AWS Associate Certified Solutions Architect - Associate 2 — Questions and Answers
Question 1: A company needs a managed relational database that automatically scales storage and supports read replicas across multiple AWS regions. Which service best fits this requirement?
- Amazon RDS Multi-AZ
- Amazon Aurora Global Database (Correct answer)
- Amazon DynamoDB Global Tables
- Amazon Redshift
Correct answer: Amazon Aurora Global Database
Aurora Global Database spans multiple AWS regions with sub-second replication latency and supports cross-region read replicas.
Question 2: An application stores session data that must be accessible with microsecond latency and must survive an Availability Zone failure. Which solution meets both requirements?
- Amazon ElastiCache for Redis with cluster mode disabled
- Amazon ElastiCache for Memcached
- Amazon ElastiCache for Redis with Multi-AZ and automatic failover (Correct answer)
- Amazon DynamoDB with DAX
Correct answer: Amazon ElastiCache for Redis with Multi-AZ and automatic failover
ElastiCache for Redis with Multi-AZ and automatic failover replicates data to a standby node in another AZ, surviving AZ failures.
Question 3: A Solutions Architect must design an architecture where an EC2 instance in a private subnet can download software updates from the internet without being directly reachable from the internet. What should be used?
- Internet Gateway attached to the private subnet
- NAT Gateway in a public subnet with a route from the private subnet (Correct answer)
- VPN Gateway with a customer gateway
- VPC Peering to a public VPC
Correct answer: NAT Gateway in a public subnet with a route from the private subnet
A NAT Gateway in a public subnet allows outbound internet traffic from private subnets while blocking unsolicited inbound connections.
Question 4: A company wants to enforce that all objects uploaded to an S3 bucket are encrypted at rest using AWS-managed keys, regardless of what the uploader specifies. How should this be enforced?
- Enable S3 Versioning and configure lifecycle policies
- Apply a bucket policy that denies uploads without aws:SecureTransport
- Enable default encryption on the bucket with SSE-S3 or SSE-KMS (Correct answer)
- Use S3 Object Lock in COMPLIANCE mode
Correct answer: Enable default encryption on the bucket with SSE-S3 or SSE-KMS
Enabling default encryption ensures all newly uploaded objects are automatically encrypted even if the PUT request does not specify encryption headers.
Question 5: An application running on EC2 needs to call the S3 API without embedding AWS credentials in the code. What is the recommended approach?
- Store credentials in AWS Secrets Manager and retrieve them at startup
- Hardcode credentials in environment variables on the instance
- Assign an IAM role to the EC2 instance (Correct answer)
- Use an S3 bucket policy that allows public access
Correct answer: Assign an IAM role to the EC2 instance
Attaching an IAM role to an EC2 instance provides temporary credentials via the instance metadata service, eliminating the need to manage static credentials.
Question 6: A web application must serve users in the US and Europe with low latency. Static assets are in S3. What is the simplest AWS solution to reduce latency globally?
- Create S3 buckets in every region and use Route 53 latency-based routing
- Use Amazon CloudFront with the S3 bucket as the origin (Correct answer)
- Deploy EC2 instances in each region and sync files with AWS DataSync
- Enable S3 Transfer Acceleration on the bucket
Correct answer: Use Amazon CloudFront with the S3 bucket as the origin
CloudFront caches static assets at edge locations worldwide, serving users from the nearest edge point to minimize latency.
Question 7: A company's on-premises data center must connect to its AWS VPC with consistent, dedicated bandwidth and does not want traffic traversing the public internet. Which service should be used?
- AWS Site-to-Site VPN
- AWS Direct Connect (Correct answer)
- AWS Transit Gateway with VPN attachment
- Amazon VPC Peering
Correct answer: AWS Direct Connect
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet entirely.
AWS Associate Certified Solutions Architect - Associate 2
A company needs a managed relational database that automatically scales storage and supports read replicas across multiple AWS regions.
Which service best fits this requirement?