CCNA New Solutions Questions — Page 3 of 7

151

MCQmedium

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

A.Amazon S3

B.Amazon ElastiCache for Memcached

C.Amazon RDS for MySQL

D.Amazon DynamoDB

AnswerD

DynamoDB offers low latency, high availability, and is suitable for small configuration data.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for frequently accessed configuration data under 10 KB. It provides built-in high availability and durability by automatically replicating data across three Availability Zones in an AWS Region, meeting the requirement for multi-AZ resilience without manual setup.

Exam trap

The trap here is that candidates often choose Amazon S3 for any 'storage' need without considering latency requirements, or they pick ElastiCache thinking it provides durable storage, when in fact DynamoDB is the only option that combines low latency, high availability across AZs, and native persistence for small configuration items.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service designed for larger objects (minimum 0 bytes, but optimal for >128 KB) and while it can store small items, its latency is higher (typically tens to hundreds of milliseconds) and it is not optimized for frequent, low-latency reads of sub-10 KB configuration data. Option B is wrong because Amazon ElastiCache for Memcached is an in-memory cache that does not provide native persistence or high availability across multiple Availability Zones without additional configuration (e.g., using a cluster with replication, which Memcached does not support natively); it is intended for caching, not as a durable data store for configuration. Option C is wrong because Amazon RDS for MySQL is a relational database that introduces overhead from SQL parsing, connection management, and schema design, and while it can be made multi-AZ, it is overkill for simple key-value configuration data and does not offer the single-digit millisecond latency of DynamoDB for this use case.

Practice this question →

152

MCQhard

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

A.Use API Gateway's WebSocket API.

B.Enable API Gateway's VPC Link.

C.Configure a Lambda authorizer to validate the OAuth 2.0 token.

D.Use usage plans with API keys.

AnswerC

Lambda authorizer can call the IdP to validate tokens and return an IAM policy.

Why this answer

A Lambda authorizer (formerly known as a custom authorizer) allows API Gateway to call a Lambda function that validates the OAuth 2.0 token (e.g., JWT) from the external IdP. This offloads authentication logic from the backend Lambda to API Gateway, enabling centralized token validation before the request reaches the integration.

Exam trap

The trap here is that candidates confuse API keys (which identify the client application) with OAuth 2.0 tokens (which authenticate the end user), leading them to incorrectly select usage plans with API keys.

How to eliminate wrong answers

Option A is wrong because WebSocket APIs are used for bidirectional, stateful communication (e.g., real-time chat), not for RESTful API authentication with OAuth 2.0. Option B is wrong because VPC Link enables private integration between API Gateway and resources inside a VPC (e.g., an internal NLB), but it has nothing to do with authentication or token validation. Option D is wrong because usage plans with API keys are for rate limiting and API monetization, not for authenticating users via OAuth 2.0 tokens; API keys identify the client application, not the end user.

Practice this question →

153

Multi-Selecthard

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Select 3 answers

A.AWS Certificate Manager (ACM)

B.Amazon Route 53

C.AWS Direct Connect

D.AWS App Mesh

E.AWS Cloud Map

AnswersA, D, E

ACM provides certificates for mTLS.

Why this answer

AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's public DNS capabilities with the internal service discovery provided by AWS Cloud Map, or they assume Direct Connect is needed for secure communication, overlooking that mTLS is handled at the application layer by App Mesh and ACM.

Practice this question →

154

MCQmedium

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

A.Amazon Simple Notification Service (SNS)

B.AWS Secrets Manager

C.AWS Systems Manager Parameter Store

D.CloudFormation cross-stack references using Export and ImportValue

AnswerD

Exports allow passing outputs to other stacks.

Why this answer

CloudFormation cross-stack references using the `Export` output attribute and the `Fn::ImportValue` intrinsic function allow you to pass output values from one stack as parameters to another stack within the same AWS account and region. This is the native, recommended mechanism for sharing stack outputs without introducing external services or additional complexity.

Exam trap

The trap here is that candidates may confuse Parameter Store (a general-purpose parameter store) with CloudFormation's native cross-stack reference feature, overlooking that the question explicitly asks for passing outputs between CloudFormation stacks, which is directly solved by `Export` and `ImportValue`.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service used for notifications and event-driven workflows, not for storing or passing CloudFormation stack outputs as parameters. Option B is wrong because AWS Secrets Manager is designed to securely store and rotate secrets (e.g., database credentials, API keys), not to pass CloudFormation outputs between stacks. Option C is wrong because AWS Systems Manager Parameter Store can store configuration data and secrets, but it is not the native CloudFormation mechanism for cross-stack references; using it would require custom logic to write outputs to Parameter Store and then read them in the other stack, adding unnecessary overhead and violating the principle of using built-in CloudFormation features.

Practice this question →

155

MCQmedium

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

A.Access is allowed because the Principal is "*".

B.Access is denied because the bucket is not public.

C.Access is allowed because the policy does not explicitly deny.

D.Access is denied because the IP is not allowed.

AnswerD

The policy restricts access to the specified IP range.

Why this answer

The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Exam trap

The trap here is that candidates often assume a bucket policy with Principal '*' automatically allows all access, ignoring the condition block that can restrict access based on IP address or other attributes.

How to eliminate wrong answers

Option A is wrong because the Principal '*' in the policy does not grant access unconditionally; the policy includes a condition that restricts access to a specific IP address range, and the user's IP (198.51.100.5) is not in that range. Option B is wrong because the bucket policy itself can grant access without making the bucket publicly accessible; the bucket's block public access settings are not mentioned, and the policy's explicit deny is the reason for denial, not the bucket's public status. Option C is wrong because the policy does explicitly deny access via the condition block; the 'Effect' is 'Deny' for requests that do not match the allowed IP range, so the lack of an explicit deny statement is incorrect.

Practice this question →

156

Multi-Selectmedium

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Select 2 answers

A.Create a manual snapshot and copy it to another Region.

B.Enable automated backups and copy them to another Region.

C.Use S3 cross-Region replication for the database.

D.Configure a cross-Region read replica.

E.Enable Multi-AZ deployment.

AnswersB, D

Cross-Region backup copy enables restore in another region.

Why this answer

The correct answers are B and D. Option B enables automated backups of the RDS instance and copies them to another region, allowing point-in-time restoration in a different region for disaster recovery. Option D creates a cross-Region read replica, which serves as a standby database in another region for DR and also offloads read traffic.

Option A (manual snapshot) requires manual effort and scheduling, not automated. Option C (S3 cross-Region replication) does not apply to RDS database backups. Option E (Multi-AZ) provides high availability within a single region but not across regions.

Practice this question →

157

Multi-Selectmedium

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

Select 2 answers

A.Set Lambda reserved concurrency to a value that matches the expected peak load.

B.Increase the Lambda function timeout to 15 minutes.

C.Enable usage plans and throttling in API Gateway to limit requests.

D.Use Amazon SQS to buffer requests and decouple the frontend.

E.Configure Lambda provisioned concurrency to pre-warm instances.

AnswersA, C

Reserved concurrency limits the maximum concurrent executions, preventing throttling and uncontrolled scaling.

Why this answer

Lambda reserved concurrency guarantees a fixed number of concurrent executions for the function, preventing it from being throttled by other functions in the account. By setting reserved concurrency to match the expected peak load, the application ensures that all requests during the flash sale can be processed without hitting account-level concurrency limits.

Exam trap

The trap here is that candidates often confuse provisioned concurrency (which reduces cold starts) with reserved concurrency (which guarantees capacity and prevents throttling), leading them to select Option E instead of Option A.

Practice this question →

158

MCQmedium

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

A.AWS CloudHSM

B.AWS Identity and Access Management (IAM) roles

C.AWS Systems Manager Parameter Store

D.AWS Secrets Manager

AnswerD

Secrets Manager provides built-in automatic rotation for RDS, Redshift, and DocumentDB credentials.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing the lifecycle of database credentials. It integrates natively with Amazon ECS and Fargate via task role permissions, allowing containers to retrieve secrets at runtime without hardcoding them. Secrets Manager also supports automatic rotation of credentials for Amazon RDS, Aurora, and other databases, which directly addresses the requirement for credential rotation.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets) with AWS Secrets Manager, but Parameter Store lacks native automatic rotation and is not designed for managing database credential lifecycles, making Secrets Manager the correct choice for this specific requirement.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides hardware-based cryptographic key storage and cryptographic operations, not a service for storing or rotating database credentials; it lacks built-in automatic rotation and secret management features. Option B is wrong because IAM roles provide temporary credentials for AWS API access but cannot store or rotate database credentials; they are used for authorization, not secret storage. Option C is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation of database credentials; it requires custom solutions (e.g., Lambda functions) to implement rotation, whereas Secrets Manager provides built-in rotation.

Practice this question →

159

MCQmedium

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

A.Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.

B.Request a service quota increase for Lambda concurrent executions.

C.Set a reserved concurrency of 500 for the Lambda function.

D.Increase the Lambda function timeout to more than 30 seconds.

AnswerA

Each shard is processed by a single Lambda instance; if processing takes too long, the iterator age grows and records may expire.

Why this answer

The primary consideration is to ensure that the Lambda function processes each batch within the Kinesis stream's iterator age (default 7 days). With 5,000 records/sec across 10 shards, each shard receives 500 records/sec. If each record takes 30 seconds to process, the Lambda function must process records faster than they arrive to avoid falling behind and exceeding the iterator age, which would cause data loss.

The iterator age metric tracks how far behind the consumer is, and if it grows unbounded, records will expire before being processed.

Exam trap

The trap here is that candidates focus on Lambda's concurrency limits or timeouts, but the real bottleneck is the iterator age and the inability to process records faster than they arrive per shard, which is a fundamental scaling constraint in Kinesis-Lambda integrations.

How to eliminate wrong answers

Option B is wrong because requesting a service quota increase for Lambda concurrent executions is not the primary consideration; the default concurrent execution quota (1,000) is sufficient for this workload (10 shards × 5 concurrent batches per shard = 50 concurrent executions, well under the limit). Option C is wrong because setting a reserved concurrency of 500 would artificially cap the function's scaling and could cause throttling, as the function needs to scale dynamically based on shard throughput, not be limited to a fixed number. Option D is wrong because increasing the Lambda function timeout to more than 30 seconds does not address scaling; the timeout only affects how long a single invocation can run, not the ability to handle the sustained load of 5,000 records/sec across 10 shards.

Practice this question →

160

MCQmedium

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

A.Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, Amazon Kinesis Data Firehose

B.Amazon SQS, AWS Lambda, Amazon S3

C.Amazon Kinesis Data Streams, Amazon Redshift, Amazon S3

D.Amazon IoT Core, AWS Lambda, Amazon DynamoDB

AnswerA

Correct. Amazon Kinesis Data Streams can ingest millions of messages per second, Kinesis Data Analytics performs real-time processing, and Kinesis Data Firehose delivers the processed data to S3 with low latency.

Why this answer

Kinesis Data Streams ingests high-throughput data, Kinesis Data Analytics processes it in real-time, and Kinesis Data Firehose delivers the results to S3. Option B uses SQS, which is not designed for millions of messages per second, and Lambda may throttle under high load. Option C uses Redshift, which is a data warehouse; while streaming data can be loaded into Redshift, it is not a real-time streaming destination and typically requires Firehose.

Option D uses IoT Core for ingestion, but DynamoDB is not optimized for storing large analytical results; S3 would be more appropriate.

Practice this question →

161

MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use for message brokering?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Streams

D.AWS Step Functions

AnswerA

SQS provides fully managed message queues for async communication.

Why this answer

Option A (Amazon SQS) is correct because SQS provides a fully managed message queuing service for asynchronous communication between microservices, enabling decoupling. Option B (Amazon SNS) is a pub/sub notification service, not a queue. Option C (Amazon Kinesis Data Streams) is for real-time streaming data.

Option D (AWS Step Functions) is for workflow orchestration.

