AWS Associate Certified Solutions Architect - Associate 3 — Questions and Answers
Question 1: A workload requires that compute capacity automatically increases when CPU utilization exceeds 70% and decreases when it drops below 30%. Which Auto Scaling policy type should be configured?
- Simple scaling
- Step scaling
- Target tracking scaling (Correct answer)
- Scheduled scaling
Correct answer: Target tracking scaling
Target tracking scaling automatically adjusts capacity to maintain a specified metric target, such as 70% average CPU utilization.
Question 2: An architect needs to decouple a order-processing system so that the order service and fulfillment service can scale independently. Which AWS service provides a durable message buffer?
- Amazon SNS
- Amazon SQS (Correct answer)
- Amazon Kinesis Data Firehose
- AWS Step Functions
Correct answer: Amazon SQS
Amazon SQS is a managed message queue that buffers messages between producers and consumers, allowing independent scaling of each tier.
Question 3: An S3 bucket contains objects that are frequently accessed for the first 30 days and rarely accessed afterward. Which lifecycle policy minimizes storage cost?
- Transition objects to S3 Intelligent-Tiering immediately
- Transition objects to S3 Standard-IA after 30 days
- Transition objects to S3 Glacier Instant Retrieval after 30 days (Correct answer)
- Delete objects after 30 days
Correct answer: Transition objects to S3 Glacier Instant Retrieval after 30 days
S3 Glacier Instant Retrieval offers the lowest storage cost for rarely accessed data that still requires millisecond retrieval.
Question 4: A Lambda function must access a secret stored in AWS Secrets Manager. Which permission model is required?
- Attach an IAM user policy to the Lambda execution role
- Add a resource-based policy to the Lambda function
- Grant secretsmanager:GetSecretValue permission to the Lambda execution role (Correct answer)
- Enable VPC endpoints for Secrets Manager
Correct answer: Grant secretsmanager:GetSecretValue permission to the Lambda execution role
The Lambda execution role must have the secretsmanager:GetSecretValue action allowed so the function can retrieve the secret at runtime.
Question 5: A company wants to run containers without managing the underlying EC2 instances. Which AWS compute option achieves this?
- Amazon ECS on EC2 launch type
- Amazon ECS on AWS Fargate (Correct answer)
- Amazon EC2 with Docker installed
- AWS Elastic Beanstalk with single-instance environment
Correct answer: Amazon ECS on AWS Fargate
AWS Fargate is a serverless compute engine for containers that removes the need to provision or manage EC2 instances.
Question 6: A Solutions Architect must ensure that traffic between two VPCs in the same region does not traverse the public internet. What is the most cost-effective solution?
- Configure Site-to-Site VPN between the two VPCs
- Use VPC Peering (Correct answer)
- Deploy a NAT Gateway in each VPC
- Use AWS Transit Gateway with a VPN attachment
Correct answer: Use VPC Peering
VPC Peering creates a direct private network route between two VPCs with no additional networking hardware costs.
Question 7: An application needs to perform complex fan-out notifications: when an order is placed, it must notify inventory, billing, and shipping services simultaneously. Which pattern is most appropriate?
- Write to a single SQS queue that all three services poll
- Publish to an SNS topic with three SQS queues subscribed (Correct answer)
- Use EventBridge with three Lambda targets
- Use Step Functions with parallel state
Correct answer: Publish to an SNS topic with three SQS queues subscribed
SNS fan-out to multiple SQS queues delivers the same message to all three services simultaneously while allowing each to process independently.
AWS Associate Certified Solutions Architect - Associate 3
A workload requires that compute capacity automatically increases when CPU utilization exceeds 70% and decreases when it drops below 30%.
Which Auto Scaling policy type should be configured?