Question bank
AWS Certified Solutions Architect – Associate
41 AWS Certified Solutions Architect – Associate questions with the correct answer and a written explanation, organised across 4 exam domains.
- 41 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Design Cost-Optimized Architectures
8 questions in this domain
- Question 1Single Choice
Which S3 storage class is designed for frequently accessed data with the highest durability?
- AS3 StandardCorrect answer
- BS3 Standard-IA
- CS3 One Zone-IA
- DS3 Glacier Deep Archive
Why this is the answer
S3 Standard provides low-latency access and 99.999999999% durability for frequently accessed data.
- Question 2Multiple Select
Which of the following are true about S3 Standard-IA? (Select two)
- ALower storage cost than S3 StandardCorrect answer
- BNo retrieval fee
- C30-day minimum storage durationCorrect answer
- DRetrieval time of minutes to hours
Why this is the answer
S3 Standard-IA has a lower storage cost than S3 Standard and a 30-day minimum storage duration. It incurs retrieval fees and provides millisecond retrieval.
- Question 3Interactive
Based on the provided lifecycle configuration, which storage class do objects with the 'logs/' prefix move to after 90 days?
- AS3 Standard
- BS3 Standard-IA
- CS3 Glacier Flexible RetrievalCorrect answer
- DS3 Glacier Deep Archive
Why this is the answer
The lifecycle rule transitions objects from S3 Standard (default) to STANDARD_IA after 30 days, then to GLACIER after 90 days, which corresponds to S3 Glacier Flexible Retrieval.
- Question 4Single Choice
Which Amazon EBS volume type provides a baseline performance of 3,000 IOPS and is recommended as a cost-effective choice for most workloads?
- Agp2
- Bgp3Correct answer
- Cio1
- Dst1
Why this is the answer
EBS gp3 offers a baseline of 3,000 IOPS and 125 MB/s throughput at a 20% lower cost than gp2, making it cost-effective for most workloads.
- Question 5Multiple Select
Which of the following are features of S3 Intelligent-Tiering? (Select two)
- ANo retrieval feesCorrect answer
- BFixed monthly storage fee per objectCorrect answer
- CRequires a 30-day minimum storage commitment
- DOnly moves objects between two tiers
Why this is the answer
S3 Intelligent-Tiering charges a small monthly monitoring fee per object but no retrieval fees, and it automatically moves objects between four access tiers. It has no minimum storage commitment.
- Question 6Interactive
The following AWS CLI command describes an EC2 instance purchase. What purchase model is being used?
- AOn-Demand
- BReserved Instance
- CSpot InstanceCorrect answer
- DDedicated Host
Why this is the answer
The 'InstanceLifecycle' field set to 'spot' indicates this is a Spot Instance, which offers significant discounts but can be reclaimed.
- Question 7Single Choice
Which AWS service can be used to reduce data transfer costs for static content by caching at edge locations?
- AAWS Global Accelerator
- BAmazon CloudFrontCorrect answer
- CAWS Transit Gateway
- DAmazon Route 53
Why this is the answer
Amazon CloudFront caches static content at edge locations, reducing origin load and egress costs due to lower edge-to-internet pricing.
- Question 8Multiple Select
Which of the following are true about AWS Reserved Instances? (Select two)
- AAvailable in 1-year or 3-year termsCorrect answer
- BCan be used for any instance family
- COffer a discount of up to 72%Correct answer
- DAre always tied to a specific Availability Zone
Why this is the answer
Reserved Instances require a 1- or 3-year commitment and provide up to 72% discount. Standard RIs are region- or AZ-specific and locked to an instance family.
Design High-Performing Architectures
10 questions in this domain
- Question 9Single Choice
What is the maximum number of GET/HEAD requests per second that a single S3 prefix can support?
- A3,500
- B5,500Correct answer
- C10,000
- D15,000
Why this is the answer
A single S3 prefix supports 5,500 GET/HEAD requests per second. Exceeding this requires prefix sharding.
