encryption) is not required as server-side encryption meets the requirement. Option C (server access logging) does not control access or encryption. Option D (bucket ACL) is less secure and not recommended for controlling access compared to IAM policies.

Practice this question →

406

MCQeasy

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

A.Use Amazon ElastiCache for Redis to store session data

B.Store session data on an Amazon EBS volume attached to each instance

C.Store session data in an Amazon RDS database

D.Enable sticky sessions (session affinity) on the ALB

AnswerA

Redis provides a fast, shared session store that all instances can access.

Why this answer

Amazon ElastiCache for Redis provides a fully managed, in-memory data store that is ideal for storing session state externally from the EC2 instances. This decouples session data from the compute layer, allowing any instance to retrieve the same session data regardless of which instance originally handled the request. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it both highly scalable and cost-effective for session management at scale.

Exam trap

The trap here is that candidates often confuse sticky sessions (session affinity) as a valid solution for session persistence, but it actually undermines scalability and fault tolerance by tying a user to a single instance, which is the opposite of what a stateless, horizontally scalable architecture requires.

How to eliminate wrong answers

Option B is wrong because storing session data on an EBS volume attached to each instance creates a single point of failure and prevents instances from sharing session data; EBS volumes are tied to a single Availability Zone and cannot be concurrently accessed by multiple instances. Option C is wrong because using Amazon RDS for session data introduces unnecessary relational database overhead, higher latency for simple key-value lookups, and increased cost compared to an in-memory cache like Redis. Option D is wrong because enabling sticky sessions (session affinity) on the ALB forces traffic from a user to the same instance, which reduces scalability and defeats the purpose of horizontal scaling; if that instance fails, the session data is lost.

Practice this question →

407

Multi-Selecthard

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

Select 2 answers

A.Enable SSL/TLS for all data transfers

B.Use S3 Access Points with a bucket policy

C.Use server-side encryption with Amazon S3 managed keys (SSE-S3)

D.Use client-side encryption before uploading

E.Use server-side encryption with AWS KMS (SSE-KMS)

AnswersC, E

SSE-S3 encrypts data at rest.

Why this answer

Server-side encryption with Amazon S3 managed keys (SSE-S3) encrypts data at rest using AES-256, with S3 managing the encryption keys entirely. This meets the requirement for encryption at rest without any additional customer effort or key management overhead.

Exam trap

The trap here is that candidates may confuse encryption in transit (SSL/TLS) with encryption at rest, or think that access controls (S3 Access Points) provide encryption, leading them to select options A or B instead of focusing on the two server-side encryption methods (SSE-S3 and SSE-KMS) that directly encrypt data at rest.

Practice this question →

408

MCQhard

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

A.Deploy the Auto Scaling group in a single Region with instances spread across two AZs

B.Deploy the Auto Scaling group in three Availability Zones within a single Region

C.Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover

D.Use an active-active configuration across two Regions with Route 53 weighted routing

AnswerC

Active-passive reduces cost; failover provides resilience.

Why this answer

It provides multi-Region resilience using an active-passive architecture, which is the most cost-effective approach for a stateless application that must survive a regional outage. The active-passive setup uses Route 53 failover routing to direct traffic to the primary Region under normal conditions and automatically fail over to the secondary Region only when the primary is unhealthy, minimizing ongoing costs by keeping the secondary infrastructure idle or minimal until needed.

Exam trap

The trap here is that candidates often choose a single-Region, multi-AZ option (A or B) because they assume high availability within a Region is sufficient, but the question explicitly requires resilience during a regional outage, which only multi-Region architectures can provide.

How to eliminate wrong answers

Option A is wrong because deploying in a single Region, even across two AZs, cannot survive a regional outage, as the entire Region may become unavailable. Option B is wrong because using three AZs within a single Region still leaves the application vulnerable to a full regional failure, and it does not address the requirement for regional outage resilience. Option D is wrong because an active-active configuration across two Regions with Route 53 weighted routing is less cost-effective than active-passive, as it requires both Regions to be fully operational and handling traffic at all times, increasing costs without providing additional benefit for a stateless application that can handle instance failures.

Practice this question →

409

MCQeasy

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

A.Use a single EC2 instance in one AZ and a standby instance in another AZ

B.Use AWS Elastic Beanstalk with a single instance environment

C.Use AWS CloudFormation to launch a single instance in each AZ

D.Use an Auto Scaling group with a minimum of two instances across two Availability Zones

AnswerD

Auto Scaling automatically replaces failed instances and distributes across AZs.

Why this answer

An Auto Scaling group with a minimum of two instances across two Availability Zones ensures that if one instance or an entire AZ fails, the remaining instance continues to serve traffic, and Auto Scaling automatically launches a replacement instance to restore the desired count. This architecture provides both high availability and automatic recovery from instance failures without manual intervention.

Exam trap

The trap here is that candidates often confuse 'high availability' with 'fault tolerance' and assume that simply having two instances in different AZs (Option C) is sufficient, but without an auto-recovery mechanism like Auto Scaling, a failed instance remains down and requires manual remediation.

How to eliminate wrong answers

Option A is wrong because a single active instance with a standby instance in another AZ does not provide automatic recovery; failover to the standby would require manual or custom scripting, and the standby instance is idle, wasting resources. Option B is wrong because AWS Elastic Beanstalk with a single instance environment runs only one EC2 instance, which is a single point of failure and cannot automatically recover from instance failures without additional configuration like a multi-instance environment. Option C is wrong because using AWS CloudFormation to launch a single instance in each AZ creates two independent instances but does not include any health-check or auto-replacement mechanism; if one instance fails, CloudFormation does not automatically replace it, and there is no load balancing or failover logic.

Practice this question →

410

MCQhard

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

A.Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Enable Aurora Auto Scaling to add read replicas based on CPU or connections.

B.Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Use Amazon SQS to queue read requests during peak traffic.

C.Use an Auto Scaling group with a simple scaling policy based on CPU utilization. Use DynamoDB Auto Scaling for the database.

D.Use an Auto Scaling group with a step scaling policy based on CPU utilization. Use ElastiCache Auto Scaling to add cache nodes for read traffic.

AnswerA

Auto Scaling scales web tier; Aurora Auto Scaling scales read capacity automatically.

Why this answer

It uses an Auto Scaling group with a target tracking scaling policy based on CPU utilization to automatically scale the web tier, and enables Aurora Auto Scaling to add read replicas based on CPU or connections, which meets the requirements for both web and database scaling. Option B is incorrect because Amazon SQS is a message queue service and does not scale the database or handle read traffic for Aurora. Option C is incorrect because DynamoDB is a NoSQL database, not the specified Aurora MySQL database, and its auto scaling does not apply.

Option D is incorrect because ElastiCache is a caching service, not the database tier, and its auto scaling does not address read scaling for Aurora.

