Architecting on AWS Certification Cheat Sheet 2026

The 30 highest-yield Architecting on AWS Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which CloudWatch metric would an architect monitor to detect that an Application Load Balancer has no healthy targets available? → HealthyHostCount
2. An architect needs to automate evidence collection for PCI DSS, HIPAA, and NIST 800-53 frameworks continuously. Which AWS service is purpose-built for this? → AWS Audit Manager
3. Which AWS service can be used to implement a dead-letter queue to capture messages that repeatedly fail processing in an SQS-based architecture? → Amazon SQS itself
4. Which AWS networking feature provides a private, dedicated network connection between an on-premises data center and AWS, bypassing the public internet? → AWS Direct Connect
5. What AWS feature allows an Auto Scaling group to replace unhealthy EC2 instances automatically without manual intervention? → Health check replacement
6. Which non-destructive testing (NDT) method is most effective for detecting planar, surface-breaking cracks at weld toes in ferritic steel? → Magnetic particle testing (MT)
7. An architect wants to improve the read performance of a relational database without scaling the primary instance. Which AWS solution achieves this? → Add RDS Read Replicas and direct read traffic to them
8. Which EC2 instance purchasing model is best suited for a batch processing workload that can tolerate interruptions in exchange for the lowest possible cost? → Spot Instances
9. Which pricing model offers the highest discount on AWS Lambda compared to paying per invocation at on-demand rates? → Lambda Compute Savings Plans
10. Which AWS Direct Connect connection type is provided by an AWS partner and shares bandwidth with other customers? → Hosted connection
11. Which AWS service can automatically remediate a non-compliant resource by invoking an AWS Systems Manager Automation document? → AWS Config automatic remediation
12. Which Application Load Balancer feature allows routing of requests to different target groups based on URL path patterns? → Path-based routing
13. An architect needs to route user requests to the nearest AWS Region to minimize latency. Which Route 53 routing policy should be used? → Latency-based routing
14. A company needs to detect and remediate configuration drift on EC2 instances automatically. Which AWS service is MOST appropriate? → AWS Systems Manager State Manager
15. An architect wants to right-size EC2 instances based on historical CPU and memory utilization. Which AWS service provides these recommendations? → AWS Compute Optimizer
16. Which shielding gas mixture is preferred for GMAW of austenitic stainless steel to minimize carbon pickup and carbide precipitation? → Ar + 5% O2 or Ar + 2% CO2
17. A company must prove to auditors that no IAM root account API calls occurred in the past 90 days. Which approach provides this evidence MOST efficiently? → Query CloudTrail Lake with SQL for root user events
18. In an AWS architecture blueprint, a box with the label 'VPC Peering' connecting two VPC boundaries represents what connectivity type? → A direct private network connection between two VPCs enabling resource communication
19. An architect needs to connect dozens of VPCs and on-premises networks through a central hub with minimal operational overhead. Which service is best suited? → AWS Transit Gateway
20. A joint design team must architect a real-time analytics pipeline ingesting 500,000 events per second. Which AWS service is designed for this ingestion scale? → Amazon Kinesis Data Streams
21. An architect must ensure data in transit between on-premises systems and AWS meets NIST 800-52 TLS requirements. What is the recommended approach? → Configure AWS services to use TLS 1.2 or higher and disable older protocol versions
22. What is the primary metallurgical reason for preheating high-carbon or alloy steels before welding? → To slow the cooling rate of the HAZ, reducing martensite formation and hydrogen diffusion
23. Which AWS service enables centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization? → AWS Firewall Manager
24. An architect must ensure CloudTrail is enabled in every region for every new account added to an AWS Organization. What is the MOST scalable solution? → Create an organization-level CloudTrail trail in the management account
25. Which AWS service provides a managed way to store, rotate, and audit database credentials to help meet SOC 2 access-control requirements? → AWS Secrets Manager
26. Which AWS service continuously evaluates resource configurations against desired compliance rules and can automatically remediate non-compliant resources? → AWS Config with Config Rules and Remediation Actions
27. Which VPC feature allows instances in a private subnet to initiate outbound internet traffic without exposing them to inbound connections? → NAT Gateway
28. Which S3 feature ensures that a specific version of an object cannot be deleted or overwritten for a defined retention period? → S3 Object Lock in Compliance mode
29. What does Amazon CloudFront's Origin Access Control (OAC) accomplish? → It restricts S3 bucket access so only CloudFront can read objects
30. What is a near-miss report in Architecting on AWS Certification safety management? → Documentation of an event that could have resulted in harm but did not