Architecting on AWS Certification AWS Certified Solutions Architect - Associate 4 — Questions and Answers
Question 1: A company needs to migrate 50 TB of on-premises data to Amazon S3 within two weeks. The internet bandwidth is limited to 100 Mbps. Which AWS service should be used?
- AWS Direct Connect
- AWS DataSync over internet
- AWS Snowball Edge (Correct answer)
- S3 Transfer Acceleration
Correct answer: AWS Snowball Edge
AWS Snowball Edge physically ships a storage device to the customer, enabling offline data transfer that bypasses limited internet bandwidth.
Question 2: An architect wants to implement a multi-region active-passive disaster recovery strategy with an RTO of under 1 hour. Which approach best meets this requirement?
- Backup and restore to a warm standby in another region
- Pilot Light with minimal resources pre-provisioned in the DR region (Correct answer)
- Multi-site active-active deployment
- Regular S3 backups only
Correct answer: Pilot Light with minimal resources pre-provisioned in the DR region
A Pilot Light configuration keeps core services running in the DR region and can scale up within minutes to meet RTO targets under 1 hour.
Question 3: Which AWS CloudFront feature allows you to run custom code closer to users to personalize content or perform authentication before requests reach the origin?
- Origin Shield
- CloudFront Functions (Correct answer)
- Field-Level Encryption
- Signed URLs
Correct answer: CloudFront Functions
CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for low-latency request/response manipulation.
Question 4: A company wants to enforce that all new S3 buckets in an AWS account are created with public access blocked. How can this be enforced automatically?
- Use an S3 bucket policy on each bucket
- Enable AWS Config rule s3-bucket-public-read-prohibited
- Use AWS Organizations SCP to deny s3:PutBucketAcl
- Enable S3 Block Public Access at the account level (Correct answer)
Correct answer: Enable S3 Block Public Access at the account level
Enabling S3 Block Public Access at the account level prevents any bucket or object in the account from being made publicly accessible.
Question 5: A workload requires high-performance computing with GPU instances that need very low latency communication between nodes. Which EC2 feature should be used?
- Enhanced Networking with ENA
- Placement Groups – Cluster
- Placement Groups – Spread
- Elastic Fabric Adapter (EFA) (Correct answer)
Correct answer: Elastic Fabric Adapter (EFA)
EFA provides OS-bypass networking with very low latency and high throughput, specifically designed for tightly coupled HPC and ML workloads.
Question 6: An application stores user session data in an in-memory cache. The architect needs a managed, highly available caching layer that supports sub-millisecond latency. Which service should be used?
- Amazon RDS with read replicas
- Amazon DynamoDB Accelerator (DAX)
- Amazon ElastiCache for Redis (Correct answer)
- AWS Global Accelerator
Correct answer: Amazon ElastiCache for Redis
ElastiCache for Redis provides a fully managed, highly available in-memory data store with sub-millisecond latency and support for session management.
Question 7: A Solutions Architect needs to ensure that traffic between EC2 instances in a VPC and an S3 bucket does not traverse the public internet. What should be configured?
- VPC Peering to S3
- NAT Gateway with S3 endpoint
- Gateway VPC Endpoint for S3 (Correct answer)
- AWS PrivateLink for S3
Correct answer: Gateway VPC Endpoint for S3
A Gateway VPC Endpoint for S3 routes traffic from the VPC directly to S3 over the AWS private network without using the internet.
Architecting on AWS Certification AWS Certified Solutions Architect - Associate 4
A company needs to migrate 50 TB of on-premises data to Amazon S3 within two weeks.
The internet bandwidth is limited to 100 Mbps.
Which AWS service should be used?