Practice this question →

162

Multi-Selectmedium

Which TWO actions improve the security of an Amazon S3 bucket that stores sensitive data?

Select 2 answers

A.Enable CORS (Cross-Origin Resource Sharing).

B.Enable S3 server access logging.

C.Enable S3 Block Public Access.

D.Enable S3 Transfer Acceleration.

E.Use a bucket policy that denies access to all principals except the root user.

AnswersB, C

Provides audit trail for access requests.

Why this answer

Enabling S3 Block Public Access (Option C) is a critical security control that prevents any public access to the bucket, regardless of bucket policies or object ACLs, effectively eliminating the risk of unintended data exposure. Enabling S3 server access logging (Option B) records all requests made to the bucket, providing an audit trail that can be used to detect unauthorized access attempts, troubleshoot security events, and meet compliance requirements. Both actions directly enhance the security posture of a bucket storing sensitive data.

Exam trap

The SAP-C02 exam often tests the misconception that enabling S3 Transfer Acceleration or CORS improves security, when in fact they are performance and cross-origin features respectively, not security controls.

Practice this question →

163

MCQhard

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

A.Objects are locked indefinitely until the lock is manually removed.

B.Objects can be deleted immediately because versioning is enabled.

C.Objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

D.Objects can be deleted only by the root user.

AnswerC

Object Lock with GOVERNANCE mode and 365-day retention prevents deletion.

Why this answer

The configuration shown enables S3 Object Lock in governance mode with a retention period of 365 days. In governance mode, an object cannot be deleted or overwritten until the retention period expires, unless the user has special permissions such as s3:BypassGovernanceRetention. This is why option C is correct: objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

Exam trap

The trap here is that candidates often assume the root user can bypass any S3 lock, but in compliance mode, even the root user is restricted, making option D a common distractor.

How to eliminate wrong answers

Option A is wrong because objects are not locked indefinitely; they are locked for a specific retention period of 365 days, after which the lock expires and the object can be deleted or overwritten normally. Option B is wrong because even with versioning enabled, S3 Object Lock in compliance mode prevents deletion of any version of the object during the retention period; versioning does not override the lock. Option D is wrong because the root user is also subject to compliance mode locks; no user, including the root user, can delete or overwrite the object during the retention period.

Practice this question →

164

Multi-Selectmedium

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

Select 2 answers

A.Create an AWS WAF web ACL and attach it to the Lambda function

B.Configure API Gateway to require an API key and associate WAF with the usage plan

C.Associate an AWS WAF web ACL with the API Gateway HTTP API

D.Associate an AWS WAF web ACL with the API Gateway REST API stage

E.Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint

AnswersC, D

WAF can be associated with HTTP APIs.

Why this answer

AWS WAF can be directly associated with an API Gateway HTTP API to filter and monitor HTTP requests based on rules in a web ACL. Option D is correct because AWS WAF can also be directly associated with a specific stage of an API Gateway REST API, providing granular security at the API stage level.

Exam trap

The trap here is that candidates may think WAF must be attached to a CloudFront distribution or a Lambda function, but AWS WAF directly supports association with both API Gateway REST API stages and HTTP APIs without requiring CloudFront.

Practice this question →

165

MCQeasy

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

A.S3 Object Lock

B.S3 Transfer Acceleration

C.S3 Event Notifications

D.S3 Inventory

AnswerC

S3 can send events to Lambda on object creation.

Why this answer

S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Exam trap

The trap here is that candidates may confuse S3 Event Notifications with S3 Inventory or S3 Object Lock, thinking any S3 feature that 'tracks' or 'protects' objects can trigger code, but only Event Notifications provide real-time, push-based triggers to Lambda.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock is a write-once-read-many (WORM) feature that prevents objects from being deleted or overwritten for a fixed retention period; it does not trigger Lambda functions. Option B is wrong because S3 Transfer Acceleration uses AWS edge locations to speed up uploads over long distances via optimized network paths; it has no event triggering capability. Option D is wrong because S3 Inventory provides scheduled CSV/Parquet reports listing objects and their metadata for auditing or lifecycle management; it does not generate real-time events to invoke Lambda.

Practice this question →

166

MCQhard

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

A.Use Amazon RDS Proxy with a single database

B.Use a separate Amazon RDS instance for each microservice

C.Use Amazon DynamoDB for all microservices

D.Use a single Amazon RDS instance shared across all microservices

AnswerB

Database-per-service pattern ensures loose coupling.

Why this answer

A microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Exam trap

The trap here is that candidates may assume a single shared database (Option D) is simpler and sufficient for high availability, overlooking the critical microservices principle of decentralized data management and the operational overhead of tight coupling.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Proxy is a connection pooling service that does not address the need for database isolation; sharing a single database across microservices creates tight coupling and a single point of failure. Option C is wrong because Amazon DynamoDB is a NoSQL database that does not natively support complex relational queries (e.g., multi-table joins, subqueries) required by the existing application, making it unsuitable for this migration. Option D is wrong because using a single Amazon RDS instance shared across all microservices reintroduces the monolithic database bottleneck, violates the principle of database per service, and increases the risk of contention and cascading failures.

Practice this question →

167

MCQeasy

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

A.Amazon Kinesis Data Firehose, Amazon Redshift

B.Amazon SQS, AWS Lambda, Amazon RDS

C.AWS IoT Core, Amazon DynamoDB

D.Amazon Kinesis Data Streams, AWS Lambda, Amazon S3

AnswerD

Real-time ingestion, processing, and storage.

Why this answer

Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (which delivers near-real-time batches) with Kinesis Data Streams (which enables per-record real-time processing), leading them to pick Option A despite its lack of a real-time processing component.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse for analytics, not a real-time processing engine, and Kinesis Data Firehose delivers data in batches, not per-record processing. Option B is wrong because Amazon SQS is a message queue for decoupling components, not designed for real-time streaming ingestion, and Amazon RDS is a relational database, not suitable for high-throughput streaming data storage. Option C is wrong because AWS IoT Core ingests IoT messages but DynamoDB is a NoSQL database for low-latency queries, not a long-term analytics store like S3, and this combination lacks a real-time processing step.

Practice this question →

168

MCQhard

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

A.Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling

B.Use Amazon SQS standard queues with Lambda function and a dead-letter queue

C.Use Amazon SQS FIFO queues with Lambda function

D.Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue

AnswerD

Kinesis preserves order within shards; Lambda processes records sequentially; DLQ handles failures.

Why this answer

Amazon Kinesis Data Streams preserves the order of records within a shard, which maps to each device's stream when using a partition key like device ID. The Lambda function processes records from the stream, and a dead-letter queue captures any records that fail after the retry policy is exhausted, ensuring no data loss. This combination meets the requirements for ordered processing per device and fault tolerance without data loss.

Exam trap

The trap here is that candidates often assume SQS FIFO queues are the only way to guarantee ordering, but they overlook the throughput limitations and the fact that Kinesis Data Streams is designed for high-throughput, ordered stream processing with Lambda, making it the better fit for IoT-scale workloads.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose does not guarantee record ordering within a stream and is designed for near-real-time delivery to destinations like S3, not for ordered processing with Lambda; the SQS queue for error handling adds unnecessary complexity and does not solve the ordering requirement. Option B is wrong because Amazon SQS standard queues do not guarantee FIFO (first-in, first-out) delivery, so messages from the same device could be processed out of order, violating the ordering requirement. Option C is wrong because while Amazon SQS FIFO queues guarantee order within a message group, they have a throughput limit of 300 transactions per second (with batching) and do not natively support the high-throughput, ordered stream processing needed for thousands of IoT devices; Kinesis Data Streams scales better for this use case.

Practice this question →

169

MCQmedium

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

A.Amazon CloudFront and AWS Shield

B.AWS Global Accelerator and Amazon CloudFront

C.Amazon Route 53 and AWS Shield

D.AWS WAF and Amazon CloudFront

AnswerA

CloudFront caches content at edge, Shield protects against DDoS.

Why this answer

Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with a CDN, but Global Accelerator does not cache content—it only optimizes network routing, making it unsuitable for content delivery without CloudFront.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator improves latency by directing traffic over the AWS global network to the optimal endpoint, but it does not provide content caching or DDoS protection at the edge; it is not a CDN. Option C is wrong because Amazon Route 53 is a DNS service that routes traffic but does not cache content or provide low-latency content delivery; AWS Shield alone does not offer CDN capabilities. Option D is wrong because AWS WAF is a web application firewall that filters HTTP/S requests but does not provide low-latency content caching or global edge distribution; it must be combined with CloudFront for CDN functionality, but the option omits Shield for DDoS protection.

Practice this question →

170

MCQhard

A company is designing a new global application that will serve users worldwide. The application uses an Application Load Balancer (ALB) in a single region. To reduce latency for users in other regions, the company wants to cache static content at edge locations. The dynamic content must still be served from the ALB. Which configuration should be used?

A.AWS Global Accelerator with the ALB as the endpoint

B.Amazon CloudFront with the ALB as the origin

C.Amazon CloudFront with multiple origins: S3 for static content and ALB for dynamic content

D.Amazon S3 Transfer Acceleration for static content

AnswerC

CloudFront can be configured with multiple origins. Static content is cached at edge locations from S3, and dynamic content is forwarded to the ALB. This reduces latency for static content.

Why this answer

It uses Amazon CloudFront with multiple origins: an S3 bucket for static content (cached at edge locations) and the ALB for dynamic content (forwarded to the origin). This configuration meets the requirement to reduce latency for static assets via edge caching while ensuring dynamic requests are always served from the ALB, avoiding stale or incorrect responses.

Exam trap

The trap here is that candidates often assume CloudFront with a single ALB origin can handle both static and dynamic content by simply enabling caching, but they overlook that caching dynamic content can lead to serving stale data; the correct solution requires separate origins and path-based routing to isolate caching behavior.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network but does not cache content at edge locations; it only optimizes network path and provides static IP addresses, not content caching. Option B is wrong because using CloudFront with only the ALB as the origin would cache both static and dynamic content at the edge, which can cause stale dynamic responses and violates the requirement that dynamic content must be served from the ALB (unless you configure cache behaviors to bypass caching for dynamic paths, but the option does not specify this and is not the best practice for mixed content). Option D is wrong because Amazon S3 Transfer Acceleration only speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache content for delivery to end users; it is a transfer optimization feature, not a content delivery network.

Practice this question →

171

MCQmedium

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

A.Amazon S3 Intelligent-Tiering

B.Amazon S3 Glacier Deep Archive

C.Amazon S3 Glacier with expedited retrieval

D.Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year

AnswerB

Lowest cost, retrieval within 12 hours, suitable for 7-year retention.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that must be retained for 7 years and retrieved within 24 hours, as it offers the lowest storage cost among AWS storage options while supporting retrieval times of 12–24 hours via standard retrieval. The 10 TB/year volume (70 TB total) and 24-hour retrieval window align perfectly with Glacier Deep Archive's design for long-term archival data that is rarely accessed.

Exam trap

The trap here is that candidates confuse 'retrievable within 24 hours' with 'needs fast retrieval' and choose Glacier with expedited retrieval (Option C), failing to recognize that Glacier Deep Archive's standard retrieval (12–24 hours) meets the requirement at a fraction of the cost.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering is designed for data with unknown or changing access patterns and incurs monitoring and automation fees that make it more expensive than Glacier Deep Archive for purely archival data with no frequent access needs. Option C is wrong because S3 Glacier with expedited retrieval (1–5 minutes) is significantly more expensive per GB than Glacier Deep Archive, and the 24-hour retrieval requirement does not justify the premium cost of expedited access. Option D is wrong because storing data in S3 Standard for the first year before transitioning to Glacier is more expensive than storing directly in Glacier Deep Archive from day one, as S3 Standard costs roughly 10x more per GB than Glacier Deep Archive, and the lifecycle transition itself incurs additional per-object costs.

