Question bank
AWS Certified Solutions Architect – Professional
42 AWS Certified Solutions Architect – Professional questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Design Cost-Optimized Architectures
11 questions in this domain
- Question 1Single Choice
Which AWS compute pricing model offers the highest discount for a steady-state workload with a fixed instance family and term?
- AStandard Reserved InstancesCorrect answer
- BConvertible Reserved Instances
- CCompute Savings Plan
- DOn-Demand Instances
Why this is the answer
Standard RIs provide the highest discount (up to 72%) for a specific instance family and term, offering no flexibility but maximum savings.
- Question 2Multiple Select
Which two AWS services are covered by a Compute Savings Plan? (Choose 2)
- AAmazon EC2Correct answer
- BAWS LambdaCorrect answer
- CAmazon RDS
- DAmazon DynamoDB
Why this is the answer
A Compute Savings Plan covers EC2, Lambda, and Fargate usage. RDS and DynamoDB are not included.
- Question 3Interactive
Use the following scenario: A company wants to run fault-tolerant batch jobs. Which compute option best suits their cost-optimization needs?
- ASpot InstancesCorrect answer
- BOn-Demand Instances
- CReserved Instances
- DDedicated Hosts
Why this is the answer
Spot Instances offer up to 90% discount and are ideal for fault-tolerant, stateless, or batch workloads that can handle interruptions.
- Question 4Single Choice
What is the minimum storage duration charge for objects transitioned to S3 Standard-IA?
- A30 daysCorrect answer
- B90 days
- C180 days
- DNo minimum
Why this is the answer
S3 Standard-IA has a minimum 30-day storage charge. Objects deleted earlier incur a cost equal to 30 days of storage.
- Question 5Multiple Select
Which two EBS volume types provide baseline performance independent of volume size? (Choose 2)
- Agp3Correct answer
- Bio2 Block Express
- Cst1 (Throughput Optimized HDD)
- Dsc1 (Cold HDD)
Why this is the answer
gp3 provides baseline 3,000 IOPS and 125 MiB/s regardless of size. io2 and HDD types have performance tied to capacity.
- Question 6Interactive
Examine the scenario: A company stores 10 KB log files and wants to archive them after 30 days. Which storage class should they avoid due to per-object overhead?
- AS3 Standard-IACorrect answer
- BS3 Glacier Deep Archive
- CS3 One Zone-IA
- DS3 Glacier Instant Retrieval
Why this is the answer
Standard-IA and One Zone-IA have a minimum 128 KB charge per object, making small objects more expensive than Standard.
- Question 7Single Choice
What is the default baseline IOPS for an Amazon EBS gp3 volume regardless of size?
- A3,000 IOPSCorrect answer
- B16,000 IOPS
- C125 IOPS
- DDepends on volume size
Why this is the answer
gp3 provides 3,000 IOPS baseline and 125 MiB/s throughput, independent of the volume's capacity.
- Question 8Multiple Select
Which two strategies reduce data transfer costs within AWS? (Choose 2)
- AUse VPC Gateway Endpoints for S3Correct answer
- BPlace resources in the same Availability ZoneCorrect answer
- CRoute traffic through a NAT Gateway
- DUse public internet for all transfers
Why this is the answer
VPC endpoints keep traffic within AWS network; same AZ avoids cross-AZ charges; NAT and internet increase costs.
- Question 9Interactive
Review the command: aws budgets create-budget --account-id 123456789012 --budget file://budget.json. What does this AWS service help control?
- ATrack and alert on cost or usageCorrect answer
- BAutomatically scale resources
- CMonitor application performance
- DManage IAM roles
Why this is the answer
AWS Budgets enables you to set cost, usage, or coverage budgets and receive alerts when thresholds are exceeded.
- Question 10Single Choice
Which AWS service provides cost optimization checks for idle resources automatically?
- AAWS Trusted AdvisorCorrect answer
- BAWS Cost Explorer
- CAWS Budgets
- DAWS Compute Optimizer
Why this is the answer
Trusted Advisor includes cost optimization checks that identify idle resources like underutilized EC2 instances and unattached EIPs.