- Question 10Multiple Select
Which of the following are valid EBS volume types? (Select two.)
- Agp3Correct answer
- Bio2Correct answer
- Cst2
- Def1
Why this is the answer
Valid EBS types include gp3 (general purpose) and io2 (provisioned IOPS). st2 and ef1 do not exist.
- Question 11Interactive
Review the following CloudFormation snippet. Which EBS volume type is being provisioned?
- Agp2
- Bgp3Correct answer
- Cio1
- Dst1
Why this is the answer
The code specifies VolumeType: gp3, which is a general purpose SSD volume with baseline performance.
- Question 12Single Choice
Which AWS service provides a fully managed NFS file system that can be mounted on multiple EC2 instances?
- AAmazon EBS
- BAmazon EFSCorrect answer
- CAmazon S3
- DAmazon FSx
Why this is the answer
Amazon EFS is a fully managed NFS file system that can be concurrently accessed by multiple EC2 instances.
- Question 13Multiple Select
Which of the following are performance modes available for Amazon EFS? (Select two.)
- AGeneral PurposeCorrect answer
- BMax I/OCorrect answer
- CHigh Throughput
- DLow Latency
Why this is the answer
EFS offers General Purpose (low latency) and Max I/O (high throughput) performance modes.
- Question 14Interactive
Review the following Terraform snippet. Which EFS performance mode is being set?
- AgeneralPurposeCorrect answer
- BmaxIO
- Cbursting
- Dprovisioned
Why this is the answer
The code sets performance_mode = \"generalPurpose\", which provides low latency for latency-sensitive applications.
- Question 15Single Choice
Which AWS service offers a file system optimized for high-performance computing (HPC) with sub-millisecond latency?
- AAmazon EFS
- BAmazon FSx for LustreCorrect answer
- CAmazon S3
- DAmazon EBS
Why this is the answer
FSx for Lustre is a high-performance file system optimized for HPC, machine learning, and media processing.
- Question 16Multiple Select
Which of the following are valid AWS Storage Gateway types? (Select two.)
- AFile GatewayCorrect answer
- BVolume GatewayCorrect answer
- CObject Gateway
- DBlock Gateway
Why this is the answer
Storage Gateway has three modes: File, Volume, and Tape. Object and Block are not valid types.
- Question 17Interactive
Review the following AWS CLI command. Which Storage Gateway type is being created?
- AFile GatewayCorrect answer
- BVolume Gateway
- CTape Gateway
- DGateway Cached
Why this is the answer
The command uses --gateway-type FILE_S3, indicating a File Gateway is being created.
- Question 18Single Choice
Which Auto Scaling policy type is most recommended for dynamic scaling based on a target metric?
- ASimple Scaling
- BStep Scaling
- CTarget TrackingCorrect answer
- DScheduled Scaling
Why this is the answer
Target Tracking Scaling is the recommended policy; it automatically adjusts capacity to maintain a target metric value.
Design Resilient Architectures
11 questions in this domain
- Question 19Single Choice
What is the primary purpose of an Auto Scaling Group in AWS?
- AManually adjust EC2 instance count
- BAutomatically adjust EC2 instance count based on demandCorrect answer
- CCreate EC2 instances in a single Availability Zone
- DProvide a static set of EC2 instances
Why this is the answer
Auto Scaling automatically adjusts the number of EC2 instances to meet demand, improving scalability and cost-efficiency.
- Question 20Multiple Select
Which two components are essential for building a loosely coupled architecture on AWS? (Choose two.)
- AAmazon SQSCorrect answer
- BAmazon SNSCorrect answer
- CElastic Load Balancing
- DAWS Lambda
Why this is the answer
SQS decouples with message queues, SNS decouples with pub/sub. ELB and Lambda are load balancing and compute, not decoupling mechanisms.
- Question 21Interactive
Given the provided CloudFormation snippet, what resource is being created that enables horizontal scaling?
