AWS Certified Solutions Architect - Associate practice questions

Question 1

An architect is being asked at what scope a security group's rules take effect for a workload running on EC2. Per the VPC documentation, which option matches?

Accepted Answer

After you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance, with each security group having its own inbound and outbound rules per VPC.

Answer

Security groups apply at the AWS Region scope only, and every EC2 instance launched in that Region inherits exactly the same inbound and outbound rules regardless of the customer's intent at all.

Answer

Security groups apply at the AWS account scope only, and there is no documented way to attach a different security group to two different EC2 instances inside the same VPC at the same time.

Answer

Security groups apply only when an EC2 instance is in the stopped state and are ignored by AWS whenever the EC2 instance is running, regardless of how many rules the security group itself contains.

Question 2

An architect is being asked, working at a media streaming company, to commit to an RTO target for a multi-Region Aurora workload and the architect must reference the Aurora Global Database documentation. Per that documentation, which option matches the documented RTO for Aurora Global Database?

Accepted Answer

Recovery time objective (RTO) is the time it takes a system to return to a working state after a disaster or service outage, and for Aurora Global Database, RTO can be in the order of minutes.

Answer

Recovery time objective (RTO) for Aurora Global Database is documented as a fixed 24 hours regardless of workload size, AWS Region pair, or the customer's database instance class configuration.

Answer

Recovery time objective (RTO) for Aurora Global Database is documented as a fixed 30 days regardless of workload size, AWS Region pair, or the customer's database instance class configuration.

Answer

Recovery time objective (RTO) for Aurora Global Database is not defined by AWS and the customer is solely responsible for measuring and committing to an RTO through a third-party DR tooling provider.

Question 3

An architect is being asked, working at a media streaming company, to deliver static and dynamic web content with low latency to a global audience and the architect must choose the AWS content delivery service. Per the documentation, which option matches?

Accepted Answer

You create an Amazon CloudFront distribution to tell CloudFront from where you want content to be delivered, and the details about how to track and manage content delivery to viewers globally.

Answer

Amazon CloudFront distributions are AWS-managed EC2 instances that the customer launches in every AWS Region manually, with no documented role in low-latency global content delivery in any AWS Region.

Answer

Amazon CloudFront distributions are an Amazon Route 53 record set that resolves the application's DNS name to a fixed origin and has no documented role in any caching or low-latency delivery at all.

Answer

Amazon CloudFront distributions are a one-time data export service for moving on-premises data into AWS and explicitly do not provide any documented capability for any content-delivery workload at all.

Question 4

An architect is being asked to weigh in. A fintech startup runs an interruption-tolerant batch workload and the architect must choose the documented EC2 purchasing option that uses spare EC2 capacity at a steep discount. Per the documentation, which option matches?

Accepted Answer

A Spot Instance is an instance that uses spare EC2 capacity that is available for less than the On-Demand price, enabling significant cost reduction in exchange for accepting interruption when capacity changes.

Answer

A Spot Instance is a Reserved Instance variant that the customer commits to for a fixed three-year term, with no documented use of spare EC2 capacity and no documented discount on the On-Demand price.

Answer

A Spot Instance is a billing label only and AWS does not provide any actual EC2 capacity at the Spot price, regardless of the workload's interruption tolerance or the customer's actual cost expectations at all.

Answer

A Spot Instance is an EC2 Dedicated Host purchase option that the customer commits to for a fixed one-year term and is priced higher than On-Demand, regardless of the workload's interruption tolerance.

Question 5

An organization is designing how Secrets Manager identifies the caller of a secret read and the architect must explain how the service verifies the caller. Per the documentation, which option matches?

Accepted Answer

Secrets Manager uses a sign-in process with passwords, access keys, and multi-factor authentication (MFA) tokens to verify the identity of the users that interact with the service.

Answer

Secrets Manager identifies callers by source IPv4 address only, and architects must maintain an allowlist of source addresses at the VPC level for every workload that intends to read a secret.

Answer

Secrets Manager identifies callers by EC2 instance type only, refusing any GetSecretValue call that originates from an instance whose type is not on the customer's pre-approved instance allowlist.

Answer

Secrets Manager identifies callers by the User-Agent HTTP header of the SDK and refuses requests from any SDK whose User-Agent is not on a static allowlist that AWS maintains by AWS Region.

Question 6

A media streaming company is designing a multi-Region active-active table for a globally scaled application and the architect must explain what DynamoDB global tables provide. Per the documentation, which option matches?

