Architecting on AWS Certification Joint Design & Preparation 5 — Questions and Answers
Question 1: A joint design team must ensure that sensitive PII stored in S3 is never accidentally made public. Which preventive control enforces this at the organization level?
- S3 bucket policies reviewed quarterly
- AWS Organizations SCP blocking s3:PutBucketAcl with public grants, plus S3 Block Public Access enabled at the account level (Correct answer)
- IAM policies on each developer's role
- CloudTrail logging all S3 API calls
Correct answer: AWS Organizations SCP blocking s3:PutBucketAcl with public grants, plus S3 Block Public Access enabled at the account level
SCPs enforce guardrails across all accounts in the organization while S3 Block Public Access provides a second layer of defense at the account level.
Question 2: During joint preparation for a high-availability web application, the team must design for an AZ failure. Which architecture ensures the application remains available during a single AZ outage?
- All EC2 instances in a single AZ with a load balancer
- Auto Scaling group spanning three AZs behind an Application Load Balancer (Correct answer)
- A single large EC2 instance with EBS Multi-Attach
- Two EC2 instances in the same AZ with Route 53 health checks
Correct answer: Auto Scaling group spanning three AZs behind an Application Load Balancer
Distributing instances across multiple AZs behind an ALB ensures traffic is automatically redirected to healthy AZs if one fails.
Question 3: Two teams are jointly architecting a solution where a third-party partner needs read-only access to specific S3 buckets in your AWS account without receiving long-term credentials. Which mechanism should be used?
- Create an IAM user and share the access key with the partner
- Configure an IAM role with a trust policy allowing the partner's AWS account to assume it via cross-account role assumption (Correct answer)
- Make the S3 bucket publicly readable
- Share AWS root account credentials temporarily
Correct answer: Configure an IAM role with a trust policy allowing the partner's AWS account to assume it via cross-account role assumption
Cross-account role assumption grants temporary, scoped credentials via STS without requiring long-term access keys to be shared.
Question 4: During joint design, the team needs to implement a CI/CD pipeline that automatically deploys to ECS Fargate when code is pushed to CodeCommit. Which AWS-native service combination builds this pipeline?
- Jenkins on EC2 with manual deployment scripts
- CodePipeline orchestrating CodeBuild for the image build and CodeDeploy for the ECS deployment (Correct answer)
- Lambda functions triggered by S3 events to deploy containers
- Elastic Beanstalk with automatic deployment from CodeCommit
Correct answer: CodePipeline orchestrating CodeBuild for the image build and CodeDeploy for the ECS deployment
CodePipeline connects source, build, and deploy stages natively, with CodeBuild building Docker images and CodeDeploy managing blue/green ECS deployments.
Question 5: A joint architecture team is preparing a cost governance strategy for a multi-team AWS environment. Which approach provides the most granular cost visibility per team without requiring separate accounts?
- Review the total monthly AWS bill at the organization level
- Apply consistent resource tags per team and use Cost Explorer tag-based cost allocation reports (Correct answer)
- Use AWS Budgets with a single budget for the entire organization
- Estimate costs manually from CloudWatch metrics
Correct answer: Apply consistent resource tags per team and use Cost Explorer tag-based cost allocation reports
Tag-based cost allocation in Cost Explorer breaks down spending by team, project, or environment using tags applied consistently to all resources.
Question 6: During joint preparation, the security architect requires that all API calls made within the AWS environment be logged immutably for 7 years to satisfy audit requirements. Which solution achieves this?
- Enable CloudTrail logging to an S3 bucket with Object Lock in Compliance mode and a 7-year retention policy (Correct answer)
- Store CloudTrail logs in an EC2 instance's local disk
- Use VPC Flow Logs retained in CloudWatch Logs for 7 years
- Enable AWS Config and review the configuration history dashboard
Correct answer: Enable CloudTrail logging to an S3 bucket with Object Lock in Compliance mode and a 7-year retention policy
CloudTrail captures all API calls, and S3 Object Lock in Compliance mode prevents deletion or modification of log objects for the specified retention period.
Question 7: A cross-team design session identifies that a microservice needs to process a large file uploaded to S3, but processing takes 20 minutes. Which architecture avoids Lambda timeout limits for this workload?
- Increase Lambda timeout to 60 minutes
- Trigger an AWS Step Functions workflow from an S3 event notification that invokes a Fargate task for the long-running processing (Correct answer)
- Process the file synchronously within API Gateway timeout limits
- Use a larger Lambda memory configuration to reduce processing time below 15 minutes
Correct answer: Trigger an AWS Step Functions workflow from an S3 event notification that invokes a Fargate task for the long-running processing
Step Functions orchestrates a Fargate task which has no timeout limit, allowing arbitrarily long processing while Lambda handles only the lightweight trigger.
Architecting on AWS Certification Joint Design & Preparation 5
A joint design team must ensure that sensitive PII stored in S3 is never accidentally made public.
Which preventive control enforces this at the organization level?