AWS Solutions Architect — Associate practice questions and exam guide

What is the impact of denying iam:PassRole on a role?

1. Callers cannot hand that role to EC2/Lambda/other
2. Callers cannot assume that role via STS AssumeRole
3. The role's trust policy is invalidated at next use
4. The role is deleted at the next Config evaluation cycle

Answer: A — Callers cannot hand that role to EC2/Lambda/other

A) Correct — PassRole controls who can attach a role to a resource. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

A backup strategy is expensive. Cheapest lever:

1. AWS Backup lifecycle to Cold Storage after
2. Manual EBS snapshot copy to another region only
3. Rely on RAID inside EC2 as the backup mechanism
4. Only S3 Standard as the backup destination target

Answer: A — AWS Backup lifecycle to Cold Storage after

A) Correct — AWS Backup + cold tier gives cheap long retention. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

A worker fleet on Spot needs graceful drain. Handle:

1. Two-minute interruption notice via IMDS and drain
2. Ignore Spot interruptions and rely on retry only
3. Convert all Spot to On-Demand at 90% capacity
4. Skip health checks so drained workers keep serving

Answer: A — Two-minute interruption notice via IMDS and drain

A) Correct — Spot interruption handler triggers ASG lifecycle hook. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

What does an IAM permissions boundary do for a delegated admin?

1. Grants root-level permissions to the delegated identity
2. Rotates the delegated user's credentials once per hour
3. Caps the maximum permissions any role they create can
4. Blocks all AWS actions unless SCPs are also attached

Answer: C — Caps the maximum permissions any role they create can

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — boundaries are the intersection of granted and boundary policies. D) direction reversal of the correct principle.

AWS PrivateLink lets you:

1. Peer two VPCs together across regions without any charge
2. Create Layer 2 links between on-prem and multiple VPCs
3. Consume services across VPCs/accounts via interface endpoints
4. Enforce HTTPS on all API Gateway public endpoints under review

Answer: C — Consume services across VPCs/accounts via interface endpoints

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — PrivateLink avoids public IPs for consumer-to-provider access. D) direction reversal of the correct principle.

Backup and restore DR requires which minimum AWS controls?

1. Weekly EBS snapshots with no offsite copy under review
2. Manual copy of app binaries to S3 once per quarter
3. Regular AWS Backup jobs plus tested cross-region restore
4. Reliance on RAID-5 EBS volumes for volume durability

Answer: C — Regular AWS Backup jobs plus tested cross-region restore

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — backup only works if restore is tested. D) direction reversal of the correct principle.

Unknown access pattern; cheapest general S3 tier:

1. S3 Standard-IA for everything even hot objects
2. S3 Glacier Instant Retrieval for every write immediately
3. S3 Intelligent-Tiering auto-moves between tiers
4. S3 One Zone-IA on all new production data by default

Answer: C — S3 Intelligent-Tiering auto-moves between tiers

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — Intelligent-Tiering trades a small monitoring fee for automation. D) direction reversal of the correct principle.

A workload wants free ingress. Which AWS service ingress is FREE?

1. Data-in from Direct Connect at full DX port rate
2. Data-in from AWS PrivateLink at per-hour ENI cost
3. Data-in to AWS from the internet on most services
4. Data-in from S3 to EC2 in a different region

Answer: C — Data-in to AWS from the internet on most services

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — AWS-inbound internet ingress is generally free. D) direction reversal of the correct principle.

Shield Advanced protects which of the following endpoint types?

1. Only EC2 instances behind an Elastic Network Interface
2. S3 buckets accessed via CloudFront distributions only
3. ELB, CloudFront, Route 53, Global Accelerator, and EIPs
4. Any TCP endpoint reachable in a private VPC subnet

Answer: C — ELB, CloudFront, Route 53, Global Accelerator, and EIPs

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — Advanced adds cost protection and DDoS response team. D) direction reversal of the correct principle.

