Architecting on AWS Certification Joint Design & Preparation 2 — Questions and Answers
Question 1: A team is jointly designing a multi-tier application on AWS and needs to ensure that the web tier can scale independently of the database tier. Which architectural pattern best supports this requirement?
- Tightly coupled monolith with shared RDS instance
- Decoupled architecture using Auto Scaling groups with SQS between tiers (Correct answer)
- Single EC2 instance running all application components
- Direct database connections from each web server without connection pooling
Correct answer: Decoupled architecture using Auto Scaling groups with SQS between tiers
Decoupling tiers with SQS allows each layer to scale independently without being blocked by the other tier's capacity.
Question 2: During joint architecture planning for a global SaaS application, the team must reduce latency for international users without duplicating the entire backend. Which AWS service combination achieves this?
- CloudFront with S3 origin for all content
- Route 53 latency-based routing with regional API Gateway endpoints and a single primary database (Correct answer)
- Multiple full-stack deployments in every AWS region
- Global Accelerator with static IP addresses pointing to a single EC2 instance
Correct answer: Route 53 latency-based routing with regional API Gateway endpoints and a single primary database
Latency-based routing with regional API endpoints serves requests from the nearest region while keeping the database centralized.
Question 3: Two teams are jointly preparing a disaster recovery strategy. The RTO is 1 hour and RPO is 15 minutes. Which DR strategy meets these requirements most cost-effectively?
- Multi-site active-active across two regions
- Warm standby with pilot light in a secondary region
- Backup and restore from S3 Glacier
- Warm standby with a scaled-down but running environment in a secondary region (Correct answer)
Correct answer: Warm standby with a scaled-down but running environment in a secondary region
A warm standby keeps core services running at reduced capacity, enabling recovery within 1 hour while continuous replication satisfies the 15-minute RPO.
Question 4: A cross-functional team is designing a shared services VPC that must be accessed by 20 application VPCs in the same account. Which connectivity model scales best while avoiding complex route management?
- VPC peering between all 20 application VPCs and the shared VPC
- AWS Transit Gateway connecting all VPCs through a central hub (Correct answer)
- VPN tunnels from each application VPC to the shared VPC
- Internet Gateway-based routing with security groups
Correct answer: AWS Transit Gateway connecting all VPCs through a central hub
Transit Gateway acts as a hub, eliminating the need to manage hundreds of individual peering connections as VPC count grows.
Question 5: During joint design sessions, the security team requires that all inter-service communication within a microservices architecture be mutually authenticated. Which approach best satisfies this on AWS?
- Security groups restricting traffic by port and protocol
- AWS App Mesh with mTLS enabled between Envoy proxies (Correct answer)
- Network ACLs on the VPC subnets
- IAM roles assigned to each EC2 instance
Correct answer: AWS App Mesh with mTLS enabled between Envoy proxies
App Mesh with mTLS enforces mutual certificate-based authentication between services at the application layer, not just network layer.
Question 6: A team jointly planning a data lake architecture needs to separate raw, curated, and consumption zones. Which AWS service combination provides the best foundation for this?
- Three separate EC2 instances with attached EBS volumes
- S3 with distinct prefixes or buckets per zone, AWS Glue for ETL, and Athena for querying (Correct answer)
- RDS with separate schemas for each zone
- ElastiCache with Redis sorted sets to organize data tiers
Correct answer: S3 with distinct prefixes or buckets per zone, AWS Glue for ETL, and Athena for querying
S3 provides durable, scalable storage for each zone while Glue transforms data between zones and Athena enables serverless SQL querying.
Question 7: During architecture preparation, the team must choose an approach for managing secrets used by Lambda functions that access RDS. Which option follows AWS best practices?
- Hardcode database credentials in the Lambda function code
- Store credentials in Lambda environment variables encrypted with the default service key
- Use AWS Secrets Manager with automatic rotation and grant Lambda the secretsmanager:GetSecretValue permission (Correct answer)
- Pass credentials via API Gateway request headers from the client
Correct answer: Use AWS Secrets Manager with automatic rotation and grant Lambda the secretsmanager:GetSecretValue permission
Secrets Manager provides centralized secret storage with automatic rotation, and fine-grained IAM policies control which functions can retrieve each secret.
Architecting on AWS Certification Joint Design & Preparation 2
A team is jointly designing a multi-tier application on AWS and needs to ensure that the web tier can scale independently of the database tier.
Which architectural pattern best supports this requirement?