Architecting on AWS Certification Amazon Web Services 5 — Questions and Answers
Question 1: Which AWS global infrastructure component caches content at locations close to end users to reduce latency for web applications?
- AWS Local Zones
- AWS Wavelength Zones
- Amazon CloudFront Edge Locations (Correct answer)
- AWS Outposts
Correct answer: Amazon CloudFront Edge Locations
CloudFront Edge Locations are globally distributed points of presence that cache content and serve it from the location nearest to the user.
Question 2: A financial services company must ensure API keys and database passwords are rotated automatically and never hardcoded. Which AWS service is purpose-built for this?
- AWS Systems Manager Parameter Store
- AWS Secrets Manager (Correct answer)
- AWS KMS
- AWS Certificate Manager
Correct answer: AWS Secrets Manager
AWS Secrets Manager stores, rotates, and manages access to secrets such as database credentials and API keys automatically.
Question 3: Which AWS compute service is best for running event-driven code in response to triggers such as S3 uploads or API Gateway calls without provisioning servers?
- Amazon EC2 Auto Scaling
- AWS Fargate
- AWS Lambda (Correct answer)
- Amazon ECS
Correct answer: AWS Lambda
AWS Lambda runs code in response to triggers and automatically manages the compute resources, charging only for execution time.
Question 4: What is the maximum size of a single object that can be stored in Amazon S3?
- 5 GB
- 100 GB
- 5 TB (Correct answer)
- 1 TB
Correct answer: 5 TB
Amazon S3 supports individual objects up to 5 TB; objects larger than 5 GB must use the multipart upload API.
Question 5: An architect needs to connect dozens of VPCs and on-premises networks through a central hub with minimal operational overhead. Which service is best suited?
- VPC Peering
- AWS Direct Connect Gateway
- AWS Transit Gateway (Correct answer)
- AWS PrivateLink
Correct answer: AWS Transit Gateway
AWS Transit Gateway acts as a network transit hub, enabling transitive routing between thousands of VPCs and on-premises networks.
Question 6: Which IAM policy evaluation rule applies when there is a conflict between an explicit Deny and an explicit Allow in the same account?
- Allow takes precedence
- Deny takes precedence (Correct answer)
- The most recently attached policy wins
- The resource-based policy wins
Correct answer: Deny takes precedence
In IAM policy evaluation, an explicit Deny always overrides any Allow, regardless of the order or number of policies.
Question 7: A company wants to run a containerized batch processing job that starts, completes work, and terminates without a long-running cluster. Which service pattern is most cost-effective?
- ECS with reserved EC2 instances
- AWS Batch with Fargate compute (Correct answer)
- Amazon EKS with managed nodes
- AWS Glue with Spark
Correct answer: AWS Batch with Fargate compute
AWS Batch with Fargate compute automatically provisions resources for batch jobs, runs them to completion, and terminates with no idle cluster costs.
Architecting on AWS Certification Amazon Web Services 5
Which AWS global infrastructure component caches content at locations close to end users to reduce latency for web applications?