AWS SAA-C03 · Updated 2026
Free AWS Solutions Architect Associate Practice Exam (2026)
Full-length SAA-C03 mock exams with the same number of questions and time as the real exam. Real-world architecture scenarios across all 4 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 2 hours 10 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Secure Architectures
Operations engineers sign in to a production AWS account as IAM users. They must be able to stop and terminate EC2 instances only when they signed in with multi-factor authentication (MFA). Read-only actions must keep working without MFA. Which solution will meet these requirements?
Correct answer: A. Allow ec2:StopInstances and ec2:TerminateInstances in the IAM policy only when aws:MultiFactorAuthPresent is true.
The aws:MultiFactorAuthPresent condition key lets a policy allow specific sensitive actions only for MFA-authenticated sessions while other actions still work. MFA Delete is an S3 bucket versioning feature and has no effect on EC2 actions.
The aws:MultiFactorAuthPresent condition key lets a policy allow specific sensitive actions only for MFA-authenticated sessions while other actions still work. MFA Delete is an S3 bucket versioning feature and has no effect on EC2 actions.
Question 2Resilient Architectures
A company uses EC2 instances in an Auto Scaling group to process jobs from an SQS queue. The number of messages in the queue varies widely during the day, and jobs must be finished within a target time. CPU usage is a poor signal of the actual backlog. Which scaling approach will meet these requirements?
Correct answer: C. Use target tracking on a custom backlog-per-instance metric built from visible messages
AWS recommends scaling queue workers on backlog per instance, which divides the visible messages by the number of running instances and compares it to an acceptable backlog. This ties capacity directly to the work waiting in the queue. CPU-based tracking can miss a growing backlog when jobs are I/O bound or waiting on other services.
AWS recommends scaling queue workers on backlog per instance, which divides the visible messages by the number of running instances and compares it to an acceptable backlog. This ties capacity directly to the work waiting in the queue. CPU-based tracking can miss a growing backlog when jobs are I/O bound or waiting on other services.
Question 3High-Performing Architectures
An IoT platform writes sensor readings to an Amazon S3 bucket at more than 20,000 PUT requests per second. All objects go under a single prefix named after the current date, and the application gets HTTP 503 Slow Down errors during peaks. The company wants to increase write throughput. Which solution will meet these requirements?
Correct answer: D. Spread the objects across many prefixes, such as by adding a hashed device ID, so requests run in parallel.
S3 supports at least 3,500 PUT requests per second per partitioned prefix, so spreading writes across many prefixes multiplies the request rate the bucket can handle. Transfer Acceleration speeds up long-distance transfers but does not raise the per-prefix request limit.
S3 supports at least 3,500 PUT requests per second per partitioned prefix, so spreading writes across many prefixes multiplies the request rate the bucket can handle. Transfer Acceleration speeds up long-distance transfers but does not raise the per-prefix request limit.
Question 4Cost-Optimized Architectures
A company generates thumbnails from original images that are stored in Amazon S3 Standard. The thumbnails can be regenerated from the originals at any time. Each thumbnail is accessed only a few times a month, but it must load in milliseconds when requested. The company wants the LOWEST storage cost for the thumbnails. Which storage class should the company use?
Correct answer: D. S3 One Zone-IA, which stores the thumbnails in a single AZ at a lower price per GB
S3 One Zone-IA costs about 20% less than Standard-IA and still gives millisecond access, and losing an AZ is acceptable because the thumbnails can be regenerated. Standard-IA would work, but its multi-AZ resilience adds cost that this re-creatable data does not need.
S3 One Zone-IA costs about 20% less than Standard-IA and still gives millisecond access, and losing an AZ is acceptable because the thumbnails can be regenerated. Standard-IA would work, but its multi-AZ resilience adds cost that this re-creatable data does not need.
Question 5Secure Architectures
A media company's internet-facing application uses Amazon CloudFront, an Application Load Balancer, and Amazon Route 53. Large DDoS attacks have caused high scaling charges. The company wants 24/7 access to AWS DDoS experts during attacks and protection against scaling costs caused by DDoS attacks. Which solution will meet these requirements?
Correct answer: B. Subscribe to AWS Shield Advanced and add protection for the CloudFront distribution, the ALB, and the hosted zones.
Shield Advanced adds 24/7 access to the Shield Response Team and cost protection that credits scaling charges caused by DDoS attacks. Shield Standard defends against common network and transport layer attacks but includes neither the response team nor cost protection.
Shield Advanced adds 24/7 access to the Shield Response Team and cost protection that credits scaling charges caused by DDoS attacks. Shield Standard defends against common network and transport layer attacks but includes neither the response team nor cost protection.
Question 6Resilient Architectures
A company uses an AWS Lambda function to process messages from an SQS queue in batches of 10. When one message in a batch fails, the whole batch returns to the queue and the successful messages are processed again. The company wants only the failed messages to be retried while keeping batch processing. Which solution will meet these requirements?
Correct answer: B. Enable ReportBatchItemFailures on the event source mapping and return the failed message IDs
With ReportBatchItemFailures turned on, the function returns the IDs of the messages that failed, and Lambda deletes the rest so only the failures go back to the queue. A batch size of 1 also isolates failures but gives up batching and raises invocation count and cost. Deleting the whole batch on error would lose the failed messages.
With ReportBatchItemFailures turned on, the function returns the IDs of the messages that failed, and Lambda deletes the rest so only the failures go back to the queue. A batch size of 1 also isolates failures but gives up batching and raises invocation count and cost. Deleting the whole batch on error would lose the failed messages.
Question 7High-Performing Architectures
A company is moving a large Oracle database to Amazon EC2. The database needs 150,000 IOPS with consistent sub-millisecond latency on a single EBS volume, and it requires the highest durability that Amazon EBS offers. Which solution will meet these requirements?
Correct answer: D. Use an io2 Block Express volume provisioned with 150,000 IOPS on a supported Nitro-based instance.
io2 Block Express supports up to 256,000 IOPS per volume with sub-millisecond latency and 99.999% durability, so it fits this database on one volume. gp3 has lower durability and cannot reach 150,000 IOPS on a single volume.
io2 Block Express supports up to 256,000 IOPS per volume with sub-millisecond latency and 99.999% durability, so it fits this database on one volume. gp3 has lower durability and cannot reach 150,000 IOPS on a single volume.
Question 8Cost-Optimized Architectures
A healthcare company stores medical images in Amazon S3. After 6 months, each image is accessed about once a quarter, but when a doctor requests an image it must be returned in milliseconds. The data must be stored across multiple Availability Zones. Which solution provides the LOWEST storage cost?
Correct answer: C. Use a lifecycle rule to move images to S3 Glacier Instant Retrieval after 180 days
S3 Glacier Instant Retrieval is designed for data accessed about once a quarter, returns objects in milliseconds, and stores data across multiple AZs at a lower price per GB than Standard-IA. Standard-IA also meets the access needs, but its higher storage price makes it more expensive for data read so rarely.