- Question 11Multiple Select
Which two governance controls can prevent cost overruns in AWS? (Choose 2)
- AService Control Policies (SCPs)Correct answer
- BAWS Config rules with remediation
- CAWS Budgets actions
- DAWS Cost Anomaly Detection
Why this is the answer
SCPs prevent actions at the account level; Budget Actions are reactive. Config rules detect but do not prevent unless combined with SCPs.
Design High-Performing Architectures
10 questions in this domain
- Question 12Single Choice
Which AWS service provides a discount of up to 72% in exchange for a one- or three-year commitment to a specific instance family in a region?
- ASavings Plans
- BSpot Instances
- CReserved InstancesCorrect answer
- DOn-Demand Instances
Why this is the answer
Reserved Instances (RIs) provide a significant discount of up to 72% for a one- or three-year commitment to a specific instance family in a region. Savings Plans offer similar discounts but with more flexibility across instance families and services.
- Question 13Multiple Select
Which of the following are valid S3 storage classes that can be used as part of a lifecycle policy to reduce costs? (Select two.)
- AS3 Standard
- BS3 Standard-IACorrect answer
- CS3 One Zone-IACorrect answer
- DS3 Glacier Instant Retrieval
Why this is the answer
S3 Standard-IA and S3 One Zone-IA are both valid storage classes that can be transitioned to via lifecycle policies. S3 Glacier Instant Retrieval is also valid, but the question asks for two classes; Standard-IA and One Zone-IA are correct examples. S3 Standard is the default class, not typically used as a cost-saving transition target.
- Question 14Interactive
You have a set of log files stored in an S3 bucket. The logs are accessed frequently for the first 30 days, then rarely afterward. You want to minimize storage costs without losing immediate access to older logs. Based on the AWS documentation, which S3 storage class should you transition the logs to after 30 days? The lifecycle policy configuration is shown below.
- AS3 Glacier Deep Archive
- BS3 Glacier Flexible Retrieval
- CS3 Standard-IACorrect answer
- DS3 One Zone-IA
Why this is the answer
S3 Standard-IA is designed for data that is accessed less frequently but requires rapid access when needed. It offers lower storage cost than S3 Standard and immediate retrieval. Glacier classes have retrieval delays, which do not meet the requirement for immediate access.
- Question 15Single Choice
Which AWS service provides static Anycast IP addresses to route traffic to the nearest healthy endpoint using the AWS global network?
- AAmazon CloudFront
- BAWS Global AcceleratorCorrect answer
- CAWS Direct Connect
- DAWS Transit Gateway
Why this is the answer
AWS Global Accelerator uses two static Anycast IP addresses and routes user traffic over the AWS global network to the nearest healthy endpoint, offering low latency and fast failover. CloudFront provides domain names and caches content; it does not offer fixed Anycast IPs.
- Question 16Multiple Select
Which of the following statements about VPC peering are accurate? (Select two.)
- AVPC peering supports transitive routing across multiple peered VPCs.
- BVPC peering creates a direct, one-to-one connection between two VPCs.Correct answer
- CVPC peering can route traffic between VPCs in different AWS Regions.Correct answer
- DVPC peering allows you to route traffic through a third VPC to reach another VPC.
Why this is the answer
VPC peering is a one-to-one connection that can be established between VPCs in the same or different regions (inter-region VPC peering). It does not support transitive routing – you cannot route traffic through a third VPC. Route tables must be manually configured.
- Question 17Interactive
You need to connect a corporate data center to AWS with a dedicated, low-latency link that bypasses the public internet. You also require encrypted traffic over this connection. Based on the AWS documentation, which two components must you use together? The configuration block shows a virtual interface and a VPN attachment.
- ADirect Connect private VIF and a VPN connection over the VIFCorrect answer
- BDirect Connect public VIF and a VPN connection
- CSite-to-Site VPN over the internet and Direct Connect public VIF
- DDirect Connect private VIF and a transit gateway attachment
Why this is the answer
To have a dedicated link plus encryption, you use a Direct Connect private virtual interface (VIF) to provide a private path into AWS, then create an IPsec VPN tunnel over that private VIF. A public VIF only provides access to AWS public services and does not encrypt traffic.