A workload's data lake ingest uses many small files. Cost impact:

1. Higher S3 request cost and slower analytics scans
2. Lower S3 request cost with faster analytics scans
3. No cost impact since S3 has no per-request cost
4. Better cost with higher CloudFront cache hit rate

Answer: A — Higher S3 request cost and slower analytics scans

A) Correct — small files hurt both cost and Athena scan time. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

Why is IMDSv2 preferred over IMDSv1 on EC2 instances?

1. It removes the metadata service and hardens the kernel
2. It replaces IAM roles with static passwords per instance
3. It requires a session token that blocks SSRF token theft
4. It logs every credential read to CloudTrail management events

Answer: C — It requires a session token that blocks SSRF token theft

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — IMDSv2 is session-oriented and defeats simple SSRF fetches. D) direction reversal of the correct principle.

A dev/test environment runs 24/7 today. Cut cost by:

1. Instance Scheduler shutting non-prod off
2. Buy 3-year All Upfront RIs for the dev environment
3. Move dev/test to Direct Connect for cheaper egress
4. Enable Multi-AZ for dev to match production cost

Answer: A — Instance Scheduler shutting non-prod off

A) Correct — off-hours shutdown is standard 60-70% dev savings. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

AWS Inspector's core capability is:

1. Session-recording and keystroke logs of admin users
2. Layer 7 web application firewall on ALB and CloudFront
3. Continuous vulnerability scanning of EC2/ECR/Lambda
4. Sensitive-data discovery inside S3 objects and buckets

Answer: C — Continuous vulnerability scanning of EC2/ECR/Lambda

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — Inspector automates CVE and network-exposure findings. D) direction reversal of the correct principle.

Least-privilege connectivity from private subnets to AWS APIs uses:

1. A NAT Gateway sized to peak outbound traffic bursts
2. A public IP address assigned to each private instance
3. Interface VPC endpoints for the specific AWS services
4. A Site-to-Site VPN routed through a public transit VPC

Answer: C — Interface VPC endpoints for the specific AWS services

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — interface endpoints avoid internet exposure entirely. D) direction reversal of the correct principle.

A workload's Elastic Beanstalk env is bigger than needed. Cheapest fix:

1. Migrate the whole environment to Dedicated Hosts
2. Enable Multi-AZ RDS in every dev environment nightly
3. Right-size instance types and enable dev-hour scheduling
4. Move to a larger instance family for headroom under review

Answer: C — Right-size instance types and enable dev-hour scheduling

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — rightsizing + scheduling is a 30-60% saver. D) direction reversal of the correct principle.

An S3 bucket policy is a:

1. Resource-based policy attached to the bucket itself
2. Trust policy attached to the IAM role of the caller
3. Permissions boundary evaluated only during writes
4. Session policy passed at STS AssumeRole time

Answer: A — Resource-based policy attached to the bucket itself

A) Correct — resource policies can grant cross-account and enforce HTTPS. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

Enforce that S3 uploads must use a specific KMS key. Use:

1. Object lifecycle rule that re-encrypts objects nightly
2. S3 Access Points that intercept and rewrite the key
3. Bucket policy Deny when the required KMS key ID mismatches
4. Client-side wrapper library shared by every uploader team

Answer: C — Bucket policy Deny when the required KMS key ID mismatches

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — policy condition keys enforce the intended CMK on PUT. D) direction reversal of the correct principle.

A workload's read replicas fall behind during a spike. Best NEXT step:

1. Force reads onto the primary until the replicas catch up
2. Turn off replication and rebuild replicas nightly instead
3. Add replica capacity or move to Aurora with faster
4. Ignore lag and rely on eventual consistency for reads

Answer: C — Add replica capacity or move to Aurora with faster

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — async lag under load is a signal to scale or move to Aurora. D) direction reversal of the correct principle.

