Practice Questions

Question 1

A financial services company is modernizing their legacy batch processing system that handles daily transaction reconciliation reports. The current system uses a central coordinator server that distributes reconciliation tasks to multiple processing workers. The workload varies significantly - during month-end periods, processing volume can increase by 300%, while weekends see minimal activity. The company needs to migrate this system to AWS with maximum resilience and automatic scaling capabilities to handle the variable workload efficiently while minimizing operational overhead. How should a solutions architect design the architecture to meet these requirements?

Question 2

A global gaming company operates a multiplayer online game platform on AWS. The platform handles millions of concurrent players during peak gaming hours across different time zones. The company needs a scalable, near-real-time solution to share millions of player activity events (scores, achievements, item purchases) with several internal analytics applications. Player events must be processed to mask personally identifiable information (PII) before being stored in a NoSQL database for fast query performance by leaderboard services. What should a solutions architect recommend to meet these requirements?

Question Analysis

Core Concept: This question tests designing a scalable, near-real-time event ingestion and fan-out architecture using streaming services, plus secure data handling (PII masking) before persistence in a low-latency NoSQL store. The key services are Amazon Kinesis Data Streams (real-time streaming and multiple consumers), AWS Lambda (stream processing/transformation), and Amazon DynamoDB (fast key-value/NoSQL queries for leaderboards). Why the Answer is Correct: Option C best matches all requirements: (1) ingest millions of concurrent player events with elastic throughput, (2) share the same event stream with several internal analytics applications in near real time, and (3) ensure PII is masked before storing in DynamoDB for fast leaderboard queries. Kinesis Data Streams is purpose-built for high-throughput, low-latency streaming and supports multiple independent consumers reading the same data (fan-out) without building custom distribution. Lambda can be invoked from Kinesis to transform each record (mask/remove PII) and then write sanitized events to DynamoDB. Key AWS Features / Best Practices: - Kinesis Data Streams: shard-based scaling for write/read throughput; retention for replay; enhanced fan-out for dedicated per-consumer throughput and low latency. - Lambda + Kinesis integration: event source mapping with batching, retries, and checkpointing; use idempotent writes to DynamoDB to handle retries safely. - DynamoDB: on-demand capacity or auto scaling to handle variable peak loads; partition key design for leaderboard access patterns; optional DynamoDB Streams for downstream change capture (but not required here). - Security: mask PII in the stream processing layer before persistence; apply least-privilege IAM and consider encryption at rest (KMS) for Kinesis and DynamoDB. Common Misconceptions: A seems attractive because DynamoDB Streams can publish changes, but it is not designed as the primary high-throughput ingestion and multi-consumer event bus, and “a rule in DynamoDB to remove PII upon write” is not a native DynamoDB feature. B mentions Firehose, but Firehose is primarily a delivery service to destinations like S3/Redshift/OpenSearch; it is not a multi-consumer near-real-time bus, and DynamoDB is not a standard Firehose destination. D relies on S3 batch files, which increases latency and is not near real time. Exam Tips: When you see “millions of events,” “near-real-time,” and “several applications consume the same events,” think Kinesis Data Streams (or MSK) rather than S3 batching or DynamoDB Streams. If the requirement says “mask PII before storing,” place transformation (Lambda/Kinesis Data Analytics) before the database sink. Also verify service capabilities: DynamoDB doesn’t have write-time transformation rules, and Firehose has limited destination/consumer patterns compared to Kinesis Data Streams.

Question 3

A media production company operates a video editing workflow on AWS using Linux-based workstations. Currently, the company uses two Amazon EC2 instances running NFS servers to store project files, raw footage, and rendered videos. The NFS servers replicate data between each other to ensure redundancy. The creative team requires seamless access to shared storage across multiple editing workstations without changing their current workflow. The company needs a highly available and durable storage solution that maintains the current file access patterns used by the editing workstations. What should a solutions architect recommend to meet these requirements?

Question Analysis

Core Concept: This question tests selecting a managed, highly available shared file system that preserves existing POSIX/NFS file access patterns for Linux workstations. The key requirement is “seamless access to shared storage” without workflow changes, plus high availability and durability. Why the Answer is Correct: Amazon EFS is a fully managed NFS file system designed for multiple Linux clients to mount concurrently. It eliminates the operational burden and fragility of self-managed NFS servers on EC2 (patching, scaling, failover, replication logic). EFS stores data redundantly across multiple Availability Zones within a Region, providing high durability and availability by design. Because clients mount EFS over NFS (v4.x), the editing workstations can continue using the same shared-file workflow and file semantics. Key AWS Features: EFS supports NFS mounts from many EC2 instances and workstations in a VPC, elastic capacity (no pre-provisioning), and Multi-AZ resilience as a regional service. Use mount targets in each AZ for high availability and low-latency access. Choose EFS Standard storage class for frequently accessed media; optionally enable lifecycle management to transition colder content to EFS Infrequent Access. For security, use security groups, IAM authorization for EFS, and encryption at rest/in transit. Common Misconceptions: S3 is highly durable but is object storage, not a POSIX/NFS file system; moving to S3 typically requires application/workflow changes (different APIs, semantics, and tooling). Storage Gateway File Gateway is primarily for hybrid/on-premises caching and does not make EC2-hosted NFS servers “highly available” by itself; it also introduces an extra layer and is not the simplest fit for in-AWS shared storage. FSx for Lustre is a high-performance parallel file system, but it is not the default choice for “keep NFS workflow” and “high availability/durability” without additional complexity; also, “cross-AZ replication” is not a standard configuration knob in the way implied. Exam Tips: When you see “Linux shared file storage,” “NFS,” “multiple clients,” and “no workflow changes,” default to EFS. Use FSx for Lustre when the question emphasizes HPC/throughput/parallel I/O and tight integration with S3 for scratch or compute-heavy pipelines. Use S3 when object storage semantics are acceptable. Use Storage Gateway primarily for hybrid connectivity to AWS storage from on-premises environments.

