Architecting on AWS Certification Joint Design & Preparation 4 — Questions and Answers
Question 1: A joint design team must architect a real-time analytics pipeline ingesting 500,000 events per second. Which AWS service is designed for this ingestion scale?
- SQS FIFO queue
- Amazon Kinesis Data Streams (Correct answer)
- SNS standard topic
- RDS with bulk inserts
Correct answer: Amazon Kinesis Data Streams
Kinesis Data Streams is designed for real-time, high-throughput data streaming and scales by adding shards to handle millions of records per second.
Question 2: During joint preparation, the team discovers that their on-premises Active Directory must authenticate users for AWS Management Console access. Which service enables this without syncing all credentials to AWS?
- AWS IAM with duplicated user accounts
- AWS IAM Identity Center with AD Connector as the identity source (Correct answer)
- Cognito user pools connected to on-premises LDAP
- Creating IAM users for every AD user manually
Correct answer: AWS IAM Identity Center with AD Connector as the identity source
IAM Identity Center with AD Connector federates authentication to on-premises AD so users log in with existing credentials without syncing passwords to AWS.
Question 3: A cross-team architecture review requires a cost-optimized compute strategy for a batch workload that runs 6 hours per night and can tolerate interruptions. Which EC2 purchasing option is most appropriate?
- On-Demand Instances
- Reserved Instances with 1-year term
- Spot Instances with checkpointing to S3 (Correct answer)
- Dedicated Hosts
Correct answer: Spot Instances with checkpointing to S3
Spot Instances offer up to 90% savings, and checkpointing allows the batch job to resume from the last saved state if interrupted.
Question 4: During joint design, the team needs to expose a REST API that aggregates data from three backend Lambda functions. Which service orchestrates this with the least custom code?
- An EC2 instance running Nginx as a reverse proxy
- API Gateway with separate integrations per route mapped to each Lambda (Correct answer)
- A fourth Lambda function that calls the other three synchronously
- CloudFront with Lambda@Edge for routing
Correct answer: API Gateway with separate integrations per route mapped to each Lambda
API Gateway natively routes each HTTP method/path to a different Lambda integration, handling request/response transformation without custom aggregation code.
Question 5: Two teams are jointly designing a multi-account AWS environment following AWS Organizations best practices. Which account structure isolates production workloads most effectively?
- All workloads in a single account with separate IAM policies per team
- A flat OU structure with dev, staging, and prod in the same account
- Separate AWS accounts for production, staging, and development within an AWS Organization (Correct answer)
- One account per developer with shared production resources
Correct answer: Separate AWS accounts for production, staging, and development within an AWS Organization
Separate accounts provide the strongest blast-radius isolation because IAM boundaries, service quotas, and billing are completely independent per account.
Question 6: During joint capacity preparation, the team finds that their DynamoDB table experiences hot partition issues during flash sales. Which design change resolves this?
- Switch from provisioned to on-demand capacity mode only
- Add a random suffix to partition keys to distribute writes across multiple partitions (Correct answer)
- Increase the RCU/WCU provisioned capacity
- Enable DynamoDB Streams for the table
Correct answer: Add a random suffix to partition keys to distribute writes across multiple partitions
Write sharding by appending a random suffix distributes hot-key traffic across multiple partitions, eliminating the throttling caused by a single partition absorbing all writes.
Question 7: A joint architecture team is preparing their monitoring strategy and needs to detect when application errors exceed a threshold and automatically notify on-call engineers. Which combination achieves this?
- Manually review CloudWatch logs daily
- CloudWatch Logs metric filter → CloudWatch Alarm → SNS topic → PagerDuty subscription (Correct answer)
- Enable AWS Config and review compliance reports
- Use CloudTrail to count API error events and email weekly summaries
Correct answer: CloudWatch Logs metric filter → CloudWatch Alarm → SNS topic → PagerDuty subscription
A metric filter extracts error counts from logs, the alarm triggers when the threshold is breached, and SNS delivers the alert to the on-call notification system in near real time.
Architecting on AWS Certification Joint Design & Preparation 4
A joint design team must architect a real-time analytics pipeline ingesting 500,000 events per second.
Which AWS service is designed for this ingestion scale?