AWS Certified Solutions Architect – Associate

An application running on EC2 instances needs to read objects from an S3 bucket. What is the most secure way to grant this access?

1. AStore long-lived credentials in a file on the instance
2. BMake the S3 bucket public and filter by source IP
3. CAttach an IAM role to the EC2 instances with a policy granting least-privilege S3 read accessCorrect
4. DEmbed an IAM user's access keys in the application code

Why: IAM roles provide temporary, automatically rotated credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived keys. Scoping the role's policy to only the required bucket and actions follows the principle of least privilege. Hard-coded access keys and public buckets create serious security risks and violate the Security pillar of the Well-Architected Framework.

A read-heavy application repeatedly runs the same expensive database queries, causing high latency. Which addition most improves read performance with minimal application change?

1. AIncrease the RDS instance storage size
2. BMove the database to a larger EBS magnetic volume
3. CAdd Amazon ElastiCache to cache frequent query results in memoryCorrect
4. DEnable S3 Transfer Acceleration

Why: ElastiCache (Redis or Memcached) stores frequently accessed query results in memory, serving repeated reads with sub-millisecond latency and offloading the database. Growing storage or using magnetic EBS does not reduce query latency for hot data. S3 Transfer Acceleration speeds S3 uploads and is unrelated to database queries.