AWS Certified Solutions Architect – Associate — All Questions

An application running on EC2 instances needs to read objects from an S3 bucket. What is the most secure way to grant this access?

• a.Embed an IAM user's access keys in the application code
• b.Store long-lived credentials in a file on the instance
• c.Attach an IAM role to the EC2 instances with a policy granting least-privilege S3 read access✓
• d.Make the S3 bucket public and filter by source IP

IAM roles provide temporary, automatically rotated credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived keys. Scoping the role's policy to only the required bucket and actions follows the principle of least privilege. Hard-coded access keys and public buckets create serious security risks and violate the Security pillar of the Well-Architected Framework.

A company must encrypt data at rest in S3 while retaining full control over the key material, key rotation policy, and the ability to audit every key usage via CloudTrail. Which option best meets this requirement?

• a.Server-side encryption with AWS KMS customer managed keys (SSE-KMS)✓
• b.Server-side encryption with Amazon S3 managed keys (SSE-S3)
• c.Client-side encryption with a hard-coded static key
• d.No encryption, relying on bucket policies only

SSE-KMS with a customer managed key lets you define rotation, key policies, and grants while logging each decrypt/encrypt call in CloudTrail for auditing. SSE-S3 encrypts data but gives you no control over or visibility into the key. Bucket policies control access but do not encrypt data at rest.

A web application behind an Application Load Balancer is being targeted by SQL injection and cross-site scripting attempts at the HTTP layer. Which service should be added to filter this malicious traffic?

• a.AWS Shield Standard
• b.AWS WAF with managed rule groups✓
• c.Amazon GuardDuty
• d.A network ACL on the public subnet

AWS WAF inspects HTTP/HTTPS requests and can block SQL injection and XSS using AWS managed rule groups attached to the ALB. Shield Standard protects against network/transport-layer DDoS, not application-layer exploits. NACLs operate on IP/port and cannot parse request content.

An RDS database must be reachable only from application servers in a private subnet and never from the internet. Which configuration achieves this?

• a.Place the database in a public subnet with an Elastic IP
• b.Attach an internet gateway route to the database subnet
• c.Open the database security group to 0.0.0.0/0 on port 3306
• d.Place the database in a private subnet and set its security group to allow inbound traffic only from the application tier's security group✓

Deploying RDS in a private subnet with no route to an internet gateway keeps it unreachable from the internet. Referencing the application tier's security group as the source in the database security group restricts access to just those instances, following least privilege. Opening 0.0.0.0/0 or using public subnets would expose the database.

An application needs to retrieve database credentials at runtime, and the credentials must be automatically rotated on a schedule. Which service is purpose-built for this?

• a.AWS Secrets Manager✓
• b.AWS Systems Manager Parameter Store standard parameters
• c.Amazon S3 with encryption
• d.IAM instance profile tags

Secrets Manager stores credentials encrypted with KMS and provides native automatic rotation, including built-in integration with RDS to rotate database passwords. Standard Parameter Store parameters can hold secrets but do not offer managed rotation. Storing credentials in S3 or tags is insecure and lacks rotation.

A mobile and web application needs user sign-up, sign-in, and federated identity with Google and Apple, returning tokens the app can use to call an API. Which service should be used?

• a.AWS IAM users, one per end user
• b.AWS Directory Service
• c.Amazon Cognito user pools with identity federation✓
• d.AWS KMS

Amazon Cognito user pools provide managed user directories, sign-up/sign-in flows, and federation with social and enterprise identity providers, issuing JWT tokens for authorizing API calls. Creating an IAM user per application end user does not scale and is not intended for app-user authentication. KMS handles encryption keys, not identity.

A security team wants to allow developers to launch EC2 instances but must ensure they cannot detach or modify IAM policies. Which approach follows AWS best practice?

• a.Grant developers the AdministratorAccess managed policy
• b.Attach a least-privilege IAM policy granting only the specific EC2 actions needed, with no IAM write permissions✓
• c.Share the root account credentials for convenience
• d.Give every developer full IAM permissions and monitor with CloudTrail

Least privilege means granting only the specific permissions required for the task, so a scoped policy allowing EC2 launch actions without IAM write access is correct. AdministratorAccess and root credentials violate least privilege and separation of duties. Monitoring after over-permissioning does not prevent misuse.

A company wants its RDS database to automatically fail over to a standby in another Availability Zone with minimal downtime during an AZ outage. Which feature provides this?