- Question 18Single Choice
Which AWS service is purpose-built for real-time, low-latency data ingestion with per-record processing and custom consumer logic?
- AAmazon Kinesis Data Firehose
- BAmazon Kinesis Data StreamsCorrect answer
- CAWS Glue Streaming
- DAmazon Managed Streaming for Apache Kafka (MSK)
Why this is the answer
Amazon Kinesis Data Streams provides real-time ingestion with custom consumers (e.g., Lambda, KCL) for per-record, low-latency processing. Data Firehose is for near-real-time delivery without custom consumption. Glue Streaming and MSK are different services.
- Question 19Multiple Select
Which of the following are valid distribution styles in Amazon Redshift? (Select two.)
- AKEY distributionCorrect answer
- BHASH distribution
- CEVEN distributionCorrect answer
- DRANGE distribution
Why this is the answer
Amazon Redshift supports KEY, EVEN, and ALL distribution styles. KEY distribution places rows with the same key value on the same node. EVEN distributes rows evenly across all nodes. HASH and RANGE are not valid distribution styles in Redshift.
- Question 20Interactive
You are designing a data pipeline that ingests streaming clickstream data. The data must be processed in near-real-time with automatic scaling and minimal code. The output will be written to an S3 bucket. Based on the AWS documentation, which service should you use for ingestion? The code snippet shows a destination configuration.
- AAmazon Kinesis Data Streams
- BAmazon Kinesis Data FirehoseCorrect answer
- CAWS Glue Streaming ETL
- DAmazon MSK
Why this is the answer
Amazon Kinesis Data Firehose is a fully managed service that can ingest streaming data, automatically scale, and deliver to S3 with a configurable buffer interval (e.g., 60 seconds). It does not require custom consumers; transformations can be done via Lambda if needed. Data Streams is for real-time custom consumption, not simple delivery.
- Question 21Single Choice
Which DynamoDB accelerator reduces read latency from milliseconds to microseconds by caching items and query results?
- AAmazon ElastiCache for Redis
- BAmazon CloudFront
- CDAX (DynamoDB Accelerator)Correct answer
- DAmazon DynamoDB DAX is not a real service
Why this is the answer
DAX (DynamoDB Accelerator) is a purpose-built in-memory cache for DynamoDB that reduces read latency to microseconds. ElastiCache can also cache DynamoDB data but is not as tightly integrated. CloudFront caches content at the edge.
Design Resilient Architectures
10 questions in this domain
- Question 22Single Choice
What is the primary purpose of a Multi-AZ deployment for Amazon RDS?
- ASynchronous replication across AWS Regions for disaster recovery
- BAutomated failover to a standby instance in a different Availability Zone within the same regionCorrect answer
- CRead scalability by allowing the standby instance to serve traffic
- DAsynchronous replication to multiple Regions for low-latency reads
Why this is the answer
RDS Multi-AZ provides a synchronous standby replica in a different Availability Zone within the same region. Automatic failover occurs if the primary fails, ensuring high availability. The standby cannot serve reads.
- Question 23Multiple Select
Which of the following are characteristics of DynamoDB Global Tables? (Select TWO)
- ASupports multi-master writes across multiple AWS RegionsCorrect answer
- BProvides synchronous replication for zero data loss
- CReplication is eventually consistent across regionsCorrect answer
- DRequires manual conflict resolution using custom application logic
Why this is the answer
DynamoDB Global Tables are multi-master and offer eventual consistency across regions. Conflict resolution is automatic using 'last writer wins'. Replication is asynchronous, not synchronous.
- Question 24Interactive
Examine the following Terraform configuration for an Auto Scaling group. What does the 'desired_capacity' attribute represent?