- AAuto Scaling GroupCorrect answer
- BLaunch Configuration
- CElastic Load Balancer
- DEC2 Instance
Why this is the answer
The AWS::AutoScaling::AutoScalingGroup resource defines an Auto Scaling Group for automatic scaling.
- Question 22Single Choice
What is the maximum Lambda function execution timeout?
- A5 minutes
- B15 minutesCorrect answer
- C30 minutes
- D60 minutes
Why this is the answer
Lambda functions have a maximum timeout of 15 minutes (900 seconds).
- Question 23Multiple Select
Which two statements about SQS Standard queues are true? (Choose two.)
- AAt-least-once deliveryCorrect answer
- BExactly-once processing
- CBest-effort orderingCorrect answer
- DStrict FIFO ordering
Why this is the answer
Standard queues offer at-least-once delivery and best-effort ordering. FIFO queues offer exactly-once and strict ordering.
- Question 24Interactive
Examine the Terraform snippet. Which service is used to distribute traffic across multiple targets?
- AApplication Load BalancerCorrect answer
- BNetwork Load Balancer
- CClassic Load Balancer
- DRoute 53
Why this is the answer
The resource 'aws_lb' with type 'application' creates an Application Load Balancer.
- Question 25Single Choice
Which AWS service decouples producers and consumers using a message queue?
- AAmazon SNS
- BAmazon SQSCorrect answer
- CAWS Lambda
- DAmazon Kinesis
Why this is the answer
SQS is a fully managed message queuing service for decoupling application components.
- Question 26Multiple Select
Which two types of Elastic Load Balancers operate at Layer 7? (Choose two.)
- AApplication Load BalancerCorrect answer
- BNetwork Load Balancer
- CClassic Load Balancer
- DGateway Load Balancer
Why this is the answer
Only ALB operates at Layer 7. NLB and GLB operate at Layer 4, CLB is legacy.
- Question 27Interactive
Refer to the AWS CLI command. What does the `--max-results` parameter specify?
- AMaximum number of results to returnCorrect answer
- BTimeout in seconds
- CNumber of retries
- DBatch size for processing
Why this is the answer
In AWS CLI, --max-results limits the number of results returned in a single call.
- Question 28Single Choice
Which queue type provides exactly-once processing and strict order?
- AStandard Queue
- BFIFO QueueCorrect answer
- CDead-Letter Queue
- DPriority Queue
Why this is the answer
FIFO queues provide first-in-first-out delivery and exactly-once processing.
- Question 29Multiple Select
Which two AWS services are used to build a decoupled architecture with event-driven compute? (Choose two.)
- AAmazon SNSCorrect answer
- BAWS LambdaCorrect answer
- CAmazon RDS
- DAmazon EC2
Why this is the answer
SNS publishes events, Lambda executes code in response to events, enabling decoupling.
Design Secure Architectures
12 questions in this domain
- Question 30Single Choice
What type of credentials does an IAM role provide when assumed?
- ATemporary credentialsCorrect answer
- BLong-term access keys
- CSSH key pairs
- DMFA device serial numbers
Why this is the answer
IAM roles provide temporary credentials via AWS Security Token Service (STS). These credentials are automatically rotated and are the best practice for granting permissions to services or federated users.
- Question 31Multiple Select
Which two types of IAM policies are available in AWS? (Choose two.)
- AIdentity-based policiesCorrect answer
- BResource-based policiesCorrect answer
- CService control policies
- DSession policies
Why this is the answer
IAM policies can be identity-based (attached to users, groups, or roles) or resource-based (attached to resources like S3 buckets). SCPs are a separate feature of AWS Organizations.
- Question 32Interactive
Examine the IAM trust policy below. Which entity is allowed to assume the role?
- AThe EC2 serviceCorrect answer
- BAn IAM user in the same account
- CAny AWS account
- DAn IAM group
Why this is the answer
The trust policy allows the EC2 service principal (ec2.amazonaws.com) to assume the role. This is commonly used to grant an EC2 instance permissions via an instance profile.