Practice this question →

411

Multi-Selectmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Select 2 answers

A.Amazon CloudFront

B.AWS Global Accelerator

C.Network Load Balancer

D.Application Load Balancer

E.Amazon Route 53

AnswersC, D

NLB distributes traffic at Layer 4.

Why this answer

Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and can distribute incoming traffic across multiple EC2 instances in an Auto Scaling group with extremely low latency and high throughput. It is ideal for applications that require handling millions of requests per second while preserving the source IP address of clients.

Exam trap

The SAP-C02 exam often tests the distinction between services that perform actual load balancing (ALB, NLB) versus services that provide DNS-based routing (Route 53) or content delivery (CloudFront) or global traffic optimization (Global Accelerator), leading candidates to mistakenly select Route 53 or CloudFront as load balancers.

Practice this question →

412

Multi-Selecteasy

A company is designing a new application that will process images uploaded by users. The application must automatically resize images and store them in Amazon S3. The solution should be serverless and event-driven. Which THREE AWS services should be used together? (Choose three.)

Select 3 answers

A.Amazon S3

B.AWS Lambda

C.Amazon EC2

D.Amazon Simple Queue Service (SQS)

E.Amazon S3 Event Notification

AnswersA, B, E

S3 stores the uploaded and processed images.

Why this answer

Options A, B, and E are correct. Amazon S3 can trigger a Lambda function on object uploads. Lambda can process the image and store the result back in S3.

Option C is wrong because EC2 is not serverless. Option D is wrong because SQS is not needed for this event-driven flow.

Practice this question →

413

MCQhard

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

A.The SecurityGroups property should be a list, but the YAML specifies a single reference incorrectly.

B.The security group ingress rule allows SSH from anywhere.

C.There is a circular dependency between the EC2 instance and the security group.

D.The AMI ID is invalid.

AnswerA

The error occurs when the SecurityGroups property is provided as a single string instead of a list. In CloudFormation, even one security group must be specified as a list, e.g., [!Ref MySecurityGroup].

Why this answer

The error 'Value of property SecurityGroups must be a list of strings' occurs because the YAML template specifies the SecurityGroups property as a single string (e.g., !Ref MySecurityGroup) instead of a list of strings (e.g., [!Ref MySecurityGroup]). In AWS CloudFormation, the SecurityGroups property for an EC2 instance expects a list of security group IDs or names, even if only one security group is provided. The YAML syntax must wrap the reference in square brackets to form a list, or the template will fail validation.

Exam trap

The trap here is that candidates may confuse the SecurityGroups property with SecurityGroupIds, or assume that a single reference can be passed as a scalar, but CloudFormation strictly enforces the list type for SecurityGroups even when only one security group is used.

How to eliminate wrong answers

Option B is wrong because allowing SSH from anywhere (0.0.0.0/0) is a security concern but does not cause a 'list of strings' error; it would only trigger a security review or a different validation error if the template explicitly forbids it. Option C is wrong because a circular dependency between the EC2 instance and the security group would cause a stack creation failure with a 'circular dependency' error, not a type mismatch error about SecurityGroups. Option D is wrong because an invalid AMI ID would produce an error like 'AMI ID not found' or 'InvalidAMIID.NotFound', not a property type validation error.

Practice this question →

414

Drag & Dropmedium

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create the replication instance, then endpoints, then the migration task, start it, and finally cut over.

Practice this question →

415

MCQmedium

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

A.Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.

B.Use AWS WAF with rate-based rules and associate it with the ALB.

C.Use an AWS Network Firewall and configure stateful rules to block malicious IPs.

D.Enable AWS Shield Standard and use security groups to restrict traffic.

AnswerA

Deploying CloudFront with AWS Shield Advanced provides edge DDoS protection and enforces TLS 1.3, making this the correct solution.

Why this answer

Deploying CloudFront in front of the ALB with AWS Shield Advanced provides edge-based DDoS protection, absorbing attacks before they reach the ALB. CloudFront supports TLS 1.3, meeting the encryption requirement. Option B is incorrect because AWS WAF with rate-based rules can help filter malicious traffic but does not absorb DDoS attacks at the edge; it works at the ALB level.

Option C is incorrect because AWS Network Firewall is a stateful firewall that protects VPCs, not at the edge, and cannot absorb large DDoS attacks. Option D is incorrect because AWS Shield Standard provides basic protection, but it is not sufficient for absorbing DDoS attacks, and security groups do not mitigate DDoS at the edge.

Exam trap

The trap is assuming that any AWS WAF or firewall solution at the ALB level can absorb DDoS attacks, but edge protection (CloudFront + Shield Advanced) is required for absorbing attacks before they reach the ALB.

Practice this question →

416

MCQhard

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

A.Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

B.Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

C.Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

D.Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.

AnswerD

Cross-Region read replicas provide low RPO; scaling from 0 minimizes cost; Route 53 failover provides RTO.

Why this answer

Option D meets the RPO of less than 5 minutes because RDS cross-Region read replicas use asynchronous replication with a typical lag of seconds. It meets the RTO of less than 30 minutes because the read replica can be promoted to a standalone primary in minutes. The standby EC2 environment with Auto Scaling set to 0 (scaling up based on health check alarms) minimizes cost when not in use.

Route 53 failover routing redirects traffic to us-west-2 after promotion. Option A is incorrect because a single hot standby EC2 instance incurs ongoing cost, and it does not meet the cost minimization requirement. Option B is incorrect because automated snapshots have an RPO of up to 24 hours (not <5 minutes), and restoring to S3-mounted volumes is not a functional database serving solution.

Option C is incorrect because Multi-AZ in both regions is costly (always running instances) and cross-Region load balancing with ALB is not a native feature for failover; plus Multi-AZ does not provide a separate read replica in another region for DR without additional replication.

Practice this question →

417

MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

A.Run an Amazon ECS service with Fargate that polls the SQS queue and writes to DynamoDB. Configure auto scaling based on CPU utilization.

B.Use an Amazon ECS service with Fargate and a target tracking scaling policy based on SQS queue depth.

C.Use Amazon Kinesis Data Streams to ingest messages and an AWS Lambda function to process and write to DynamoDB.

D.Use an AWS Lambda function with an SQS trigger to process messages and write to DynamoDB.

AnswerD

Lambda scales to zero when idle and scales up to handle thousands of messages, making it cost-effective and scalable.

Why this answer

Using an AWS Lambda function with an SQS trigger is serverless, scales automatically with the queue depth, and incurs no cost when no messages are processed, making it the most cost-effective and scalable choice for unpredictable workloads. Option A is wrong because auto scaling based on CPU utilization does not directly correlate with the number of messages in the queue, potentially causing delays or over-provisioning. Option B is wrong because, although a target tracking policy based on SQS queue depth is better, an ECS with Fargate service still requires at least one running task, which may be idle and incur costs.