S3 Glacier Instant Retrieval is designed for data accessed about once a quarter, returns objects in milliseconds, and stores data across multiple AZs at a lower price per GB than Standard-IA. Standard-IA also meets the access needs, but its higher storage price makes it more expensive for data read so rarely.
Question 9Secure Architectures
A three-tier application has web servers behind an Application Load Balancer, application servers in an Auto Scaling group, and an Amazon RDS database. The database must accept connections only from the application servers, even as Auto Scaling adds or replaces instances. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: B. Add an inbound rule to the database security group that allows the database port from the app tier's security group.
Using the application tier's security group as the source allows any instance in that group, so new Auto Scaling instances are covered automatically. A network ACL rule for the whole VPC CIDR is simple, but it lets every resource in the VPC reach the database.
Using the application tier's security group as the source allows any instance in that group, so new Auto Scaling instances are covered automatically. A network ACL rule for the whole VPC CIDR is simple, but it lets every resource in the VPC reach the database.
Question 10Resilient Architectures
A company runs dozens of microservices on a self-managed Kubernetes cluster in its data center. It wants to move them to AWS with minimal changes to its existing Kubernetes manifests and Helm charts. The operations team does not want to patch, scale, or manage worker nodes. Which solution will meet these requirements?
Correct answer: C. Move the services to Amazon EKS and run the pods on AWS Fargate by using Fargate profiles
Amazon EKS runs standard Kubernetes, so existing manifests and Helm charts work with little change, and Fargate profiles run pods with no worker nodes to manage. ECS on Fargate also removes node management, but it would require rewriting the Kubernetes manifests as ECS task definitions.
Amazon EKS runs standard Kubernetes, so existing manifests and Helm charts work with little change, and Fargate profiles run pods with no worker nodes to manage. ECS on Fargate also removes node management, but it would require rewriting the Kubernetes manifests as ECS task definitions.
Question 11High-Performing Architectures
A data analytics company runs a daily log processing job on Amazon EC2 that reads and writes several terabytes of data in large, sequential blocks. The job needs high throughput, and the company wants the lowest-cost EBS volume type that suits this frequently accessed workload. Which solution will meet these requirements?
Correct answer: A. Use Throughput Optimized HDD (st1) volumes that are sized to deliver the throughput the job needs.
st1 is a low-cost HDD volume designed for frequently accessed, throughput-heavy sequential workloads such as log processing. sc1 is cheaper, but it is meant for infrequently accessed cold data and has much lower throughput.
st1 is a low-cost HDD volume designed for frequently accessed, throughput-heavy sequential workloads such as log processing. sc1 is cheaper, but it is meant for infrequently accessed cold data and has much lower throughput.
Question 12Secure Architectures
A company stores confidential documents in Amazon S3. Auditors require that every use of the encryption key is logged in AWS CloudTrail and that the security team, not the storage administrators, controls who can decrypt the data. Which solution will meet these requirements?
Correct answer: B. Use SSE-KMS with a customer managed key whose key policy is owned and managed by the security team.
With a customer managed KMS key, the key policy decides who can use the key to decrypt, and every KMS call is logged in CloudTrail. The AWS managed aws/s3 key also logs usage, but its key policy cannot be edited, so the security team cannot control decryption separately from S3 permissions.
With a customer managed KMS key, the key policy decides who can use the key to decrypt, and every KMS call is logged in CloudTrail. The AWS managed aws/s3 key also logs usage, but its key policy cannot be edited, so the security team cannot control decryption separately from S3 permissions.
Question 13Cost-Optimized Architectures
A company backs up its on-premises servers to a physical tape library by using commercial backup software. Backups must be kept for 10 years, restores are rare, and a restore time of up to 48 hours is acceptable. The company wants to eliminate tape hardware and off-site tape storage costs without changing its backup software workflow. Which solution is MOST cost-effective?
Correct answer: A. Deploy a Tape Gateway as a virtual tape library and archive the virtual tapes to S3 Glacier Deep Archive
Tape Gateway presents a virtual tape library to existing backup software, so the workflow does not change, and archived tapes in S3 Glacier Deep Archive get the lowest storage price on AWS. An S3 File Gateway could also reach Deep Archive, but the backup jobs would have to be reconfigured to write to a file share instead of tape.
Tape Gateway presents a virtual tape library to existing backup software, so the workflow does not change, and archived tapes in S3 Glacier Deep Archive get the lowest storage price on AWS. An S3 File Gateway could also reach Deep Archive, but the backup jobs would have to be reconfigured to write to a file share instead of tape.
Question 14Resilient Architectures
A company runs an Amazon RDS for MySQL Multi-AZ DB instance for its order system. Analysts run heavy reporting queries during business hours, and these queries slow down order processing. Reports can be a few seconds behind live data. Which solution will meet these requirements?
Correct answer: C. Create a read replica and update the reporting tool to connect to the read replica endpoint
A read replica receives changes asynchronously and serves read-only queries, which moves the reporting load off the primary while staying only seconds behind. In a Multi-AZ DB instance deployment, the standby cannot accept connections and exists only for failover. A larger instance class may help for a while but keeps both workloads competing on one database.
A read replica receives changes asynchronously and serves read-only queries, which moves the reporting load off the primary while staying only seconds behind. In a Multi-AZ DB instance deployment, the standby cannot accept connections and exists only for failover. A larger instance class may help for a while but keeps both workloads competing on one database.
Question 15Secure Architectures
An application writes millions of small objects per day to an Amazon S3 bucket that uses SSE-KMS with a customer managed key. AWS KMS request costs have grown sharply, and the application is getting KMS throttling errors. The company must keep using its customer managed key. Which solution will meet these requirements?
Correct answer: D. Enable S3 Bucket Keys on the bucket so that S3 uses a bucket-level key and makes fewer calls to AWS KMS.
S3 Bucket Keys let S3 create data keys from a short-lived bucket-level key, which can cut KMS requests and their cost by up to 99 percent while still using the customer managed key. A quota increase would ease the throttling but would not lower the KMS request charges.
S3 Bucket Keys let S3 create data keys from a short-lived bucket-level key, which can cut KMS requests and their cost by up to 99 percent while still using the customer managed key. A quota increase would ease the throttling but would not lower the KMS request charges.
Question 16High-Performing Architectures
A company is migrating a file share that Linux servers access over NFS and Windows servers access over SMB. Both groups must work on the same data at the same time. The company also needs deduplication, compression, and point-in-time snapshots, with the least operational overhead. Which solution will meet these requirements?