• a.A read replica in the same AZ
• b.Manual snapshots taken hourly
• c.RDS Multi-AZ deployment with a synchronous standby✓
• d.Storing backups in S3 Glacier

RDS Multi-AZ maintains a synchronous standby replica in a second Availability Zone and automatically fails over to it if the primary fails, providing high availability. Read replicas are for scaling reads and are asynchronous, not automatic failover. Snapshots and Glacier backups aid recovery but do not deliver automatic failover.

To decouple a fluctuating order-processing workload so that a spike in orders does not overwhelm the processing tier, which service should sit between the producers and consumers?

• a.Amazon SQS queue that the processing tier polls✓
• b.A single large EC2 instance for all processing
• c.Amazon Route 53 latency routing
• d.An EBS volume shared across instances

Amazon SQS buffers messages, letting the processing tier consume at its own pace and absorbing spikes without dropping work, which improves resilience and enables independent scaling. A single instance is a bottleneck and single point of failure. Route 53 handles DNS routing and EBS is block storage, neither of which decouples the tiers.

A stateless web tier runs on EC2 across two Availability Zones. The architecture must automatically replace unhealthy instances and adjust capacity to demand. Which combination achieves this?

• a.A single EC2 instance with a static Elastic IP
• b.Manually launching instances when alarms fire
• c.An Application Load Balancer only, with fixed instances
• d.An Auto Scaling group spanning both AZs behind an Application Load Balancer with health checks✓

An Auto Scaling group distributed across multiple AZs launches replacement instances when health checks fail and scales in or out based on demand, while the ALB spreads traffic across healthy targets. A single instance or manual intervention cannot self-heal. An ALB alone does not replace failed instances or change capacity.

A shared file system must be mounted concurrently by hundreds of Linux EC2 instances across multiple Availability Zones, and it must scale storage automatically. Which service fits best?

• a.Amazon EBS volume attached to each instance
• b.Amazon EFS mounted from all instances✓
• c.Instance store volumes
• d.A single S3 bucket mounted as a block device

Amazon EFS is a fully managed, elastic NFS file system that many instances across multiple AZs can mount simultaneously, scaling capacity automatically. A standard EBS volume attaches to one instance in one AZ, and instance store is ephemeral. S3 is object storage and is not a POSIX file system for concurrent block mounts.

A company needs a relational database that provides MySQL compatibility, replicates six copies of data across three Availability Zones, and offers fast automated failover. Which service best meets this?

• a.Amazon Aurora✓
• b.A self-managed MySQL cluster on a single EC2 instance
• c.Amazon DynamoDB
• d.Amazon Redshift

Aurora is MySQL- and PostgreSQL-compatible and stores six copies of data across three AZs, providing high durability and fast failover to a replica. A single EC2 MySQL instance is a single point of failure. DynamoDB is a NoSQL key-value store and Redshift is a data warehouse, neither of which is a MySQL-compatible relational OLTP database.

A global application must route users to a healthy Region and fail over automatically to a secondary Region if the primary becomes unavailable. Which approach provides this DNS-level resilience?

• a.A single Elastic IP in one Region
• b.An Application Load Balancer spanning Regions
• c.Amazon Route 53 with health checks and failover routing policy✓
• d.A NAT gateway in each subnet

Route 53 failover routing uses health checks to detect an unhealthy primary endpoint and automatically returns the secondary Region's record, enabling cross-Region DNS failover. An ALB cannot span multiple Regions. Elastic IPs and NAT gateways are single-Region constructs and do not provide global failover.

A read-heavy application repeatedly runs the same expensive database queries, causing high latency. Which addition most improves read performance with minimal application change?

• a.Increase the RDS instance storage size
• b.Add Amazon ElastiCache to cache frequent query results in memory✓
• c.Enable S3 Transfer Acceleration
• d.Move the database to a larger EBS magnetic volume

ElastiCache (Redis or Memcached) stores frequently accessed query results in memory, serving repeated reads with sub-millisecond latency and offloading the database. Growing storage or using magnetic EBS does not reduce query latency for hot data. S3 Transfer Acceleration speeds S3 uploads and is unrelated to database queries.

A media company serves large video files to a global audience and wants to reduce latency and origin load by caching content near users. Which service should be used?

• a.A larger EC2 instance in one Region
• b.Amazon EFS
• c.An internet gateway
• d.Amazon CloudFront✓

CloudFront is a content delivery network that caches content at edge locations worldwide, lowering latency for global viewers and offloading requests from the origin. A single larger instance still serves from one Region with no edge caching. EFS is regional file storage and an internet gateway only provides connectivity, neither of which delivers a global CDN.

