Architecting on AWS Certification AWS Certified Solutions Architect - Associate 5 — Questions and Answers
Question 1: A company wants to run containers without managing the underlying EC2 instances. Which combination of services achieves this?
- Amazon ECS with EC2 launch type
- Amazon EKS with self-managed node groups
- Amazon ECS with AWS Fargate (Correct answer)
- AWS Batch with EC2 Spot
Correct answer: Amazon ECS with AWS Fargate
ECS with the Fargate launch type is a serverless compute engine that runs containers without provisioning or managing EC2 instances.
Question 2: An architect needs to give a third-party auditor read-only access to specific AWS resources without sharing long-term credentials. Which IAM feature should be used?
- Create an IAM user with a read-only policy
- Use AWS Organizations cross-account policies
- Create an IAM role with a trust policy for the auditor's account (Correct answer)
- Share root account credentials
Correct answer: Create an IAM role with a trust policy for the auditor's account
An IAM role with a cross-account trust policy allows the auditor to assume the role using their own credentials, eliminating the need for long-term shared keys.
Question 3: Which AWS service provides DDoS protection automatically for all AWS customers at no additional cost?
- AWS WAF
- AWS Shield Advanced
- AWS Shield Standard (Correct answer)
- Amazon GuardDuty
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no charge and protects against common Layer 3 and Layer 4 DDoS attacks.
Question 4: A Lambda function needs to access an RDS database in a private subnet. What configuration is required?
- Deploy Lambda in the same VPC and private subnet with appropriate security groups (Correct answer)
- Use RDS Proxy without VPC configuration
- Enable Lambda internet access and use RDS public endpoint
- Create a VPC peering between Lambda's VPC and RDS VPC
Correct answer: Deploy Lambda in the same VPC and private subnet with appropriate security groups
Configuring a Lambda function to run inside a VPC with access to the private subnet where RDS resides, and allowing the security group, enables private connectivity.
Question 5: An application must process streaming clickstream data in real time and store raw events for later batch analysis. Which combination of services is most appropriate?
- Amazon SQS + Amazon RDS
- Amazon Kinesis Data Streams + Amazon S3 (Correct answer)
- Amazon SNS + Amazon DynamoDB
- AWS Batch + Amazon EFS
Correct answer: Amazon Kinesis Data Streams + Amazon S3
Kinesis Data Streams ingests real-time streaming data at scale, and S3 provides cost-effective durable storage for raw events for batch analysis.
Question 6: A company wants to centrally manage and enforce compliance policies across all AWS accounts in their organization. Which service provides this capability?
- AWS IAM Permission Boundaries
- AWS Control Tower with AWS Organizations SCPs (Correct answer)
- AWS Config with remediation actions
- AWS Security Hub
Correct answer: AWS Control Tower with AWS Organizations SCPs
AWS Control Tower with Organizations Service Control Policies (SCPs) provides centralized governance and guardrails enforced across all member accounts.
Question 7: A web application hosted on EC2 behind an ALB needs to serve users globally with low latency. The architect also needs to protect it from SQL injection and cross-site scripting attacks. Which services should be combined?
- Amazon CloudFront + AWS WAF (Correct answer)
- AWS Global Accelerator + Amazon Inspector
- Amazon Route 53 latency routing + AWS Shield Standard
- CloudFront + Amazon GuardDuty
Correct answer: Amazon CloudFront + AWS WAF
CloudFront caches content at edge locations globally for low latency, and AWS WAF attached to the CloudFront distribution filters SQLi and XSS attacks at the edge.
Architecting on AWS Certification AWS Certified Solutions Architect - Associate 5
A company wants to run containers without managing the underlying EC2 instances.
Which combination of services achieves this?