Correct answer: D. Amazon FSx for NetApp ONTAP with volumes shared over both the NFS and SMB protocols
FSx for NetApp ONTAP serves the same volumes over NFS and SMB at once and includes deduplication, compression, and snapshots. FSx for Windows File Server has deduplication and shadow copies but serves data only over SMB, so the Linux servers could not use NFS.
FSx for NetApp ONTAP serves the same volumes over NFS and SMB at once and includes deduplication, compression, and snapshots. FSx for Windows File Server has deduplication and shadow copies but serves data only over SMB, so the Linux servers could not use NFS.
Question 17Resilient Architectures
At 14:05, a developer ran an UPDATE statement without a WHERE clause on an Amazon RDS for PostgreSQL database, which has automated backups enabled. The company must recover the data as it was at 14:04. Which solution will meet these requirements?
Correct answer: A. Restore the DB instance to a point in time of 14:04 as a new instance
Point-in-time restore uses automated backups and transaction logs to create a new instance at any second within the retention period. A read replica and the Multi-AZ standby already contain the bad update, and the midnight snapshot would lose the morning's valid data.
Point-in-time restore uses automated backups and transaction logs to create a new instance at any second within the retention period. A read replica and the Multi-AZ standby already contain the bad update, and the midnight snapshot would lose the morning's valid data.
Question 18Cost-Optimized Architectures
A company runs a production Amazon RDS for MySQL db.r7g.2xlarge Multi-AZ DB instance 24 hours a day. The load is steady, and the company expects to keep the same instance class and engine for at least 3 years. The company wants the LARGEST possible discount. Which purchase option will meet these requirements?
Correct answer: B. A 3-year RDS Reserved Instance for db.r7g.2xlarge Multi-AZ with the All Upfront payment option
A 3-year RDS Reserved Instance paid All Upfront gives the deepest discount for a database that will not change for 3 years. Database Savings Plans add flexibility across engines and instance types, but their discount on provisioned instances is smaller, and Compute Savings Plans do not cover RDS at all.
A 3-year RDS Reserved Instance paid All Upfront gives the deepest discount for a database that will not change for 3 years. Database Savings Plans add flexibility across engines and instance types, but their discount on provisioned instances is smaller, and Compute Savings Plans do not cover RDS at all.
Question 19Secure Architectures
An AWS Lambda function runs in private subnets of a VPC that has no internet gateway and no NAT gateway. The function must send messages to an Amazon SQS queue. The security team does not allow any path to the internet. Which solution will meet these requirements?
Correct answer: D. Create an interface VPC endpoint for Amazon SQS in the private subnets with private DNS turned on.
Interface endpoints, powered by PrivateLink, give private access to SQS and most other AWS services, and private DNS lets the SDK keep using the normal endpoint name. Gateway endpoints exist only for Amazon S3 and DynamoDB, so they are not an option for SQS.
Interface endpoints, powered by PrivateLink, give private access to SQS and most other AWS services, and private DNS lets the SDK keep using the normal endpoint name. Gateway endpoints exist only for Amazon S3 and DynamoDB, so they are not an option for SQS.
Question 20High-Performing Architectures
A company runs a content management application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. All instances must read and write the same files through a POSIX-compliant file system. Traffic is spiky and hard to predict, and the company does not want to provision storage size or throughput in advance. Which solution will meet these requirements?
Correct answer: C. Create an Amazon EFS file system with Elastic throughput and a mount target in each Availability Zone.
EFS is a shared, POSIX-compliant file system that grows and shrinks automatically, can be mounted from every Availability Zone, and Elastic throughput scales performance with demand. EBS Multi-Attach works only within one Availability Zone and needs a cluster-aware file system.
EFS is a shared, POSIX-compliant file system that grows and shrinks automatically, can be mounted from every Availability Zone, and Elastic throughput scales performance with demand. EBS Multi-Attach works only within one Availability Zone and needs a cluster-aware file system.
Question 21Resilient Architectures
A company runs a business application on EC2 instances with an Amazon RDS database in one Region. Its disaster recovery plan needs an RPO of minutes and an RTO of under 1 hour for a Regional outage. The company wants to keep costs low and does not want application servers running in the recovery Region until a disaster occurs. Which DR strategy meets these requirements?
Correct answer: A. Pilot light with a cross-Region read replica and AMIs ready to launch app servers on demand
Pilot light keeps the core data live in the recovery Region through continuous replication, which gives an RPO of minutes, while app servers are launched from AMIs only during a disaster. That keeps costs low and still allows recovery within an hour. Warm standby also meets the RTO, but it keeps application servers running all the time, which the company wants to avoid.
Pilot light keeps the core data live in the recovery Region through continuous replication, which gives an RPO of minutes, while app servers are launched from AMIs only during a disaster. That keeps costs low and still allows recovery within an hour. Warm standby also meets the RTO, but it keeps application servers running all the time, which the company wants to avoid.
Question 22Secure Architectures
A company manages Linux EC2 instances in private subnets through a bastion host that has SSH open to the corporate IP range. The security team wants to remove the bastion host, close all inbound ports on the instances, and record every session for audits. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: C. Use AWS Systems Manager Session Manager with the SSM Agent and an instance role, and log sessions to S3.
Session Manager opens shell sessions over the SSM Agent's outbound connection, so no inbound ports or bastion hosts are needed, and it can log full sessions to S3 or CloudWatch Logs. Client VPN removes the bastion host, but SSH still has to stay open on the instances.
Session Manager opens shell sessions over the SSM Agent's outbound connection, so no inbound ports or bastion hosts are needed, and it can log full sessions to S3 or CloudWatch Logs. Client VPN removes the bastion host, but SSH still has to stay open on the instances.
Question 23Cost-Optimized Architectures
A company runs a t3.medium EC2 instance 24/7 that checks an S3 bucket every minute for new CSV files and processes them. About 200 files arrive each day at random times, and each file takes about 20 seconds to process. The company wants to reduce cost and operational overhead. Which solution will meet these requirements?
Correct answer: A. Replace the instance with an AWS Lambda function that is invoked by S3 event notifications for new files
A Lambda function triggered by S3 event notifications runs only when a file arrives, so about 200 short invocations a day cost far less than an always-on instance and remove server management. A Spot Instance lowers the hourly price, but the script still polls around the clock and the company must handle interruptions.
A Lambda function triggered by S3 event notifications runs only when a file arrives, so about 200 short invocations a day cost far less than an always-on instance and remove server management. A Spot Instance lowers the hourly price, but the script still polls around the clock and the company must handle interruptions.
Question 24High-Performing Architectures
A company runs a distributed caching and data processing tier on Amazon EC2. Each node needs very high random read and write IOPS at the lowest possible latency for temporary data. The application replicates data across nodes, so losing one node's data is acceptable. The company wants the best I/O performance at the lowest cost. Which solution will meet these requirements?
Correct answer: B. Use storage optimized instances, such as I4i, and keep the data on NVMe instance store volumes.