Option C is wrong because Amazon Kinesis Data Streams is designed for real-time streaming, not standard message queuing, and is more expensive and complex than the SQS and Lambda combination.

Practice this question →

418

MCQhard

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

A.Increase the Lambda function timeout and use a single database connection per function instance.

B.Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.

C.Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.

D.Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.

AnswerB

RDS Proxy efficiently manages connection pooling and reduces load on the database.

Why this answer

Amazon RDS Proxy sits between the Lambda function and the RDS database, maintaining a pool of established connections. When Lambda invocations scale up, they reuse connections from the pool instead of opening new ones, preventing the database from being overwhelmed. This is the recommended AWS pattern for serverless applications with high concurrency and relational databases.

Exam trap

The trap here is that candidates often think batching or reducing concurrency is the solution, but the real challenge is managing connection reuse under elastic scaling, which only a dedicated proxy like RDS Proxy can solve without sacrificing throughput.

How to eliminate wrong answers

Option A is wrong because increasing the Lambda timeout does not reduce the number of connections; each concurrent invocation still opens its own connection, and a single connection per instance does not scale safely under high concurrency. Option C is wrong because setting reserved concurrency to 1 cripples throughput and defeats the purpose of using DynamoDB Streams, which expects parallel processing; it also does not address connection pooling, as the single instance still opens one connection per invocation. Option D is wrong because batching records does not reduce the number of concurrent Lambda invocations; each batch still runs in its own instance and opens a separate database connection, so the connection count remains high.

Practice this question →

419

MCQmedium

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

A.The instance is pending.

B.The instance is stopped.

C.The instance is running and has passed its status checks.

D.The instance is terminated.

AnswerC

Running means the instance is operational.

Why this answer

The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot.

However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Exam trap

The trap here is that candidates often confuse the instance lifecycle state (e.g., 'running') with the status check results, assuming 'running' alone implies full health, but the question requires recognizing that the output also includes 'InstanceStatus: ok' and 'SystemStatus: ok', which together confirm the instance is running and has passed its status checks.

How to eliminate wrong answers

Option A is wrong because 'pending' is a separate lifecycle state that occurs when an instance is starting up, not when it is already running; the output explicitly shows 'running', not 'pending'. Option B is wrong because 'stopped' is a different lifecycle state where the instance is shut down and not running; the output shows 'running', so the instance is not stopped. Option D is wrong because 'terminated' is a final lifecycle state where the instance is permanently deleted and cannot be started; the output shows 'running', so the instance is not terminated.

Practice this question →

420

MCQhard

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

A.RDS Multi-AZ in the same region

B.RDS Cross-Region Read Replicas

C.Amazon S3

D.AWS Database Migration Service

AnswerB

Provides a readable replica in another region for DR.

Why this answer

RDS Multi-AZ provides high availability within a single region by synchronously replicating data to a standby instance in a different Availability Zone. To protect against a regional failure, you need a cross-region disaster recovery solution. RDS Cross-Region Read Replicas asynchronously replicate data to a different AWS Region, allowing you to promote the replica to a standalone primary database in the event of a regional outage.

Exam trap

The trap here is that candidates confuse Multi-AZ (which is high availability within a region) with cross-region disaster recovery, assuming Multi-AZ alone provides regional protection.

How to eliminate wrong answers

Option A is wrong because RDS Multi-AZ in the same region only protects against Availability Zone failures, not regional failures; it does not replicate data across AWS Regions. Option C is wrong because Amazon S3 is an object storage service and cannot serve as a direct disaster recovery target for a relational database; it lacks native database replication and failover capabilities. Option D is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migrations, not for automated, low-RPO disaster recovery with automatic failover; it requires manual intervention to promote a target database.

Practice this question →

421

MCQeasy

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

A.Full S3 access to the bucket and objects for the root user of account 123456789012.

B.Full S3 access to the bucket and objects for all IAM users in account 123456789012.

C.No access because the root user is not allowed.

D.Read-only access to the bucket.

AnswerB

Correct. The root user ARN in an S3 bucket policy grants access to all IAM users in the account.

Why this answer

In AWS S3 bucket policies, specifying the root user ARN `arn:aws:iam::123456789012:root` as the principal grants access to all IAM users and roles in that account, not just the root user. The root user ARN is a shorthand for the entire account. Therefore, the policy grants full S3 access to all IAM users in account 123456789012, making option B correct.

Exam trap

A common misconception is that the root user ARN only grants access to the root user. In reality, in resource-based policies like S3 bucket policies, the root user ARN represents all IAM principals in the account.

How to eliminate wrong answers

Option B is wrong because the policy specifies the root user principal (`arn:aws:iam::123456789012:root`), which does not grant access to all IAM users in the account; IAM users would need their own explicit permissions or a role with a trust policy. Option C is wrong because the root user is explicitly allowed by the policy, and AWS root users can be granted access via resource-based policies like S3 bucket policies. Option D is wrong because the policy grants `s3:*` (all S3 actions), not just read-only access.

Practice this question →

422

Multi-Selecthard

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The solution must have a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. The application data is stored on Amazon EBS volumes. Which THREE steps should be taken to meet these requirements? (Choose three.)

Select 3 answers

A.Create Amazon Machine Images (AMIs) with pre-installed software and use AWS Backup to automate recovery in another region.

B.Use Amazon EBS snapshots and replicate them to another AWS Region using cross-region snapshot copy.

C.Use AWS CloudEndure Disaster Recovery to continuously replicate the EC2 instances to another region.

D.Enable Amazon S3 cross-region replication for the EBS snapshots.

E.Use AWS Database Migration Service (DMS) to replicate data to a secondary region.

AnswersA, B, C

AWS Backup can create AMI backups and support cross-region copy and restore.

Why this answer

Creating AMIs with pre-installed software and using AWS Backup to automate recovery in another region enables rapid instance launch with all required software already configured, supporting an RTO of under 15 minutes. AWS Backup can automate cross-region AMI copying and recovery, ensuring the RPO of less than 5 minutes is met when combined with frequent backup schedules.

Exam trap

The trap here is that candidates may confuse S3 cross-region replication (which works only for S3 objects) with the cross-region snapshot copy feature for EBS, leading them to select option D incorrectly.

Practice this question →

423

MCQhard

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

A.Use S3 bucket policies and S3 access logs for auditing.

B.Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.

C.Use IAM policies with condition keys and enable AWS CloudTrail for auditing.

D.Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.

AnswerD

Lake Formation provides row/column-level security and auditing; S3 Object Lambda can transform data for masking.

Why this answer

AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.

