1. An application running on EC2 instances needs to read objects from an S3 bucket. What is the most secure way to grant this access?
- a.Attach an IAM role to the EC2 instances with a policy granting least-privilege S3 read access✓
- b.Store long-lived credentials in a file on the instance
- c.Embed an IAM user's access keys in the application code
- d.Make the S3 bucket public and filter by source IP
IAM roles provide temporary, automatically rotated credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived keys. Scoping the role's policy to only the required bucket and actions follows the principle of least privilege. Hard-coded access keys and public buckets create serious security risks and violate the Security pillar of the Well-Architected Framework.
2. A company must encrypt data at rest in S3 while retaining full control over the key material, key rotation policy, and the ability to audit every key usage via CloudTrail. Which option best meets this requirement?
- a.Client-side encryption with a hard-coded static key
- b.Server-side encryption with AWS KMS customer managed keys (SSE-KMS)✓
- c.Server-side encryption with Amazon S3 managed keys (SSE-S3)
- d.No encryption, relying on bucket policies only
SSE-KMS with a customer managed key lets you define rotation, key policies, and grants while logging each decrypt/encrypt call in CloudTrail for auditing. SSE-S3 encrypts data but gives you no control over or visibility into the key. Bucket policies control access but do not encrypt data at rest.
3. An application needs to retrieve database credentials at runtime, and the credentials must be automatically rotated on a schedule. Which service is purpose-built for this?
- a.IAM instance profile tags
- b.AWS Secrets Manager✓
- c.Amazon S3 with encryption
- d.AWS Systems Manager Parameter Store standard parameters
Secrets Manager stores credentials encrypted with KMS and provides native automatic rotation, including built-in integration with RDS to rotate database passwords. Standard Parameter Store parameters can hold secrets but do not offer managed rotation. Storing credentials in S3 or tags is insecure and lacks rotation.
4. A mobile and web application needs user sign-up, sign-in, and federated identity with Google and Apple, returning tokens the app can use to call an API. Which service should be used?
- a.AWS IAM users, one per end user
- b.Amazon Cognito user pools with identity federation✓
- c.AWS Directory Service
- d.AWS KMS
Amazon Cognito user pools provide managed user directories, sign-up/sign-in flows, and federation with social and enterprise identity providers, issuing JWT tokens for authorizing API calls. Creating an IAM user per application end user does not scale and is not intended for app-user authentication. KMS handles encryption keys, not identity.
5. A company wants its RDS database to automatically fail over to a standby in another Availability Zone with minimal downtime during an AZ outage. Which feature provides this?
- a.Storing backups in S3 Glacier
- b.RDS Multi-AZ deployment with a synchronous standby✓
- c.A read replica in the same AZ
- d.Manual snapshots taken hourly
RDS Multi-AZ maintains a synchronous standby replica in a second Availability Zone and automatically fails over to it if the primary fails, providing high availability. Read replicas are for scaling reads and are asynchronous, not automatic failover. Snapshots and Glacier backups aid recovery but do not deliver automatic failover.
6. To decouple a fluctuating order-processing workload so that a spike in orders does not overwhelm the processing tier, which service should sit between the producers and consumers?
- a.Amazon Route 53 latency routing
- b.Amazon SQS queue that the processing tier polls✓
- c.An EBS volume shared across instances
- d.A single large EC2 instance for all processing
Amazon SQS buffers messages, letting the processing tier consume at its own pace and absorbing spikes without dropping work, which improves resilience and enables independent scaling. A single instance is a bottleneck and single point of failure. Route 53 handles DNS routing and EBS is block storage, neither of which decouples the tiers.
7. A shared file system must be mounted concurrently by hundreds of Linux EC2 instances across multiple Availability Zones, and it must scale storage automatically. Which service fits best?
- a.Instance store volumes
- b.Amazon EBS volume attached to each instance
- c.A single S3 bucket mounted as a block device
- d.Amazon EFS mounted from all instances✓
Amazon EFS is a fully managed, elastic NFS file system that many instances across multiple AZs can mount simultaneously, scaling capacity automatically. A standard EBS volume attaches to one instance in one AZ, and instance store is ephemeral. S3 is object storage and is not a POSIX file system for concurrent block mounts.
8. A read-heavy application repeatedly runs the same expensive database queries, causing high latency. Which addition most improves read performance with minimal application change?
- a.Add Amazon ElastiCache to cache frequent query results in memory✓
- b.Move the database to a larger EBS magnetic volume
- c.Enable S3 Transfer Acceleration
- d.Increase the RDS instance storage size
ElastiCache (Redis or Memcached) stores frequently accessed query results in memory, serving repeated reads with sub-millisecond latency and offloading the database. Growing storage or using magnetic EBS does not reduce query latency for hot data. S3 Transfer Acceleration speeds S3 uploads and is unrelated to database queries.
9. A media company serves large video files to a global audience and wants to reduce latency and origin load by caching content near users. Which service should be used?
- a.Amazon EFS
- b.A larger EC2 instance in one Region
- c.An internet gateway
- d.Amazon CloudFront✓
CloudFront is a content delivery network that caches content at edge locations worldwide, lowering latency for global viewers and offloading requests from the origin. A single larger instance still serves from one Region with no edge caching. EFS is regional file storage and an internet gateway only provides connectivity, neither of which delivers a global CDN.
10. A fault-tolerant batch-processing job can be interrupted and resumed and runs at flexible times. Which EC2 purchasing option minimizes cost for this workload?
- a.A three-year Reserved Instance for steady 24/7 use
- b.EC2 Spot Instances✓
- c.A Dedicated Host
- d.On-Demand Instances
Spot Instances offer the deepest discount (up to about 90% off On-Demand) and are ideal for interruption-tolerant, flexible workloads like batch jobs. On-Demand costs the most for intermittent work, and Reserved Instances or Dedicated Hosts commit you to capacity better suited to steady-state, always-on usage.
11. Data is stored in S3 with unpredictable and changing access patterns, and the team wants to minimize cost without manually moving objects or writing lifecycle rules. Which storage class fits best?
- a.S3 Standard for everything
- b.S3 Glacier Deep Archive
- c.S3 One Zone-Infrequent Access
- d.S3 Intelligent-Tiering✓
S3 Intelligent-Tiering automatically moves objects between access tiers based on usage, optimizing cost when access patterns are unknown or changing, with no retrieval fees for the frequent and infrequent tiers. S3 Standard misses savings on cold data, Glacier Deep Archive adds retrieval latency unsuitable for unpredictable access, and One Zone-IA reduces resilience by storing in a single AZ.
12. A company runs a predictable, steady baseline of compute across EC2 and Fargate and wants the best discount while retaining flexibility to change instance families and Regions. Which commitment model is most appropriate?
- a.Pay On-Demand rates continuously
- b.Standard Reserved Instances locked to one instance type
- c.Compute Savings Plans with a one- or three-year hourly spend commitment✓
- d.Spot Instances for the steady baseline
Compute Savings Plans offer discounts comparable to Reserved Instances in exchange for an hourly spend commitment, while flexibly applying across instance families, sizes, Regions, and even Fargate and Lambda. Standard RIs lock you to a specific instance type and Region, reducing flexibility. On-Demand forgoes savings, and Spot is unsuitable for a steady baseline that must not be interrupted.