AWS SAA-C03 · Updated 2026
Free AWS Solutions Architect Associate Practice Exam (2026)
Full-length SAA-C03 mock exams with the same number of questions and time as the real exam. Real-world architecture scenarios across all 4 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 2 hours 10 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Secure Architectures
A company uses AWS Organizations with dozens of member accounts. For data residency reasons, no IAM user or role in any member account may create resources outside the eu-west-1 and eu-central-1 Regions. Global services such as IAM must keep working. The solution must need the least ongoing administrative effort. Which solution will meet these requirements?
Correct answer: C. Attach an SCP to the organization root that denies actions when aws:RequestedRegion is not an approved Region, exempting global services.
One SCP that denies requests based on aws:RequestedRegion acts as a guardrail for every principal in the member accounts, including roles created later. Per-account IAM policies are easy to miss on new users and roles and must be kept in sync across dozens of accounts. Regions that are enabled by default cannot be turned off at all.
One SCP that denies requests based on aws:RequestedRegion acts as a guardrail for every principal in the member accounts, including roles created later. Per-account IAM policies are easy to miss on new users and roles and must be kept in sync across dozens of accounts. Regions that are enabled by default cannot be turned off at all.
Question 2Resilient Architectures
A retail company processes payment events for customer accounts. Events for the same account must be processed in the exact order they are sent, and duplicate events must not be processed twice. Events for different accounts should be processed in parallel to keep throughput high. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: B. Send events to an SQS FIFO queue with the account ID as the message group ID and deduplication
A FIFO queue keeps strict order within each message group, so using the account ID as the group ID keeps per-account order while different accounts are processed in parallel. Deduplication stops the same event from being processed twice. One shared group ID also keeps order, but it pushes every message through a single ordered stream and removes parallelism.
A FIFO queue keeps strict order within each message group, so using the account ID as the group ID keeps per-account order while different accounts are processed in parallel. Deduplication stops the same event from being processed twice. One shared group ID also keeps order, but it pushes every message through a single ordered stream and removes parallelism.
Question 3High-Performing Architectures
A media company stores raw video files in a single Amazon S3 bucket in us-east-1. Field teams in Australia, Brazil, and Japan upload files of 5-20 GB each over the public internet, and the uploads are slow and often restart. The company wants faster uploads with the least operational overhead. Which solution will meet these requirements?
Correct answer: D. Enable S3 Transfer Acceleration on the bucket and have the teams upload through the accelerate endpoint with multipart upload.
Transfer Acceleration routes uploads through the nearest edge location and then over the AWS backbone, which speeds up long-distance transfers of large files with a single bucket setting. Regional buckets with replication could work, but they add buckets, rules, and replication delay, which is far more overhead.
Transfer Acceleration routes uploads through the nearest edge location and then over the AWS backbone, which speeds up long-distance transfers of large files with a single bucket setting. Regional buckets with replication could work, but they add buckets, rules, and replication delay, which is far more overhead.
Question 4Cost-Optimized Architectures
A media company stores 400 TB of user-uploaded video clips in Amazon S3 Standard. Access patterns are unpredictable: some clips are not viewed for months and then suddenly become popular again. All clips must stay available with millisecond access. The company wants to lower storage costs with the LEAST operational overhead. Which solution will meet these requirements?
Correct answer: A. Move the clips to S3 Intelligent-Tiering so that S3 shifts each object between access tiers based on its usage
S3 Intelligent-Tiering moves each object between frequent, infrequent and archive instant access tiers based on real access, with no retrieval fees and no change in access speed. A lifecycle rule to Standard-IA cannot move objects back to S3 Standard, and popular clips left in Standard-IA would add retrieval charges.
S3 Intelligent-Tiering moves each object between frequent, infrequent and archive instant access tiers based on real access, with no retrieval fees and no change in access speed. A lifecycle rule to Standard-IA cannot move objects back to S3 Standard, and popular clips left in Standard-IA would add retrieval charges.
Question 5Secure Architectures
An application runs on Amazon EC2 instances in Account A. It must read items from an Amazon DynamoDB table in Account B. The security team does not allow long-term access keys. Which solution will meet these requirements?
Correct answer: B. Create a role in Account B with read access to the table that trusts Account A's instance role, and have the app call sts:AssumeRole.
Assuming a role in Account B returns temporary credentials, and Account B decides exactly what that role can do. A policy on the instance role in Account A is not enough by itself, because cross-account access also needs permission granted on the Account B side.
Assuming a role in Account B returns temporary credentials, and Account B decides exactly what that role can do. A policy on the instance role in Account A is not enough by itself, because cross-account access also needs permission granted on the Account B side.
Question 6Resilient Architectures
An e-commerce company publishes an event each time an order is placed. Three teams own the inventory, shipping, and analytics systems, and each system must receive every order event and process it at its own pace. If one system is down for several hours, it must not lose events or slow down the others. Which solution will meet these requirements?
Correct answer: A. Publish order events to an SNS topic and subscribe a separate SQS queue for each of the systems
SNS fan-out to one SQS queue per system gives each team its own copy of every event, and each queue holds messages until its consumer is ready. With one shared queue, each message is consumed by only one system, so the other two miss it. Direct HTTPS subscriptions stop retrying after the delivery policy runs out, so a long outage can lose events.
SNS fan-out to one SQS queue per system gives each team its own copy of every event, and each queue holds messages until its consumer is ready. With one shared queue, each message is consumed by only one system, so the other two miss it. Direct HTTPS subscriptions stop retrying after the delivery policy runs out, so a long outage can lose events.
Question 7High-Performing Architectures
A company runs PostgreSQL on an Amazon EC2 instance with a 400 GiB gp2 EBS volume that has a baseline of 1,200 IOPS. The workload needs a steady 8,000 IOPS and 400 MiB/s of throughput. The company does not need more storage and wants the most cost-effective change with no downtime. Which solution will meet these requirements?
Correct answer: D. Modify the volume to gp3 by using Elastic Volumes and provision 8,000 IOPS and 400 MiB/s of throughput.
gp3 lets you set IOPS and throughput independently of size, and Elastic Volumes changes the type while the volume stays in use. io2 would also meet the target, but it costs much more for performance that gp3 already provides.
gp3 lets you set IOPS and throughput independently of size, and Elastic Volumes changes the type while the volume stays in use. io2 would also meet the target, but it costs much more for performance that gp3 already provides.
Question 8Cost-Optimized Architectures
A company stores product photos in Amazon S3 Standard. Photos are accessed often for the first 30 days and occasionally for the next 60 days, when they must be available immediately. After 90 days, photos are rarely accessed but must be kept for 5 years in total, and retrieval within 12 hours is acceptable. The data must stay resilient to the loss of an Availability Zone. Which solution is MOST cost-effective?