Exam trap

The trap here is that candidates often assume IAM policies or S3 bucket policies alone can achieve fine-grained access control, but they lack the column/row-level granularity and dynamic data masking that Lake Formation and S3 Object Lambda provide.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies alone cannot enforce fine-grained access control at the object level (e.g., column or row level), and S3 access logs provide basic request logging but lack the granular auditing and data masking capabilities required. Option B is wrong because Amazon Macie discovers sensitive data but does not enforce access control or mask data; S3 bucket policies are too coarse for fine-grained control and cannot mask data on the fly. Option C is wrong because IAM policies with condition keys can restrict access based on attributes like tags or IP, but they cannot provide column/row-level permissions or mask sensitive data; AWS CloudTrail logs API calls but does not enable real-time data masking.

Practice this question →

424

MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

A.Use Amazon RDS for MySQL or PostgreSQL with read replicas.

B.Use Amazon Aurora Serverless to reduce management.

C.Store data in Amazon S3 and use Athena for queries.

D.Migrate to Amazon DynamoDB for scalability.

AnswerA

RDS maintains SQL compatibility, minimizing code changes.

Why this answer

Using Amazon RDS with the same database engine (MySQL or PostgreSQL) minimizes code changes, as the application can connect via standard SQL drivers. Read replicas can help with read scaling without altering the codebase. Option B is wrong because Aurora Serverless may require configuration changes and does not necessarily minimize code changes.

Option C is wrong because S3 and Athena are not suitable for transactional relational queries and would require significant architectural changes. Option D is wrong because DynamoDB would require schema redesign and application changes to use NoSQL.

Practice this question →

425

MCQmedium

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web frontend, a REST API, and a PostgreSQL database. The migration plan is to containerize the frontend and API using Amazon ECS with Fargate, and use Amazon RDS for PostgreSQL. The company expects variable traffic with peak loads during promotional events. The architecture must be highly available and cost-effective. The operations team wants to minimize manual scaling interventions. Which solution should a Solutions Architect recommend?

A.Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon DynamoDB for the database with on-demand capacity mode.

B.Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon RDS for PostgreSQL with Multi-AZ deployment and Auto Scaling for storage.

C.Deploy the API and frontend on Amazon EC2 instances behind an Application Load Balancer. Use Auto Scaling groups with dynamic scaling policies. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.

D.Deploy the API and frontend on Amazon ECS with Fargate. Configure a scheduled task to scale out during known promotional events. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.

AnswerB

ECS with Fargate and target tracking scaling provides automated, cost-effective scaling without over-provisioning.

Why this answer

It combines ECS with Fargate for serverless containers, Application Auto Scaling with target tracking based on CPU and memory utilization for automatic scaling, and Amazon RDS for PostgreSQL with Multi-AZ deployment for high availability and storage auto scaling. This meets the requirements for variable traffic, high availability, cost-effectiveness, and minimal manual intervention. Option A is wrong because it suggests Amazon DynamoDB instead of PostgreSQL, which is unsuitable for the relational workload.

Option C is wrong because it uses EC2 instances with Auto Scaling, which adds management overhead and is less cost-effective than Fargate. Option D is wrong because it relies on scheduled scaling, which cannot handle unexpected spikes in traffic.

Practice this question →

426

MCQeasy

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

A.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.

B.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.

C.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.

D.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.

AnswerA

This encrypts backend traffic, uses ACM for backend (same cert), and health checks use HTTP to avoid certificate issues.

Why this answer

It meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.

Exam trap

The trap here is that candidates often assume health checks must use the same protocol as the target group traffic, but AWS recommends using HTTP health checks even for HTTPS target groups to avoid certificate validation failures and ensure reliable health monitoring.

How to eliminate wrong answers

Option B is wrong because it configures the target group with HTTP health checks on port 80 but does not specify HTTPS for the target group traffic, leaving traffic between the ALB and EC2 instances unencrypted, violating the security requirement. Option C is wrong because it uses a self-signed certificate for the target group HTTPS, which would cause the ALB to reject the certificate during health checks and traffic forwarding (ALB requires trusted certificates for HTTPS target groups), and health checks using HTTPS on port 443 would fail due to certificate validation issues. Option D is wrong because it uses a separate ACM certificate for the target group HTTPS health checks, which is unnecessary and introduces complexity; the same ACM certificate can be used, and health checks should use HTTP to avoid certificate validation overhead and ensure reliable health monitoring.

Practice this question →

427

MCQeasy

A company is designing a new web application that will be accessed by users worldwide. The application should have low latency and high availability. The application uses a stateless web tier and a relational database. Which architecture minimizes latency for global users?

A.Deploy the application in multiple regions with Route 53 latency-based routing, and use Amazon Aurora Global Database for the database tier.

B.Deploy the application in a single region and use Route 53 geolocation routing.

C.Deploy the application in multiple regions, use CloudFront to cache static content, and route dynamic requests to the nearest region via Route 53 latency-based routing.

D.Deploy the application in a single region and use Amazon CloudFront to cache content globally.

AnswerA

Aurora Global Database allows reads from local regions, reducing latency for read-heavy workloads.

Why this answer

Deploying in multiple regions with Route 53 latency-based routing directs users to the region with the lowest network latency, minimizing response times. Amazon Aurora Global Database provides a fully managed cross-region replication solution with typical latency of under one second, ensuring the relational database tier is available close to each application deployment for low-latency reads and fast failover.

Exam trap

The trap here is that candidates often assume CloudFront alone can solve global latency for dynamic applications, overlooking that the database tier remains a single point of latency unless a global database solution like Aurora Global Database is used.

How to eliminate wrong answers

Option B is wrong because deploying in a single region forces all global users to traverse potentially high-latency paths to that one region, and Route 53 geolocation routing does not reduce latency—it only routes based on geographic location, which may not correspond to the lowest latency path. Option C is wrong because while CloudFront caching static content and latency-based routing for dynamic requests improves performance, the relational database remains in a single region (or requires manual cross-region replication), creating a bottleneck for database reads and writes that increases latency for users far from the database region. Option D is wrong because a single-region deployment with CloudFront only accelerates static content delivery; dynamic requests and database operations still incur the full round-trip latency to the single region, failing to minimize latency for global users.

Practice this question →

428

MCQmedium

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

A.Use a standard SQS queue and set the Lambda function reserved concurrency to 1.

B.Use an SQS FIFO queue and enable content-based deduplication.

C.Use a standard SQS queue and configure Lambda destinations for the queue.

D.Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.

AnswerB

SQS FIFO queues support exactly-once processing when combined with deduplication IDs.

Why this answer

An SQS FIFO queue guarantees first-in, first-out delivery and exactly-once processing, eliminating duplicates within a message group. Enabling content-based deduplication allows the queue to automatically detect and discard duplicate messages based on the message body, ensuring each Lambda invocation processes a unique message without additional application logic.

Exam trap

The trap here is that candidates often assume reserved concurrency or Lambda destinations can enforce exactly-once processing, but only SQS FIFO queues with deduplication provide the necessary guarantee at the queue level.

