Architecting on AWS Certification AWS Certified Solutions Architect - Associate 2 — Questions and Answers
Question 1: A company needs to store frequently accessed data with millisecond latency and the ability to scale to millions of requests per second. Which AWS service best meets these requirements?
- Amazon RDS Multi-AZ
- Amazon DynamoDB (Correct answer)
- Amazon Redshift
- Amazon Aurora Serverless
Correct answer: Amazon DynamoDB
DynamoDB is a fully managed NoSQL database that provides single-digit millisecond performance at any scale.
Question 2: An application requires a shared file system accessible by multiple EC2 instances simultaneously across multiple Availability Zones. Which storage solution should be used?
- Amazon EBS gp3
- Amazon S3
- Amazon EFS (Correct answer)
- Instance Store
Correct answer: Amazon EFS
Amazon EFS is a fully managed NFS file system that can be mounted concurrently by multiple EC2 instances across AZs.
Question 3: A Solutions Architect must ensure that an S3 bucket's objects are encrypted at rest using keys managed by the customer. Which encryption option achieves this with the least operational overhead?
- SSE-S3
- SSE-KMS with AWS managed key
- SSE-KMS with customer managed key (Correct answer)
- Client-side encryption
Correct answer: SSE-KMS with customer managed key
SSE-KMS with a customer managed key gives the customer full control over key rotation, policies, and auditing while AWS manages the encryption engine.
Question 4: A web application experiences unpredictable traffic spikes. The architect wants to decouple the front-end from the back-end processing layer to handle bursts without losing requests. Which AWS service is most appropriate?
- Amazon SNS
- Amazon SQS (Correct answer)
- AWS Step Functions
- Amazon EventBridge
Correct answer: Amazon SQS
SQS acts as a buffer between producers and consumers, absorbing traffic spikes and allowing back-end workers to process messages at their own pace.
Question 5: Which VPC feature allows private subnets to initiate outbound internet traffic while preventing inbound connections from the internet?
- Internet Gateway
- VPC Peering
- NAT Gateway (Correct answer)
- VPC Endpoint
Correct answer: NAT Gateway
A NAT Gateway provides outbound-only internet access for resources in private subnets by translating private IPs to the gateway's public IP.
Question 6: A company wants to replicate an on-premises Active Directory to AWS for authentication of EC2 instances. Which service provides a managed Microsoft AD in the cloud?
- AWS IAM Identity Center
- AWS Directory Service for Microsoft Active Directory (Correct answer)
- Amazon Cognito
- AWS IAM
Correct answer: AWS Directory Service for Microsoft Active Directory
AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) provisions a fully managed AD domain in AWS.
Question 7: An architect needs to route user requests to the nearest AWS Region to minimize latency. Which Route 53 routing policy should be used?
- Weighted routing
- Failover routing
- Geolocation routing
- Latency-based routing (Correct answer)
Correct answer: Latency-based routing
Latency-based routing directs users to the AWS Region that provides the lowest network latency for that user.
Architecting on AWS Certification AWS Certified Solutions Architect - Associate 2
A company needs to store frequently accessed data with millisecond latency and the ability to scale to millions of requests per second.
Which AWS service best meets these requirements?