Correct answer: A. Lifecycle rule: S3 Standard-IA after 30 days, S3 Glacier Deep Archive after 90 days, expire after 5 years
Standard-IA keeps millisecond access across multiple AZs for days 30 to 90, and S3 Glacier Deep Archive is the lowest-cost class whose standard retrievals finish within 12 hours. Glacier Instant Retrieval would also work, but it costs more per GB than Deep Archive, and instant access is not needed after 90 days.
Standard-IA keeps millisecond access across multiple AZs for days 30 to 90, and S3 Glacier Deep Archive is the lowest-cost class whose standard retrievals finish within 12 hours. Glacier Instant Retrieval would also work, but it costs more per GB than Deep Archive, and instant access is not needed after 90 days.
Question 9Secure Architectures
A company has 30 AWS accounts in AWS Organizations. Employees sign in with Microsoft Entra ID. Employees must use their corporate credentials to reach the accounts they need, access must be managed in one place, and users must be provisioned automatically. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: C. Enable IAM Identity Center with Entra ID as the external identity provider, sync users with SCIM, and assign permission sets to groups.
IAM Identity Center connects to Entra ID once, syncs users and groups through SCIM, and grants access to every account through permission sets. Per-account SAML federation also works, but it means 30 separate identity providers and role mappings to maintain.
IAM Identity Center connects to Entra ID once, syncs users and groups through SCIM, and grants access to every account through permission sets. Per-account SAML federation also works, but it means 30 separate identity providers and role mappings to maintain.
Question 10Resilient Architectures
A media company uses an SQS standard queue to send video files for transcoding to a fleet of EC2 workers. Each job takes up to 8 minutes. Many videos are transcoded two or three times, even though each worker deletes the message after it finishes. The queue uses the default settings. What should a solutions architect do to fix this issue?
Correct answer: A. Increase the queue's visibility timeout to a value longer than the maximum job duration
The default visibility timeout is 30 seconds, so a message becomes visible again while a worker is still processing it and another worker picks it up. Setting the timeout above the 8-minute job time keeps the message hidden until the first worker deletes it. Long polling only cuts down empty responses and does not stop messages from reappearing.
The default visibility timeout is 30 seconds, so a message becomes visible again while a worker is still processing it and another worker picks it up. Setting the timeout above the 8-minute job time keeps the message hidden until the first worker deletes it. Long polling only cuts down empty responses and does not stop messages from reappearing.
Question 11High-Performing Architectures
A genomics company runs an analysis job on hundreds of Amazon EC2 instances. The input data is stored in Amazon S3. The job needs a shared POSIX file system with sub-millisecond latency and hundreds of GB/s of aggregate throughput, and the results must be written back to S3. Which solution will meet these requirements?
Correct answer: D. Create an Amazon FSx for Lustre file system that is linked to the S3 bucket through a data repository association.
FSx for Lustre is built for HPC, with sub-millisecond latency and very high parallel throughput, and a data repository association loads objects from S3 and exports results back. EFS is a general-purpose file system and would need separate copy jobs to move data in and out of S3.
FSx for Lustre is built for HPC, with sub-millisecond latency and very high parallel throughput, and a data repository association loads objects from S3 and exports results back. EFS is a general-purpose file system and would need separate copy jobs to move data in and out of S3.
Question 12Secure Architectures
Amazon EC2 instances in a public subnet are receiving unwanted traffic from a specific range of IP addresses. The company must block all inbound traffic from that range to every instance in the subnet right away, while keeping all other current traffic flowing. Which solution will meet these requirements?
Correct answer: B. Add an inbound deny rule for the range to the subnet's network ACL, with a lower rule number than the existing allow rules.
Network ACLs are stateless subnet-level filters that support explicit deny rules, evaluated in rule-number order. Security groups only support allow rules, so they cannot block one range while allowing everything else.
Network ACLs are stateless subnet-level filters that support explicit deny rules, evaluated in rule-number order. Security groups only support allow rules, so they cannot block one range while allowing everything else.
Question 13Cost-Optimized Architectures
A company's S3 bill keeps growing, and Storage Lens shows a large amount of storage from multipart uploads that failed and were never completed. The company wants to remove this cost with the LEAST operational overhead. Which solution will meet these requirements?
Correct answer: C. Add a lifecycle rule that aborts incomplete multipart uploads after 7 days
Incomplete multipart upload parts are billed until they are removed, and a lifecycle rule cleans them up automatically. Intelligent-Tiering only changes storage tiers for complete objects, so it does nothing about orphaned parts.
Incomplete multipart upload parts are billed until they are removed, and a lifecycle rule cleans them up automatically. Intelligent-Tiering only changes storage tiers for complete objects, so it does nothing about orphaned parts.
Question 14Resilient Architectures
An insurance company has an application that reads claims from an SQS queue. A few malformed messages fail processing every time, return to the queue, and keep being retried. This wastes compute capacity and delays valid messages. The team wants to keep the failed messages for later analysis. Which solution will meet these requirements?
Correct answer: B. Configure a dead-letter queue with a redrive policy that sets a maximum receive count
A dead-letter queue with a maxReceiveCount moves a message aside after it fails a set number of times, so it stops blocking the main queue and stays available for analysis. Deleting failed messages clears the queue but loses the data the team wants to keep. A long visibility timeout only slows the retries and leaves the bad messages in the main queue.
A dead-letter queue with a maxReceiveCount moves a message aside after it fails a set number of times, so it stops blocking the main queue and stays available for analysis. Deleting failed messages clears the queue but loses the data the team wants to keep. A long visibility timeout only slows the retries and leaves the bad messages in the main queue.
Question 15Secure Architectures
An application on Amazon ECS connects to an Amazon RDS for MySQL database. The database password is stored as plain text in the task definition. An audit requires that the credentials be encrypted, retrieved at runtime, and rotated automatically every 30 days with minimal custom code. Which solution will meet these requirements?
Correct answer: D. Store the credentials in AWS Secrets Manager with managed RDS rotation on a 30-day schedule, and reference the secret in the task.
Secrets Manager has built-in rotation for Amazon RDS credentials and can inject secrets into ECS tasks at runtime. Parameter Store SecureString encrypts the value but has no native rotation, so a custom script would have to change the password and update the database.
Secrets Manager has built-in rotation for Amazon RDS credentials and can inject secrets into ECS tasks at runtime. Parameter Store SecureString encrypts the value but has no native rotation, so a custom script would have to change the password and update the database.
Question 16High-Performing Architectures
A research lab is deploying a tightly coupled computational fluid dynamics application on Amazon EC2. The nodes exchange large amounts of data constantly, and the application needs the lowest possible network latency and the highest packets-per-second rate between instances. Which solution will meet these requirements?
Correct answer: B. Launch the instances in a cluster placement group in one Availability Zone and use Elastic Fabric Adapter.
A cluster placement group packs instances close together in one Availability Zone, and Elastic Fabric Adapter adds low-latency, high-throughput networking for tightly coupled HPC. A spread placement group puts each instance on distinct hardware, which helps availability but increases latency between nodes.