How to eliminate wrong answers

Option A is wrong because setting reserved concurrency to 1 on a standard SQS queue does not prevent duplicate messages; standard queues offer at-least-once delivery, and concurrency limits only throttle processing, not eliminate duplicates. Option C is wrong because Lambda destinations (e.g., for success/failure events) are used for asynchronous invocation results, not for deduplication; they do not affect the at-least-once delivery behavior of a standard SQS queue. Option D is wrong because DynamoDB Streams as an event source for Lambda does not provide exactly-once processing for SQS messages; it is unrelated to SQS deduplication and introduces its own at-least-once delivery semantics.

Practice this question →

429

Multi-Selecteasy

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

Select 3 answers

A.Store AWS access keys in AWS Secrets Manager and retrieve them at runtime.

B.Create an IAM role with permissions to access the S3 bucket.

C.Attach the IAM role to the ECS task definition as the task role.

D.Enable the ECS task execution role to pass the task role to the container.

E.Configure the application to use the AWS CLI with environment variables for credentials.

AnswersB, C, D

The task role will assume this role to get temporary credentials.

Why this answer

The application must not have long-term credentials stored in the container image or environment variables. By creating an IAM role with permissions to access the S3 bucket and attaching it as the ECS task role (Option C), the application can obtain temporary credentials from the ECS task metadata endpoint. This eliminates the need to store any static access keys.

Option D is also correct because the ECS task execution role must have the `iam:PassRole` permission to allow the task role to be associated with the container, enabling the credential retrieval mechanism.

Exam trap

The trap here is that candidates may think storing credentials in AWS Secrets Manager (Option A) is acceptable because it removes them from the image, but the requirement explicitly prohibits any long-term credentials from being present in the container at runtime, which Secrets Manager retrieval still introduces.

Practice this question →

430

MCQeasy

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

A.Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.

B.Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.

C.Use resource-based policies on the buckets to allow access from the IAM Identity Center users.

D.Use S3 bucket policies that grant access to specific IAM users based on their usernames.

AnswerA

ABAC with tags enables fine-grained, scalable access control.

Why this answer

It uses IAM roles with tag-based policies, which integrate with AWS IAM Identity Center via attribute-based access control (ABAC). Developers assume the role after authenticating through Identity Center, and the policy dynamically grants access to S3 buckets matching their team tags, enabling fine-grained, scalable permissions without managing individual users or groups.

Exam trap

The trap here is that candidates often assume IAM groups (Option B) are the natural way to organize users from Identity Center, but Identity Center uses its own group structure and permission sets, not IAM groups, making Option B incompatible.

How to eliminate wrong answers

Option B is wrong because IAM groups are not directly compatible with IAM Identity Center; Identity Center uses permission sets and groups within its own directory, not IAM groups, so attaching policies to IAM groups would not apply to Identity Center users. Option C is wrong because resource-based policies on S3 buckets cannot directly reference IAM Identity Center users or groups; they can only reference IAM principals (users, roles, or AWS accounts), and Identity Center users are not IAM principals. Option D is wrong because S3 bucket policies that grant access based on IAM usernames are brittle and unscalable; they require hardcoding usernames, do not leverage team membership, and do not integrate with Identity Center's federated identity model.

Practice this question →

431

MCQeasy

A company is designing a serverless data processing pipeline using AWS Lambda functions. The pipeline processes messages from an Amazon SQS queue. Each message takes approximately 30 seconds to process, and the pipeline must handle bursts of up to 10,000 messages per minute. The messages must be processed in the order they are received. Which solution meets these requirements?

A.Use an SQS FIFO queue with a Lambda function that sets the Concurrency limit to 100.

B.Use an SQS FIFO queue with a Lambda function configured with a reserved concurrency of 1000.

C.Use an SQS Standard queue with a Lambda function that processes messages in batches.

D.Use an Amazon Kinesis Data Stream with a Lambda function that processes multiple records per invocation.

AnswerB

FIFO queues preserve order; Lambda with reserved concurrency avoids throttling.

Why this answer

An SQS FIFO queue guarantees first-in-first-out delivery within each message group, and with multiple message group IDs, messages can be processed in parallel. The Lambda function can be configured with a batch size of up to 10 messages from the same group. Assuming that messages are distributed across many groups, each invocation processes a batch of messages in approximately 30 seconds, yielding a per-group throughput of up to 20 messages per minute.

With a reserved concurrency of 1000, the pipeline can handle up to 1000 groups concurrently, achieving a total throughput of 20,000 messages per minute, which exceeds the required burst of 10,000 messages per minute. Reserved concurrency also ensures that the necessary capacity is available when needed, preventing throttling.

Exam trap

The trap here is that candidates often confuse 'Concurrency limit' (which caps maximum concurrency) with 'reserved concurrency' (which guarantees availability), and they may overlook that SQS Standard queues do not preserve order, leading them to choose Option A or C incorrectly.

How to eliminate wrong answers

Option A is wrong because setting a Concurrency limit to 100 restricts the Lambda function to only 100 concurrent executions, which at 30 seconds per message yields a maximum throughput of 200 messages per minute, far below the required 10,000. Option C is wrong because an SQS Standard queue does not guarantee message ordering, which violates the requirement that messages must be processed in the order they are received. Option D is wrong because Amazon Kinesis Data Streams does not provide strict per-message ordering across shards; ordering is only guaranteed within a shard, and processing multiple records per invocation can still lead to out-of-order processing if records from different shards are interleaved.

Practice this question →

432

MCQhard

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

A.Use AWS KMS to generate a key

B.Enable default encryption on the bucket

C.Provide the encryption key in the request headers

D.Configure a bucket policy to require SSE-C

AnswerC

SSE-C requires the key to be provided with each request.

Why this answer

SSE-C requires the customer to provide the encryption key in the request headers when uploading or accessing objects. Amazon S3 uses the provided key to encrypt data at rest and then discards the key; the customer is responsible for managing the key lifecycle. This is the only way to enforce customer-provided encryption keys at the object level.

Exam trap

The trap here is that candidates confuse SSE-C with SSE-KMS or SSE-S3, assuming that a bucket policy or default encryption alone can enforce customer-provided keys, when in fact SSE-C requires the key to be explicitly supplied in every request.

How to eliminate wrong answers

Option A is wrong because AWS KMS generates AWS-managed or customer-managed keys (SSE-KMS), not customer-provided keys (SSE-C) that are supplied per request. Option B is wrong because enabling default encryption on the bucket applies SSE-S3 or SSE-KMS automatically, not SSE-C, which requires the key to be sent with each request. Option D is wrong because a bucket policy can require SSE-C (e.g., via a condition key like s3:x-amz-server-side-encryption-customer-algorithm), but it does not enable SSE-C itself; the key must still be provided in the request headers.