Accepted Answer

DynamoDB global tables is a fully managed, multi-Region, and multi-active database feature that provides easy to use data replication and fast local read and write performance for globally scaled applications.

Answer

DynamoDB global tables is a single-Region read replica feature that mirrors a primary table inside one AWS Region and does not replicate any data across AWS Regions or AWS accounts at any point at all.

Answer

DynamoDB global tables is an S3 Glacier Deep Archive backup feature that snapshots a DynamoDB table once per year to cold storage and is not used to provide any multi-Region read or write capability.

Answer

DynamoDB global tables is an Amazon Redshift cross-cluster federation feature that joins data across Redshift clusters and is unrelated to multi-Region replication of any Amazon DynamoDB table at all.

Question 7

An architect is being asked to weigh in. A media streaming company is reviewing an older design that uses EFS Max I/O performance mode and the architect must explain the documented status and scope of Max I/O today. Per the documentation, which option matches?

Accepted Answer

Max I/O mode is a previous generation performance type designed for highly parallelized workloads that can tolerate higher latencies, and it is not supported for One Zone file systems or file systems using Elastic throughput.

Answer

Max I/O mode is the only AWS-recommended performance mode for all One Zone file systems and the architect must convert any existing General Purpose file system to Max I/O for any One Zone deployment.

Answer

Max I/O mode is a synonym for General Purpose mode and AWS treats both labels identically, with no documented difference in latency, parallelism, or throughput between the two modes in any AWS Region at all.

Answer

Max I/O mode is mandatory for any file system that uses Elastic throughput and the architect cannot use any other performance mode for an Elastic throughput EFS file system in any AWS Region.

Question 8

An architect is being asked to weigh in. A media streaming company has highly variable EC2 usage across instance families and AWS Regions and the architect must choose the Savings Plan variant that gives the broadest pricing flexibility. Per the documentation, which option matches?

Accepted Answer

Compute Savings Plans provide lower prices on Amazon EC2 instance usage regardless of instance family, instance size, OS, tenancy, or AWS Region, and also apply to AWS Fargate and AWS Lambda usage.

Answer

Compute Savings Plans apply only to a single instance family in a single AWS Region and explicitly do not apply to AWS Fargate or AWS Lambda usage, regardless of the customer's workload requirements.

Answer

Compute Savings Plans are documented only as a billing aggregator and have no documented discount applied to any EC2, Fargate, or Lambda usage in any AWS Region for any customer workload of theirs at all.

Answer

Compute Savings Plans apply only to GovCloud AWS Regions and explicitly do not apply to any commercial AWS Region, regardless of the customer's actual EC2, Fargate, or Lambda usage in the AWS account.

Question 9

An architect is being asked how to keep an internet-facing application available during a volumetric DDoS attack on AWS. Per the AWS Shield documentation, which option matches?

Accepted Answer

You can leverage these protections to ensure the availability of the applications that you run on AWS by designing and configuring your architecture for DDoS resiliency.

Answer

Disable Elastic Load Balancing during any volumetric DDoS event and route all traffic directly to the EC2 instance's public IP address so that the load balancer is not a target of the attack itself.

Answer

Turn off Amazon CloudWatch monitoring during any volumetric DDoS event so that the burst of metric writes does not consume the CloudWatch quota for the AWS account and slow other workloads.

Answer

Delete the workload's AWS Shield Advanced subscription as soon as a DDoS attack starts so that AWS treats the workload as a free-tier resource and does not bill for any mitigation work performed.

Question 10

A platform team is designing a public web tier on EC2 across multiple Availability Zones and the architect must explain what Elastic Load Balancing does for incoming traffic. Per the ELB documentation, which option matches?

Accepted Answer

Elastic Load Balancing automatically distributes your incoming traffic across multiple targets, such as EC2 instances, containers, and IP addresses, in one or more Availability Zones.

Answer

Elastic Load Balancing is an AWS Backup vault for HTTP request payloads, retaining each request for 30 days and is not used to forward live HTTP traffic to any registered target group at all.

Answer

Elastic Load Balancing is an AWS-managed BGP route reflector that exchanges routes with the customer's on-premises routers and does not forward any application-layer HTTP or TCP traffic itself.

Answer

Elastic Load Balancing is a single EC2 instance that the customer launches and operates manually, with AWS providing no built-in scaling, health checking, or cross-AZ distribution capabilities at all.