NVMe instance store is physically attached to the host, so it delivers the highest random I/O at the lowest latency, and its cost is included in the instance price. Its data is lost when an instance stops, which is acceptable here, while io2 volumes would add large cost and network-attached latency.
NVMe instance store is physically attached to the host, so it delivers the highest random I/O at the lowest latency, and its cost is included in the instance price. Its data is lost when an instance stops, which is acceptable here, while io2 volumes would add large cost and network-attached latency.
Question 25Secure Architectures
A photo-sharing mobile app signs users in with an Amazon Cognito user pool. Each user must upload photos directly to an Amazon S3 bucket, but only into a prefix that matches that user's own identity. The company does not want uploads to pass through its backend servers. Which solution will meet these requirements?
Correct answer: A. Use a Cognito identity pool to issue temporary credentials with a policy scoped by the user's identity ID variable.
An identity pool exchanges the user pool token for temporary AWS credentials, and the IAM policy can use the identity ID variable to limit each user to their own prefix. Per-user access points do not scale, and users would still need credentials to call them.
An identity pool exchanges the user pool token for temporary AWS credentials, and the IAM policy can use the identity ID variable to limit each user to their own prefix. Per-user access points do not scale, and users would still need credentials to call them.
Question 26Resilient Architectures
An online retailer needs to recover its web platform within 10 minutes of a Regional outage, with an RPO under 1 minute. The recovery site must be able to take some production traffic immediately and then scale up to full capacity. The company accepts paying for some always-on resources but not for a full duplicate environment. Which DR strategy meets these requirements?
Correct answer: C. Warm standby with a smaller, always-running copy of the stack that scales out on failover
Warm standby runs a scaled-down but fully working copy of the environment, so it can serve traffic at once and then scale out to full capacity within minutes. Pilot light needs app servers to be launched and configured first, so it cannot take traffic immediately. Multi-site would meet the goals but costs as much as a second full production stack.
Warm standby runs a scaled-down but fully working copy of the environment, so it can serve traffic at once and then scale out to full capacity within minutes. Pilot light needs app servers to be launched and configured first, so it cannot take traffic immediately. Multi-site would meet the goals but costs as much as a second full production stack.
Question 27Cost-Optimized Architectures
A company runs two workloads on Amazon ECS with AWS Fargate: a customer-facing web service that must not be interrupted, and nightly data-processing tasks that are stateless and can be retried if stopped. The company wants to lower the cost of the nightly tasks without managing any servers. Which solution will meet these requirements?
Correct answer: B. Run only the nightly tasks on the FARGATE_SPOT capacity provider and keep the web service on FARGATE
Fargate Spot runs interruption-tolerant tasks on spare capacity at up to a 70% discount, gives a two-minute warning before stopping a task, and needs no servers. EC2 Spot gives similar savings, but the company would then have to manage instances and an Auto Scaling group, which it wants to avoid.
Fargate Spot runs interruption-tolerant tasks on spare capacity at up to a 70% discount, gives a two-minute warning before stopping a task, and needs no servers. EC2 Spot gives similar savings, but the company would then have to manage instances and an Auto Scaling group, which it wants to avoid.
Question 28Secure Architectures
A security team must identify all S3 buckets, IAM roles, KMS keys, and Lambda functions in its AWS organization that are shared with principals outside the organization. The team must also get new findings when external sharing is added later. Which solution will meet these requirements?
Correct answer: D. Create an IAM Access Analyzer external access analyzer with the organization as the zone of trust.
IAM Access Analyzer reviews resource-based policies, reports resources that grant access outside the zone of trust, and creates new findings as policies change. Credential reports only list IAM users and the status of their credentials, not resource sharing.
IAM Access Analyzer reviews resource-based policies, reports resources that grant access outside the zone of trust, and creates new findings as policies change. Credential reports only list IAM users and the status of their credentials, not resource sharing.
Question 29High-Performing Architectures
A company is moving Windows-based applications to AWS. They need shared file storage over SMB that is joined to the company's Active Directory and supports NTFS permissions, with the least management effort. Which solution will meet these requirements?
Correct answer: A. Amazon FSx for Windows File Server joined to the AD domain
FSx for Windows File Server is a managed native Windows file system with SMB, AD integration and NTFS ACLs. Amazon EFS supports NFS and is meant for Linux clients, so Windows applications cannot use it as an SMB share.
FSx for Windows File Server is a managed native Windows file system with SMB, AD integration and NTFS ACLs. Amazon EFS supports NFS and is meant for Linux clients, so Windows applications cannot use it as an SMB share.
Question 30Resilient Architectures
A company runs an internal reporting application that is not business critical. Management has approved an RTO of 24 hours and an RPO of 24 hours for a Regional outage and wants the lowest possible cost. The application uses EC2 instances with EBS volumes and an Amazon RDS database. Which solution will meet these requirements?
Correct answer: B. Use AWS Backup daily backup plans that copy the EC2, EBS, and RDS backups to a second Region
Backup and restore is the cheapest DR strategy and fits an RTO and RPO of 24 hours. AWS Backup can run daily backups and copy them to another Region automatically, with no running resources there. Elastic Disaster Recovery gives much faster recovery but adds continuous replication and staging costs the company does not need.
Backup and restore is the cheapest DR strategy and fits an RTO and RPO of 24 hours. AWS Backup can run daily backups and copy them to another Region automatically, with no running resources there. Elastic Disaster Recovery gives much faster recovery but adds continuous replication and staging costs the company does not need.
Question 31Secure Architectures
Many project teams in a company create Amazon EC2 instances in one account. Developers must manage only the instances that belong to their own project. New projects are added every week, and the security team does not want to edit IAM policies for each new project. Which solution will meet these requirements?
Correct answer: A. Use ABAC with one policy that allows actions when aws:ResourceTag/project matches aws:PrincipalTag/project.
Attribute-based access control compares a tag on the user or role with a tag on the resource, so one policy covers every project, including new ones. Per-project policies that list instance IDs need constant edits as teams and instances change.
Attribute-based access control compares a tag on the user or role with a tag on the resource, so one policy covers every project, including new ones. Per-project policies that list instance IDs need constant edits as teams and instances change.
Question 32Cost-Optimized Architectures
A company runs an I/O-intensive OLTP workload on an Amazon Aurora PostgreSQL cluster that uses the Aurora Standard storage configuration. Cost Explorer shows that I/O charges make up about 40% of the cluster's total cost. The company wants to reduce database costs without changing the application. Which solution will meet these requirements?
Correct answer: D. Change the cluster's storage configuration to Aurora I/O-Optimized so I/O requests are not charged
Aurora I/O-Optimized removes per-request I/O charges in exchange for higher instance and storage prices, and AWS recommends it when I/O is more than about 25% of Aurora spend. Aurora Serverless v2 changes how compute is billed, but with the Standard configuration the I/O charges remain, so the largest cost driver stays.