Practice this question →

433

MCQhard

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

A.The security group allows SSH from a restricted IP, but not from the users.

B.The security group does not allow outbound traffic, so responses cannot be sent.

C.The security group allows HTTP only from the IP range 203.0.113.0/24.

D.The security group does not allow inbound HTTP traffic.

AnswerC

Correct. The security group only allows HTTP from 203.0.113.0/24, which excludes many users, blocking access.

Why this answer

Security groups are stateful: if inbound HTTP traffic is allowed, the corresponding outbound response traffic is automatically allowed, regardless of outbound rules. Therefore, missing outbound rules cannot prevent responses. The most likely issue is that the security group only allows HTTP from the IP range 203.0.113.0/24.

Users outside that range will be blocked, even though the instance is in a public subnet with an internet gateway.

Exam trap

The trap is that candidates may incorrectly blame missing outbound rules, overlooking the stateful nature of security groups. The real issue is often a restrictive inbound rule that does not permit traffic from the users' IP ranges.

How to eliminate wrong answers

Option A is wrong because the issue is about HTTP access, not SSH; SSH restrictions would not prevent HTTP users from reaching the web server. Option C is wrong because the security group allows HTTP from 0.0.0.0/0, not just 203.0.113.0/24, so IP-based restriction is not the problem. Option D is wrong because the security group explicitly allows inbound HTTP traffic on port 80 from 0.0.0.0/0, so inbound HTTP is permitted.

Practice this question →

434

MCQmedium

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

A.Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.

B.Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.

C.Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.

D.Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.

AnswerB

CloudFront provides HTTPS and works with ACM.

Why this answer

Amazon CloudFront can terminate HTTPS at the edge using an SSL certificate from AWS Certificate Manager (ACM), and it can be configured with an origin pointing to an S3 bucket configured for static website hosting. This combination allows the use of a custom domain name (e.g., www.example.com) via a CloudFront alternate domain name (CNAME) and enforces HTTPS for all client connections, which S3 static website hosting alone cannot natively support.

Exam trap

The trap here is that candidates assume S3 static website hosting can directly serve HTTPS with a custom domain and SSL certificate, but S3 does not support SSL termination or custom certificates on its website endpoint, making a CDN like CloudFront mandatory for HTTPS enforcement.

How to eliminate wrong answers

Option A is wrong because S3 static website hosting does not support attaching a custom SSL certificate directly; S3 only serves HTTP on the bucket's website endpoint, and HTTPS is not available without a front-end service like CloudFront. Option C is wrong because Route 53 with an alias record pointing to an S3 website endpoint does not provide HTTPS termination; DNSSEC only secures DNS queries, not the HTTP connection, and the S3 website endpoint itself does not support HTTPS. Option D is wrong because an Application Load Balancer (ALB) cannot be placed directly in front of an S3 bucket as an origin; ALBs require targets such as EC2 instances, IP addresses, or Lambda functions, not S3 buckets.

Practice this question →

435

MCQhard

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

A.Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.

B.Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.

C.Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.

D.Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.

AnswerC

Both policies are required for cross-account SSE-KMS.

Why this answer

When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.

Exam trap

The trap here is that candidates assume that specifying a cross-account KMS key ARN in the S3 bucket configuration is sufficient, overlooking the mandatory two-way policy update (KMS key policy in the key-owning account and S3 bucket policy in the bucket-owning account) required for cross-account KMS operations.

How to eliminate wrong answers

Option A is wrong because simply enabling SSE-KMS on the S3 bucket and specifying the ARN of the KMS key from Account B does not automatically grant Account A the necessary permissions; the KMS key policy in Account B must explicitly allow Account A to use the key. Option B is wrong because updating only the KMS key policy in Account B is insufficient; the S3 bucket policy in Account A must also allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 performs the encryption/decryption on behalf of the requester. Option D is wrong because updating only the S3 bucket policy to allow s3:PutObject with kms:Encrypt permission does not grant Account A access to the KMS key in Account B; the KMS key policy must also be updated to allow Account A to use the key.

Practice this question →

436

Matchingmedium

Match each AWS security service to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Protect web applications from common exploits

Enhanced DDoS protection for critical workloads

Create and manage encryption keys

Rotate and manage secrets securely

Manage user identities and permissions

Why these pairings

Security services address different aspects of threat protection and access control.

Practice this question →

437

MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

A.Use the awslogs log driver in the task definition and specify the log group.

B.Install and configure the CloudWatch agent in the container image.

C.Output logs to stdout/stderr and use a Lambda function to push them.

D.Configure a sidecar container running the CloudWatch agent.

AnswerA

The awslogs log driver is the native integration for ECS and Fargate to send logs to CloudWatch.

Why this answer

The awslogs log driver is the native, built-in mechanism for Amazon ECS tasks using the Fargate launch type to send container logs directly to CloudWatch Logs. By specifying the 'awslogs' log driver in the task definition and providing the log group name, ECS automatically streams stdout and stderr from the container to the specified CloudWatch log group without requiring any additional agents or infrastructure.

Exam trap

The trap here is that candidates often over-engineer the solution by thinking a separate agent or sidecar is required for log shipping, when in fact the awslogs log driver is the simplest and most efficient native integration for ECS with Fargate.

How to eliminate wrong answers

Option B is wrong because installing the CloudWatch agent inside the container image is unnecessary and adds complexity; the awslogs log driver handles log shipping natively at the container runtime level. Option C is wrong because using a Lambda function to push logs from stdout/stderr is an overly complex, non-standard approach that introduces latency and potential data loss, whereas the awslogs driver streams logs in real time. Option D is wrong because a sidecar container running the CloudWatch agent is redundant and consumes additional resources; the awslogs log driver is the recommended and simpler method for Fargate tasks.

Practice this question →

438

MCQhard

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

A.Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.

B.Use Amazon Aurora Global Database.

C.Use Amazon RDS with automated backups and restore in another Region.

D.Use Amazon RDS Multi-AZ with a standby in a different AWS Region.

AnswerA

Cross-Region read replicas use asynchronous replication with minimal lag, and can be promoted quickly, meeting the RPO/RTO requirements.

Why this answer

Amazon RDS for MySQL cross-Region read replicas use asynchronous replication with a typical lag of less than 5 seconds, meeting the RPO requirement. In a disaster, you promote the replica to a standalone primary instance, which takes under 1 minute, satisfying the RTO. This is the only option that provides both sub-5-second RPO and sub-1-minute RTO for RDS MySQL.

Exam trap

The trap here is that candidates confuse Amazon Aurora Global Database (which is not available for RDS MySQL) with RDS cross-Region replicas, or assume Multi-AZ can be configured across Regions, which is technically impossible.