Question 11

An architect is being asked, working at a media streaming company, to justify adding DAX in front of a DynamoDB table that already responds in single-digit milliseconds. Per the documentation, which option matches?

Accepted Answer

DynamoDB response times can be measured in single-digit milliseconds, but certain use cases require response times in microseconds, and for these DAX delivers fast response times for eventually consistent data.

Answer

DynamoDB response times are documented as multi-second by default and DAX is intended only as a one-time backfill mechanism, with no documented role in lowering read latency from milliseconds to microseconds.

Answer

DynamoDB response times are documented as identical to relational database response times and DAX is documented as a stub feature that has no effect on response times in any AWS Region for any workload.

Answer

DynamoDB response times are documented as exclusively microseconds by default and DAX is documented as a degraded-mode caching layer that returns results in seconds, regardless of the access pattern at all.

Question 12

An architect is being asked, working at a fintech startup, whether S3 Intelligent-Tiering charges retrieval fees when accessing an object that has been moved to a lower-cost access tier within the storage class. Per the documentation, which option matches?

Accepted Answer

There are no retrieval charges in S3 Intelligent-Tiering, with the storage class delivering automatic storage cost savings in three low latency and high throughput access tiers.

Answer

There is a per-GB retrieval charge in S3 Intelligent-Tiering whenever an object is accessed from any access tier other than the most expensive frequent-access tier, regardless of access pattern at the time.

Answer

There is a flat $1,000 retrieval charge for every PutObject and every GetObject made against any object in any access tier within S3 Intelligent-Tiering, regardless of the object's size or access frequency.

Answer

There is a multi-hour retrieval delay for any access to any object in any access tier within S3 Intelligent-Tiering, behaving identically to S3 Glacier Flexible Retrieval for all access patterns at all times.

Question 13

An architect is being asked how Secrets Manager decides whether a particular caller is allowed to perform a particular action on a particular secret. Per the documentation, which option matches?

Accepted Answer

Secrets Manager uses policies to define who has access to which resources, and which actions the identity can take on those resources, with access control ensuring only approved individuals can perform operations.

Answer

Secrets Manager evaluates a fixed AWS-managed allow-list that lists every IAM principal in the account and is updated by AWS Support tickets on a strictly weekly basis at the architect's request.

Answer

Secrets Manager applies AWS Organizations service control policies only at the secret-rotation Lambda function level and ignores any identity-based or resource-based policies attached to the secret itself.

Answer

Secrets Manager grants access based on Amazon CloudWatch alarm state, allowing any GetSecretValue call only when the secret's read-latency alarm has been in the OK state for the last 24 hours.

Question 14

An architect is being asked which OSI layer the Gateway Load Balancer operates at and which traffic types it forwards. Per the documentation, which option matches?

Accepted Answer

A Gateway Load Balancer operates at the third layer of the Open Systems Interconnection (OSI) model, the network layer, and listens for all IP packets across all ports, forwarding traffic to the target group.

Answer

A Gateway Load Balancer operates at the seventh layer of the OSI model and inspects HTTP request headers, forwarding only HTTP and HTTPS traffic to the registered virtual appliance target group at all times.

Answer

A Gateway Load Balancer operates at the second layer of the OSI model, forwarding Ethernet frames between VPCs, and explicitly does not handle any IP-layer packets, regardless of the listener configuration.

Answer

A Gateway Load Balancer operates at the fourth layer of the OSI model and forwards only TCP and UDP traffic, dropping all other IP protocol traffic such as ICMP or GRE between the source and target group.

Question 15

A platform team is being onboarded to Amazon ECS and the architect must explain what an ECS cluster actually is at the conceptual level. Per the documentation, which option matches?

Accepted Answer

An Amazon ECS cluster is a logical grouping of tasks or services that provides the infrastructure capacity for your containerized applications, with multiple infrastructure types available per cluster.

Answer

An Amazon ECS cluster is a single EC2 instance that the architect provisions manually and on which AWS deploys tasks one at a time, with no notion of any logical grouping of tasks at any level.

Answer

An Amazon ECS cluster is an Amazon S3 bucket that the architect uses to hold container image layers, with no documented role in providing any infrastructure capacity for any containerized application of theirs.

Answer

An Amazon ECS cluster is a one-time AWS Snowball Edge accessory that the architect ships to a remote site to run containers offline, with no documented role inside any AWS Region for any application.

AWS Certified Solutions Architect - Associate

Sample questions

Sources

Similar exams