Aurora I/O-Optimized removes per-request I/O charges in exchange for higher instance and storage prices, and AWS recommends it when I/O is more than about 25% of Aurora spend. Aurora Serverless v2 changes how compute is billed, but with the Standard configuration the I/O charges remain, so the largest cost driver stays.
Question 33Resilient Architectures
A company is releasing a new version of its web application behind a second Application Load Balancer. It wants to send only 10% of users to the new version at first and increase the share gradually. Which solution will meet these requirements?
Correct answer: A. Use Route 53 weighted routing records with weights of 90 and 10
Weighted routing splits traffic between records in proportion to their weights, which suits a gradual canary release. Failover routing sends traffic to the secondary only when the primary is unhealthy, so it cannot send a fixed share.
Weighted routing splits traffic between records in proportion to their weights, which suits a gradual canary release. Failover routing sends traffic to the secondary only when the primary is unhealthy, so it cannot send a fixed share.
Question 34High-Performing Architectures
An online retailer needs full-text search across millions of product descriptions, with relevance ranking, typo tolerance and response times in milliseconds. Which AWS service will meet these requirements?
Correct answer: C. Amazon OpenSearch Service
OpenSearch Service builds inverted indexes for fast full-text search with relevance scoring and fuzzy matching. DynamoDB scans and SQL LIKE queries read large amounts of data and do not rank results by relevance.
OpenSearch Service builds inverted indexes for fast full-text search with relevance scoring and fuzzy matching. DynamoDB scans and SQL LIKE queries read large amounts of data and do not rank results by relevance.
Question 35Secure Architectures
A web portal lets customers download invoices stored in a private Amazon S3 bucket. Each customer must download only their own invoice, and the download link must stop working after 15 minutes. Customers do not have AWS credentials. Which solution will meet these requirements?
Correct answer: A. Have the backend generate an S3 presigned URL for the requested invoice with a 15-minute expiration.
A presigned URL is signed with the backend's credentials and grants time-limited access to one object, so customers need no AWS identity. IAM users for customers add long-term identities to manage and do not give a link that expires.
A presigned URL is signed with the backend's credentials and grants time-limited access to one object, so customers need no AWS identity. IAM users for customers add long-term identities to manage and do not give a link that expires.
Question 36Resilient Architectures
A manufacturing company runs 40 Windows and Linux servers in its on-premises data center. It needs a disaster recovery site on AWS with an RPO of seconds and an RTO of minutes. The company wants to avoid paying for full-size servers in AWS until a failover happens. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: D. Use AWS Elastic Disaster Recovery to replicate the servers to a low-cost staging area in AWS
Elastic Disaster Recovery continuously replicates block-level data to lightweight staging resources, which gives an RPO of seconds, and launches full-size recovery instances within minutes only when needed. Hourly backups cannot meet an RPO of seconds. A one-time copy with Application Migration Service would quickly fall out of date.
Elastic Disaster Recovery continuously replicates block-level data to lightweight staging resources, which gives an RPO of seconds, and launches full-size recovery instances within minutes only when needed. Hourly backups cannot meet an RPO of seconds. A one-time copy with Application Migration Service would quickly fall out of date.
Question 37High-Performing Architectures
A company keeps the last 6 months of sales data in Amazon Redshift and five years of older data as Parquet files in Amazon S3. Analysts must query both together with SQL without loading the old data into the cluster. Which solution will meet these requirements?
Correct answer: B. Use Amazon Redshift Spectrum with external tables over the S3 data
Redshift Spectrum lets the cluster query data in S3 through external tables and join it with local tables, without loading it. Loading five years of data each night adds cost and storage to the cluster for data that is rarely used.
Redshift Spectrum lets the cluster query data in S3 through external tables and join it with local tables, without loading it. Loading five years of data each night adds cost and storage to the cluster for data that is rarely used.
Question 38Secure Architectures
A company runs an unencrypted Amazon RDS for PostgreSQL DB instance in production. A new policy requires the database to be encrypted at rest with an AWS KMS key. Which solution will meet these requirements?
Correct answer: C. Take a snapshot, copy it with encryption using a KMS key, and restore a new DB instance from the encrypted copy.
RDS cannot turn on encryption for an existing unencrypted instance, but a snapshot copy can be encrypted and then restored as a new encrypted instance. Creating an encrypted read replica from an unencrypted instance is not supported, so that path fails.
RDS cannot turn on encryption for an existing unencrypted instance, but a snapshot copy can be encrypted and then restored as a new encrypted instance. Creating an encrypted read replica from an unencrypted instance is not supported, so that path fails.
Question 39Cost-Optimized Architectures
A research company runs a self-managed distributed computing cluster of 50 EC2 instances spread across three Availability Zones. The nodes exchange hundreds of terabytes of data with each other every month. Jobs can be restarted if they fail, and the cluster does not need to survive an AZ outage. Data transfer charges between the nodes are high. Which solution is MOST cost-effective?
Correct answer: B. Launch all nodes in one Availability Zone and have them communicate over their private IP addresses
Data transfer between EC2 instances in the same AZ over private IP addresses is free, while traffic between AZs is charged per GB in each direction. Routing through a transit gateway keeps traffic private but adds a per-GB processing charge on top of the inter-AZ charge.
Data transfer between EC2 instances in the same AZ over private IP addresses is free, while traffic between AZs is charged per GB in each direction. Routing through a transit gateway keeps traffic private but adds a per-GB processing charge on top of the inter-AZ charge.
Question 40Resilient Architectures
A media company stores production video assets in an Amazon S3 bucket in eu-west-1. A compliance rule requires a copy of every new object in a bucket in eu-central-1, and 99.99 percent of objects must be replicated within 15 minutes, with metrics to prove it. Which solution will meet these requirements?
Correct answer: D. Configure S3 Cross-Region Replication with S3 Replication Time Control enabled
S3 Replication Time Control is designed to replicate 99.99 percent of objects within 15 minutes, is backed by an SLA, and provides replication metrics and events. It is turned on as part of a Cross-Region Replication rule. A Lambda copy function could work for small files but gives no time guarantee and is harder to run for large video objects.
S3 Replication Time Control is designed to replicate 99.99 percent of objects within 15 minutes, is backed by an SLA, and provides replication metrics and events. It is turned on as part of a Cross-Region Replication rule. A Lambda copy function could work for small files but gives no time guarantee and is harder to run for large video objects.
Question 41Secure Architectures
A company wants every new Amazon EBS volume and snapshot copy in its AWS account to be encrypted, including volumes created by Auto Scaling groups and by other teams' scripts that do not request encryption. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: B. Turn on EBS encryption by default in each AWS Region that the account uses.
EBS encryption by default is a per-Region account setting that encrypts every new volume, even when the request does not ask for encryption. An SCP that requires the encrypted flag would make scripts that leave it out fail instead of encrypting their volumes.