How to eliminate wrong answers

Option B is wrong because Amazon Aurora Global Database uses a dedicated storage-based replication layer that can achieve sub-1-second RPO, but it is not compatible with Amazon RDS for MySQL; it requires Aurora MySQL. Option C is wrong because automated backups have a default RPO of 5 minutes (or up to 35 days of retention) and restoring in another Region typically takes 15 minutes or more, far exceeding the 1-minute RTO. Option D is wrong because Amazon RDS Multi-AZ with a standby in a different Region is not supported; Multi-AZ replicas must be in the same AWS Region, and cross-Region failover is not possible.

Practice this question →

439

Multi-Selectmedium

A company is building a new application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which two AWS services or features meet these requirements?

Select 2 answers

A.Amazon Aurora DB cluster with multiple Availability Zones

B.Amazon RDS Multi-AZ deployment

C.Amazon RDS Single-AZ deployment with automated backups

D.Amazon DynamoDB with global tables

E.Amazon RDS Read Replica

AnswersA, B

Aurora automatically fails over to a replica in another AZ.

Why this answer

Amazon Aurora DB cluster with multiple Availability Zones meets the requirements because Aurora automatically replicates data across three Availability Zones by default, providing high availability and automatic failover with minimal downtime (typically under 30 seconds). Aurora's distributed storage layer allows the primary instance to fail over to a read replica in another AZ without data loss, making it ideal for applications requiring a relational database with multi-AZ high availability.

Exam trap

The trap here is that candidates may overlook the 'relational database' requirement and select DynamoDB (a NoSQL service) or assume that RDS Read Replica provides automatic failover, when in fact it requires manual promotion and does not meet the minimal downtime requirement.

Practice this question →

440

MCQeasy

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

A.Use Amazon API Gateway with VPC Link

B.Use an Application Load Balancer with target groups per service

C.Use Amazon Route 53 with weighted routing policies

D.Use AWS App Mesh with Envoy sidecars

AnswerD

App Mesh provides traffic splitting and observability for canary deployments.

Why this answer

AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) or load balancer-level routing (ALB) with the application-layer traffic management needed for canary deployments, overlooking that only a service mesh like App Mesh provides the granular, proxy-based control required for HTTP traffic splitting without operational overhead.

How to eliminate wrong answers

Option A is wrong because Amazon API Gateway with VPC Link is designed for external API management and routing to private VPC resources, not for internal service-to-service communication within a microservices architecture, and it adds unnecessary latency and complexity for internal calls. Option B is wrong because an Application Load Balancer with target groups per service can route traffic but does not natively support canary deployments with weighted traffic splitting across service versions; it requires external tooling or custom scripting for gradual rollouts. Option C is wrong because Amazon Route 53 with weighted routing policies operates at the DNS level, which cannot handle HTTP-level traffic routing, session affinity, or fine-grained canary percentages, and DNS caching can cause uneven traffic distribution during deployments.

Practice this question →

441

MCQeasy

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

A.Configure S3 to send event notifications to the Lambda function directly

B.Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

C.Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

D.Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

AnswerA

S3 event notifications can directly invoke Lambda functions.

Why this answer

Amazon S3 can directly invoke an AWS Lambda function via event notifications when a new object is created. This is the simplest and most direct integration, requiring no intermediate services. S3 publishes an event to Lambda, which then executes the function synchronously, ensuring near-real-time processing of uploaded files.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing intermediate services like SNS or SQS, not realizing that S3 can directly invoke Lambda with no additional components, which is the simplest and most cost-effective design.

How to eliminate wrong answers

Option B is wrong because while S3 can send notifications to an SNS topic, and SNS can trigger Lambda, this adds unnecessary complexity and latency; the direct S3-to-Lambda integration is simpler and more efficient for this use case. Option C is wrong because S3 can send notifications to an SQS queue, but Lambda would need to poll the queue, introducing polling overhead and potential delays; the requirement is for immediate triggering, not polling. Option D is wrong because S3 does not natively send event notifications to Amazon CloudWatch Events (now Amazon EventBridge); while EventBridge can receive S3 events via CloudTrail or S3 event notifications, this is an indirect path and not the standard configuration for triggering Lambda directly from S3 object creation.

Practice this question →

442

Multi-Selecthard

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Select 3 answers

A.Use AWS Secrets Manager to store and rotate service credentials.

B.Configure mutual TLS (mTLS) between services using certificates from ACM.

C.Enable ECS Service Connect between services for automatic DNS and TLS encryption.

D.Deploy an API Gateway in front of each microservice.

E.Use IAM roles for tasks and attach policies that allow access to other services.

AnswersA, C, E

Secrets Manager securely stores credentials for database or API keys.

Why this answer

AWS Secrets Manager provides a secure way to store and automatically rotate service credentials (such as database passwords or API keys) used by microservices running on ECS Fargate. This eliminates hard-coded secrets and reduces the risk of credential exposure, aligning with security best practices for service-to-service authentication.

Exam trap

The trap here is that candidates may confuse mTLS with standard TLS or assume ACM can be used for internal mTLS, but ACM does not support issuing client certificates for service-to-service mutual authentication in ECS Fargate.

Practice this question →

443

MCQeasy

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

A.Amazon S3

B.Amazon ElastiCache for Memcached

C.Amazon RDS for PostgreSQL

D.Amazon DynamoDB

AnswerD

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, with built-in high availability and durability, making it the best choice for this use case.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It is designed for low-latency, high-availability access, making it ideal for storing and retrieving user preferences in a key-value format. Option A: Amazon S3 is object storage, not a key-value store, and is not optimized for low-latency reads and writes for small objects.

Option B: Amazon ElastiCache for Memcached is an in-memory key-value store, but it is not persistent and typically used for caching, not as a primary data store for persistent user preferences. Option C: Amazon RDS for PostgreSQL is a relational database, which requires schema definition and is not optimized for simple key-value access patterns.

Practice this question →

444

MCQmedium

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

A.Use Amazon SQS to buffer the requests and set a Lambda reserved concurrency to limit the processing rate

B.Increase the Lambda function timeout and retry on failure

C.Configure a Lambda function destination on failure to reprocess

D.Use Amazon SNS to fan out the notification to multiple Lambda functions

AnswerA

SQS can buffer requests and Lambda reserved concurrency can limit concurrency, effectively throttling the rate.

Why this answer

Amazon SQS acts as a durable buffer that decouples the S3 event from the Lambda invocation, allowing the function to poll messages at a controlled rate. By setting a Lambda reserved concurrency, you limit the number of concurrent executions, which directly caps the processing rate to stay within the external API's 10 requests per second limit. This combination ensures that the Lambda function does not exceed the API's throttling threshold while still processing all events reliably.

Exam trap

The trap here is that candidates often choose SNS fan-out (Option D) thinking it improves throughput, but they fail to recognize that it amplifies concurrency and worsens throttling, whereas SQS with reserved concurrency provides controlled, decoupled processing.

