AWS

A company hires an external cost-optimisation vendor that needs read access to resources in the company's AWS account. The vendor runs from its own AWS account and serves many other customers. Which solution meets this requirement MOST securely?

Third-party access is an IAM role the vendor assumes from their own account, never an IAM user with access keys. The detail that separates a good answer from a nearly-good one is the external ID condition in the trust policy, which is what stops another of the vendor's customers from tricking them into acting on your account.

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A compliance review finds that an existing Amazon EBS volume attached to a production EC2 instance is unencrypted. The data on the volume must be encrypted at rest with an AWS KMS key. Which sequence of steps achieves this?

You cannot turn encryption on for an existing EBS volume in place. The supported path is to snapshot it, copy the snapshot with encryption enabled, create a new volume from the encrypted copy, and swap it onto the instance.

An application on Amazon ECS connects to an Amazon RDS for PostgreSQL database using a username and password stored in the task definition as plaintext environment variables. Security policy now requires that the database password be encrypted at rest and rotated automatically every 30 days. Which solution meets these requirements with the LEAST operational overhead?

Secrets Manager is the service that rotates credentials for you, and it has built-in rotation for RDS. Parameter Store SecureString encrypts a value perfectly well but has no native rotation, so choosing it means writing and owning the rotation yourself.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

An audit discovers that several Amazon S3 buckets across a company's AWS accounts have been made publicly readable by developers. The company must guarantee that no bucket in any account can be made public, and must be alerted to any bucket policy that grants access outside the organization. Which combination of actions meets these requirements?

S3 Block Public Access enforced at the account level is the preventive control, and IAM Access Analyzer is the detective one. The pairing matters: the exam separates stopping something from noticing it, and this stem asks for both.

An ecommerce application sends order events to a processing service. During sales events the processing service is overwhelmed and drops orders. Orders for a given customer must be processed in the sequence they were submitted, and no order may be processed twice. Which solution meets these requirements?

Two requirements in the stem, ordering and no duplicates, point at exactly one service. An SQS FIFO queue guarantees first-in-first-out delivery within a message group and provides exactly-once processing through deduplication. A standard queue gives neither.

An Amazon RDS for MySQL database serves a reporting application. Read queries have grown until they slow down writes, and the business separately requires that the database survive the loss of a single Availability Zone with automatic failover. Which combination meets both requirements?

Multi-AZ and read replicas solve different problems and the exam tests whether you conflate them. A Multi-AZ standby is synchronous and cannot serve reads. A read replica is asynchronous and does serve reads. Needing both availability and read scaling means deploying both.

An AWS Lambda function is triggered by an Amazon SQS queue. A small number of malformed messages cause the function to fail repeatedly. These messages are retried continuously, which delays processing of valid messages and increases cost. What should a solutions architect do to resolve this?

A message that can never succeed will be retried until it expires, blocking the queue behind it. The fix is a dead-letter queue with a maxReceiveCount redrive policy, which moves the poison message aside after a set number of failures so everything else keeps flowing.

A web application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Users report being logged out at random. Investigation shows that session data is held in memory on each instance, so a request routed to a different instance loses the session. Which solution fixes this while keeping the web tier horizontally scalable?

Session state held on an instance makes that instance special, which is what breaks scaling and termination. Moving sessions to a shared store such as ElastiCache or DynamoDB makes every instance interchangeable, which is the property the rest of the architecture assumes.

A media company stores original video files in an Amazon S3 bucket in us-east-1. Regulators require that a copy of every new file exists in a second AWS Region within 15 minutes of upload, and that no file can be permanently deleted by mistake. Which TWO actions should a solutions architect take?

Cross-Region Replication copies new objects to a bucket in another Region automatically, and versioning is its prerequisite as well as the control that makes deletion recoverable. The pair answers both halves of the requirement with one dependency between them.

A product catalogue application backed by Amazon RDS shows rising read latency. Analysis shows that a small number of identical queries account for most of the load, and the underlying data changes only a few times per day. The team wants to reduce latency to single-digit milliseconds with minimal application rework. What should a solutions architect recommend?

Repeated identical reads over rarely changing data is the textbook caching case. Amazon ElastiCache serves those queries from memory in well under a millisecond, and because the data changes a few times a day, staleness is cheap to manage.

An application stores orders in an Amazon DynamoDB table with a partition key of orderId. A new reporting feature must list all orders for a given customerId, sorted by order date. Running the report currently scans the entire table and is slow and expensive. What should a solutions architect recommend?

A scan means the access pattern has no index behind it. A global secondary index with customerId as its partition key and the order date as its sort key turns that scan into a query. Only a global secondary index can introduce a new partition key on an existing table.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

A company stores analytics datasets in Amazon S3. Access is unpredictable: some datasets are queried daily for months, others are never opened again after the first week, and the team cannot tell which is which in advance. All objects are larger than 1 MB and must remain available for immediate retrieval. Which approach is MOST cost-effective?

Lifecycle rules are the cheapest option when access falls off predictably with age. When nobody can predict it, S3 Intelligent-Tiering is the class designed for exactly that: it moves each object between tiers on its own access pattern, with no retrieval fees and no minimum storage duration.

A company runs a steady production workload on Amazon EC2 that has not changed size in two years and is expected to continue for at least three more. The team occasionally changes instance family as new generations are released, and is also beginning to move some services to AWS Fargate. The company wants the largest possible discount without giving up that flexibility. Which purchasing option should a solutions architect recommend?

Predictable long-running usage should never sit on On-Demand pricing. Compute Savings Plans give the deepest commitment discount while staying flexible across instance family, size, Region and even across EC2, Fargate and Lambda, which is what the stem's flexibility requirement is asking for.

A nightly batch job renders video segments. The work is split into thousands of independent tasks, any task can be retried safely if it fails, and the job must finish before 06:00 but has no other timing constraint. The company wants to minimise compute cost. Which approach should a solutions architect recommend?

Independent, retryable tasks with a loose deadline is the definition of an interruption-tolerant workload, and that is what Spot Instances are for. Spreading the request across several instance types and Availability Zones is what keeps a Spot fleet from being reclaimed all at once.

A development team uses several Amazon RDS for MySQL instances that are only needed during working hours on weekdays. The team wants to stop paying for them outside those hours with the least possible engineering effort, and the databases must retain their data and endpoints between sessions. Which solution meets these requirements?

Stopping an RDS instance removes the instance-hour charge while keeping the data, the endpoint and the configuration. The catch worth knowing is the seven-day limit: RDS restarts a stopped instance automatically after seven consecutive days, so a weekday schedule fits and a long shutdown does not.