EBS encryption by default is a per-Region account setting that encrypts every new volume, even when the request does not ask for encryption. An SCP that requires the encrypted flag would make scripts that leave it out fail instead of encrypting their volumes.
Question 42High-Performing Architectures
A retail company uses a provisioned Amazon Redshift cluster as its data warehouse. During month-end reporting, hundreds of analysts run queries at once, queries wait in queues, and dashboards slow down. The cluster is sized correctly for the rest of the month. The company wants consistent performance during these bursts without paying for a larger cluster all month. Which solution will meet these requirements?
Correct answer: C. Enable concurrency scaling for the cluster's workload management queues.
Concurrency scaling adds transient cluster capacity automatically when queries start to queue and removes it when demand drops, and clusters earn free concurrency scaling credits each day. Redshift Spectrum lets the cluster query data in S3, but the main cluster still plans and coordinates those queries, so the queuing remains.
Concurrency scaling adds transient cluster capacity automatically when queries start to queue and removes it when demand drops, and clusters earn free concurrency scaling credits each day. Redshift Spectrum lets the cluster query data in S3, but the main cluster still plans and coordinates those queries, so the queuing remains.
Question 43Cost-Optimized Architectures
A company takes daily EBS snapshots with a custom script, but old snapshots are never deleted and the snapshot bill keeps rising. The company must keep snapshots for 30 days. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: A. Create an Amazon Data Lifecycle Manager policy with a 30-day retention
Data Lifecycle Manager creates snapshots on a schedule and deletes them when they pass the retention period, with no custom code. EBS snapshots are not stored in a customer S3 bucket, so an S3 lifecycle rule cannot manage them.
Data Lifecycle Manager creates snapshots on a schedule and deletes them when they pass the retention period, with no custom code. EBS snapshots are not stored in a customer S3 bucket, so an S3 lifecycle rule cannot manage them.
Question 44Secure Architectures
A company runs an Amazon RDS for PostgreSQL database. Auditors found that some client applications connect without TLS. The company must make sure the database rejects any connection that is not encrypted in transit. Which solution will meet these requirements?
Correct answer: D. Set the rds.force_ssl parameter to 1 in the custom DB parameter group used by the instance.
Setting rds.force_ssl to 1 makes PostgreSQL refuse any client connection that does not use SSL/TLS. Security group rules control which sources can connect, but they cannot force those connections to be encrypted.
Setting rds.force_ssl to 1 makes PostgreSQL refuse any client connection that does not use SSL/TLS. Security group rules control which sources can connect, but they cannot force those connections to be encrypted.
Question 45Resilient Architectures
A SaaS company runs identical, active copies of its application in us-east-1, eu-west-1, and ap-southeast-2. Users must be sent to the Region that gives them the fastest response. If one Region becomes unhealthy, its users must be sent automatically to the next best Region. Which solution will meet these requirements?
Correct answer: A. Create Route 53 latency-based records for each Region and associate a health check with each
Latency-based routing answers each query with the Region that has the lowest measured latency for the user, and health checks remove an unhealthy Region so users go to the next-lowest latency Region. Geolocation routing is based on where users are, not on actual network latency. Failover routing supports one primary and one secondary record, which suits active-passive designs.
Latency-based routing answers each query with the Region that has the lowest measured latency for the user, and health checks remove an unhealthy Region so users go to the next-lowest latency Region. Geolocation routing is based on where users are, not on actual network latency. Failover routing supports one primary and one secondary record, which suits active-passive designs.
Question 46High-Performing Architectures
A company is building a recommendation feature that finds friends of friends and shared interests across billions of relationships. Queries must traverse several levels of connections and return results in milliseconds. Which solution will meet these requirements?
Correct answer: C. Use Amazon Neptune and write the traversals as openCypher or Gremlin graph queries.
Neptune is a purpose-built graph database that stores relationships directly, so multi-hop traversals such as friends of friends run in milliseconds. Recursive SQL joins in Aurora get slower and more complex as the number of hops and rows grows.
Neptune is a purpose-built graph database that stores relationships directly, so multi-hop traversals such as friends of friends run in milliseconds. Recursive SQL joins in Aurora get slower and more complex as the number of hops and rows grows.
Question 47Secure Architectures
A company must control outbound internet traffic from workloads in several VPCs. Only connections to an approved list of domain names are allowed, and the company also needs stateful inspection with intrusion prevention. The solution must use a managed AWS service. Which solution will meet these requirements?
Correct answer: D. Deploy AWS Network Firewall in the egress path with stateful domain list rules and intrusion prevention rules.
AWS Network Firewall is a managed VPC firewall that supports stateful domain allow lists and Suricata-compatible intrusion prevention rules. AWS WAF only filters inbound HTTP requests to resources such as ALBs and CloudFront, and it cannot be attached to a NAT gateway.
AWS Network Firewall is a managed VPC firewall that supports stateful domain allow lists and Suricata-compatible intrusion prevention rules. AWS WAF only filters inbound HTTP requests to resources such as ALBs and CloudFront, and it cannot be attached to a NAT gateway.
Question 48Cost-Optimized Architectures
A company wants to be alerted automatically when spending on any AWS service rises unexpectedly compared with its normal pattern. The company does not want to set and maintain fixed thresholds for each service, and it wants the alerts to point to the likely root cause. Which solution will meet these requirements?
Correct answer: D. Set up AWS Cost Anomaly Detection with an AWS services monitor and an alert subscription for the team
Cost Anomaly Detection uses machine learning to learn normal spend for each service, sends alerts by email or Amazon SNS, and includes a root cause analysis with each anomaly. AWS Budgets can alert per service, but every budget needs a fixed threshold that someone must set and keep up to date.
Cost Anomaly Detection uses machine learning to learn normal spend for each service, sends alerts by email or Amazon SNS, and includes a root cause analysis with each anomaly. AWS Budgets can alert per service, but every budget needs a fixed threshold that someone must set and keep up to date.
Question 49Resilient Architectures
A company patches its web servers in place every month by connecting to each EC2 instance and running update scripts. Over time, servers have drifted into different configurations, and failed patches are hard to roll back. The company wants consistent servers and quick rollback with little manual work. Which solution will meet these requirements?
Correct answer: B. Bake a new AMI for each release and roll it out with an Auto Scaling instance refresh
With immutable infrastructure, servers are never changed after launch: each release is a new AMI, and an instance refresh replaces old instances with new ones. Every server runs the same image, and rollback means going back to the previous launch template version. Run Command keeps patching in place, so drift and hard rollbacks continue.
With immutable infrastructure, servers are never changed after launch: each release is a new AMI, and an instance refresh replaces old instances with new ones. Every server runs the same image, and rollback means going back to the previous launch template version. Run Command keeps patching in place, so drift and hard rollbacks continue.