How to eliminate wrong answers

Option B is wrong because increasing the Lambda function timeout does not control the invocation rate; it only extends the maximum execution duration, which does not prevent bursts of concurrent invocations from exceeding the API rate limit. Option C is wrong because configuring a Lambda function destination on failure to reprocess only handles individual invocation errors (e.g., code exceptions) but does not address rate-based throttling from the external API; it would still allow excessive concurrent requests. Option D is wrong because using Amazon SNS to fan out notifications to multiple Lambda functions would increase the number of concurrent invocations, making the throttling problem worse instead of solving it.

Practice this question →

445

Multi-Selecthard

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

Select 3 answers

A.Shared database schema across services

B.Circuit breaker pattern to handle service failures

C.Synchronous RESTful HTTP calls between services

D.Event-driven communication using Amazon SNS and SQS

E.API Gateway as a facade for service endpoints

AnswersB, D, E

Circuit breakers isolate failures, allowing services to degrade gracefully without impacting others.

Why this answer

The circuit breaker pattern (B) prevents cascading failures by monitoring for failures and opening the circuit to stop calls to an unhealthy service, allowing it time to recover. This supports loose coupling because the caller does not need to know the internal state of the downstream service, and it enables independent deployability by isolating failures during deployment or scaling events.

Exam trap

The trap here is that candidates often confuse synchronous RESTful calls (C) as a valid pattern for loose coupling, but in reality, synchronous calls create tight temporal coupling and reduce independent deployability, whereas event-driven and facade patterns (D and E) are the correct approaches.

Practice this question →

446

MCQeasy

A company wants to deploy a new web application on AWS that uses a microservices architecture. The company expects rapid growth and wants to decouple services to allow independent scaling and development. The team wants to use Docker containers for consistency across environments. Which solution should a Solutions Architect recommend?

A.Use Amazon Lightsail containers to deploy each microservice as a container service.

B.Deploy each microservice on separate EC2 instances behind an Application Load Balancer.

C.Use Amazon ECS with Fargate to run each microservice as a separate task definition, with service auto scaling.

D.Use AWS Elastic Beanstalk with Docker platform to deploy each microservice as a separate environment.

AnswerC

ECS with Fargate is a fully managed container service that decouples services and scales independently.

Why this answer

Amazon ECS with Fargate is a fully managed container orchestration service that allows each microservice to run as a separate task definition, enabling independent scaling and decoupling. Fargate eliminates the need to manage underlying EC2 instances, aligning with the requirement for Docker containers and microservices architecture.

Option A is incorrect because Amazon Lightsail containers are designed for simpler workloads and lack the advanced orchestration, scaling, and networking features required for a microservices architecture at scale.

Option B is incorrect because deploying each microservice on separate EC2 instances does not leverage containerization, leading to resource inefficiency and management overhead. An Application Load Balancer can distribute traffic but does not provide the independent scaling and isolation that containers offer.

Option D is incorrect because AWS Elastic Beanstalk with Docker platform abstracts container management but imposes a PaaS model that may limit granular control over individual microservices. It is less suitable for decoupled microservices that require independent deployment and scaling compared to ECS with Fargate.

Practice this question →

447

Multi-Selecteasy

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

Select 2 answers

A.Use an Auto Scaling group to launch instances only in one Availability Zone.

B.Use a Network Load Balancer instead of ALB for better performance.

C.Launch EC2 instances in at least two Availability Zones.

D.Configure the ALB to be internet-facing and register instances from multiple AZs.

E.Launch all EC2 instances in a single Availability Zone for low latency.

AnswersC, D

Multiple AZs provide fault tolerance if one AZ fails.

Why this answer

Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the application continues to run from the other AZ, providing fault tolerance and high availability. Option D is correct because configuring the ALB to be internet-facing and registering instances from multiple AZs allows the ALB to distribute incoming traffic across healthy instances in different AZs, automatically rerouting traffic if an AZ becomes impaired.

Exam trap

The trap here is that candidates often think a single AZ with Auto Scaling is sufficient for high availability, but true fault tolerance requires distributing resources across multiple AZs to survive an AZ-level failure.

Practice this question →

448

MCQeasy

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

A.Amazon SQS

B.Amazon SNS

C.Amazon Kinesis

D.AWS Step Functions

AnswerA

SQS provides a reliable message queue.

Why this answer

Amazon SQS is the best choice for decoupling a web application frontend from a backend processing service because it provides a fully managed message queue that allows the frontend to send jobs (messages) asynchronously without waiting for the backend to process them. The backend can poll the queue at its own pace, ensuring reliable, scalable, and fault-tolerant communication between the two components. SQS supports standard queues for high throughput and FIFO queues for exactly-once processing, making it ideal for decoupling asynchronous workloads.

Exam trap

The trap here is that candidates often confuse SNS (push-based pub/sub) with SQS (pull-based queue) for decoupling, failing to recognize that asynchronous job processing requires the backend to pull messages, not receive pushes, and that SNS alone does not provide a buffer for unprocessed jobs.

How to eliminate wrong answers

Option B (Amazon SNS) is wrong because SNS is a pub/sub messaging service that pushes messages to multiple subscribers, not a queue; it does not provide the decoupling needed for asynchronous job processing where the backend pulls messages at its own pace. Option C (Amazon Kinesis) is wrong because Kinesis is designed for real-time streaming data ingestion and processing (e.g., logs, metrics), not for decoupling discrete job requests between a frontend and backend; it introduces complexity and cost overhead for simple job queues. Option D (AWS Step Functions) is wrong because Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue; it is used for stateful workflows, not for decoupling frontend and backend via asynchronous message passing.

Practice this question →

449

MCQhard

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

A.AWS Cloud Map

B.Amazon ECS service connect

C.Elastic Load Balancing with internal NLB

D.Amazon Route 53 private hosted zones with health checks

AnswerA

Cloud Map automatically manages service discovery.

Why this answer

AWS Cloud Map provides service discovery that automatically updates with service scaling.

Practice this question →

450

Multi-Selecteasy

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Select 2 answers

A.AWS Secrets Manager.

B.Amazon S3 with bucket policies.

C.IAM roles for EC2 instances.

D.EC2 user data scripts.

E.AWS Systems Manager Parameter Store.

AnswersC, E

IAM roles allow instances to access Parameter Store without credentials.

Why this answer

And E. IAM roles for EC2 instances (C) allow EC2 to securely access other AWS services without hardcoding credentials. AWS Systems Manager Parameter Store (E) provides secure, hierarchical storage for configuration data and secrets.

Together, they enable EC2 to retrieve configuration data like database credentials and API keys at runtime without embedding secrets in code or user data. Option A (Secrets Manager) is also valid for secrets, but the question asks for two services, and the marked correct pair is C and E. Option B (S3 with bucket policies) is insecure for secrets, and option D (EC2 user data) is not secure for credentials.

Practice this question →