An application needs a fully managed NoSQL database delivering single-digit millisecond latency at any scale, with the option of microsecond reads via an in-memory cache. Which combination fits?

• a.Amazon DynamoDB with DynamoDB Accelerator (DAX)✓
• b.Amazon RDS with a read replica
• c.Amazon Redshift with concurrency scaling
• d.Amazon Aurora Serverless

DynamoDB provides consistent single-digit millisecond latency at scale, and DAX is a purpose-built in-memory cache that reduces read latency to microseconds for eventually consistent reads. RDS and Aurora are relational engines, not NoSQL. Redshift is an analytics data warehouse, not a low-latency operational key-value store.

A company ingests a high-throughput, continuous stream of clickstream data that must be processed in near real time by multiple consumers. Which service is designed for this?

• a.Amazon SQS standard queue
• b.Amazon S3 event notifications
• c.Amazon Kinesis Data Streams✓
• d.Amazon Athena

Kinesis Data Streams is built for high-throughput, ordered, real-time streaming data that multiple consumers can read concurrently while retaining records for replay. SQS is a decoupling queue where a message is typically processed once, not a multi-consumer stream. Athena queries data at rest in S3 and does not ingest live streams.

A latency-sensitive TCP-based application needs to route users over the AWS global network to the nearest healthy Regional endpoint using static anycast IP addresses. Which service provides this?

• a.Amazon CloudFront
• b.AWS Global Accelerator✓
• c.Amazon Route 53 weighted routing
• d.AWS Direct Connect

AWS Global Accelerator provides static anycast IP addresses and routes traffic over the AWS backbone to the closest healthy endpoint, improving performance for TCP/UDP applications. CloudFront is optimized for cacheable HTTP content, not arbitrary TCP endpoints. Direct Connect is a private on-premises link, and weighted DNS does not use the AWS global network for transport.

A fault-tolerant batch-processing job can be interrupted and resumed and runs at flexible times. Which EC2 purchasing option minimizes cost for this workload?

• a.EC2 Spot Instances✓
• b.On-Demand Instances
• c.A three-year Reserved Instance for steady 24/7 use
• d.A Dedicated Host

Spot Instances offer the deepest discount (up to about 90% off On-Demand) and are ideal for interruption-tolerant, flexible workloads like batch jobs. On-Demand costs the most for intermittent work, and Reserved Instances or Dedicated Hosts commit you to capacity better suited to steady-state, always-on usage.

Data is stored in S3 with unpredictable and changing access patterns, and the team wants to minimize cost without manually moving objects or writing lifecycle rules. Which storage class fits best?

• a.S3 Standard for everything
• b.S3 Glacier Deep Archive
• c.S3 Intelligent-Tiering✓
• d.S3 One Zone-Infrequent Access

S3 Intelligent-Tiering automatically moves objects between access tiers based on usage, optimizing cost when access patterns are unknown or changing, with no retrieval fees for the frequent and infrequent tiers. S3 Standard misses savings on cold data, Glacier Deep Archive adds retrieval latency unsuitable for unpredictable access, and One Zone-IA reduces resilience by storing in a single AZ.

A company must transfer 80 TB of data from an on-premises data center to S3, and its internet link would take months to upload that volume. Which option is most cost- and time-effective?

• a.Upload directly over the existing internet connection
• b.Provision a permanent Direct Connect line just for this one-time migration
• c.Use S3 Transfer Acceleration over the same link
• d.Use AWS Snowball to physically ship the data to AWS✓

AWS Snowball provides a physical, ruggedized device to move large datasets offline, which is faster and cheaper than saturating a slow internet link for a one-time 80 TB transfer. Direct internet upload and Transfer Acceleration are still bound by limited bandwidth. Provisioning Direct Connect for a single migration is costly and slow to set up relative to Snowball.

A company runs a predictable, steady baseline of compute across EC2 and Fargate and wants the best discount while retaining flexibility to change instance families and Regions. Which commitment model is most appropriate?

• a.Standard Reserved Instances locked to one instance type
• b.Compute Savings Plans with a one- or three-year hourly spend commitment✓
• c.Pay On-Demand rates continuously
• d.Spot Instances for the steady baseline

Compute Savings Plans offer discounts comparable to Reserved Instances in exchange for an hourly spend commitment, while flexibly applying across instance families, sizes, Regions, and even Fargate and Lambda. Standard RIs lock you to a specific instance type and Region, reducing flexibility. On-Demand forgoes savings, and Spot is unsuitable for a steady baseline that must not be interrupted.