A cluster placement group packs instances close together in one Availability Zone, and Elastic Fabric Adapter adds low-latency, high-throughput networking for tightly coupled HPC. A spread placement group puts each instance on distinct hardware, which helps availability but increases latency between nodes.
Question 17Resilient Architectures
A logistics company needs to coordinate a shipment workflow that calls several Lambda functions in sequence, retries failed steps with backoff, and waits up to 5 days for a warehouse manager to approve each shipment. The company wants a managed service that shows the state of every workflow run. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: C. Use a Step Functions Standard workflow with retry settings and a callback task for approval
Standard workflows can run for up to one year, have built-in retries with backoff, and use a task token callback to pause until a person approves. Express workflows are limited to 5 minutes, so they cannot wait days for an approval. Chaining Lambda functions by hand gives no central view of state and makes retries hard to manage.
Standard workflows can run for up to one year, have built-in retries with backoff, and use a task token callback to pause until a person approves. Express workflows are limited to 5 minutes, so they cannot wait days for an approval. Chaining Lambda functions by hand gives no central view of state and makes retries hard to manage.
Question 18Cost-Optimized Architectures
A company spends a steady amount every hour on Amazon EC2 instances from the M6i and C6i families in two AWS Regions. Over the next 3 years, the company plans to move some workloads to Graviton-based instances, shift others to a third Region, and run part of the estate as containers on AWS Fargate. The company wants a commitment-based discount that keeps applying through these changes. Which purchase option will meet these requirements?
Correct answer: A. A Compute Savings Plan with a 3-year term that commits to the steady hourly spend across compute usage
A Compute Savings Plan applies automatically to EC2 usage in any instance family, size, Region and operating system, and it also covers Fargate and Lambda. EC2 Instance Savings Plans give a slightly larger discount, but each one is locked to a single instance family in a single Region, so it would stop applying after the planned moves.
A Compute Savings Plan applies automatically to EC2 usage in any instance family, size, Region and operating system, and it also covers Fargate and Lambda. EC2 Instance Savings Plans give a slightly larger discount, but each one is locked to a single instance family in a single Region, so it would stop applying after the planned moves.
Question 19Secure Architectures
Amazon EC2 instances in private subnets process large files stored in Amazon S3 in the same Region. The traffic currently flows through a NAT gateway, and the data processing charges are high. The company also wants the S3 traffic to stay on the AWS network. Which solution will meet these requirements MOST cost-effectively?
Correct answer: D. Create an S3 gateway VPC endpoint and add it to the route tables that are associated with the private subnets.
An S3 gateway endpoint has no hourly or data processing charge and keeps traffic on the AWS network through a route table entry. An interface endpoint also keeps traffic private, but it adds hourly and per-GB charges, so it costs more for this workload.
An S3 gateway endpoint has no hourly or data processing charge and keeps traffic on the AWS network through a route table entry. An interface endpoint also keeps traffic private, but it adds hourly and per-GB charges, so it costs more for this workload.
Question 20High-Performing Architectures
An online retailer uses Amazon DynamoDB for its product catalog. During sales events, the same items are read millions of times per minute, and the team wants read latency to drop from single-digit milliseconds to microseconds. The team wants to make as few application changes as possible. Which solution will meet these requirements?
Correct answer: A. Add an Amazon DynamoDB Accelerator (DAX) cluster and point the application's DynamoDB client at the DAX endpoint.
DAX is an in-memory cache built for DynamoDB that serves cached reads in microseconds, and its client is API-compatible with DynamoDB, so code changes are small. ElastiCache could also cache the items, but the team would have to write and maintain its own caching logic.
DAX is an in-memory cache built for DynamoDB that serves cached reads in microseconds, and its client is API-compatible with DynamoDB, so code changes are small. ElastiCache could also cache the items, but the team would have to write and maintain its own caching logic.
Question 21Resilient Architectures
A fintech company uses Amazon EventBridge to route events from its payment service to several consumers. The company wants to be able to reprocess past events from a specific time window if a consumer bug is found later, without asking the payment service to resend anything. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: C. Create an EventBridge archive on the event bus and start a replay for the needed window
An EventBridge archive stores events from a bus, and a replay sends the events from a chosen time window back to the bus so the rules process them again. This is built in and needs no custom code. Copying events to S3 or Kinesis can work, but it needs custom code to resend events, which adds operational overhead.
An EventBridge archive stores events from a bus, and a replay sends the events from a chosen time window back to the bus so the rules process them again. This is built in and needs no custom code. Copying events to S3 or Kinesis can work, but it needs custom code to resend events, which adds operational overhead.
Question 22Secure Architectures
A startup is building a mobile app that needs user sign-up, sign-in, and password reset. Users must also be able to sign in with their Google or Apple accounts. The startup wants a managed service and does not want to run its own identity servers. Which solution will meet these requirements?
Correct answer: D. Use an Amazon Cognito user pool, and configure Google and Apple as social identity providers for the pool.
Cognito user pools are a managed customer directory with sign-up, sign-in, password reset, and social sign-in built in. IAM Identity Center is built for workforce access to AWS accounts and business apps, not for consumer app users.
Cognito user pools are a managed customer directory with sign-up, sign-in, password reset, and social sign-in built in. IAM Identity Center is built for workforce access to AWS accounts and business apps, not for consumer app users.
Question 23Cost-Optimized Architectures
A company runs a nightly rendering job on 100 EC2 instances for about 6 hours. The job saves checkpoints to Amazon S3 and can resume on another instance if an instance is stopped. The job must finish before the business day starts, but its exact start time is flexible. The company wants the LOWEST compute cost. Which solution will meet these requirements?
Correct answer: D. Run the job on Spot Instances across many instance types and AZs with the price-capacity-optimized strategy
Spot Instances give the deepest discount, and spreading across instance types and AZs with price-capacity-optimized allocation picks pools with spare capacity, which lowers interruption rates. A single instance type in one AZ concentrates the job in one Spot pool, so interruptions are more likely and harder to recover from.
Spot Instances give the deepest discount, and spreading across instance types and AZs with price-capacity-optimized allocation picks pools with spare capacity, which lowers interruption rates. A single instance type in one AZ concentrates the job in one Spot pool, so interruptions are more likely and harder to recover from.
Question 24High-Performing Architectures
A company runs a serverless API with AWS Lambda functions that query an Amazon RDS for MySQL DB instance. During traffic spikes, thousands of concurrent invocations open new database connections, and the database returns too-many-connections errors with high CPU usage. The company wants to fix this with the least operational overhead. Which solution will meet these requirements?
Correct answer: B. Create an Amazon RDS Proxy for the DB instance and have the Lambda functions connect through the proxy.
RDS Proxy keeps a pool of database connections and shares them across many Lambda invocations, which stops connection storms with only an endpoint change. Raising max_connections and scaling up treats the symptom, because each invocation still opens its own connection.
RDS Proxy keeps a pool of database connections and shares them across many Lambda invocations, which stops connection storms with only an endpoint change. Raising max_connections and scaling up treats the symptom, because each invocation still opens its own connection.