Practice this question →

172

Multi-Selectmedium

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

Select 2 answers

A.Amazon EFS

B.AWS Storage Gateway (File Gateway)

C.AWS Snowball Edge

D.AWS Direct Connect

E.Amazon S3

AnswersB, E

Provides low-latency access to S3 from on-premises.

Why this answer

AWS Storage Gateway (File Gateway) provides a low-latency, on-premises cache for frequently accessed data while asynchronously uploading the underlying data to Amazon S3 for durable backup. This hybrid architecture allows applications to access data with local file-system performance while leveraging S3 as the backup target, meeting both the low-latency and backup requirements.

Exam trap

The trap here is that candidates often confuse AWS Storage Gateway (File Gateway) with Amazon EFS, thinking EFS can serve as a hybrid cache, but EFS lacks the on-premises caching component required for low-latency hybrid access.

Practice this question →

173

MCQhard

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

A.Use Aurora Serverless v2 with data replication across regions using Database Migration Service (DMS).

B.Deploy Aurora Multi-AZ in the primary region and use a secondary region as a warm standby.

C.Use Aurora Global Database with one primary region and one secondary region. Enable managed failover with a Recovery Point Objective (RPO) of 1 second.

D.Configure Aurora Cross-Region Read Replicas and use Amazon Route 53 for DNS failover.

AnswerC

Aurora Global Database provides cross-region replication with low RPO and managed failover.

Why this answer

Amazon Aurora Global Database is specifically designed for cross-region disaster recovery with a typical RPO of 1 second and RTO of less than 1 minute when managed failover is enabled. It uses a storage-based replication layer that replicates data from the primary to secondary regions with minimal latency, ensuring that in a regional failure, the secondary region can be promoted to primary with very little data loss.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have higher replication lag and require manual promotion) with Aurora Global Database's managed failover (which provides sub-second RPO and automated promotion), leading them to choose option D instead of C.

How to eliminate wrong answers

Option A is wrong because Aurora Serverless v2 does not support cross-region replication natively, and AWS Database Migration Service (DMS) is a migration tool, not a real-time replication solution for high availability; it introduces significant latency and potential data loss. Option B is wrong because Aurora Multi-AZ provides high availability within a single region, not across regions, and using a secondary region as a warm standby without global database replication would require manual backup restore or other mechanisms, resulting in higher RPO and RTO. Option D is wrong because Aurora Cross-Region Read Replicas use asynchronous replication with a typical RPO of seconds to minutes, and while Route 53 can handle DNS failover, the replication lag is not guaranteed to be as low as 1 second, and promoting a read replica to primary is a manual process that can take several minutes, leading to higher data loss.

Practice this question →

174

MCQmedium

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

A.Amazon SQS, AWS Lambda, Amazon S3

B.Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

C.Amazon MQ, AWS Lambda, Amazon RDS

D.Amazon Kinesis Data Streams, AWS Lambda, Amazon S3

AnswerD

Kinesis Data Streams ingests streaming data, Lambda processes it, S3 stores it.

Why this answer

Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Exam trap

The trap here is that candidates confuse Amazon SQS with Kinesis Data Streams for real-time streaming, but SQS is a pull-based queue with no ordered replay or shard-level parallelism, making it unsuitable for high-throughput IoT data ingestion.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue for decoupled communication, not designed for real-time streaming ingestion from thousands of IoT devices; it lacks the shard-based parallelism and ordered replay capabilities needed for streaming data. Option B is wrong because Amazon Redshift is a data warehouse for analytics, not a low-latency processing target; using Kinesis Data Firehose with Redshift adds unnecessary latency and cost for real-time processing, and the requirement specifies storing in S3, not Redshift. Option C is wrong because Amazon MQ is a managed message broker for JMS-compatible applications, not optimized for high-throughput streaming from IoT devices; Amazon RDS is a relational database, not suitable for storing streaming data for analytics in S3.

Practice this question →

175

MCQmedium

A company runs a critical web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) with a target group that has health checks configured. Recently, the operations team noticed that during a deployment, the ALB started routing traffic to a new instance before it was ready to serve requests, causing a brief period of errors. The team wants to ensure that new instances are fully initialized and ready before receiving traffic. The application takes about 30 seconds to start up. Current health check settings: health check protocol HTTP, path /, interval 30 seconds, timeout 5 seconds, healthy threshold 2, unhealthy threshold 2. The deployment uses the Auto Scaling group's instance refresh feature. Which of the following is the MOST effective way to prevent traffic from being sent to instances that are not ready?

A.Implement a lifecycle hook in the Auto Scaling group that waits for the instance to signal readiness. Also, configure the target group health check with a longer interval and a higher healthy threshold to ensure the instance is fully operational.

B.Increase the health check interval to 60 seconds and the healthy threshold to 5.

C.Use the Auto Scaling group's instance refresh feature with a warm-up time of 60 seconds.

D.Use AWS Global Accelerator to pre-warm the endpoints before directing traffic.

AnswerA

Lifecycle hooks can pause the instance launch until the application signals that it is ready, and the health check can be tuned to match the startup time.

Why this answer

It uses a lifecycle hook to pause the instance until it signals readiness (e.g., via a custom script that completes initialization), and then configures the target group health check with a longer interval and higher healthy threshold to ensure the instance is fully operational before receiving traffic. This prevents the ALB from routing traffic to an instance that is not yet ready. Option B is wrong because simply increasing the health check interval and threshold does not guarantee the instance has finished its startup process; it may still fail if the application is not ready when the first health check occurs (if the instance takes 30 seconds and interval is 60, the first check is at 60 seconds, but the threshold of 5 means it needs 5 consecutive successes, which delays traffic but doesn't ensure the instance is fully functional from the start).

Option C is wrong because the instance refresh warm-up time only delays the start of the refresh process, not the time before an instance receives traffic; it does not integrate with application readiness. Option D is wrong because AWS Global Accelerator does not pre-warm endpoints; it provides static IP addresses and improves performance but does not handle application readiness checks.

Practice this question →

176

MCQmedium

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

A.Amazon SNS

B.Amazon Kinesis Data Streams

C.AWS Step Functions

D.Amazon SQS

AnswerD

SQS provides a reliable, scalable, and fully managed message queue that decouples web and application tiers.

Why this answer

Amazon SQS is the correct choice because it provides a fully managed message queuing service that enables asynchronous communication between decoupled application tiers. The web tier can send messages to an SQS queue, and the application tier can poll and process those messages independently, which improves scalability and resilience by allowing each tier to scale and fail independently.

Exam trap

The trap here is that candidates often confuse SNS (pub/sub push model) with SQS (queue pull model) for decoupling tiers, but SNS does not provide the buffering and independent consumption needed for asynchronous decoupling between a web tier and an application tier.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, not a queue for point-to-point asynchronous decoupling; it does not provide the buffering and independent consumption that SQS offers. Option B is wrong because Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for simple message queuing between application tiers, and it introduces unnecessary complexity and cost for this use case. Option C is wrong because AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue for decoupling tiers; it is used for state machines, not for basic asynchronous message passing.

Practice this question →

177

MCQmedium

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

A.Amazon S3 bucket mounted using s3fs

B.Amazon FSx for Lustre

C.Amazon EBS volume

D.Amazon EFS file system

AnswerD

EFS provides a shared file system that can be mounted by multiple containers.

Why this answer

Amazon EFS provides a shared, persistent, and scalable NFS file system that can be mounted concurrently by multiple containers within the same ECS task using Fargate. EFS supports the NFSv4.1 protocol, enabling simultaneous read/write access from multiple containers, which meets the requirement for shared persistent storage across containers in the same task.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes are zonal and single-instance attachable, making them incompatible with multi-container sharing in Fargate, whereas EFS is the only AWS-native, shared, persistent file system that works seamlessly with Fargate.

How to eliminate wrong answers

Option A is wrong because Amazon S3 mounted via s3fs is an object storage solution that does not provide true POSIX file system semantics, and s3fs is a third-party FUSE implementation that can introduce performance and consistency issues, making it unsuitable for shared persistent storage across containers in a Fargate task. Option B is wrong because Amazon FSx for Lustre is designed for high-performance computing workloads with low-latency access to data, but it is not natively integrated with ECS Fargate and requires a managed Lustre client, which is not supported in the Fargate environment. Option C is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time; they cannot be shared across multiple containers in the same ECS task, and Fargate does not support direct EBS volume attachments.

Practice this question →

178

Multi-Selecthard

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

Select 2 answers

A.Use Auto Scaling groups to automatically replace unhealthy instances.

B.Deploy application across multiple Availability Zones.

C.Manually create EBS snapshots every day.

D.Store data in a single Amazon S3 bucket in one Region.

E.Use a single large EC2 instance to simplify management.

AnswersA, B

Auto Scaling helps maintain desired capacity.

Why this answer

Auto Scaling groups can automatically replace unhealthy EC2 instances by performing health checks and launching new instances to maintain desired capacity, which is a core principle of fault-tolerant design. Option B is correct because deploying across multiple Availability Zones ensures that if one AZ fails, the application continues to operate from another AZ, providing high availability and fault tolerance.

Exam trap

The trap here is that candidates often confuse data backup strategies (like EBS snapshots) with high availability design, or they mistakenly believe that a single large instance or a single-region storage approach is sufficient for fault tolerance, ignoring the need for redundancy and automated recovery.

Practice this question →

179

MCQmedium

A company is designing a new solution to host a static website with global audience. The website content includes HTML, CSS, JavaScript, and images. The company wants to minimize latency for users worldwide and reduce the load on the origin server. The origin server is an Amazon S3 bucket configured for static website hosting. Which solution should be used to achieve these goals?

A.Use AWS Global Accelerator to route traffic to the S3 bucket.

B.Use AWS Lambda@Edge to serve content from edge locations.

C.Use Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.

D.Enable S3 Transfer Acceleration on the bucket.

AnswerC

CloudFront caches content at edge locations, reducing latency and origin load.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches static content (HTML, CSS, JavaScript, images) at edge locations worldwide, significantly reducing latency for a global audience. By placing CloudFront in front of an S3 bucket configured for static website hosting, it offloads requests from the origin server, reducing load and improving performance. CloudFront also supports features like custom SSL, geo-restriction, and origin shield to further optimize delivery.

Exam trap

The trap here is confusing content delivery (CloudFront) with network acceleration (Global Accelerator) or upload acceleration (S3 Transfer Acceleration), leading candidates to pick options that improve network routing but do not cache or serve static content at edge locations.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network to the optimal regional endpoint, but it does not cache content at edge locations; it is designed for TCP/UDP traffic and dynamic content, not for reducing load on an S3 static website origin. Option B is wrong because AWS Lambda@Edge runs custom code at CloudFront edge locations to modify requests/responses, but it is not a content delivery service itself; it requires CloudFront to be in place and cannot serve static content directly from edge locations without a CDN. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache or serve content to end users; it is designed for uploads, not for reducing latency for a global audience downloading static website content.

Practice this question →

180

MCQeasy

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

A.Amazon RDS for MySQL

B.Amazon ElastiCache

C.Amazon Aurora

D.Amazon DynamoDB

AnswerD

DynamoDB is a fully managed NoSQL database with low latency and auto-scaling.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports auto-scaling of read/write capacity based on traffic patterns, enabling the application to handle sudden spikes in read traffic without manual intervention.

Exam trap

The trap here is that candidates may confuse Amazon ElastiCache (a caching layer) with a primary NoSQL database, or assume that Amazon Aurora's MySQL compatibility makes it a NoSQL option, when in fact DynamoDB is the only fully managed NoSQL service among the choices that meets the latency and auto-scaling requirements.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database, not a NoSQL database, and it requires manual scaling or configuration of read replicas to handle traffic spikes. Option B is wrong because Amazon ElastiCache is an in-memory caching service, not a primary database; it is used to accelerate access to data stored elsewhere, not as a fully managed NoSQL database with its own persistence. Option C is wrong because Amazon Aurora is a relational database engine compatible with MySQL and PostgreSQL, not a NoSQL database, and while it offers auto-scaling storage, it does not natively auto-scale read capacity for sudden spikes without manual provisioning of Aurora Replicas.