An S3 GET P99 spike shows same prefix hot. Fix:

1. Randomize object key prefixes to spread partition
2. Use S3 Transfer Acceleration on every GET request
3. Move objects to Glacier for lower cost per read
4. Add CloudTrail data events on the hot prefix only

Answer: A — Randomize object key prefixes to spread partition

A) Correct — S3 partitions by key prefix internally. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

DynamoDB Global Tables replicate writes:

1. Multi-region active-passive with manual failover only
2. Single region only with cross-AZ synchronous copies
3. Multi-region multi-active with last-writer-wins conflict rule
4. Cross-region synchronous with a two-phase commit under review

Answer: C — Multi-region multi-active with last-writer-wins conflict rule

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — Global Tables are multi-region active-active. D) direction reversal of the correct principle.

A read-heavy tenant hits DynamoDB RCU limits. Cheapest scale:

1. DAX in front for hot-key caching at microsecond
2. Move to on-demand and pay for burst repeatedly
3. Duplicate the table into every AWS region for RCU
4. Force strong reads to guarantee freshness at 2x RCU

Answer: A — DAX in front for hot-key caching at microsecond

A) Correct — DAX reduces RCU calls for hot reads. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

An analytics job scans TBs from S3 nightly. Store data as:

1. TSV files rotated hourly with no compression at all
2. One large Excel workbook opened by every worker
3. Parquet compressed with Snappy and partitioned by query-relevant columns (e.g., date)
4. Encrypted PDFs, one per raw log line for privacy

Answer: C — Parquet compressed with Snappy and partitioned by query-relevant columns (e.g., date)

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — Parquet + partitioning cuts scan cost and time. D) direction reversal of the correct principle.

A stateless container fleet on ECS Fargate becomes HA by:

1. One task per service to minimize deployment surprises
2. Public IP per task with no LB to save ELB minutes
3. Two subnets in different AZs plus service replica >= 2
4. Manual CloudFormation redeploy on task health failure

Answer: C — Two subnets in different AZs plus service replica >= 2

A) true-but-irrelevant to this scenario. B) right-concept but wrong-scenario. C) Correct — ECS service maintains desired count across AZs. D) direction reversal of the correct principle.

A workload's SG must limit egress to only the SaaS partner IP. Configure:

1. Egress rule restricted to the partner IP/CIDR and TLS port
2. Default egress allow-all with an outbound NACL block later
3. Public IP on the instance with an SG allow-all outbound
4. NAT Gateway open to 0.0.0.0/0 for all outbound partner calls

Answer: A — Egress rule restricted to the partner IP/CIDR and TLS port

A) Correct — SG egress by CIDR is the least-privilege outbound control. B) true-but-irrelevant to this scenario. C) right-concept but wrong-scenario. D) direction reversal of the correct principle.

What is Amazon Pinpoint?

Multichannel customer engagement (email, SMS, push, voice). Built on SES/SNS. Used for marketing campaigns, transactional notifications, A/B testing.

How do you encrypt data in transit between services?

Use TLS endpoints (most AWS APIs require TLS 1.2+), enforce HTTPS via bucket policies, ALB redirect HTTP→HTTPS, RDS SSL, ElastiCache encryption-in-transit.

How would you analyze and correlate metrics + logs + traces?

CloudWatch (metrics/logs) + X-Ray (tracing) + Container Insights / Lambda Insights for managed services. Application Signals for service-level performance.

How do you architect a globally low-latency, eventually consistent app?

CloudFront + Lambda@Edge + DynamoDB Global Tables (multi-region, multi-active) + S3 with CRR. Route 53 latency-based routing for APIs/origins.

What is the AWS Pricing Calculator?

Estimates monthly costs of an AWS architecture. Useful for sizing changes, RFP responses, and TCO comparisons.

How can you reduce data egress cost using CloudFront?

Egress through CloudFront is free between AWS and CloudFront and discounted to viewers. Caching also reduces origin requests. Major saver for static heavy sites.