- AThe minimum number of instances that must always be running
- BThe initial number of instances the Auto Scaling group launches and maintainsCorrect answer
- CThe maximum number of instances the Auto Scaling group can launch
- DThe number of instances that will be running in each Availability Zone
Why this is the answer
Desired capacity is the target number of instances the Auto Scaling group tries to maintain. It can be adjusted by scaling policies. It is not the minimum or maximum.
- Question 25Single Choice
Which disaster recovery strategy keeps a minimal copy of core services (e.g., database) running in the DR region, with the rest of the environment powered off?
- ABackup and Restore
- BPilot LightCorrect answer
- CWarm Standby
- DMulti-Site Active/Active
Why this is the answer
Pilot Light keeps a small core of persistent data services (like a database) running in the DR region. Other compute resources are not active; they are started only upon failover.
- Question 26Multiple Select
Which of the following are characteristics of Amazon SQS FIFO queues? (Select THREE)
- AGuarantees exactly-once processing, even with multiple consumersCorrect answer
- BProvides first-in-first-out delivery of messagesCorrect answer
- CSupports a throughput of up to 3,000 messages per second with batchingCorrect answer
- DSupports unlimited throughput by adding more consumers
Why this is the answer
FIFO queues guarantee exactly-once processing and preserve message order. Throughput is limited to 3,000 TPS with batching (300 without). Adding more consumers does not increase throughput; that applies to Standard queues.
- Question 27Interactive
Review the CloudFormation snippet below for an RDS instance. What does the 'MultiAZ' parameter set to 'true' accomplish?
- AIt creates a cross-region read replica
- BIt provisions a synchronous standby in a different Availability Zone within the same regionCorrect answer
- CIt enables automated backups across multiple regions
- DIt allows the standby instance to serve read traffic
Why this is the answer
MultiAZ=true creates a synchronous standby in a different AZ within the same region for automatic failover. It does not create read replicas or cross-region capabilities.
- Question 28Single Choice
Which AWS service can be used to achieve sub-second failover across multiple AWS Regions for an Internet-facing application?
- AAmazon Route 53 with failover routing
- BAWS Global AcceleratorCorrect answer
- CApplication Load Balancer with cross-zone load balancing
- DAmazon CloudFront with multiple origins
Why this is the answer
AWS Global Accelerator provides two static anycast IPs that route traffic to healthy region endpoints. It can achieve sub-second failover, faster than DNS-based routing like Route 53 failover (which is limited by TTL and health check intervals).
- Question 29Multiple Select
Which of the following are true about AWS Auto Scaling target tracking policies? (Select TWO)
- AThey automatically adjust the group's desired capacity to keep a target metric at a specified valueCorrect answer
- BThey require the user to define explicit step adjustments based on alarm thresholds
- CThey inherently manage cooldown periods to avoid oscillatory behaviorCorrect answer
- DThey can be used only with CPU utilization metrics
Why this is the answer
Target tracking policies simplify scaling by automatically adjusting capacity to maintain a target metric value. They handle cooldowns automatically. Step scaling requires manual step adjustments. Target tracking works with various metrics like CPU, memory, request count, etc.
- Question 30Interactive
Examine the following Python code snippet that sends a message to an SQS queue. What does the 'MessageGroupId' parameter enforce?
- AIt ensures the message is delivered to a specific consumer only
- BIt groups messages so that all messages in the same group are processed in order and not interleaved with other groupsCorrect answer
- CIt sets the visibility timeout for the message
- DIt enables duplicate suppression across the entire queue
Why this is the answer
MessageGroupId is required for FIFO queues. Messages within the same group are delivered in order and are not interleaved with messages from other groups. This allows multiple consumers to process different groups concurrently while preserving order within a group.
- Question 31Single Choice
What is the typical Recovery Point Objective (RPO) for an Aurora Global Database under normal conditions?
- AZero (synchronous replication)
- BLess than 1 secondCorrect answer
- C5-10 minutes
- D1-5 seconds
Why this is the answer
Aurora Global Database uses asynchronous replication with typical lag under 1 second, so RPO is less than 1 second. It is not zero because replication is not synchronous. RPO can spike during high load or DDL operations.