Practice this question →

181

MCQhard

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

A.Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

B.Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

C.Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.

D.Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.

AnswerD

Aurora Global Database offers sub-second replication; Route 53 failover routing provides fast DNS failover.

Why this answer

Amazon Aurora Global Database provides cross-region replication with a typical lag of under 1 second, meeting the RPO requirement, and supports failover in under 1 minute, satisfying the RTO of less than 5 minutes. Combined with Route 53 failover routing and a health check on port 8080, this architecture enables rapid, automated traffic redirection to the secondary region without additional compute or storage costs beyond the Aurora storage and I/O.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have asynchronous replication and manual failover) with Aurora Global Database (which provides near-synchronous replication and automated failover), leading them to choose Option C despite its inability to meet the strict RPO and RTO requirements.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Multi-AZ is a single-region, high-availability feature; it does not provide cross-region disaster recovery, so it cannot meet the multi-region requirement. Option B is wrong because DynamoDB global tables are for NoSQL workloads, not for an Amazon Aurora MySQL database, and Application Load Balancers do not support health checks on custom TCP port 8080 (ALB only supports HTTP/HTTPS health checks). Option C is wrong because Amazon RDS for MySQL cross-region read replicas use asynchronous replication with a replication lag that can exceed 1 second, failing the RPO requirement, and failover requires manual promotion of the read replica, which cannot achieve a 5-minute RTO.

Practice this question →

182

MCQeasy

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within a week and have minimal downtime. Which AWS service should the company use to transfer the initial database dump to AWS?

A.Upload the database dump directly to an S3 bucket using multipart upload.

B.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data with minimal downtime.

C.Use AWS Snowball Edge to transfer the data offline.

D.Use S3 Transfer Acceleration to speed up the upload of the dump file.

AnswerB

DMS can perform a full load and then continuously replicate changes, allowing a cutover with minimal downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct choice because it allows the initial full load of the 2 TB database to be migrated while continuously capturing and applying changes from the source Oracle database. This minimizes downtime to a brief cutover window, meeting the requirement of minimal downtime. The 100 Mbps internet connection is sufficient for the initial load over a week (2 TB at 100 Mbps ≈ 2.3 days theoretical), and DMS handles the schema conversion and data transfer natively without requiring manual dump files.

Exam trap

The trap here is that candidates often assume a direct upload to S3 or Snowball is faster for large datasets, but they overlook the critical requirement of minimal downtime, which only DMS with ongoing replication can satisfy by keeping the source database online during migration.

How to eliminate wrong answers

Option A is wrong because uploading a database dump directly to S3 via multipart upload does not provide ongoing replication or minimize downtime; the application would need to be offline for the entire duration of the dump and upload, which could exceed the allowed downtime window. Option C is wrong because AWS Snowball Edge is designed for offline transfer of large datasets over slow or unreliable connections, but here the 100 Mbps connection is adequate for the 2 TB within a week, and Snowball introduces additional shipping and processing delays that would likely exceed the one-week deadline. Option D is wrong because S3 Transfer Acceleration only speeds up uploads over long distances by using AWS edge locations, but it does not address the need for minimal downtime or ongoing replication; the application would still need to be offline during the dump and upload process.

Practice this question →

183

Multi-Selecteasy

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

Select 2 answers

A.Use Spot Instances for compute.

B.Purchase Reserved Instances (RI) for a 1-year term.

C.Configure Auto Scaling to scale out during the job and scale in after.

D.Use On-Demand Instances to ensure availability.

E.Use Dedicated Hosts for compliance.

AnswersA, C

Spot Instances are cost-effective and suitable for fault-tolerant batch jobs.

Why this answer

Spot Instances (Option A) are ideal for this batch processing job because the job can tolerate interruptions and requires significant compute power for only a few hours nightly. Spot Instances offer up to 90% cost savings compared to On-Demand Instances by leveraging unused AWS EC2 capacity, making them the most cost-effective choice for fault-tolerant, time-flexible workloads.

Exam trap

The trap here is that candidates often choose Reserved Instances (Option B) thinking they are always cheaper for recurring workloads, but they fail to recognize that the low utilization (a few hours per night) makes On-Demand or Spot more cost-effective than a 1-year commitment.

Practice this question →

184

Multi-Selecthard

A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Configure the ALB to use HTTPS listeners and the target group to use HTTPS.

B.Place the EC2 instances in private subnets and use a NAT gateway for outbound internet access.

C.Attach an Internet Gateway to the VPC and route traffic through it.

D.Enable VPC Flow Logs on the private subnets.

E.Configure network ACLs to deny all inbound traffic from the internet.

AnswersA, B

This encrypts traffic between the client and ALB, and between ALB and EC2 instances if the target group uses HTTPS.

Why this answer

Configuring the ALB with HTTPS listeners and the target group with HTTPS ensures that traffic between the ALB and EC2 instances is encrypted using TLS. This meets the security team's requirement for encrypted traffic end-to-end, as the ALB terminates the client HTTPS connection and re-encrypts traffic to the targets.

Exam trap

The trap here is the distinction between 'direct internet access' and 'indirect internet access'. Candidates may incorrectly assume that having any internet access (even via a NAT gateway) violates the requirement. However, the requirement explicitly states 'no direct internet access', which means no public IP and no route to an internet gateway.

A NAT gateway provides outbound-only internet access from private subnets, which is indirect and does not allow inbound connections. This is permissible and often necessary for patching and updates.

Practice this question →

185

MCQeasy

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

A.Amazon ECS

B.AWS Lambda

C.Amazon EC2

D.AWS Fargate

AnswerB

Lambda is event-driven and serverless.

Why this answer

AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to events, such as S3 object creation, with sub-millisecond startup times. It automatically scales and requires no server management, making it ideal for this use case.

Exam trap

The trap here is that candidates often confuse AWS Fargate as a serverless compute option for event-driven workloads, but Fargate is designed for containerized applications with longer runtimes and higher latency, not for sub-millisecond event responses.

How to eliminate wrong answers

Option A is wrong because Amazon ECS is a container orchestration service that requires managing a cluster or using Fargate, and it does not natively trigger from S3 events without additional components like EventBridge or Lambda. Option C is wrong because Amazon EC2 involves provisioning and managing virtual servers, which contradicts the requirement for no server management and millisecond execution. Option D is wrong because AWS Fargate is a serverless compute engine for containers, but it still requires defining tasks and has a startup latency of seconds, not milliseconds, and does not directly integrate with S3 events without a Lambda intermediary.

Practice this question →

186

MCQhard

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

A.Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.

B.Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.

C.Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.

D.Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.

AnswerA

NLB can handle TCP traffic and route based on port to different services.

Why this answer

A Network Load Balancer (NLB) with a TCP listener can forward traffic based on destination port to different target groups, allowing the legacy client using a proprietary binary protocol over TCP to reach distinct microservices without any client-side changes. This preserves the existing TCP connection semantics and binary protocol, which an Application Load Balancer (HTTP/HTTPS only) or API Gateway (HTTP/REST) cannot handle.

Exam trap

The trap here is that candidates often assume an Application Load Balancer or API Gateway can handle any protocol because of their advanced routing features, but they forget that ALB and API Gateway are strictly Layer 7 (HTTP/HTTPS) and cannot process raw TCP or proprietary binary protocols.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator uses endpoint groups for routing traffic to regional endpoints, but it does not support port-based routing to different target groups within a single listener; it relies on the underlying NLB or ALB for that granularity, adding unnecessary complexity without solving the port-based routing need. Option C is wrong because an Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and cannot handle proprietary binary protocols over TCP; it requires HTTP-based routing, which would force changes to the client. Option D is wrong because Amazon API Gateway only supports HTTP/REST and WebSocket APIs, not raw TCP or proprietary binary protocols, and would require the client to send HTTP requests, breaking the existing protocol.

Practice this question →

187

MCQhard

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

A.Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function

B.Enable DynamoDB Accelerator (DAX) for the Lambda function

C.Provisioned Concurrency on the Lambda function

D.Increase the SQS queue visibility timeout and retention period

AnswerA

Reserved concurrency prevents throttling, and SQS acts as a buffer.

Why this answer

Using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Exam trap

The trap here is that candidates confuse Provisioned Concurrency (which reduces cold starts) with reserved concurrency (which guarantees processing capacity), and overlook that SQS alone cannot prevent message loss if Lambda is throttled.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance, but it does not prevent message loss or handle Lambda throttling. Option C is wrong because Provisioned Concurrency keeps a set number of Lambda instances warm to reduce cold starts, but it does not protect against throttling during extreme spikes; reserved concurrency is needed to guarantee capacity. Option D is wrong because increasing the SQS queue visibility timeout and retention period only delays message reprocessing and extends storage time, but does not address the root cause of message loss due to Lambda throttling.

Practice this question →

188

MCQeasy

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

A.Create IAM users for each mobile user and distribute access keys.

B.Use AWS Security Token Service (STS) directly from the mobile app.

C.Create an IAM role and have the mobile app assume it directly.

D.Use Amazon Cognito with an identity pool to issue temporary credentials.

AnswerD

Cognito Identity Pools are designed for this purpose.

Why this answer

Amazon Cognito identity pools are designed to provide temporary, limited-privilege AWS credentials to mobile app users. The service authenticates users through a public identity provider (e.g., Amazon, Facebook, Google, or a custom OIDC provider) and then exchanges the resulting identity token for temporary AWS credentials via the AWS Security Token Service (STS). This approach avoids embedding long-term credentials in the mobile app and enforces least-privilege access through IAM roles associated with the identity pool.

Exam trap

The trap here is that candidates confuse the ability to call STS directly with the need for pre-existing credentials; STS cannot issue temporary credentials without first authenticating the caller, so a mobile app without embedded credentials must use a service like Cognito to broker the token exchange.

How to eliminate wrong answers

Option A is wrong because creating IAM users for each mobile user and distributing access keys is not scalable, introduces long-term static credentials that are insecure when stored on mobile devices, and violates the principle of least privilege for temporary access. Option B is wrong because using AWS Security Token Service (STS) directly from the mobile app would require the app to have long-term AWS credentials (access key and secret key) to call STS, which defeats the purpose of temporary credentials and creates a security risk. Option C is wrong because having the mobile app assume an IAM role directly is not possible without first obtaining temporary credentials; the AssumeRole API call itself requires valid AWS credentials (either long-term or temporary) to invoke, so a mobile app without pre-provisioned credentials cannot assume a role directly.

Practice this question →

189

MCQeasy

A company is designing a new application that will store sensitive user data in an Amazon RDS for PostgreSQL database. The data must be encrypted at rest and in transit. The company also requires automated backups with a retention period of 35 days. What is the MOST secure and cost-effective configuration?

A.Enable RDS encryption at rest using AWS KMS, and use client-side encryption for data in transit.

B.Use an AWS KMS key to encrypt the RDS instance, and configure the DB instance to use SSL/TLS for connections.

C.Store the data in Amazon S3 with server-side encryption, and use an RDS database for metadata only.

D.Enable encryption at rest for the RDS instance, and enforce SSL/TLS connections by setting the rds.force_ssl parameter to 1.

AnswerD

RDS encryption at rest is enabled with a single checkbox; SSL/TLS is enforced via parameter group. Automated backups are enabled by default with 35-day retention.

Why this answer

It uses AWS KMS to encrypt the RDS for PostgreSQL instance at rest and enforces encryption in transit by setting the `rds.force_ssl` parameter to 1, which requires all connections to use SSL/TLS. This satisfies both encryption requirements while leveraging RDS automated backups (retention up to 35 days) at no additional cost beyond standard backup storage, making it the most secure and cost-effective configuration.

Exam trap

The trap here is that candidates often assume simply enabling SSL/TLS on the RDS instance (Option B) is sufficient for in-transit encryption, but they overlook the need to enforce it via the `rds.force_ssl` parameter to prevent unencrypted connections from being accepted.