Question 25Secure Architectures
A retail website runs behind an Application Load Balancer. During a sale, a few IP addresses sent thousands of HTTP requests per minute to the login page, which slowed the site for real customers. The company wants to automatically block any IP address that goes over a set request limit. Which solution will meet these requirements?
Correct answer: C. Associate an AWS WAF web ACL with the ALB and add a rate-based rule that is scoped to the login page path.
A WAF rate-based rule counts requests from each IP address over a time window and blocks addresses that go over the limit, and it can be scoped to a URI path. Network ACL entries would need manual updates for every new address and have a small rule quota.
A WAF rate-based rule counts requests from each IP address over a time window and blocks addresses that go over the limit, and it can be scoped to a URI path. Network ACL entries would need manual updates for every new address and have a small rule quota.
Question 26Resilient Architectures
An online store must wait 60 seconds after an order is placed before processing it, so customers have time to cancel. Orders are sent to an Amazon SQS queue. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: D. Configure the queue as a delay queue with a 60-second delivery delay
A delay queue hides new messages from consumers for the set delay, so every order waits 60 seconds before processing. The visibility timeout only starts after a consumer receives a message, so it does not delay the first delivery.
A delay queue hides new messages from consumers for the set delay, so every order waits 60 seconds before processing. The visibility timeout only starts after a consumer receives a message, so it does not delay the first delivery.
Question 27Cost-Optimized Architectures
A company runs a Java web application on 40 x86-based m6i.xlarge instances in an Auto Scaling group. CPU utilization stays steady at about 60% all day. The application has no native x86 dependencies. The company wants to reduce compute costs with minimal code changes while keeping the same performance. Which solution will meet these requirements?
Correct answer: C. Test the application on Arm64 and switch the launch template to Graviton-based m8g.xlarge instances
Graviton-based instances offer better price performance than comparable x86 instances, and JVM applications usually run on Arm64 without code changes. Burstable t3 instances look cheaper, but steady 60% CPU is above their baseline, so unlimited mode adds surplus credit charges that cancel the savings.
Graviton-based instances offer better price performance than comparable x86 instances, and JVM applications usually run on Arm64 without code changes. Burstable t3 instances look cheaper, but steady 60% CPU is above their baseline, so unlimited mode adds surplus credit charges that cancel the savings.
Question 28Secure Architectures
A healthcare company stores millions of objects across hundreds of Amazon S3 buckets. The compliance team must find which buckets contain personally identifiable information (PII) such as names, addresses, and passport numbers, and must get ongoing alerts when new sensitive data appears. Which solution will meet these requirements?
Correct answer: B. Enable Amazon Macie with automated sensitive data discovery for all of the buckets in the account.
Macie uses machine learning and pattern matching to find PII inside S3 objects and keeps reporting findings as data changes. GuardDuty S3 Protection looks for suspicious access activity, not for sensitive content stored inside objects.
Macie uses machine learning and pattern matching to find PII inside S3 objects and keeps reporting findings as data changes. GuardDuty S3 Protection looks for suspicious access activity, not for sensitive content stored inside objects.
Question 29High-Performing Architectures
A company uses an Amazon Aurora MySQL DB cluster with a single writer instance. Business analysts run heavy reporting queries all day, the read load changes a lot from hour to hour, and the reports are slowing down write transactions. The company wants to isolate the reads and match read capacity to demand automatically. Which solution will meet these requirements?
Correct answer: C. Add Aurora Replicas with Aurora Auto Scaling and send reporting queries to the cluster reader endpoint.
Aurora Replicas share the cluster storage and take reads off the writer, and Aurora Auto Scaling adds or removes replicas as load changes while the reader endpoint spreads connections. A global database secondary is meant for disaster recovery and global reads, so it adds cross-Region cost without scaling to the hourly load.
Aurora Replicas share the cluster storage and take reads off the writer, and Aurora Auto Scaling adds or removes replicas as load changes while the reader endpoint spreads connections. A global database secondary is meant for disaster recovery and global reads, so it adds cross-Region cost without scaling to the hourly load.
Question 30Resilient Architectures
A company is splitting a monolithic web application into containerized microservices. Requests to /orders, /users, and /catalog must go to different services, and each service must scale on its own. The company does not want to manage servers or EC2 capacity. Which solution will meet these requirements?
Correct answer: A. Run each service on ECS with AWS Fargate behind an Application Load Balancer using path rules
An Application Load Balancer routes HTTP requests to different target groups based on the URL path, and ECS services on Fargate scale independently with no servers to manage. A Network Load Balancer works at layer 4 and cannot route on URL paths, and ECS on EC2 still needs instance management. A Gateway Load Balancer is built for inline security appliances, not path routing.
An Application Load Balancer routes HTTP requests to different target groups based on the URL path, and ECS services on Fargate scale independently with no servers to manage. A Network Load Balancer works at layer 4 and cannot route on URL paths, and ECS on EC2 still needs instance management. A Gateway Load Balancer is built for inline security appliances, not path routing.
Question 31Secure Architectures
A company wants to detect threats such as EC2 instances talking to known cryptocurrency mining domains, unusual API calls from unfamiliar locations, and possible credential exfiltration. The solution must not require deploying agents or building log pipelines. Which solution will meet these requirements?
Correct answer: B. Enable Amazon GuardDuty, which analyzes CloudTrail events, VPC Flow Logs, and DNS query logs.
GuardDuty is a managed threat detection service that reads CloudTrail, VPC Flow Logs, and DNS logs on its own, with no agents needed for these findings. Inspector reports software vulnerabilities and network exposure, but it does not detect active threats such as crypto mining or stolen credentials.
GuardDuty is a managed threat detection service that reads CloudTrail, VPC Flow Logs, and DNS logs on its own, with no agents needed for these findings. Inspector reports software vulnerabilities and network exposure, but it does not detect active threats such as crypto mining or stolen credentials.
Question 32Cost-Optimized Architectures
A startup is launching a new mobile game that stores player data in Amazon DynamoDB. The company cannot predict traffic. Usage is expected to spike sharply during in-game events and to be very low between them. The company wants to avoid capacity planning and pay only for the requests it serves. Which solution will meet these requirements?
Correct answer: A. Create the table in on-demand capacity mode so that DynamoDB bills per request and scales automatically
On-demand mode charges per read and write request, needs no capacity planning, and scales with traffic automatically. Provisioned mode with auto scaling still bills for provisioned capacity during quiet periods and reacts too slowly to sharp, short spikes.
On-demand mode charges per read and write request, needs no capacity planning, and scales with traffic automatically. Provisioned mode with auto scaling still bills for provisioned capacity during quiet periods and reacts too slowly to sharp, short spikes.
Question 33Resilient Architectures
A gaming company runs multiplayer game servers on EC2 instances in an Auto Scaling group across three Availability Zones. The game uses a custom protocol over UDP. Some partners must add the service's IP addresses to their firewall allow lists, so the addresses must not change. Which solution will meet these requirements?