Question 50High-Performing Architectures
A company moves several terabytes of data each day between its on-premises data center and a VPC. It uses an AWS Site-to-Site VPN over the internet today, but throughput is limited and latency varies during the day. The company needs consistent, private, high-bandwidth connectivity of 10 Gbps. Which solution will meet these requirements?
Correct answer: C. Order a 10 Gbps AWS Direct Connect dedicated connection and use a private virtual interface to reach the VPC.
Direct Connect provides a dedicated private link into AWS, so bandwidth and latency stay consistent instead of depending on internet conditions. More VPN tunnels with ECMP can add total throughput, but the traffic still crosses the internet, so latency keeps varying.
Direct Connect provides a dedicated private link into AWS, so bandwidth and latency stay consistent instead of depending on internet conditions. More VPN tunnels with ECMP can add total throughput, but the traffic still crosses the internet, so latency keeps varying.
Question 51Secure Architectures
An application needs about 50 configuration values, including a few third-party API tokens that are changed by hand once a year. The values must be encrypted with AWS KMS and read at runtime. The company wants the lowest cost and does not need automatic rotation. Which solution will meet these requirements?
Correct answer: D. Store the values as standard SecureString parameters in AWS Systems Manager Parameter Store.
Standard SecureString parameters are encrypted with KMS and have no storage charge, which suits values that do not need automatic rotation. Secrets Manager would also work, but it charges for every secret each month, and its rotation features are not needed here.
Standard SecureString parameters are encrypted with KMS and have no storage charge, which suits values that do not need automatic rotation. Secrets Manager would also work, but it charges for every secret each month, and its rotation features are not needed here.
Question 52Resilient Architectures
A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. User session data is stored in memory on each instance, so users are logged out when scale-in removes an instance. The company wants the web tier to scale freely without losing sessions. Which solution will meet these requirements?
Correct answer: C. Move session data to Amazon ElastiCache so that any instance can read any user's session
Storing sessions in ElastiCache makes the web tier stateless, so any instance can serve any request and instances can be removed without logging users out. Sticky sessions still tie each user to one instance, so the session is lost when that instance is terminated. Scale-in protection blocks the scaling the company wants.
Storing sessions in ElastiCache makes the web tier stateless, so any instance can serve any request and instances can be removed without logging users out. Sticky sessions still tie each user to one instance, so the session is lost when that instance is terminated. Scale-in protection blocks the scaling the company wants.
Question 53Cost-Optimized Architectures
A company tags all of its resources with a user-defined tag named Project. The finance team wants to group costs by project in AWS Cost Explorer, but the Project tag does not appear as a grouping option. Which action will make the tag available in Cost Explorer?
Correct answer: B. Activate the Project tag as a cost allocation tag in the Billing and Cost Management console
User-defined tags must be activated as cost allocation tags, from the management account in an organization, before they appear in Cost Explorer and billing reports. Tag policies help keep tag values consistent, but they do not make a tag available for cost reporting.
User-defined tags must be activated as cost allocation tags, from the management account in an organization, before they appear in Cost Explorer and billing reports. Tag policies help keep tag values consistent, but they do not make a tag available for cost reporting.
Question 54Secure Architectures
A payment processor must keep its encryption keys in dedicated hardware security modules (HSMs) that are single-tenant and fully controlled by the company. The applications must use standard interfaces such as PKCS#11 and JCE. Which solution will meet these requirements?
Correct answer: C. Use AWS CloudHSM clusters, and connect applications through the PKCS#11 and JCE libraries.
CloudHSM gives single-tenant HSMs in the company's VPC, where only the company manages HSM users and keys, and it supports PKCS#11, JCE, and OpenSSL. KMS with imported key material gives more control over where the key comes from, but the key still lives in multi-tenant HSMs run by the KMS service.
CloudHSM gives single-tenant HSMs in the company's VPC, where only the company manages HSM users and keys, and it supports PKCS#11, JCE, and OpenSSL. KMS with imported key material gives more control over where the key comes from, but the key still lives in multi-tenant HSMs run by the KMS service.
Question 55High-Performing Architectures
A company has 80 VPCs across several AWS accounts in one Region and two on-premises data centers connected through AWS Direct Connect. Every VPC must reach every other VPC and both data centers. The current full mesh of VPC peering connections has become hard to manage, and the company wants the least operational overhead. Which solution will meet these requirements?
Correct answer: A. Create a transit gateway, share it through AWS RAM, attach every VPC, and link it to a Direct Connect gateway.
A transit gateway acts as a regional hub, so each VPC needs one attachment instead of dozens of peering connections, and a Direct Connect gateway links the hub to the data centers. A transit VPC with appliances adds more components to run and patch instead of reducing them.
A transit gateway acts as a regional hub, so each VPC needs one attachment instead of dozens of peering connections, and a Direct Connect gateway links the hub to the data centers. A transit VPC with appliances adds more components to run and patch instead of reducing them.
Question 56Resilient Architectures
A company serves its website's static assets through Amazon CloudFront from an S3 bucket in us-east-1. It has replicated the bucket to us-west-2. If the primary bucket returns server errors or is unreachable, CloudFront must automatically fetch content from the replica. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: B. Create a CloudFront origin group with both buckets and set failover on 5xx status codes
A CloudFront origin group has a primary and a secondary origin, and CloudFront retries the request against the secondary when the primary returns chosen error codes or cannot be reached. This is built in and needs no code. Two distributions behind Route 53 add DNS caching delays and more resources to manage.
A CloudFront origin group has a primary and a secondary origin, and CloudFront retries the request against the secondary when the primary returns chosen error codes or cannot be reached. This is built in and needs no code. Two distributions behind Route 53 add DNS caching delays and more resources to manage.
Question 57Secure Architectures
A company's S3 bucket, created several years ago, receives files that a partner uploads from the partner's own AWS account. The company's users cannot read some uploaded objects because the partner's account owns them. The company wants to own every object in the bucket and stop using ACLs. Which solution will meet these requirements?
Correct answer: A. Set S3 Object Ownership on the bucket to the bucket owner enforced setting.
With bucket owner enforced, ACLs are disabled and the bucket owner automatically owns every object, so the bucket policy controls access to all uploads. A bucket policy alone cannot grant access to objects owned by another account while ACLs are still in effect.
With bucket owner enforced, ACLs are disabled and the bucket owner automatically owns every object, so the bucket policy controls access to all uploads. A bucket policy alone cannot grant access to objects owned by another account while ACLs are still in effect.
Question 58Cost-Optimized Architectures
A company stores several hundred terabytes in a single S3 Standard bucket. The company wants to move data to S3 Standard-IA with a lifecycle rule, but it does not know after how many days objects become infrequently accessed. The company wants a data-driven answer with the LEAST effort. Which solution will meet these requirements?