How to eliminate wrong answers

Option A is wrong because client-side encryption for data in transit is not a standard RDS feature and would require custom application logic, adding complexity and potential security gaps; RDS natively supports SSL/TLS for in-transit encryption, which is simpler and more reliable. Option B is wrong because while it correctly uses AWS KMS for encryption at rest and SSL/TLS for connections, it does not enforce SSL/TLS—without setting `rds.force_ssl=1`, clients can still connect without encryption, leaving data in transit vulnerable. Option C is wrong because storing sensitive user data in Amazon S3 with server-side encryption does not meet the requirement for an RDS for PostgreSQL database; using RDS only for metadata violates the stated need to store sensitive user data in the database itself, and S3 lacks the relational query capabilities required by the application.

Practice this question →

190

MCQmedium

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

A.Amazon Kinesis Data Firehose

B.Amazon Kinesis Data Streams

C.Amazon Kinesis Data Analytics

D.Amazon EMR

AnswerC

Kinesis Data Analytics processes streaming data in real time.

Why this answer

Amazon Kinesis Data Analytics is the most appropriate service for real-time stream processing because it allows you to process streaming data in real time using SQL or Apache Flink. Option A (Amazon Kinesis Data Firehose) is designed for loading streaming data into data stores like S3, not for real-time processing. Option B (Amazon Kinesis Data Streams) is a data ingestion service that captures and stores data streams, but does not provide built-in processing capabilities.

Option D (Amazon EMR) is primarily used for batch processing of large data sets using frameworks like Hadoop and Spark, and is not optimized for real-time stream processing.

Practice this question →

191

MCQhard

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

A.Use Route 53 failover routing instead of latency-based routing.

B.Configure Route 53 latency-based routing without health checks.

C.Use Route 53 weighted routing with weights set to 50 for each region.

D.Configure Route 53 latency-based routing with health checks attached to each ALB endpoint.

AnswerD

Health checks allow Route 53 to automatically route traffic away from unhealthy endpoints.

Why this answer

Route 53 latency-based routing with health checks ensures that traffic is directed to the region with the lowest latency, and if an ALB endpoint fails its health check, Route 53 automatically removes it from DNS responses, routing traffic to the healthy region. This provides the required active-active multi-region failover with minimal disruption.

Exam trap

The trap here is that candidates often assume failover routing is the only way to handle regional failures, but for active-active architectures, latency-based routing with health checks provides automatic failover while maintaining low-latency routing to both regions.

How to eliminate wrong answers

Option A is wrong because failover routing is designed for active-passive setups, not active-active; it would route all traffic to a primary region and only fail over to a secondary region when the primary fails, which does not meet the requirement for both regions to be active simultaneously. Option B is wrong because latency-based routing without health checks cannot detect regional failures; if an ALB becomes unavailable, Route 53 would continue to return its IP, causing connection failures for clients. Option C is wrong because weighted routing with equal weights distributes traffic based on weight ratios, not latency, and without health checks it cannot automatically fail over if a region becomes unavailable.

Practice this question →

192

MCQeasy

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

A.Use Amazon ElastiCache for Memcached as the primary database.

B.Deploy Amazon RDS in a Multi-AZ configuration without read replicas.

C.Deploy Amazon RDS in a single Availability Zone with a large instance size.

D.Deploy Amazon RDS in a Multi-AZ configuration and use read replicas to offload read traffic.

AnswerD

Multi-AZ provides failover, and read replicas improve read performance.

Why this answer

It combines Multi-AZ deployment for high availability with read replicas to offload read traffic, addressing both the read-heavy workload and sudden traffic spikes. Multi-AZ ensures automatic failover to a standby instance in a different Availability Zone if the primary fails, while read replicas distribute read queries across multiple copies, reducing load on the primary database and improving performance under spike conditions.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming Multi-AZ alone provides read scaling, but Multi-AZ only provides failover redundancy—the standby instance cannot serve reads, so read replicas are required to offload read traffic.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Memcached is an in-memory caching layer, not a relational database; it cannot serve as the primary database for a web application requiring persistent, relational storage with ACID transactions. Option B is wrong because Multi-AZ without read replicas provides high availability but does not offload read traffic, so the single primary instance becomes a bottleneck under sudden read spikes, leading to performance degradation. Option C is wrong because deploying in a single Availability Zone with a large instance size lacks high availability—if the AZ fails, the database becomes unavailable—and scaling vertically with a larger instance does not efficiently handle sudden read spikes compared to horizontal scaling with read replicas.

Practice this question →

193

MCQhard

A company is designing a new multi-region disaster recovery solution for a critical database. The database runs on Amazon RDS for MySQL in us-east-1. The recovery point objective (RPO) is 1 second, and the recovery time objective (RTO) is 1 minute. Which strategy meets these requirements?

A.Single-AZ RDS instance with cross-Region snapshot copy

B.Multi-AZ RDS instance in us-east-1

C.Multi-AZ RDS instance with a cross-Region read replica in us-west-2

D.Amazon Aurora Global Database

AnswerC

Synchronous replication within region, asynchronous to replica, fast failover.

Why this answer

A Multi-AZ RDS instance with a cross-Region read replica in us-west-2 can achieve an RPO of 1 second and an RTO of 1 minute. The cross-Region read replica uses asynchronous replication with a typical lag of less than 1 second, meeting the RPO. For RTO, you can promote the read replica to a standalone instance in under a minute, and the Multi-AZ configuration in the primary region ensures high availability during the promotion process.

Exam trap

The trap here is that candidates often assume Amazon Aurora Global Database is the best choice for low RPO/RTO, but for RDS for MySQL, the cross-Region read replica is the correct service, and Aurora Global Database has a slightly higher RTO due to the failover process, making it unsuitable for a 1-minute RTO.

How to eliminate wrong answers

Option A is wrong because cross-Region snapshot copies are asynchronous and typically have an RPO of minutes to hours, far exceeding the 1-second requirement, and restoring from a snapshot takes minutes to hours, failing the 1-minute RTO. Option B is wrong because a Multi-AZ RDS instance in us-east-1 only provides high availability within a single region, not cross-Region disaster recovery, so it cannot meet the multi-region requirement. Option D is wrong because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of less than 1 second, but its RTO for a failover is often 1-2 minutes or more, which does not meet the strict 1-minute RTO; additionally, the question specifies RDS for MySQL, not Aurora, so this option is not applicable.

Practice this question →

194

MCQmedium

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

A.Enable Multi-AZ deployment with a DB cluster.

B.Use automated backups with 5-minute retention.

C.Take manual snapshots every 5 minutes and copy to another region.

D.Create a cross-region read replica in us-west-2.

AnswerA

Synchronous replication and automatic failover meet RTO/RPO.

Why this answer

A Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides high availability within a region) with cross-region replication (which is asynchronous and cannot meet tight RPO/RPO), or they assume automated backups or snapshots can achieve sub-15-minute RTO, ignoring the restore time overhead.

How to eliminate wrong answers

Option B is wrong because automated backups with 5-minute retention only provide point-in-time recovery within the retention period, but the RTO for restoring from a backup is significantly longer than 15 minutes (often 30+ minutes for a large database), and the RPO is limited to the backup interval, not the 5-minute requirement. Option C is wrong because manual snapshots taken every 5 minutes cannot be copied to another region quickly enough to meet the 15-minute RTO; snapshot copy times are unpredictable and often exceed 15 minutes, and the RPO would be compromised by the copy delay. Option D is wrong because a cross-region read replica in us-west-2 is asynchronous, meaning replication lag can exceed 5 minutes, and promoting a read replica to a primary instance typically takes several minutes, failing the 15-minute RTO; additionally, cross-region failover introduces latency and potential data loss beyond the 5-minute RPO.

Practice this question →

195

MCQeasy

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

A.Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.

B.AWS Lambda@Edge for both static content and API.

C.Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.

D.Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.

AnswerC

CloudFront provides CDN, API Gateway manages APIs, Lambda runs code serverlessly.

Why this answer

It combines Amazon CloudFront for global low-latency delivery of static content, Amazon API Gateway to create and manage the REST API with built-in caching and throttling, and AWS Lambda for serverless compute. This architecture provides high availability, automatic scaling, and global edge caching, meeting the startup's requirements without managing servers.

Exam trap

The trap here is that candidates may confuse Lambda@Edge as a full compute solution for APIs, overlooking its severe execution limits, or assume that an ALB provides global low latency when it is inherently regional and requires additional services like Global Accelerator for global performance.

How to eliminate wrong answers

Option A is wrong because using an Application Load Balancer (ALB) for the API introduces a regional, not global, endpoint and requires managing EC2 instances or Lambda targets behind it, adding complexity and latency compared to API Gateway's global edge-optimized endpoints. Option B is wrong because Lambda@Edge is designed for lightweight, short-duration operations (e.g., header manipulation, URL rewrites) at CloudFront edge locations, not for running full REST API backends with DynamoDB interactions; it has a 5-second execution timeout and limited memory, making it unsuitable for typical API workloads. Option D is wrong because S3 Transfer Acceleration only speeds up uploads to S3 via optimized network paths, but does not provide a REST API gateway, authentication, or request throttling, and it lacks the global edge caching and API management features needed for a low-latency, globally available API.

Practice this question →

196

MCQmedium

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

A.Amazon EKS with managed node groups

B.Amazon ECS with Fargate launch type

C.Amazon ECS with EC2 launch type and Auto Scaling groups

D.Amazon Lightsail containers

AnswerB

Fargate is serverless, no infrastructure management.

Why this answer

Amazon ECS with the Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. This directly meets the requirement to minimize operational overhead while allowing each microservice to scale independently, as Fargate automatically handles the infrastructure and scaling based on the task definitions.

Exam trap

The trap here is that candidates often confuse 'managed node groups' (EKS) with 'serverless' (Fargate), assuming that managed node groups eliminate all operational overhead, when in fact they still require you to manage the EC2 instances, just with some automation for provisioning and updates.

How to eliminate wrong answers

Option A is wrong because Amazon EKS with managed node groups still requires you to manage and pay for the underlying EC2 instances (the node groups), and you are responsible for patching, scaling, and maintaining the worker nodes, which adds operational overhead. Option C is wrong because Amazon ECS with the EC2 launch type and Auto Scaling groups requires you to manage the EC2 instances, including capacity planning, patching, and cluster optimization, which contradicts the goal of minimizing operational overhead. Option D is wrong because Amazon Lightsail containers are designed for simpler, less complex workloads and do not offer the same level of granular scaling, integration with AWS services (e.g., VPC, IAM, CloudWatch), or the ability to handle production-grade microservices architectures with independent scaling requirements.

Practice this question →

197

MCQmedium

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

A.Deploy a second ECS cluster and ALB in the secondary region with no tasks. Use cross-Region replication for ElastiCache. Use Route 53 to fail over after scaling up tasks.

B.Deploy a second ECS cluster and ALB in the secondary region with a scaled-down number of tasks. Use ElastiCache Global Datastore for Redis to replicate session data. Use Route 53 health checks to fail over.

C.Use a multi-region ECS service with Service Connect and Route 53 latency-based routing. Keep equal capacity in both regions.

D.Use pilot light by replicating ECS task definitions and copying AMIs to the secondary region. Use ElastiCache snapshot and restore. Fail over with Route 53.

AnswerB

Correct: Warm standby with Global Datastore meets RPO and RTO.

Why this answer

It uses ElastiCache Global Datastore for Redis, which provides cross-Region replication with sub-minute RPO, meeting the 15-minute RPO requirement. The scaled-down ECS tasks in the secondary region can be quickly scaled up to achieve the 30-minute RTO, and Route 53 health checks enable automated failover. This design minimizes cost by running only minimal capacity in the secondary region until failover occurs.