Correct answer: C. Use a Network Load Balancer with a UDP listener and an Elastic IP address in each subnet
A Network Load Balancer supports UDP and lets you attach one Elastic IP address per Availability Zone subnet, which gives partners fixed addresses. An ALB handles only HTTP and HTTPS, and its IP addresses change over time. Elastic IPs on individual instances break as the Auto Scaling group replaces or adds instances.
A Network Load Balancer supports UDP and lets you attach one Elastic IP address per Availability Zone subnet, which gives partners fixed addresses. An ALB handles only HTTP and HTTPS, and its IP addresses change over time. Elastic IPs on individual instances break as the Auto Scaling group replaces or adds instances.
Question 34High-Performing Architectures
A gaming company runs multiplayer game servers on Amazon EC2 behind Network Load Balancers in three AWS Regions. The game uses UDP. Players need the lowest possible latency, the company wants a fixed set of IP addresses that players can allowlist, and traffic must move away from an unhealthy Region within seconds. Which solution will meet these requirements?
Correct answer: D. Create an AWS Global Accelerator with an endpoint group in each Region for the load balancers.
Global Accelerator gives two static anycast IP addresses, carries TCP and UDP traffic over the AWS global network, and fails over between endpoint groups within seconds. Route 53 latency routing relies on DNS, so client caching slows failover and players do not get a fixed set of IP addresses.
Global Accelerator gives two static anycast IP addresses, carries TCP and UDP traffic over the AWS global network, and fails over between endpoint groups within seconds. Route 53 latency routing relies on DNS, so client caching slows failover and players do not get a fixed set of IP addresses.
Question 35Secure Architectures
A financial services company must store trade records in Amazon S3 for 7 years in a write-once-read-many (WORM) format. No user, including the root user of the AWS account, can be allowed to delete or overwrite the records during the retention period. Which solution will meet these requirements?
Correct answer: D. Enable S3 Object Lock in compliance mode on the bucket with a default retention period of 7 years.
In compliance mode, no user, including the root user, can delete a locked object version or shorten its retention until the period ends. Governance mode can be bypassed by anyone with the s3:BypassGovernanceRetention permission, so it does not meet the requirement.
In compliance mode, no user, including the root user, can delete a locked object version or shorten its retention until the period ends. Governance mode can be bypassed by anyone with the s3:BypassGovernanceRetention permission, so it does not meet the requirement.
Question 36Resilient Architectures
A company must send all inbound and outbound VPC traffic through a fleet of third-party firewall appliances from AWS Marketplace. The fleet must scale out and stay highly available, and traffic must reach only healthy appliances. The company wants the network design to stay as simple as possible. Which solution will meet these requirements?
Correct answer: A. Deploy the appliances behind a Gateway Load Balancer and route traffic to its endpoints
A Gateway Load Balancer is built for third-party virtual appliances: it spreads traffic across healthy appliances, and its Gateway Load Balancer endpoints are used as route table targets. A Network Load Balancer is not designed to act as a transparent next hop for all VPC traffic. Scripted route changes add failure risk and ongoing maintenance.
A Gateway Load Balancer is built for third-party virtual appliances: it spreads traffic across healthy appliances, and its Gateway Load Balancer endpoints are used as route table targets. A Network Load Balancer is not designed to act as a transparent next hop for all VPC traffic. Scripted route changes add failure risk and ongoing maintenance.
Question 37High-Performing Architectures
A marketing company collects website clickstream events and wants to store them in Amazon S3 in Apache Parquet format for analysis with Amazon Athena. The data must land in S3 within a few minutes, and the company wants a fully managed solution with the least operational overhead. Which solution will meet these requirements?
Correct answer: B. Send the events to Amazon Data Firehose with record format conversion to Parquet and an S3 destination.
Data Firehose buffers streaming records, converts them to Parquet by using a schema from the AWS Glue Data Catalog, and delivers them to S3 within minutes with no servers to manage. An hourly Glue job on SQS data adds more parts to run and would miss the few-minute delivery target.
Data Firehose buffers streaming records, converts them to Parquet by using a schema from the AWS Glue Data Catalog, and delivers them to S3 within minutes with no servers to manage. An hourly Glue job on SQS data adds more parts to run and would miss the few-minute delivery target.
Question 38Secure Architectures
A company encrypts data in several services with an AWS KMS customer managed key. A new policy requires the key material to be rotated every year without changing the key ID or re-encrypting existing data, and older data must stay readable. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: D. Enable automatic key rotation on the existing customer managed key with a rotation period of 365 days.
Automatic rotation keeps the same key ID and ARN, keeps older key material to decrypt existing data, and supports a period from 90 to 2,560 days. Switching to AWS managed keys changes the key ID and forces existing data to be re-encrypted.
Automatic rotation keeps the same key ID and ARN, keeps older key material to decrypt existing data, and supports a period from 90 to 2,560 days. Switching to AWS managed keys changes the key ID and forces existing data to be re-encrypted.
Question 39Cost-Optimized Architectures
A company has 20 development databases on provisioned Amazon Aurora MySQL instances. Developers use each database for short, unpredictable periods, and the databases sit idle most nights and weekends. Developers must be able to connect at any time without manual steps, and a short delay on the first connection after an idle period is acceptable. Which solution is MOST cost-effective?
Correct answer: C. Convert the clusters to Aurora Serverless v2 with a minimum capacity of 0 ACUs to auto-pause
Aurora Serverless v2 can scale to 0 ACUs and pause automatically when there are no connections, so the company pays only for storage while a database is idle, and it resumes when a developer connects. A stop and start schedule does not fit unpredictable use, because a developer working in the evening would find the database stopped.
Aurora Serverless v2 can scale to 0 ACUs and pause automatically when there are no connections, so the company pays only for storage while a database is idle, and it resumes when a developer connects. A stop and start schedule does not fit unpredictable use, because a developer working in the evening would find the database stopped.
Question 40Resilient Architectures
A company's web application runs on EC2 instances in an Auto Scaling group. Traffic follows a strong daily pattern and rises sharply at 8 AM every weekday. New instances take several minutes to become ready, so users see slow responses during the morning ramp-up even with target tracking in place. Which solution will fix this with the LEAST operational overhead while keeping costs low?
Correct answer: B. Add a predictive scaling policy so capacity launches ahead of the forecasted daily load
Predictive scaling uses past load patterns to forecast traffic and launches instances before the daily spike, so capacity is ready when users arrive. It works alongside target tracking and needs no custom code. Setting the minimum capacity to the peak fixes the slowdown but pays for idle instances all day and night.
Predictive scaling uses past load patterns to forecast traffic and launches instances before the daily spike, so capacity is ready when users arrive. It works alongside target tracking and needs no custom code. Setting the minimum capacity to the peak fixes the slowdown but pays for idle instances all day and night.
