Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. 1. Design Secure Architectures

   An application running on EC2 instances needs to read objects from an S3 bucket. What is the most secure way to grant this access?

   • a.Embed an IAM user's access keys in the application code
   • b.Store long-lived credentials in a file on the instance
   • c.Attach an IAM role to the EC2 instances with a policy granting least-privilege S3 read access
   • d.Make the S3 bucket public and filter by source IP

   Answer: c

   Explanation: IAM roles provide temporary, automatically rotated credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived keys. Scoping the role's policy to only the required bucket and actions follows the principle of least privilege. Hard-coded access keys and public buckets create serious security risks and violate the Security pillar of the Well-Architected Framework.

2. 2. Design Secure Architectures

   A web application behind an Application Load Balancer is being targeted by SQL injection and cross-site scripting attempts at the HTTP layer. Which service should be added to filter this malicious traffic?

   • a.AWS Shield Standard
   • b.AWS WAF with managed rule groups
   • c.Amazon GuardDuty
   • d.A network ACL on the public subnet

   Answer: b

   Explanation: AWS WAF inspects HTTP/HTTPS requests and can block SQL injection and XSS using AWS managed rule groups attached to the ALB. Shield Standard protects against network/transport-layer DDoS, not application-layer exploits. NACLs operate on IP/port and cannot parse request content.

3. 3. Design Secure Architectures

   An application needs to retrieve database credentials at runtime, and the credentials must be automatically rotated on a schedule. Which service is purpose-built for this?

   • a.AWS Secrets Manager
   • b.AWS Systems Manager Parameter Store standard parameters
   • c.Amazon S3 with encryption
   • d.IAM instance profile tags

   Answer: a

   Explanation: Secrets Manager stores credentials encrypted with KMS and provides native automatic rotation, including built-in integration with RDS to rotate database passwords. Standard Parameter Store parameters can hold secrets but do not offer managed rotation. Storing credentials in S3 or tags is insecure and lacks rotation.

4. 4. Design Secure Architectures

   A security team wants to allow developers to launch EC2 instances but must ensure they cannot detach or modify IAM policies. Which approach follows AWS best practice?

   • a.Grant developers the AdministratorAccess managed policy
   • b.Attach a least-privilege IAM policy granting only the specific EC2 actions needed, with no IAM write permissions
   • c.Share the root account credentials for convenience
   • d.Give every developer full IAM permissions and monitor with CloudTrail

   Answer: b

   Explanation: Least privilege means granting only the specific permissions required for the task, so a scoped policy allowing EC2 launch actions without IAM write access is correct. AdministratorAccess and root credentials violate least privilege and separation of duties. Monitoring after over-permissioning does not prevent misuse.

5. 5. Design Resilient Architectures

   To decouple a fluctuating order-processing workload so that a spike in orders does not overwhelm the processing tier, which service should sit between the producers and consumers?

   • a.Amazon SQS queue that the processing tier polls
   • b.A single large EC2 instance for all processing
   • c.Amazon Route 53 latency routing
   • d.An EBS volume shared across instances

   Answer: a

   Explanation: Amazon SQS buffers messages, letting the processing tier consume at its own pace and absorbing spikes without dropping work, which improves resilience and enables independent scaling. A single instance is a bottleneck and single point of failure. Route 53 handles DNS routing and EBS is block storage, neither of which decouples the tiers.

6. 6. Design Resilient Architectures

   A company needs a relational database that provides MySQL compatibility, replicates six copies of data across three Availability Zones, and offers fast automated failover. Which service best meets this?

   • a.Amazon Aurora
   • b.A self-managed MySQL cluster on a single EC2 instance
   • c.Amazon DynamoDB
   • d.Amazon Redshift

   Answer: a

   Explanation: Aurora is MySQL- and PostgreSQL-compatible and stores six copies of data across three AZs, providing high durability and fast failover to a replica. A single EC2 MySQL instance is a single point of failure. DynamoDB is a NoSQL key-value store and Redshift is a data warehouse, neither of which is a MySQL-compatible relational OLTP database.

7. 7. Design High-Performing Architectures

   A read-heavy application repeatedly runs the same expensive database queries, causing high latency. Which addition most improves read performance with minimal application change?

   • a.Increase the RDS instance storage size
   • b.Add Amazon ElastiCache to cache frequent query results in memory
   • c.Enable S3 Transfer Acceleration
   • d.Move the database to a larger EBS magnetic volume

   Answer: b

   Explanation: ElastiCache (Redis or Memcached) stores frequently accessed query results in memory, serving repeated reads with sub-millisecond latency and offloading the database. Growing storage or using magnetic EBS does not reduce query latency for hot data. S3 Transfer Acceleration speeds S3 uploads and is unrelated to database queries.

8. 8. Design High-Performing Architectures

   An application needs a fully managed NoSQL database delivering single-digit millisecond latency at any scale, with the option of microsecond reads via an in-memory cache. Which combination fits?

   • a.Amazon DynamoDB with DynamoDB Accelerator (DAX)
   • b.Amazon RDS with a read replica
   • c.Amazon Redshift with concurrency scaling
   • d.Amazon Aurora Serverless

   Answer: a

   Explanation: DynamoDB provides consistent single-digit millisecond latency at scale, and DAX is a purpose-built in-memory cache that reduces read latency to microseconds for eventually consistent reads. RDS and Aurora are relational engines, not NoSQL. Redshift is an analytics data warehouse, not a low-latency operational key-value store.

9. 9. Design High-Performing Architectures

   A latency-sensitive TCP-based application needs to route users over the AWS global network to the nearest healthy Regional endpoint using static anycast IP addresses. Which service provides this?

   • a.Amazon CloudFront
   • b.AWS Global Accelerator
   • c.Amazon Route 53 weighted routing
   • d.AWS Direct Connect

   Answer: b

   Explanation: AWS Global Accelerator provides static anycast IP addresses and routes traffic over the AWS backbone to the closest healthy endpoint, improving performance for TCP/UDP applications. CloudFront is optimized for cacheable HTTP content, not arbitrary TCP endpoints. Direct Connect is a private on-premises link, and weighted DNS does not use the AWS global network for transport.

10. 10. Design Cost-Optimized Architectures

    Data is stored in S3 with unpredictable and changing access patterns, and the team wants to minimize cost without manually moving objects or writing lifecycle rules. Which storage class fits best?

    • a.S3 Standard for everything
    • b.S3 Glacier Deep Archive
    • c.S3 Intelligent-Tiering
    • d.S3 One Zone-Infrequent Access

    Answer: c

    Explanation: S3 Intelligent-Tiering automatically moves objects between access tiers based on usage, optimizing cost when access patterns are unknown or changing, with no retrieval fees for the frequent and infrequent tiers. S3 Standard misses savings on cold data, Glacier Deep Archive adds retrieval latency unsuitable for unpredictable access, and One Zone-IA reduces resilience by storing in a single AZ.