Exam trap

The trap here is that candidates often assume cross-Region replication for ElastiCache requires manual snapshot/restore or custom replication, but ElastiCache Global Datastore provides managed, low-latency replication that meets strict RPOs, and running zero tasks in the secondary region (Option A) prevents failover from working because the ALB has no healthy targets.

How to eliminate wrong answers

Option A is wrong because deploying a second ECS cluster with no tasks means the ALB in the secondary region has no healthy targets, causing Route 53 health checks to fail and preventing failover; also, cross-Region replication for ElastiCache (using snapshots or manual replication) cannot achieve sub-minute RPO and may exceed the 15-minute RPO. Option C is wrong because multi-region ECS Service Connect does not natively handle cross-Region failover or session data replication, and latency-based routing does not provide health-check-driven failover; keeping equal capacity in both regions is not cost-effective and does not meet the RTO/RPO requirements. Option D is wrong because using ElastiCache snapshot and restore can take longer than 15 minutes to restore, exceeding the RPO, and copying AMIs is irrelevant for ECS Fargate (which uses container images, not AMIs); pilot light with manual restore cannot achieve the 30-minute RTO.

Practice this question →

198

MCQhard

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

A.AWS Lambda

B.Amazon ECS

C.Amazon EKS

D.AWS Fargate

AnswerC

EKS is a managed Kubernetes service.

Why this answer

Amazon EKS (Elastic Kubernetes Service) is the correct choice because the company is migrating a legacy monolithic application to microservices and requires container orchestration. EKS provides a managed Kubernetes control plane, which is the industry-standard platform for automating deployment, scaling, and management of containerized applications, making it ideal for refactoring into microservices.

Exam trap

The trap here is that candidates often confuse Amazon ECS with EKS, assuming both are equivalent for microservices, but EKS is specifically required when the organization needs Kubernetes-based orchestration for portability and ecosystem compatibility.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not designed for managing containers or container orchestration. Option B is wrong because Amazon ECS is a container orchestration service, but it uses AWS's proprietary scheduling and does not provide the Kubernetes API, which is often required for microservices architectures that need portability across environments. Option D is wrong because AWS Fargate is a compute engine for running containers without managing servers, but it is not an orchestration service itself; it runs containers under ECS or EKS.

Practice this question →

199

Multi-Selecthard

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Select 3 answers

A.Encrypt traffic between VPCs using VPN or AWS PrivateLink.

B.Use VPC endpoints to keep traffic within the AWS network.

C.Implement network segmentation using subnets and security groups.

D.Use a single Availability Zone to reduce complexity.

E.Enable VPC Flow Logs to capture network traffic metadata.

AnswersA, C, E

Encryption of cardholder data in transit is required.

Why this answer

PCI DSS Requirement 4.1 mandates that cardholder data transmitted across open, public networks must be encrypted. Using VPN (IPsec) or AWS PrivateLink ensures that traffic between VPCs is encrypted in transit, meeting this compliance requirement. This approach also avoids exposing data to the public internet.

Exam trap

The trap here is that candidates often assume VPC endpoints alone satisfy encryption requirements, but PCI DSS demands encryption in transit (e.g., TLS or IPsec), not just network isolation.

Practice this question →

200

MCQmedium

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

A.Use AWS Secrets Manager to store and rotate credentials, and grant the EKS pod access via an IAM role

B.Use IAM database authentication for RDS and assign an IAM role to the pod

C.Hardcode the credentials in the container image and rotate the image regularly

D.Store credentials in AWS Systems Manager Parameter Store and grant the EKS pod access via an IAM role

AnswerA

Secrets Manager rotates credentials automatically and integrates with IAM for access.

Why this answer

AWS Secrets Manager is the correct choice because it natively supports automatic rotation of RDS database credentials via a built-in Lambda rotation function, and it integrates with IAM roles to grant EKS pods secure access without storing secrets in plaintext. By using an IAM role for the pod (via IRSA), the application can retrieve credentials at runtime from Secrets Manager, ensuring compliance with the security team's requirements.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager, assuming Parameter Store supports automatic rotation, but Parameter Store lacks native rotation capabilities for RDS credentials, making Secrets Manager the only correct choice for automated rotation.

How to eliminate wrong answers

Option B is wrong because IAM database authentication for RDS does not support automatic credential rotation; it relies on IAM roles and tokens, but the security team specifically requires rotating database credentials, not just authentication. Option C is wrong because hardcoding credentials in a container image violates the requirement to never store credentials in plaintext and does not provide automated rotation. Option D is wrong because AWS Systems Manager Parameter Store does not natively support automatic rotation of RDS credentials; it can store secrets but lacks the built-in rotation capability that Secrets Manager provides.

Practice this question →

201

MCQhard

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

A.Fn::ImportValue

B.Fn::GetAtt

C.Fn::Sub

D.Fn::Ref

AnswerA

ImportValue imports exported output values from other stacks.

Why this answer

A is correct because Fn::ImportValue is the only intrinsic function that can reference a cross-stack output value exported via the Export field in a CloudFormation stack. Since the SQS queue URL is an output from one stack and needs to be used in another stack, Fn::ImportValue is required to import the exported value by name.

Exam trap

The trap here is that candidates often confuse Fn::GetAtt or Fn::Ref with cross-stack references, but those functions only work within the same stack, while Fn::ImportValue is specifically designed for cross-stack value sharing.

How to eliminate wrong answers

Option B (Fn::GetAtt) is wrong because it retrieves an attribute from a resource within the same stack, not from another stack's output. Option C (Fn::Sub) is wrong because it substitutes variables in a string template, but cannot reference cross-stack exports directly. Option D (Fn::Ref) is wrong because it returns the value of a parameter or resource within the same stack, not an exported output from another stack.

Practice this question →

202

MCQmedium

A company is building a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. Each file can be up to 500 MB, and processing takes up to 10 minutes. The Lambda function must be triggered as soon as a file is uploaded. Which configuration should they use?

A.Use S3 event notification to send an SQS message, which triggers Lambda.

B.Configure S3 event notification to invoke the Lambda function directly.

C.Increase the Lambda function timeout to 15 minutes and memory to 3 GB.

D.Use AWS Step Functions to poll S3 and invoke Lambda.

AnswerB

S3 can directly invoke Lambda for each object creation event.

Why this answer

S3 event notifications can directly invoke a Lambda function when an object is created, which meets the requirement of triggering the function as soon as a file is uploaded. Lambda supports a maximum timeout of 15 minutes and up to 10 GB of memory, so the 10-minute processing time and 500 MB file size are within limits. Option A is incorrect because using SQS between S3 and Lambda adds unnecessary complexity and latency, and is not needed when the direct trigger works.

Option C is incorrect because increasing timeout and memory addresses resource limits but does not affect triggering; moreover, the default timeout can be set to 10 minutes without issue. Option D is incorrect because Step Functions add unnecessary orchestration complexity when a simple event trigger suffices.

Practice this question →

203

MCQeasy

A small business wants to host a simple static website on AWS. The website consists of HTML, CSS, JavaScript, and images. The company expects low traffic and wants to minimize costs. The website must be highly available and load quickly for users globally. Which solution should a Solutions Architect recommend?

A.Store the website files in an S3 bucket configured for static website hosting, and use Amazon CloudFront as a CDN.

B.Host the website on Amazon Lightsail with a load balancer and two instances.

C.Host the website on a single EC2 instance running Apache web server, with an Elastic IP address.

D.Deploy the website on AWS Elastic Beanstalk with a single EC2 instance.

AnswerA

S3 static hosting is very low cost, highly available, and CloudFront provides global performance.

Why this answer

S3 static website hosting with CloudFront provides low cost, high availability, and global low latency. Option B is wrong because Lightsail with a load balancer and two instances is more expensive and overkill for a simple static site. Option C is wrong because a single EC2 instance is not highly available and costs more than S3.

Option D is wrong because Elastic Beanstalk is designed for dynamic web apps, not static sites, and a single EC2 instance lacks high availability.

Practice this question →

204

MCQmedium

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

A.Store secrets in AWS Systems Manager Parameter Store with a SecureString parameter type.

B.Use AWS CloudHSM to store secrets as keys.

C.Use AWS Key Management Service (KMS) to store secrets as encrypted data keys.

D.Use AWS Secrets Manager to store secrets and configure automatic rotation.

AnswerD

Secrets Manager is purpose-built for secrets with rotation and native RDS integration.

Why this answer

AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It provides native integration with Amazon RDS, enabling automatic rotation of RDS credentials without custom code, which directly meets the requirements for automatic rotation and AWS service integration.

Exam trap

The trap here is that candidates confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with AWS Secrets Manager (which is designed specifically for automatic secret rotation and deep AWS service integration), leading them to choose Parameter Store for its lower cost and familiarity.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store with SecureString does not support automatic rotation of secrets; it requires custom AWS Lambda functions or external processes to rotate secrets. Option B is wrong because AWS CloudHSM is a hardware security module for generating and storing cryptographic keys, not for managing application secrets like database credentials or API keys, and it lacks native rotation and RDS integration. Option C is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for storing secrets; it can encrypt data keys but does not provide secret storage, rotation, or direct RDS integration.

Practice this question →

205

MCQmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

A.Use sticky sessions (session affinity) on the ALB with a session cookie.

B.Use Amazon ElastiCache for Memcached to store session data.

C.Store session data in Amazon DynamoDB tables.

D.Use Amazon ElastiCache for Redis to store session data externally.

AnswerD

Redis provides a scalable, highly available session store.

Why this answer

Amazon ElastiCache for Redis provides a highly scalable, low-latency, and durable external session store that decouples session state from EC2 instances. This allows the Auto Scaling group to add or remove instances freely without losing session data, and Redis supports replication and persistence for reliability. Compared to DynamoDB, Redis offers lower latency for session access, and compared to Memcached, it provides data structures and persistence that are beneficial for session management.

Exam trap

The trap here is that candidates often choose sticky sessions (Option A) because it seems simple and directly supported by ALB, but they overlook the fundamental scalability and resilience issues it introduces in an Auto Scaling environment.

How to eliminate wrong answers

Option A is wrong because sticky sessions (session affinity) tie a user to a specific EC2 instance, which prevents the Auto Scaling group from scaling in or out effectively and can cause session loss if that instance fails or is terminated. Option B is wrong because Amazon ElastiCache for Memcached is a pure caching solution without persistence or replication, so session data would be lost on node failure, making it unsuitable for maintaining session state reliably. Option C is wrong because while DynamoDB can store session data, it introduces higher latency per request compared to in-memory caches like Redis, and its cost for frequent read/write operations can be higher than ElastiCache for steady traffic with occasional spikes.

Practice this question →

206

MCQhard

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

A.Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

B.Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.

C.Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

D.Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

AnswerB

Customer-managed key meets requirement; CloudTrail audits access.

Why this answer

It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Exam trap

The trap here is that candidates often confuse S3 server access logs (which are log files delivered to an S3 bucket) with CloudTrail data events, or assume SSE-S3 meets the 'customer-managed keys' requirement because it is a form of server-side encryption, but SSE-S3 uses AWS-owned keys, not customer-managed ones.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses AWS-managed keys, not customer-managed keys, and S3 server access logs are best-effort (delivered asynchronously) and do not capture KMS key usage, failing both the encryption and audit requirements. Option C is wrong because SSE-S3 again uses AWS-managed keys, and Amazon CloudWatch Logs for S3 access logging is not a native S3 feature; S3 access logs are delivered to S3, not directly to CloudWatch Logs, and they lack KMS audit trails. Option D is wrong because client-side encryption requires the customer to manage encryption/decryption in their application, which adds complexity and does not leverage S3's native encryption at rest; also, CloudWatch Logs for S3 access logs is not a standard S3 audit mechanism and does not capture KMS data events.

Practice this question →

207

MCQhard

A company is designing a multi-region active-active application using Amazon Route 53, Application Load Balancers, and Auto Scaling groups. They need to route users to the closest region with the lowest latency. Which routing policy should they use?