Question 41Secure Architectures
A company serves a website through an Amazon CloudFront distribution that uses a custom domain name. All other application resources run in the eu-west-2 Region. The company wants a free, automatically renewing public TLS certificate for HTTPS between viewers and CloudFront. Which solution will meet these requirements?
Correct answer: C. Request a public certificate from AWS Certificate Manager in us-east-1 and attach it to the distribution.
CloudFront can only use ACM certificates that are in the us-east-1 (N. Virginia) Region, and ACM public certificates are free and renew automatically. A certificate in eu-west-2 works for regional resources such as an ALB there, but CloudFront cannot select it.
CloudFront can only use ACM certificates that are in the us-east-1 (N. Virginia) Region, and ACM public certificates are free and renew automatically. A certificate in eu-west-2 works for regional resources such as an ALB there, but CloudFront cannot select it.
Question 42High-Performing Architectures
A company stores several terabytes of application logs in Amazon S3 as uncompressed CSV files under one prefix. Analysts query the logs with Amazon Athena and usually filter on a date range, but every query scans the full data set. The company wants faster queries and a lower cost per query. Which solution will meet these requirements?
Correct answer: A. Use an AWS Glue ETL job to convert the logs to compressed Apache Parquet and partition them by date.
Parquet is columnar and compressed, so Athena reads only the columns it needs, and date partitions let it skip files outside the query's range. Query result reuse only helps when the same query runs again, so it does not reduce the data scanned by new queries.
Parquet is columnar and compressed, so Athena reads only the columns it needs, and date partitions let it skip files outside the query's range. Query result reuse only helps when the same query runs again, so it does not reduce the data scanned by new queries.
Question 43Cost-Optimized Architectures
Development EC2 instances run 24 hours a day, but developers use them only from 9 AM to 6 PM on weekdays. The company wants the MOST cost-effective change without affecting developers during working hours. Which solution will meet these requirements?
Correct answer: B. Stop the instances automatically outside working hours with a scheduler
The instances are idle for roughly three quarters of the week, so stopping them on a schedule removes most of the compute cost. Reserved Instances discount 24/7 usage, which still pays for all the idle hours.
The instances are idle for roughly three quarters of the week, so stopping them on a schedule removes most of the compute cost. Reserved Instances discount 24/7 usage, which still pays for all the idle hours.
Question 44Secure Architectures
An AWS account has more than 200 Amazon S3 buckets created by different teams. After an incident, the security team must make sure that no bucket in the account, including buckets created in the future, can be made public through bucket policies or ACLs. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: A. Turn on all four S3 Block Public Access settings at the account level for the AWS account.
Account-level Block Public Access overrides public bucket policies and ACLs for every current and future bucket with one setting. A Config rule with remediation only reacts after a bucket is already public and needs ongoing upkeep.
Account-level Block Public Access overrides public bucket policies and ACLs for every current and future bucket with one setting. A Config rule with remediation only reacts after a bucket is already public and needs ongoing upkeep.
Question 45Resilient Architectures
An Auto Scaling group runs an application that needs about 12 minutes to install dependencies and load data at boot. Traffic spikes are unpredictable, and new instances are not ready in time to absorb them. The company wants faster scale-out without paying for many extra running instances all the time. Which solution will meet these requirements?
Correct answer: C. Add a warm pool of pre-initialized instances in the Stopped state to the group
A warm pool keeps instances that have already finished their slow initialization in a stopped state, so they can join the group quickly when load rises. Stopped instances incur no instance-hour charges, only storage costs. Lowering the grace period would send traffic to instances that are still booting and cause errors.
A warm pool keeps instances that have already finished their slow initialization in a stopped state, so they can join the group quickly when load rises. Stopped instances incur no instance-hour charges, only storage costs. Lowering the grace period would send traffic to instances that are still booting and cause errors.
Question 46High-Performing Architectures
A company needs to move 60 TB of files from an on-premises NFS server to Amazon EFS over an existing 1 Gbps AWS Direct Connect connection that has spare capacity. Files keep changing during the migration, so the company needs incremental transfers before cutover, automatic data integrity checks, and minimal custom scripting. Which solution will meet these requirements?
Correct answer: B. Deploy an AWS DataSync agent on premises and run scheduled DataSync tasks from the NFS share to Amazon EFS.
DataSync uses an on-premises agent to copy data in parallel over Direct Connect, sends only changed files on later runs, and verifies data integrity automatically. An rsync script over a mounted EFS share could work, but it needs custom scripting and is usually much slower.
DataSync uses an on-premises agent to copy data in parallel over Direct Connect, sends only changed files on later runs, and verifies data integrity automatically. An rsync script over a mounted EFS share could work, but it needs custom scripting and is usually much slower.
Question 47Secure Architectures
A company stores static assets in a private Amazon S3 bucket and serves them through Amazon CloudFront. The objects are encrypted with SSE-KMS. Users must not be able to bypass CloudFront and download objects directly from S3. Which solution will meet these requirements?
Correct answer: D. Use a CloudFront origin access control, and allow only that distribution in the bucket policy and KMS key policy.
Origin access control is the current recommended way to lock an S3 origin to one CloudFront distribution, and it supports objects encrypted with SSE-KMS. The legacy origin access identity does not support SSE-KMS, so CloudFront could not serve these objects.
Origin access control is the current recommended way to lock an S3 origin to one CloudFront distribution, and it supports objects encrypted with SSE-KMS. The legacy origin access identity does not support SSE-KMS, so CloudFront could not serve these objects.
Question 48Cost-Optimized Architectures
A software company hosts large installer files in an S3 bucket in us-east-1. Users around the world download the files directly from S3. Data transfer out charges are high, and users far from the Region report slow downloads. Which solution will reduce costs and improve download speed?
Correct answer: A. Create a CloudFront distribution with the bucket as origin and restrict access with origin access control
Data transfer from S3 to CloudFront is free, CloudFront data transfer out rates are lower than S3 rates, and edge caching serves repeat downloads close to users. Transfer Acceleration speeds up long-distance transfers but adds a per-GB fee on top of normal data transfer, so it raises cost instead of lowering it.
Data transfer from S3 to CloudFront is free, CloudFront data transfer out rates are lower than S3 rates, and edge caching serves repeat downloads close to users. Transfer Acceleration speeds up long-distance transfers but adds a per-GB fee on top of normal data transfer, so it raises cost instead of lowering it.
Question 49Resilient Architectures
Users sometimes overwrite or delete important files in an S3 bucket by mistake. The company must be able to recover any earlier version of an object for 30 days, with the LEAST operational overhead. Which solution will meet these requirements?
Correct answer: B. Enable S3 Versioning and expire noncurrent versions after 30 days
Versioning keeps every earlier version and turns deletes into delete markers, so files can be restored, while the lifecycle rule limits the extra storage cost. Object Lock in compliance mode would block legitimate changes and deletions, which is stricter than needed.
Versioning keeps every earlier version and turns deletes into delete markers, so files can be restored, while the lifecycle rule limits the extra storage cost. Object Lock in compliance mode would block legitimate changes and deletions, which is stricter than needed.
