Architecting on AWS Certification Joint Design & Preparation 5

Question 1

A joint design team must ensure that sensitive PII stored in S3 is never accidentally made public. Which preventive control enforces this at the organization level?

Accepted Answer

AWS Organizations SCP blocking s3:PutBucketAcl with public grants, plus S3 Block Public Access enabled at the account level

Answer

SCPs enforce guardrails across all accounts in the organization while S3 Block Public Access provides a second layer of defense at the account level.

Question 2

During joint preparation for a high-availability web application, the team must design for an AZ failure. Which architecture ensures the application remains available during a single AZ outage?

Accepted Answer

Auto Scaling group spanning three AZs behind an Application Load Balancer

Answer

Distributing instances across multiple AZs behind an ALB ensures traffic is automatically redirected to healthy AZs if one fails.

Question 3

Two teams are jointly architecting a solution where a third-party partner needs read-only access to specific S3 buckets in your AWS account without receiving long-term credentials. Which mechanism should be used?

Accepted Answer

Configure an IAM role with a trust policy allowing the partner's AWS account to assume it via cross-account role assumption

Answer

Cross-account role assumption grants temporary, scoped credentials via STS without requiring long-term access keys to be shared.

Question 4

During joint design, the team needs to implement a CI/CD pipeline that automatically deploys to ECS Fargate when code is pushed to CodeCommit. Which AWS-native service combination builds this pipeline?

Accepted Answer

CodePipeline orchestrating CodeBuild for the image build and CodeDeploy for the ECS deployment

Answer

CodePipeline connects source, build, and deploy stages natively, with CodeBuild building Docker images and CodeDeploy managing blue/green ECS deployments.

Question 5

A joint architecture team is preparing a cost governance strategy for a multi-team AWS environment. Which approach provides the most granular cost visibility per team without requiring separate accounts?

Accepted Answer

Apply consistent resource tags per team and use Cost Explorer tag-based cost allocation reports

Answer

Tag-based cost allocation in Cost Explorer breaks down spending by team, project, or environment using tags applied consistently to all resources.

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Practice Test

Architecting on AWS Certification Joint Design & Preparation 5