A.Latency routing

B.Weighted routing

C.Failover routing

D.Geolocation routing

AnswerA

Routes to the region with the lowest latency.

Why this answer

(Latency routing) is correct because it routes users to the AWS region that provides the lowest latency, based on real-time latency measurements. This is ideal for multi-region active-active applications where users should be directed to the closest region. Option B (Weighted routing) distributes traffic based on assigned weights, not latency.

Option C (Failover routing) is used for active-passive disaster recovery. Option D (Geolocation routing) routes based on the geographic location of the user, not on actual network latency.

Practice this question →

208

MCQmedium

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

A.Replace the Lambda function with AWS Elemental MediaConvert job triggered by S3 events.

B.Increase the Lambda function memory to the maximum to improve performance and reduce processing time.

C.Use AWS Step Functions to call multiple Lambda functions in parallel to process chunks of the video.

D.Use a Lambda function with a larger ephemeral storage to handle the video file.

AnswerA

MediaConvert supports long-running jobs and is designed for video processing.

Why this answer

AWS Elemental MediaConvert is a managed service designed for video transcoding. It can handle large files and long-running jobs. The pipeline can be modified to trigger a MediaConvert job instead of a Lambda function.

Option B is incorrect because Lambda functions have a maximum execution time of 15 minutes; increasing memory does not extend timeout. Option C is incorrect because using a larger Lambda function still has the 15-minute limit. Option D is incorrect because Step Functions orchestrate Lambda functions but do not extend the individual Lambda timeout.

Practice this question →

209

MCQhard

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

A.S3 Standard

B.S3 Glacier Deep Archive

C.S3 One Zone-IA

D.S3 Intelligent-Tiering

AnswerD

Intelligent-Tiering optimizes cost automatically.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Exam trap

The SAP-C02 exam often tests the misconception that S3 Intelligent-Tiering is only for unpredictable access patterns, but the trap here is that candidates overlook its ability to maintain immediate query performance for Athena and Redshift Spectrum by keeping frequently accessed data in low-latency tiers, while still minimizing costs for cold data, making it superior to static storage classes for a large data lake with evolving access patterns.

How to eliminate wrong answers

Option A (S3 Standard) is wrong because it is designed for frequently accessed data and would be cost-prohibitive for petabytes of data that may become less active over time, leading to unnecessary high storage costs. Option B (S3 Glacier Deep Archive) is wrong because it has a retrieval time of 12 hours or more, which would prevent immediate query performance required by Athena and Redshift Spectrum. Option C (S3 One Zone-IA) is wrong because it stores data in a single Availability Zone, which risks data loss if that AZ fails, and it is not suitable for a durable data lake; also, it incurs retrieval costs that can accumulate with frequent queries, negating cost benefits.

Practice this question →

210

MCQhard

A company runs a critical e-commerce platform on AWS. The application is deployed across multiple Availability Zones in a single region (us-east-1). The architecture includes an Application Load Balancer (ALB), an EC2 Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ database. The application experiences periodic spikes in traffic, and the Auto Scaling group scales out successfully. However, during a recent traffic spike, the database CPU utilization reached 90%, causing increased latency and some database connection timeouts. The company needs to improve the database performance to handle the spikes without over-provisioning. The solutions architect must design a solution that reduces the load on the primary database instance and improves read scalability. The application is read-heavy, with a read-to-write ratio of 80:20. Which solution should the architect implement?

A.Implement an Amazon ElastiCache Redis cluster to cache frequent database queries.

B.Increase the DB instance class to a larger size and enable Multi-AZ with synchronous replication.

C.Migrate the database to Amazon DynamoDB and use DynamoDB Accelerator (DAX) for read performance.

D.Create one or more Amazon RDS Read Replicas in the same region and configure the application to route read queries to the read replica endpoint.

AnswerD

Read replicas offload read traffic from the primary, improving performance for read-heavy workloads.

Why this answer

Amazon RDS Read Replicas can offload read traffic from the primary instance, reducing CPU utilization. For a read-heavy workload (80:20), creating Read Replicas in the same region and routing read queries to them is the most effective solution to improve read scalability without over-provisioning the primary. Option D is correct.

Option A (ElastiCache) is more suited for caching but does not offload database reads directly; it requires significant application changes and may not handle all query patterns. Option B (scaling up instance class) has scaling limits and is less cost-effective; Multi-AZ is for high availability, not read scaling. Option C (DynamoDB) is a different database; migrating would be complex and unnecessary.

Practice this question →

211

Multi-Selecthard

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Select 2 answers

A.Use Amazon EBS Multi-Attach to attach volumes to instances in another region.

B.Use AWS Backup to create a backup plan with a daily backup.

C.Use AWS CloudFormation to recreate the EC2 instances from a template.

D.Configure Amazon EBS snapshots to be taken every 15 minutes.

E.Copy EBS snapshots to another AWS Region and automate restoring them into EBS volumes.

AnswersD, E

Meets the 15-minute RPO.

Why this answer

Taking Amazon EBS snapshots every 15 minutes ensures that the RPO of 15 minutes is met, as the maximum data loss is limited to the interval between snapshots. Option E is correct because copying EBS snapshots to another AWS Region and automating their restoration into EBS volumes enables cross-region recovery, which is necessary since the application runs in a single Region and the RTO of 2 hours allows time for the restore process.

Exam trap

The trap here is that candidates often confuse RPO with RTO and incorrectly assume that daily backups (Option B) or instance recreation (Option C) are sufficient, failing to recognize that the 15-minute RPO requires frequent snapshot intervals and cross-region replication for true disaster recovery.

Practice this question →

212

MCQhard

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

A.Add read replicas to offload read queries.

B.Increase the DB instance class to a larger size.

C.Implement Amazon RDS Proxy to manage database connections.

D.Increase the maximum number of EC2 instances in the Auto Scaling group.

AnswerC

RDS Proxy pools connections, reducing the load on the database and preventing connection exhaustion.

Why this answer

The issue stems from database connections hitting the maximum limit, causing CPU saturation and 503 errors. Amazon RDS Proxy sits between the application and the database, efficiently managing and pooling connections from the EC2 instances, reducing the number of open connections to the RDS instance and preventing connection exhaustion. This allows the existing connection pooling on the EC2 side to scale without overwhelming the database, directly addressing the root cause.

Exam trap

The trap here is that candidates often confuse connection exhaustion with CPU or memory bottlenecks and choose vertical scaling (Option B) or read replicas (Option A), missing that the core issue is the fixed connection pool size and the database's max connections limit, which RDS Proxy directly addresses by pooling and reusing connections.

How to eliminate wrong answers

Option A is wrong because adding read replicas offloads read queries but does not reduce the number of database connections hitting the primary instance; the connection limit and CPU spike from connection overhead remain. Option B is wrong because increasing the DB instance class provides more CPU and memory but does not solve the connection limit issue; the application will still exhaust the max connections, and scaling vertically is a temporary fix that increases cost without addressing the architectural bottleneck. Option D is wrong because increasing the maximum number of EC2 instances in the Auto Scaling group would increase the number of application servers, each with a fixed connection pool, potentially worsening the connection exhaustion and CPU spike on the database.

Practice this question →

213

Multi-Selecteasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Select 2 answers

A.Launch all EC2 instances in a single Availability Zone.

B.Configure the ALB as internet-facing and attach it to multiple Availability Zones.

C.Launch EC2 instances in at least two Availability Zones.

D.Use a Network Load Balancer instead of an Application Load Balancer.

E.Assign Elastic IP addresses to each EC2 instance.

AnswersB, C

Internet-facing ALB with multiple AZs provides HA.

Why this answer

An internet-facing Application Load Balancer (ALB) must be attached to multiple Availability Zones (AZs) to provide high availability and fault tolerance. If the ALB is configured in only one AZ, a failure in that AZ would render the application unreachable. Option C is correct because EC2 instances must be launched in at least two AZs to serve as healthy targets for the ALB, ensuring that traffic can be routed to instances in another AZ if one AZ fails.

Exam trap

The trap here is that candidates may think launching instances in a single AZ is sufficient if the ALB is configured across multiple AZs, but the ALB requires healthy targets in each enabled AZ to maintain high availability; without instances in at least two AZs, the ALB cannot route traffic if the sole AZ fails.

Practice this question →

214

MCQhard

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

A.Configure an S3 event notification to directly invoke an AWS Lambda function that starts the MediaConvert job.

B.Configure an S3 event notification to publish to an Amazon SNS topic, which triggers an AWS Lambda function that starts the MediaConvert job.

C.Use Amazon EventBridge to detect S3 PUT events and route them to a Lambda function.

D.Configure an S3 event notification to send events to an Amazon SQS queue, and have a Lambda function poll the queue and start MediaConvert jobs.

AnswerA

This is a simple, reliable, and scalable event-driven pattern.

Why this answer

S3 event notifications can directly invoke a Lambda function with minimal latency and no intermediate components, making it the simplest and most reliable way to trigger MediaConvert jobs for each upload. S3 event notifications are designed to deliver events with at-least-once delivery semantics, ensuring no upload is missed even under high volumes. This direct integration avoids additional failure points like SNS or SQS, which could introduce delays or require extra configuration for scaling.

Exam trap

The trap here is that candidates may overcomplicate the solution by adding intermediate services like SNS or SQS, thinking they improve reliability, when in fact the direct S3-to-Lambda integration is the most reliable and scalable for this specific trigger pattern, and additional components only introduce unnecessary complexity and potential failure points.

How to eliminate wrong answers

Option B is wrong because adding an SNS topic between S3 and Lambda introduces an unnecessary intermediate hop that does not improve reliability or scalability; SNS is typically used for fan-out to multiple subscribers, but here only one Lambda function is needed, so the direct S3-to-Lambda integration is simpler and more reliable. Option C is wrong because Amazon EventBridge is not the native service for S3 event notifications; while EventBridge can capture S3 events via CloudTrail, this adds complexity and potential latency compared to native S3 event notifications, and it is not the most direct or recommended approach for triggering Lambda from S3 PUTs. Option D is wrong because using an SQS queue adds polling overhead and potential processing delays; while it can help with throttling, it is unnecessary for this use case because Lambda can scale automatically to handle high volumes of concurrent invocations from S3 events, and the queue introduces an extra component that could fail or require monitoring.

Practice this question →

215

MCQeasy

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

A.Add an Amazon ElastiCache Redis cluster in front of DynamoDB to cache session data.

B.Use an Auto Scaling group to add more EC2 instances during peak hours.

C.Enable DynamoDB Accelerator (DAX) for the session table.

D.Increase the size of the EC2 instances to handle more concurrent users.

AnswerC

DAX provides an in-memory cache for DynamoDB, reducing read latency without application changes.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed for Amazon DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, making it ideal for read-heavy session state workloads without requiring application-level cache management.

Exam trap

The trap here is that candidates often choose ElastiCache Redis (Option A) because it is a general-purpose cache, but they overlook that DAX is purpose-built for DynamoDB and eliminates the need for custom cache invalidation logic, making it the most effective and operationally simpler choice for this specific use case.

How to eliminate wrong answers

Option A is wrong because adding an ElastiCache Redis cluster in front of DynamoDB introduces operational complexity and potential data inconsistency between the cache and the database, whereas DAX provides a native, write-through cache that automatically synchronizes with DynamoDB. Option B is wrong because scaling EC2 instances with Auto Scaling addresses compute capacity, not the latency of reading session data from DynamoDB; the bottleneck is database read performance, not application server throughput. Option D is wrong because increasing EC2 instance size improves compute and memory capacity but does not reduce the latency of DynamoDB read operations; the session state is stored externally, so larger instances do not accelerate database access.

Practice this question →

216

MCQmedium

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

A.Amazon SNS

B.AWS Step Functions

C.Amazon SQS

D.Amazon Kinesis Data Streams

AnswerC

SQS decouples the API from Lambda and buffers requests.

Why this answer

Amazon SQS can buffer requests during spikes, allowing Lambda to process them at its own pace without dropping any.

