Architecting on AWS Certification Architecting On AWS Certification 3 — Questions and Answers
Question 1: A company wants to migrate its on-premises data warehouse to AWS with minimal code changes. Which service is the BEST choice?
- Amazon DynamoDB
- Amazon Redshift (Correct answer)
- Amazon RDS for PostgreSQL
- Amazon EMR
Correct answer: Amazon Redshift
Amazon Redshift is a fully managed petabyte-scale data warehouse that supports standard SQL and minimizes code changes from on-premises data warehouses.
Question 2: Which VPC feature allows instances in a private subnet to initiate outbound internet traffic without exposing them to inbound connections?
- Internet Gateway
- NAT Gateway (Correct answer)
- VPC Peering
- VPN Gateway
Correct answer: NAT Gateway
A NAT Gateway allows private subnet instances to reach the internet for outbound traffic while blocking unsolicited inbound connections.
Question 3: An architect is designing a solution where Lambda functions need to access an RDS database securely without hardcoding credentials. Which approach is BEST?
- Store credentials in Lambda environment variables
- Use AWS Secrets Manager with automatic rotation (Correct answer)
- Embed credentials in the Lambda deployment package
- Use IAM roles with database username embedded in the policy
Correct answer: Use AWS Secrets Manager with automatic rotation
AWS Secrets Manager stores and automatically rotates database credentials, which Lambda retrieves at runtime via API without hardcoding.
Question 4: A global application requires low-latency content delivery for static and dynamic content. Which architecture BEST achieves this?
- Deploy EC2 instances in every region manually
- Use Amazon CloudFront with an Application Load Balancer as origin (Correct answer)
- Use Route 53 latency routing with a single EC2 instance
- Store all content in S3 Standard in us-east-1
Correct answer: Use Amazon CloudFront with an Application Load Balancer as origin
CloudFront caches static content at edge locations globally and forwards dynamic requests to the ALB origin with low latency.
Question 5: Which AWS service provides a managed message broker that supports both AMQP and MQTT protocols for existing applications?
- Amazon SQS
- Amazon SNS
- Amazon MQ (Correct answer)
- AWS IoT Core
Correct answer: Amazon MQ
Amazon MQ is a managed message broker service for ActiveMQ and RabbitMQ that supports industry-standard protocols like AMQP, MQTT, and STOMP.
Question 6: A company needs to replicate data between two VPCs in different AWS accounts with high bandwidth and low latency. What is the RECOMMENDED approach?
- Site-to-Site VPN between the two VPCs
- VPC Peering (Correct answer)
- AWS Direct Connect
- Internet-based replication over public IPs
Correct answer: VPC Peering
VPC Peering provides private, high-bandwidth, low-latency connectivity between VPCs across accounts without traversing the public internet.
Question 7: What does the AWS Shared Responsibility Model state is the customer's responsibility when using Amazon RDS?
- Patching the database engine software
- Managing the underlying EC2 hypervisor
- Configuring security groups and managing database user access (Correct answer)
- Replacing failed hardware in the data center
Correct answer: Configuring security groups and managing database user access
AWS manages the database engine patching and hardware, while customers are responsible for network access controls and database-level user permissions.
Architecting on AWS Certification Architecting On AWS Certification 3
A company wants to migrate its on-premises data warehouse to AWS with minimal code changes.
Which service is the BEST choice?