- Question 33Single Choice
What is the primary function of Service Control Policies (SCPs) in AWS Organizations?
- ADefine maximum available permissions for accountsCorrect answer
- BGrant permissions to IAM users
- CEncrypt data at rest
- DMonitor API activity
Why this is the answer
SCPs allow you to centrally control the maximum permissions for all accounts in your organization. They act as guardrails that can restrict what actions even an IAM administrator can perform.
- Question 34Multiple Select
Which AWS services are commonly used for defense in depth in a web application? (Choose two.)
- AAWS WAFCorrect answer
- BAWS ShieldCorrect answer
- CAWS Direct Connect
- DAWS Data Pipeline
Why this is the answer
WAF and Shield are part of the defense-in-depth strategy. WAF protects against web exploits, and Shield protects against DDoS attacks. Direct Connect and Data Pipeline are not security services.
- Question 35Interactive
Examine the S3 bucket policy snippet. What does the condition enforce?
- AAll requests must use HTTPSCorrect answer
- BOnly GET requests are allowed
- COnly requests from a specific IP range
- DAll requests must include MFA
Why this is the answer
The condition 'aws:SecureTransport': 'false' in the Deny statement forces all requests to use HTTPS (SecureTransport). Without this, HTTP requests would be allowed.
- Question 36Single Choice
What does the principle of least privilege (PoLP) require?
- AGrant only the permissions necessary to perform a functionCorrect answer
- BGrant all permissions and then remove those not needed
- CGrant the same permissions to all users
- DGrant administrative access to all developers
Why this is the answer
The principle of least privilege dictates that you should grant the minimum set of permissions required for a user, role, or service to perform its intended tasks. This reduces security risk.
- Question 37Multiple Select
Which are best practices for securing an EC2 instance? (Choose two.)
- AUse an IAM role to grant permissionsCorrect answer
- BRestrict inbound traffic with security groupsCorrect answer
- CDisable all encryption
- DUse the same SSH key for all instances
Why this is the answer
Using IAM roles (instance profiles) avoids hardcoding keys, and security groups control inbound traffic. Disabling encryption and sharing SSH keys are insecure practices.
- Question 38Interactive
Examine the KMS key policy. Which AWS account is granted decryption permission?
- A111122223333Correct answer
- B444455556666
- CThe same account that owns the key
- DOnly the root user
Why this is the answer
The policy grants kms:Decrypt to account 111122223333. The other account IDs are not listed. This enables cross-account decryption.
- Question 39Single Choice
What is the key difference between SSE-S3 and SSE-KMS for S3 encryption?
- ASSE-KMS provides control over key rotation and auditingCorrect answer
- BSSE-S3 allows you to use your own KMS key
- CSSE-KMS is less secure than SSE-S3
- DBoth require a bucket policy to be enabled
Why this is the answer
SSE-KMS uses AWS KMS customer master keys, giving you control over rotation, deletion, and auditing via CloudTrail. SSE-S3 uses S3-managed keys with no customer control over rotation.
- Question 40Multiple Select
Which AWS services can store and manage secrets securely? (Choose two.)
- AAWS Secrets ManagerCorrect answer
- BAWS Systems Manager Parameter StoreCorrect answer
- CAmazon S3
- DAWS Config
Why this is the answer
Secrets Manager and Parameter Store are designed to store secrets. Secrets Manager offers automatic rotation, while Parameter Store is a low-cost option. S3 and Config are not secret storage services.
- Question 41Interactive
Examine the bucket policy condition. What does it require for a request to be allowed?
- AMulti-Factor Authentication (MFA)Correct answer
- BA specific IP address
- CA specific time window
- DA valid SSL certificate
Why this is the answer
The condition 'aws:MultiFactorAuthPresent': 'true' requires the user to have authenticated with MFA. This is a common pattern to protect sensitive actions.
Frequently asked questions
Everything about the AWS Certified Solutions Architect – Associate question bank and how to use it.