Practice this question →

217

Multi-Selecthard

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

Select 2 answers

A.Associate the ALB with an AWS WAF web ACL.

B.Use an Application Load Balancer in front of the ECS service.

C.Use a Network Load Balancer in front of the ECS service.

D.Assign public IP addresses to the Fargate tasks.

E.Use Amazon CloudFront as a CDN.

AnswersA, B

WAF can be associated with ALB to filter malicious traffic.

Why this answer

AWS WAF can be associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS traffic at the application layer. This allows you to protect the containerized application from common web exploits like SQL injection or cross-site scripting. Option B is correct because an ALB is required to route internet traffic to the ECS Fargate service and to terminate TLS, which is necessary for WAF to inspect the request payload.

Exam trap

The trap here is that candidates often assume a Network Load Balancer can be used with WAF or that assigning public IPs to tasks is acceptable, but WAF requires Layer 7 inspection which only an ALB (or CloudFront) can provide, and direct public IPs bypass all security controls.

Practice this question →

218

MCQmedium

A company is designing a new event-driven architecture on AWS for processing orders. When a new order is placed, it must be validated, inventory checked, payment processed, and notification sent. Each step is independent and may take variable time. The company wants to decouple the steps and ensure that failures do not block the entire workflow. Which solution should a Solutions Architect recommend?

A.Use Amazon SQS queues for each step, with Lambda functions polling each queue and forwarding to the next step.

B.Use Amazon SNS to publish order events, and subscribe separate Lambda functions for validation, inventory, payment, and notification.

C.Use AWS Step Functions to define a state machine that invokes Lambda functions for each step, with retry and error handling.

D.Create a single Lambda function that performs all steps sequentially.

AnswerC

Step Functions provides orchestration, error handling, and visibility into the workflow.

Why this answer

AWS Step Functions is the correct choice because it provides a fully managed state machine that can orchestrate multiple Lambda functions with built-in retry logic, error handling, and parallel execution. This decouples each step (validation, inventory, payment, notification) while ensuring that failures in one step do not block the entire workflow, as Step Functions can handle errors gracefully with configurable retries and fallback states.

Exam trap

The trap here is that candidates often confuse decoupling with simple fan-out (SNS) or queue-based processing (SQS), overlooking the need for orchestration with error handling and sequential/parallel coordination that Step Functions uniquely provides.

How to eliminate wrong answers

Option A is wrong because using separate SQS queues with Lambda functions polling each queue introduces unnecessary complexity and latency, and does not natively support orchestration of sequential or parallel steps with error handling; it also requires custom code to manage retries and ordering. Option B is wrong because Amazon SNS is a pub/sub messaging service that fans out events to all subscribers simultaneously, but it cannot enforce a sequential order of steps or handle failures in one step without affecting others, as all subscribers receive the event at once and there is no built-in retry or error handling for the workflow. Option D is wrong because a single Lambda function performing all steps sequentially creates a monolithic architecture that violates the decoupling requirement, and any failure in a step would block the entire process with no built-in retry or error isolation.

Practice this question →

219

MCQhard

A media company is designing a video transcoding pipeline using AWS Lambda and Amazon S3. The pipeline must process videos uploaded to an S3 bucket, transcode them into multiple formats, and store the results in another S3 bucket. The processing time for each video can vary from a few seconds to several minutes. Which architecture will minimize cost and ensure all videos are processed, even if Lambda execution timeout is reached?

A.Configure S3 event notifications to invoke Lambda directly and use a dead-letter queue to capture failed events.

B.Use AWS Step Functions to orchestrate the transcoding workflow, with each step as a separate Lambda function.

C.Configure S3 event notifications to send messages to an Amazon SQS queue. Have Lambda poll the queue and process each message. Set the SQS visibility timeout to match the expected maximum processing time.

D.Use Amazon Kinesis Data Streams to ingest S3 events and have Lambda process records from the stream.

AnswerC

SQS decouples the trigger from processing, allowing Lambda to poll at its own pace; visibility timeout ensures messages are reprocessed if Lambda times out or fails.

Why this answer

Using S3 event notifications to send messages to an Amazon SQS queue decouples the upload from processing, allowing Lambda to poll the queue at its own pace. Setting the visibility timeout to match the expected maximum processing time ensures that if a Lambda invocation times out, the message becomes visible again after the visibility timeout, so it can be reprocessed. This minimizes cost (no additional services like Step Functions or Kinesis) and guarantees all videos are processed.

Option A is incorrect because direct Lambda invocation via S3 events can lead to throttling under high concurrency, and the dead-letter queue only captures events after all retries fail, but timeouts within the function may not be handled elegantly. Option B is incorrect because AWS Step Functions adds cost and complexity for orchestration; while it can manage long-running workflows, the simpler SQS approach is more cost-effective. Option D is incorrect because Amazon Kinesis Data Streams is designed for real-time streaming and is overkill for this batch-oriented transcoding pipeline, increasing cost and complexity.

Practice this question →

220

MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

A.Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks

B.Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access

C.Create IAM roles in each account with policies that require logging and block public access

D.Use AWS Config rules to detect non-compliant buckets and send notifications

AnswerB

SCPs centrally enforce restrictions across all accounts.

Why this answer

Service control policies (SCPs) at the OU level are the most scalable and secure way to enforce guardrails across all accounts in an AWS Organization. By denying actions that disable server access logging (e.g., s3:PutBucketLogging with a condition that the logging target is not set) and actions that enable public access (e.g., s3:PutBucketPublicAccessBlock with a condition that the block is not set to true), SCPs prevent non-compliant configurations from being created or modified, regardless of the IAM principal used. This approach is centralized, immutable by child accounts, and scales automatically as new accounts are added to the OU.

Exam trap

The trap here is that candidates often choose detective solutions like AWS Config (Option D) or deployment solutions like CloudFormation StackSets (Option A), failing to recognize that only a preventive, organization-wide guardrail like SCPs can enforce compliance at scale and prevent non-compliant actions from ever succeeding.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy compliant S3 buckets, but they cannot prevent users or roles in child accounts from subsequently modifying the bucket configuration to disable logging or enable public access, leaving the environment vulnerable to drift. Option C is wrong because IAM roles in each account are not scalable (they must be created and maintained per account) and cannot enforce requirements on actions performed by the root user or by services that do not assume the role; SCPs are the only mechanism that can restrict the root user. Option D is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets and send notifications, but they do not block the non-compliant action from occurring, meaning a bucket could be publicly accessible or lack logging for a period before remediation.

Practice this question →

221

MCQeasy

Refer to the exhibit. A CloudFormation stack creation failed. The architect needs to identify the reason for the failure. Which CLI command should be used to get detailed error messages?

A.aws cloudformation describe-stacks --stack-name my-stack

B.aws cloudformation describe-stack-events --stack-name my-stack

C.aws cloudformation get-template --stack-name my-stack

D.aws cloudformation list-stack-resources --stack-name my-stack

AnswerB

Correct. 'describe-stack-events' provides detailed events including error messages, which are useful for troubleshooting stack failures.

Why this answer

The 'describe-stack-events' command provides detailed events including error messages, which can be used to identify reasons for stack creation failure. Option A is incorrect because 'describe-stacks' only shows the stack status and output, not detailed error messages. Option C is incorrect because 'get-template' retrieves the template body, not events.

Option D is incorrect because 'list-stack-resources' lists resources, not events or errors.

Practice this question →

222

MCQmedium

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

A.Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.

B.Store logs on an EBS volume and take regular snapshots.

C.Write logs to the instance store volume of each EC2 instance.

D.Write logs to an Amazon S3 bucket mounted on each instance using NFS.

AnswerA

CloudWatch Logs persists logs independently of instance lifecycle and supports real-time streaming.

Why this answer

The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Exam trap

The trap here is that candidates may confuse instance store (ephemeral) with EBS (persistent) storage, or assume that mounting S3 via NFS is a straightforward AWS feature, when in fact CloudWatch Logs is the only fully managed, instance-lifecycle-independent solution for log retention in this scenario.

How to eliminate wrong answers

Option B is wrong because EBS snapshots are point-in-time backups and do not provide continuous log streaming; logs written to an EBS volume are lost if the instance is terminated and the volume is deleted, unless snapshots are taken frequently, which adds complexity and potential data loss between snapshots. Option C is wrong because instance store volumes are ephemeral and data is lost when the instance is stopped, terminated, or fails; they are not suitable for persistent log storage. Option D is wrong because mounting an S3 bucket via NFS is not a native AWS feature; it requires third-party tools or FUSE-based solutions, introduces latency and complexity, and does not guarantee real-time log streaming or seamless integration with instance scaling.

Practice this question →

223

MCQmedium

Refer to the exhibit. A company uses AWS CloudFormation to deploy an EC2 instance. The template uses a condition to select the instance type based on the environment. The company deploys the stack with the parameter EnvType set to 'prod'. What will be the instance type of the created EC2 instance?

A.t3.large

B.The instance type will be determined at runtime.

C.The instance will not be created because the condition is false.

D.t2.micro

AnswerA

The condition IsProduction is true, so Fn::If returns t3.large.

Why this answer

The condition in the CloudFormation template evaluates to true when EnvType equals 'prod', so the EC2 instance is created with the instance type specified in the condition's true branch, which is t3.large. The template uses a condition like 'If(Equals(EnvType, 'prod'), t3.large, t2.micro)', and since the parameter is set to 'prod', the Fn::If intrinsic function returns 't3.large'.

Exam trap

The trap here is that candidates may confuse a false condition with skipping resource creation, but in this case the condition is used only to select a property value, not to conditionally create the resource itself.

How to eliminate wrong answers

Option B is wrong because the instance type is not determined at runtime; CloudFormation resolves the condition and intrinsic functions at stack creation time, not during instance boot. Option C is wrong because the condition is true (EnvType equals 'prod'), so the instance is created; a false condition would omit the resource entirely. Option D is wrong because t2.micro is the value for the false branch of the condition, which is used only when EnvType is not 'prod'.

Practice this question →

224

MCQhard

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

A.The lifecycle rule only applies to noncurrent versions, not current objects.

B.The bucket name conflicts with an existing bucket.

C.Versioning is not enabled on the bucket.

D.The lifecycle rule requires a region-specific prefix.

AnswerA

NoncurrentVersionExpirationInDays only deletes old versions, not current objects.

Why this answer

The lifecycle rule in the template likely uses `NoncurrentVersionExpirationInDays`, which only applies to noncurrent versions, not current objects. To delete current objects after 30 days, an `ExpirationInDays` rule is needed. Versioning being enabled (option C) is necessary for the noncurrent version expiration to work, but the issue is that current objects are not expiring.

The bucket name conflict (option B) would cause a deployment failure, not a lifecycle misconfiguration. Region-specific prefix (option D) is not required for lifecycle rules.

Practice this question →

225

MCQmedium

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

A.Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.

B.Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

C.Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

D.Store the configuration data in environment variables in the ECS task definition.

AnswerA

Secrets Manager provides encryption, rotation, and ECS integration.

Why this answer

AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Exam trap

The trap here is that candidates often choose Systems Manager Parameter Store (Option C) because it is cheaper and also supports SecureString, but they overlook that AWS Secrets Manager is the specifically recommended service for secrets that require rotation and tighter integration with ECS, especially for database credentials.

How to eliminate wrong answers

Option B is wrong because storing configuration data in an S3 bucket with SSE-S3 requires the container to download the file at startup, which introduces complexity, potential exposure of the bucket or object, and lacks native integration with ECS task definitions for secure injection. Option C is wrong because while Systems Manager Parameter Store (SecureString) can store secrets, it does not support automatic secret rotation natively (unlike Secrets Manager), and AWS best practices recommend Secrets Manager for database credentials and other secrets that require rotation. Option D is wrong because storing secrets in environment variables in the ECS task definition exposes them in plaintext in the task definition and container metadata, violating security best practices for secret management.

Practice this question →