Question 50High-Performing Architectures
A company is migrating an on-premises Hadoop cluster that runs Apache Spark, Apache Hive, and Apache HBase workloads. The company wants to keep using these open-source frameworks with control over cluster configuration, store data durably in Amazon S3, and scale compute separately from storage. Which solution will meet these requirements?
Correct answer: D. Run the workloads on Amazon EMR and use EMRFS so that the clusters read and write their data in Amazon S3.
Amazon EMR runs Spark, Hive, and HBase on managed clusters, and EMRFS (including HBase on S3) keeps the data in S3 so clusters can be resized or shut down without data loss. AWS Glue runs serverless Spark ETL but does not host Hive or HBase, so the jobs would need to be rewritten.
Amazon EMR runs Spark, Hive, and HBase on managed clusters, and EMRFS (including HBase on S3) keeps the data in S3 so clusters can be resized or shut down without data loss. AWS Glue runs serverless Spark ETL but does not host Hive or HBase, so the jobs would need to be rewritten.
Question 51Secure Architectures
A SaaS provider runs an API in its own VPC. Hundreds of customers in their own AWS accounts need private access to the API without using the internet. Many customer VPCs use CIDR ranges that overlap with the provider's VPC. The provider wants to expose only the API, not its whole network. Which solution will meet these requirements?
Correct answer: D. Put the API behind a Network Load Balancer, create a VPC endpoint service, and have customers create interface endpoints.
AWS PrivateLink exposes a single service through an endpoint service backed by an NLB, and it works with overlapping CIDRs because customers connect through interface endpoints in their own VPCs. VPC peering does not support overlapping CIDRs and opens routing between whole networks.
AWS PrivateLink exposes a single service through an endpoint service backed by an NLB, and it works with overlapping CIDRs because customers connect through interface endpoints in their own VPCs. VPC peering does not support overlapping CIDRs and opens routing between whole networks.
Question 52Resilient Architectures
A healthcare company runs a critical application on a single Amazon RDS for MySQL DB instance. The database must fail over automatically if the instance or its Availability Zone fails, with no loss of committed transactions. The application does not need extra read capacity. Which solution will meet these requirements?
Correct answer: A. Convert the DB instance to a Multi-AZ deployment with a synchronous standby in another AZ
A Multi-AZ deployment keeps a standby in another Availability Zone that is updated synchronously, and RDS fails over to it automatically behind the same endpoint. Read replicas use asynchronous replication and need manual promotion, so recent transactions can be lost. Snapshot restores lose data since the last snapshot and take much longer.
A Multi-AZ deployment keeps a standby in another Availability Zone that is updated synchronously, and RDS fails over to it automatically behind the same endpoint. Read replicas use asynchronous replication and need manual promotion, so recent transactions can be lost. Snapshot restores lose data since the last snapshot and take much longer.
Question 53Cost-Optimized Architectures
A company's five product teams share one AWS account, and all resources carry an activated cost allocation tag named team. The finance department wants an email alert when any team's spend for the current month is forecast to exceed $10,000, so that action can be taken before month end. Which solution requires the LEAST operational overhead?
Correct answer: C. Create an AWS Budgets cost budget for each team, filtered by the team tag, with an alert on forecasted spend
AWS Budgets can filter a cost budget by a cost allocation tag and send an alert when forecasted spend crosses a threshold, with no custom code. CloudWatch billing alarms track actual charges for the account or per service, not per tag, and they cannot alert on a forecast.
AWS Budgets can filter a cost budget by a cost allocation tag and send an alert when forecasted spend crosses a threshold, with no custom code. CloudWatch billing alarms track actual charges for the account or per service, not per tag, and they cannot alert on a forecast.
Question 54Secure Architectures
A company uses AWS Backup to protect Amazon RDS databases and Amazon EBS volumes. After a ransomware warning, the company requires that no one, even an administrator with stolen credentials, can delete backups for 35 days, and that copies are kept in a separate AWS account. Which solution will meet these requirements?
Correct answer: A. Enable AWS Backup Vault Lock in compliance mode, and copy recovery points to a vault in a separate account.
Vault Lock in compliance mode makes recovery points immutable, so no one, including the root user, can delete them before retention ends, and the cross-account copy sits outside the compromised account. An IAM deny policy can simply be removed by an administrator whose credentials are stolen.
Vault Lock in compliance mode makes recovery points immutable, so no one, including the root user, can delete them before retention ends, and the cross-account copy sits outside the compromised account. An IAM deny policy can simply be removed by an administrator whose credentials are stolen.
Question 55High-Performing Architectures
A mobile gaming company needs a real-time leaderboard that ranks millions of players by score and returns the top 100 players in under a millisecond. The data store must replicate across Availability Zones with automatic failover. Which solution will meet these requirements?
Correct answer: B. Use Amazon ElastiCache (Redis OSS) with Multi-AZ replicas and keep the scores in a sorted set structure.
Redis OSS sorted sets keep members ordered by score, so rank and top-N lookups are fast in-memory operations, and ElastiCache supports replicas with Multi-AZ automatic failover. Memcached has no sorted data types, replication, or failover, so the application would have to sort millions of scores itself.
Redis OSS sorted sets keep members ordered by score, so rank and top-N lookups are fast in-memory operations, and ElastiCache supports replicas with Multi-AZ automatic failover. Memcached has no sorted data types, replication, or failover, so the application would have to sort millions of scores itself.
Question 56Resilient Architectures
A financial services company runs an Amazon Aurora PostgreSQL cluster in one AWS Region. A new policy requires a disaster recovery plan for a full Regional outage with an RPO of about 1 second and an RTO of under 1 minute. The secondary Region should also serve low-latency reads for local users. Which solution will meet these requirements?
Correct answer: B. Convert the cluster to an Aurora global database with a secondary cluster in the other Region
Aurora Global Database uses storage-level replication with typical lag under one second, and a secondary cluster can be promoted in about a minute. The secondary cluster also serves local reads. Aurora Replicas in several Availability Zones protect against an AZ failure but not the loss of a whole Region.
Aurora Global Database uses storage-level replication with typical lag under one second, and a secondary cluster can be promoted in about a minute. The secondary cluster also serves local reads. Aurora Replicas in several Availability Zones protect against an AZ failure but not the loss of a whole Region.
Question 57Secure Architectures
A company stores sensitive reports in an Amazon S3 bucket. A compliance rule states that every request to the bucket must use HTTPS, and any request over plain HTTP must be rejected. Which solution will meet these requirements?
Correct answer: C. Add a bucket policy statement that denies all S3 actions when the aws:SecureTransport condition key is false.
A Deny statement that matches aws:SecureTransport set to false rejects any request that does not use TLS. Default encryption with SSE-KMS protects objects at rest, but it does nothing to stop clients from sending requests over HTTP.
A Deny statement that matches aws:SecureTransport set to false rejects any request that does not use TLS. Default encryption with SSE-KMS protects objects at rest, but it does nothing to stop clients from sending requests over HTTP.
