Architecting on AWS Certification Joint Design & Preparation 3 — Questions and Answers
Question 1: A joint design team is architecting an event-driven system where multiple downstream services must react to the same order-placed event. Which AWS service best decouples the producer from multiple consumers?
- SQS standard queue shared by all consumers
- Amazon SNS topic with SQS queue subscriptions per consumer (Correct answer)
- Kinesis Data Streams with a single consumer
- EventBridge with a single target Lambda
Correct answer: Amazon SNS topic with SQS queue subscriptions per consumer
SNS fan-out to SQS queues ensures each consumer receives every event independently without competing for messages.
Question 2: During joint capacity planning, the team determines that a relational workload will have predictable traffic with occasional 10x spikes. Which RDS feature handles spikes without over-provisioning permanently?
- RDS Multi-AZ standby instance
- Aurora Serverless v2 with auto-scaling capacity units (Correct answer)
- Read replicas for write traffic
- Manual instance resizing before known spike windows
Correct answer: Aurora Serverless v2 with auto-scaling capacity units
Aurora Serverless v2 scales compute capacity in fine-grained increments within seconds, eliminating the need to provision for peak permanently.
Question 3: A cross-team architecture review identifies that a critical Lambda function must process exactly once even if the triggering SQS message is delivered multiple times. Which design pattern addresses this?
- Increase SQS visibility timeout to prevent redelivery
- Implement idempotency using a DynamoDB conditional write keyed on message ID (Correct answer)
- Use FIFO queues with deduplication ID
- Process messages synchronously to prevent duplicates
Correct answer: Implement idempotency using a DynamoDB conditional write keyed on message ID
Storing a processed message ID in DynamoDB with a conditional write ensures the business logic executes exactly once even if Lambda retries.
Question 4: Two teams are jointly preparing an AWS Well-Architected Framework review for their workload. Which pillar specifically addresses the ability to recover from failures and meet RTO/RPO goals?
- Operational Excellence
- Performance Efficiency
- Reliability (Correct answer)
- Cost Optimization
Correct answer: Reliability
The Reliability pillar covers failure recovery, backup strategies, and meeting recovery time and point objectives.
Question 5: During joint design for a containerized application, the team must choose between ECS on Fargate and EKS. Which factor most strongly favors EKS?
- The team wants AWS to manage the control plane entirely
- The application requires Kubernetes-native APIs, Helm charts, and advanced scheduling policies (Correct answer)
- The team wants the lowest operational overhead
- The workload consists of short-lived batch jobs
Correct answer: The application requires Kubernetes-native APIs, Helm charts, and advanced scheduling policies
EKS is the right choice when the workload or team requires Kubernetes-specific ecosystem tools like Helm, custom schedulers, or CRDs.
Question 6: A team is jointly preparing their AWS infrastructure using Infrastructure as Code. They need to deploy the same environment across dev, staging, and production accounts. Which approach best supports this?
- Manually replicate resources in each account using the console
- Use CloudFormation StackSets to deploy across multiple accounts and regions from a single template (Correct answer)
- Write separate CloudFormation templates per environment
- Use AWS Config rules to create resources in each account
Correct answer: Use CloudFormation StackSets to deploy across multiple accounts and regions from a single template
StackSets automate template deployment across multiple accounts and regions from a single management account, ensuring consistency.
Question 7: During joint architecture preparation, the compliance team requires that all S3 data be encrypted at rest with keys the customer controls and can audit. Which option satisfies this requirement?
- SSE-S3 with AWS-managed keys
- SSE-KMS with a customer-managed KMS key and CloudTrail logging enabled (Correct answer)
- Client-side encryption with a hardcoded AES key
- S3 bucket policies restricting access to encrypt traffic only
Correct answer: SSE-KMS with a customer-managed KMS key and CloudTrail logging enabled
SSE-KMS with a customer-managed key gives full control over key policy, rotation, and provides an audit trail via CloudTrail for every key usage event.
Architecting on AWS Certification Joint Design & Preparation 3
A joint design team is architecting an event-driven system where multiple downstream services must react to the same order-placed event.
Which AWS service best decouples the producer from multiple consumers?