Correct answer: C. Enable S3 Storage Class Analysis on the bucket and use its findings to set the transition age
S3 Storage Class Analysis observes access patterns over time and shows the object age at which data becomes infrequently accessed, which gives the age for a lifecycle transition to Standard-IA. CloudTrail data events with Athena could produce similar data, but they add per-event charges and require building and running queries.
S3 Storage Class Analysis observes access patterns over time and shows the object age at which data becomes infrequently accessed, which gives the age for a lifecycle transition to Standard-IA. CloudTrail data events with Athena could produce similar data, but they add per-event charges and require building and running queries.
Question 59High-Performing Architectures
A ride-sharing company streams GPS updates from vehicles. Three separate applications must process the same records in real time, records for each vehicle must stay in order, and each application needs its own dedicated read throughput. The company must also be able to replay the last 24 hours of data after a failure. Which solution will meet these requirements?
Correct answer: D. Send the records to Amazon Kinesis Data Streams and register each application as an enhanced fan-out consumer.
Kinesis Data Streams keeps records ordered by partition key, retains them for 24 hours by default for replay, and enhanced fan-out gives each registered consumer its own read throughput per shard. An SQS FIFO queue keeps order, but a message is gone once one consumer deletes it, so three applications cannot each read or replay the same records.
Kinesis Data Streams keeps records ordered by partition key, retains them for 24 hours by default for replay, and enhanced fan-out gives each registered consumer its own read throughput per shard. An SQS FIFO queue keeps order, but a message is gone once one consumer deletes it, so three applications cannot each read or replay the same records.
Question 60Resilient Architectures
A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Sometimes the application process hangs while the instance keeps running. The ALB marks these targets unhealthy, but the Auto Scaling group keeps them in service. The company wants such instances replaced automatically. Which solution will meet these requirements?
Correct answer: D. Turn on Elastic Load Balancing health checks for the Auto Scaling group alongside EC2 checks
By default, Auto Scaling uses only EC2 status checks, which pass as long as the instance is running. Adding ELB health checks lets the group act on the ALB's application-level result and replace instances that fail it. A CPU alarm is a weak signal of a hung process and would only reboot instances instead of replacing them.
By default, Auto Scaling uses only EC2 status checks, which pass as long as the instance is running. Adding ELB health checks lets the group act on the ALB's application-level result and replace instances that fail it. A CPU alarm is a weak signal of a hung process and would only reboot instances instead of replacing them.
Question 61Secure Architectures
A company runs workloads on Amazon EC2, stores container images in Amazon ECR, and uses AWS Lambda functions. The security team needs continuous, automated scanning for software vulnerabilities and unintended network exposure, with findings ranked by risk. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: A. Enable Amazon Inspector scanning for EC2 instances, ECR images, and Lambda functions.
Amazon Inspector continuously scans EC2 instances, ECR images, and Lambda functions for known CVEs and network reachability, and it scores each finding by risk. GuardDuty Runtime Monitoring watches for active threats in running workloads but does not report software vulnerabilities.
Amazon Inspector continuously scans EC2 instances, ECR images, and Lambda functions for known CVEs and network reachability, and it scores each finding by risk. GuardDuty Runtime Monitoring watches for active threats in running workloads but does not report software vulnerabilities.
Question 62Cost-Optimized Architectures
A research institute shares a 2 PB genomics dataset in an S3 bucket with external researchers who have their own AWS accounts. Downloads by these researchers create large data transfer and request charges for the institute. The institute wants the researchers to pay these charges. Which solution will meet these requirements?
Correct answer: B. Enable Requester Pays on the bucket and require researchers to send the request payer header
With Requester Pays, the requester's AWS account pays for requests and data transfer, while the bucket owner pays only for storage. CloudFront signed URLs control who can download, but the institute still pays for all CloudFront data transfer.
With Requester Pays, the requester's AWS account pays for requests and data transfer, while the bucket owner pays only for storage. CloudFront signed URLs control who can download, but the institute still pays for all CloudFront data transfer.
Question 63High-Performing Architectures
A logistics company receives daily files from 200 business partners that can send data only over SFTP. The company runs its own SFTP server on Amazon EC2 that it must patch and scale. The company wants the files to land directly in Amazon S3 for processing and wants to stop managing servers. Which solution will meet these requirements?
Correct answer: D. Create an AWS Transfer Family SFTP server that uses Amazon S3 as the storage for the partner users.
Transfer Family provides a fully managed SFTP endpoint that writes uploaded files straight to S3, so partners keep their SFTP clients and the company has no servers to patch. DataSync would mean installing and running agents at 200 partner sites, and the partners cannot move off SFTP.
Transfer Family provides a fully managed SFTP endpoint that writes uploaded files straight to S3, so partners keep their SFTP clients and the company has no servers to patch. DataSync would mean installing and running agents at 200 partner sites, and the partners cannot move off SFTP.
Question 64Resilient Architectures
A company exposes a REST API that receives sensor readings from thousands of devices. Traffic arrives in large bursts, and the backend processing service sometimes cannot keep up, so requests are lost. The company wants to accept every request reliably during bursts and process them at a steady rate. Which solution will meet these requirements with the LEAST operational overhead?
Correct answer: C. Have API Gateway send each request directly to an SQS queue that the backend consumes
API Gateway can integrate directly with SQS, so each request is stored in a durable queue and the backend reads messages at its own pace. This absorbs bursts without extra code or servers. A self-managed RabbitMQ broker on EC2 would also buffer requests but adds servers to patch, scale, and keep available.
API Gateway can integrate directly with SQS, so each request is stored in a durable queue and the backend reads messages at its own pace. This absorbs bursts without extra code or servers. A self-managed RabbitMQ broker on EC2 would also buffer requests but adds servers to patch, scale, and keep available.
Question 65Secure Architectures
Backup scripts on on-premises Linux servers upload data to Amazon S3 using IAM user access keys. The company already runs its own private certificate authority (CA) and wants the servers to use short-lived AWS credentials instead of long-term keys. Which solution will meet these requirements?
Correct answer: B. Use IAM Roles Anywhere with a trust anchor for the company's CA, and have servers assume a role with their certificates.
IAM Roles Anywhere lets workloads outside AWS trade an X.509 certificate from a trusted CA for temporary credentials of an IAM role. Rotating keys in Secrets Manager still relies on long-term IAM user keys, which the company wants to remove.
IAM Roles Anywhere lets workloads outside AWS trade an X.509 certificate from a trusted CA for temporary credentials of an IAM role. Rotating keys in Secrets Manager still relies on long-term IAM user keys, which the company wants to remove.
The real AWS Solutions Architect Associate exam at a glance
65questions
2h 10mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Solutions Architect Associate exam. They are not real exam questions. AWS Solutions Architect Associate and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 130 minutes · passing score 720 on a 100-1000 scale.