Architecting on AWS Certification Architecting On AWS Certification 5 — Questions and Answers
Question 1: A microservices application needs service-to-service authentication and encrypted traffic within a VPC. Which AWS service BEST addresses this?
- AWS WAF
- AWS App Mesh with mutual TLS (Correct answer)
- Amazon API Gateway
- Elastic Load Balancing with SSL termination
Correct answer: AWS App Mesh with mutual TLS
AWS App Mesh provides a service mesh with mutual TLS for encrypted, authenticated east-west traffic between microservices.
Question 2: Which S3 feature ensures that a specific version of an object cannot be deleted or overwritten for a defined retention period?
- S3 Versioning
- S3 Lifecycle policies
- S3 Object Lock in Compliance mode (Correct answer)
- S3 Replication
Correct answer: S3 Object Lock in Compliance mode
S3 Object Lock in Compliance mode prevents any user, including the root account, from deleting or overwriting objects during the retention period.
Question 3: A company needs to run a stateful application on ECS. Which storage option persists data even if the container task is replaced?
- Container ephemeral storage
- Amazon EFS mounted to ECS tasks (Correct answer)
- Instance store volumes
- Docker image layers
Correct answer: Amazon EFS mounted to ECS tasks
Amazon EFS provides a shared, persistent file system that ECS tasks can mount, ensuring data survives task restarts or replacements.
Question 4: What is the purpose of an AWS Service Control Policy (SCP) in AWS Organizations?
- Grant permissions to IAM users in a specific account
- Set maximum permission boundaries for all accounts in an organizational unit (Correct answer)
- Define resource-based policies for S3 buckets
- Enforce MFA for the root user only
Correct answer: Set maximum permission boundaries for all accounts in an organizational unit
SCPs define the maximum available permissions for member accounts in an OU, acting as guardrails that IAM policies cannot exceed.
Question 5: An architect must design an event-driven architecture where multiple downstream services react to the same S3 upload event. Which combination is BEST?
- S3 → SQS queue → all consumers polling the same queue
- S3 → SNS topic → multiple SQS queues (fan-out pattern) (Correct answer)
- S3 → Lambda → direct HTTP calls to downstream services
- S3 → Kinesis Data Streams → single consumer Lambda
Correct answer: S3 → SNS topic → multiple SQS queues (fan-out pattern)
The SNS fan-out pattern publishes one event to an SNS topic, which delivers it to multiple SQS queues so each consumer processes independently.
Question 6: Which AWS pricing model offers the GREATEST discount for a steady-state workload where the instance family may need to change over three years?
- On-Demand instances
- Standard Reserved Instances (3-year)
- Compute Savings Plans (3-year) (Correct answer)
- Spot Instances
Correct answer: Compute Savings Plans (3-year)
Compute Savings Plans provide up to 66% savings and apply automatically to any EC2 instance family, size, or region, offering flexibility that Standard RIs lack.
Question 7: A company needs to detect and remediate configuration drift on EC2 instances automatically. Which AWS service is MOST appropriate?
- AWS CloudTrail
- AWS Systems Manager State Manager (Correct answer)
- Amazon Inspector
- AWS Trusted Advisor
Correct answer: AWS Systems Manager State Manager
AWS Systems Manager State Manager automatically applies and re-applies desired configurations to EC2 instances on a defined schedule, correcting drift.
Architecting on AWS Certification Architecting On AWS Certification 5
A microservices application needs service-to-service authentication and encrypted traffic within a VPC.
Which AWS service BEST addresses this?