Question 58Cost-Optimized Architectures
A company runs 300 EC2 instances across many accounts in AWS Organizations. The company suspects that many instances are overprovisioned and wants instance type recommendations based on historical CPU and memory utilization, with the LEAST effort. Which solution will meet these requirements?
Correct answer: B. Opt in to AWS Compute Optimizer for the organization and publish memory metrics with the CloudWatch agent
Compute Optimizer analyzes utilization history and recommends specific instance types across every account in the organization, and it uses memory data once the CloudWatch agent publishes it. Trusted Advisor's low utilization check looks only at CPU and network to flag nearly idle instances, so it does not size instances using memory data.
Compute Optimizer analyzes utilization history and recommends specific instance types across every account in the organization, and it uses memory data once the CloudWatch agent publishes it. Trusted Advisor's low utilization check looks only at CPU and network to flag nearly idle instances, so it does not size instances using memory data.
Question 59High-Performing Architectures
A financial services company exposes an API through Amazon API Gateway and AWS Lambda. Every weekday at 9:00 AM, traffic jumps sharply, and users see extra latency from function cold starts during the first few minutes. The company wants consistent low latency during these predictable peaks. Which solution will meet these requirements?
Correct answer: D. Configure provisioned concurrency and use Application Auto Scaling to raise it on a schedule before 9:00 AM.
Provisioned concurrency keeps execution environments initialized so requests skip cold starts, and a scheduled scaling action can raise it just before the daily peak. Reserved concurrency only sets aside and caps capacity for the function; it does not pre-initialize any environments.
Provisioned concurrency keeps execution environments initialized so requests skip cold starts, and a scheduled scaling action can raise it just before the daily peak. Reserved concurrency only sets aside and caps capacity for the function; it does not pre-initialize any environments.
Question 60Resilient Architectures
A social media company has users in North America, Europe, and Asia. The application stores user data in Amazon DynamoDB and must allow reads and writes in all three Regions with low latency. If one Region becomes unavailable, users must be able to keep writing data in the other Regions. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: A. Use DynamoDB global tables with replica tables in each of the three Regions
Global tables provide fully managed multi-Region, multi-active replication, so every Region accepts reads and writes and keeps working if another Region fails. Building replication with Streams and Lambda can work but needs custom code and conflict handling. A single-Region table stops accepting writes if that Region goes down.
Global tables provide fully managed multi-Region, multi-active replication, so every Region accepts reads and writes and keeps working if another Region fails. Building replication with Streams and Lambda can work but needs custom code and conflict handling. A single-Region table stops accepting writes if that Region goes down.
Question 61Secure Architectures
Developers hardcoded IAM user access keys into an application on Amazon EC2 so that it can send messages to an Amazon SQS queue. The security team wants to remove all long-term credentials from the instances while keeping the application working. Which solution will meet these requirements?
Correct answer: C. Attach an IAM role with SQS send permissions to the instances through an instance profile, and remove the keys.
An instance profile gives the application temporary credentials that rotate automatically through the instance metadata service. Keeping the keys in Secrets Manager hides them better, but they are still long-term IAM user keys, which the team wants gone.
An instance profile gives the application temporary credentials that rotate automatically through the instance metadata service. Keeping the keys in Secrets Manager hides them better, but they are still long-term IAM user keys, which the team wants gone.
Question 62Cost-Optimized Architectures
A retail company runs its product catalog on an Amazon RDS for PostgreSQL db.r6g.4xlarge instance. About 90% of queries are reads, and the same popular products are requested again and again. CPU is close to its limit, and the company plans to move to a db.r6g.8xlarge instance. Product data can be up to 5 minutes stale. Which solution is MOST cost-effective?
Correct answer: A. Add an Amazon ElastiCache for Valkey cluster and cache popular product queries with a 5-minute TTL
Caching repeated reads in ElastiCache for Valkey takes most queries off the database at a much lower cost than larger or extra database instances, and a 5-minute TTL matches the allowed staleness. Read replicas also reduce load, but each replica costs as much as the primary, so three of them cost far more than a small cache cluster.
Caching repeated reads in ElastiCache for Valkey takes most queries off the database at a much lower cost than larger or extra database instances, and a 5-minute TTL matches the allowed staleness. Read replicas also reduce load, but each replica costs as much as the primary, so three of them cost far more than a small cache cluster.
Question 63High-Performing Architectures
A company runs Java-based AWS Lambda functions that take several seconds to start during cold starts, which hurts user experience. The company wants faster startup without paying to keep environments warm all the time. Which solution will meet these requirements?
Correct answer: D. Enable Lambda SnapStart on the published function versions
SnapStart takes a snapshot of the initialized execution environment and resumes from it, which cuts Java cold-start time without a charge for idle warm environments. Provisioned concurrency also removes cold starts but costs money for capacity that is always kept ready.
SnapStart takes a snapshot of the initialized execution environment and resumes from it, which cuts Java cold-start time without a charge for idle warm environments. Provisioned concurrency also removes cold starts but costs money for capacity that is always kept ready.
Question 64Resilient Architectures
A company hosts its public web application on EC2 instances behind an Application Load Balancer in us-east-1. It has deployed a scaled-down copy of the stack in us-west-2. Traffic must go to us-east-1 under normal conditions and switch automatically to us-west-2 only when the primary site becomes unhealthy. Which solution will meet these requirements?
Correct answer: A. Create Route 53 failover records with primary and secondary roles and a health check on primary
Failover routing sends all traffic to the primary record while its health check passes and automatically answers with the secondary record when it fails. This matches an active-passive design. Latency-based routing would send part of the traffic to us-west-2 during normal operations, which the company does not want.
Failover routing sends all traffic to the primary record while its health check passes and automatically answers with the secondary record when it fails. This matches an active-passive design. Latency-based routing would send part of the traffic to us-west-2 during normal operations, which the company does not want.
Question 65Secure Architectures
A company lets developers create IAM roles for their AWS Lambda functions. The security team must make sure developers can never create a role with more permissions than a defined set, such as access to specific DynamoDB tables and CloudWatch Logs, even if they attach AdministratorAccess to the role. Which solution will meet these requirements?
Correct answer: C. Require a permissions boundary on every role developers create, enforced by a condition in the developers' policy.
A permissions boundary caps the maximum permissions a role can ever have, and an iam:PermissionsBoundary condition on the developers' policy forces them to set it. Access Analyzer validation only reviews policies, so an over-privileged role could exist until someone acts on the finding.
A permissions boundary caps the maximum permissions a role can ever have, and an iam:PermissionsBoundary condition on the developers' policy forces them to set it. Access Analyzer validation only reviews policies, so an over-privileged role could exist until someone acts on the finding.
The real AWS Solutions Architect Associate exam at a glance
65questions
2h 10mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Solutions Architect Associate exam. They are not real exam questions. AWS Solutions Architect Associate and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 130 minutes · passing score 720 on a 100-1000 scale.