Design Secure Architectures
11 questions in this domain
- Question 32Single Choice
What is the primary function of a Service Control Policy (SCP) in AWS?
- AGrants permissions to IAM users
- BRestricts permissions at the account levelCorrect answer
- CManages user identities across accounts
- DEncrypts data at rest for services
Why this is the answer
SCPs are permission guardrails that only restrict what IAM policies can allow; they never grant permissions themselves.
- Question 33Multiple Select
Which two statements about Service Control Policies (SCPs) are correct?
- AThey can be applied to the management account.
- BThey only deny or allow actions; they never grant permissions.Correct answer
- CThey grant permissions to IAM roles.
- DThey apply to all principals in an account except the management account.Correct answer
Why this is the answer
SCPs are evaluated before IAM policies. They cannot grant permissions and do not affect the management account.
- Question 34Interactive
Based on the provided key policy, which principal can use this KMS key for encryption?
- AIAM role AdminRole in account 111122223333Correct answer
- BAny user in account 111122223333
- CThe root user of account 111122223333
- DAll IAM users in the organization
Why this is the answer
The key policy explicitly grants kms:Encrypt to the IAM role AdminRole in the specified account.
- Question 35Single Choice
What does AWS Secrets Manager primarily do?
- AStore and rotate database credentials automaticallyCorrect answer
- BCreate encryption keys for S3
- CManage TLS certificates for load balancers
- DMonitor VPC flow logs
Why this is the answer
Secrets Manager securely stores secrets like database credentials and can automatically rotate them using Lambda.
- Question 36Multiple Select
Which two services are supported by Gateway VPC Endpoints?
- AAmazon S3Correct answer
- BAmazon DynamoDBCorrect answer
- CAmazon Kinesis
- DAWS Lambda
Why this is the answer
Only S3 and DynamoDB support Gateway Endpoints; all other AWS services use Interface Endpoints.
- Question 37Interactive
Based on the NACL rule table, which inbound traffic is allowed?
- ASSH on port 22 from 10.0.0.0/16Correct answer
- BHTTP on port 80 from 0.0.0.0/0
- CHTTPS on port 443 from 192.168.0.0/24
- DAll inbound traffic is denied
Why this is the answer
The NACL rule explicitly allows TCP port 22 from the 10.0.0.0/16 range. Other rules deny or do not apply.
- Question 38Single Choice
Which AWS service provides a centralized backup management across services?
- AAWS BackupCorrect answer
- BAmazon S3
- CAWS CloudTrail
- DAWS Config
Why this is the answer
AWS Backup provides a unified console to configure backup plans, set retention, and monitor backups across supported services.
- Question 39Multiple Select
Which two features provide immutability for backups in AWS?
- ABackup Vault LockCorrect answer
- BS3 Object LockCorrect answer
- CS3 Versioning
- DLifecycle policies
Why this is the answer
Backup Vault Lock (for AWS Backup) and S3 Object Lock (for S3 buckets) prevent deletion of backups, ensuring immutability.
- Question 40Interactive
Given the CloudTrail event snippet, what type of event is recorded?
- AManagement eventCorrect answer
- BData event
- CInsight event
- DConfiguration change
Why this is the answer
The event shows 'ec2:RunInstances' which is a management API call, not a data-level operation.
- Question 41Single Choice
Which service provides threat detection using machine learning on AWS?
- AAmazon GuardDutyCorrect answer
- BAWS Config
- CAWS Security Hub
- DAWS CloudTrail
Why this is the answer
GuardDuty uses machine learning and threat intelligence to detect anomalies and malicious behavior from AWS data sources.
- Question 42Multiple Select
Which two are valid methods to enforce least privilege for cross-account access?
- AUse IAM roles instead of IAM usersCorrect answer
- BAttach IAM policies directly to users
- CUse permission boundaries to limit maximum permissionsCorrect answer
- DShare long-term access keys
Why this is the answer
Roles with trust policies and permission boundaries are used to delegate least-privilege access without long-term credentials.
Frequently asked questions
Everything about the AWS Certified Solutions Architect – Professional question bank and how to use it.