Question 4

A healthcare technology startup is developing a telemedicine platform that handles sensitive patient medical records and prescription data. The platform allows patients to schedule appointments, upload medical documents, and receive electronic prescriptions from licensed physicians. The company must comply with HIPAA regulations and ensure that sensitive patient data remains protected even from system administrators and database operators. The platform needs to support real-time patient consultations with 99.9% uptime while maintaining strict data confidentiality. Which solution meets these requirements?

Question 5

A consulting firm uses AWS Organizations to manage multiple AWS accounts for its clients. The firm needs to audit IAM user permissions to identify over-privileged users. The solution must review all IAM permissions with minimal administrative overhead. Which solution will meet these requirements with the LEAST administrative overhead?

Question Analysis

Core Concept: This question tests how to audit and continuously review IAM permissions across multiple AWS accounts in an AWS Organizations environment with minimal operational effort. The key service is IAM Access Analyzer (part of IAM), which helps identify unintended or overly broad access by analyzing policies and access paths. Why the Answer is Correct: AWS IAM Access Analyzer is designed to help you understand who has access to what, and to identify overly permissive access. For auditing over-privileged IAM users, the most relevant capability is Access Analyzer’s policy analysis and findings (including checks for broad principals, external access, and guidance for policy refinement) and its integration with AWS Organizations for multi-account visibility. It is a managed capability that reduces the need to build custom scripts, aggregate logs manually, or maintain bespoke tooling—therefore meeting the “LEAST administrative overhead” requirement. Key AWS Features: - Organization-wide analyzers: You can create an analyzer that covers an entire organization (or specific accounts), centralizing findings. - Policy validation and analysis: Access Analyzer can analyze IAM policies (identity-based and resource-based) to highlight risky patterns and help refine permissions. - Continuous monitoring: Findings update as policies change, supporting ongoing audits rather than one-time reviews. - Security best practice alignment: Supports least privilege by identifying broad access and helping tighten policies. Common Misconceptions: A common trap is confusing Network Access Analyzer with IAM permission auditing. Network Access Analyzer focuses on network reachability (VPC routing, security groups, NACLs) rather than IAM authorization. Another misconception is thinking CloudWatch alarms on activity equate to permission audits; activity monitoring does not reveal whether permissions are excessive. Amazon Inspector is for vulnerability management (EC2, ECR, Lambda) and does not audit IAM privilege scope. Exam Tips: When you see “audit IAM permissions,” “over-privileged users,” and “minimal overhead,” look for managed IAM governance tools: IAM Access Analyzer (and in broader contexts, IAM Access Advisor/last accessed info, IAM Identity Center, or AWS Config rules). Distinguish between identity authorization (IAM) and network reachability (VPC/network analyzers). Choose services that natively support AWS Organizations for multi-account scale.

Want to practice all questions on the go?

Download Cloud Pass for free — includes practice tests, progress tracking & more.

Question 6

A global media company 'WorldNews' has reporters located all over the world who need to send live broadcasts to a broadcast system hosted on AWS in the us-east-1 Region. The reporters use software on their mobile phones to send live streams through the Real-Time Messaging Protocol (RTMP). The quality of the streams is inconsistent due to network latency and congestion from various geographical locations. A solutions architect must design a solution that provides the reporters with the ability to send the highest quality streams by accelerating their TCP connections back to the broadcast system, regardless of their location. What should the solutions architect use to meet these requirements?

Question 7

(Select 3)

A healthcare technology company needs to process medical imaging data using Amazon Elastic Kubernetes Service (Amazon EKS) clusters and Amazon Aurora databases. Due to strict HIPAA compliance requirements, the processing must occur within their private medical facility. The company plans to implement AWS Outposts to maintain compliance while leveraging AWS services. The solutions architect is collaborating with the company's IT infrastructure team to deploy the medical imaging solution. The team needs to understand their operational responsibilities for the AWS Outposts deployment. Which operational responsibilities belong to the company's IT infrastructure team for the AWS Outposts implementation? (Choose three.)

Question Analysis

Core Concept: This question tests the shared responsibility model for AWS Outposts. Outposts extends AWS infrastructure and services on-premises, but operational ownership is split: AWS owns and operates the Outposts rack hardware and the AWS-managed service control plane components, while the customer owns the on-premises facility requirements (power, space, cooling, physical security) and must architect workloads for resilience within the available Outposts capacity. Why the Answer is Correct: A is correct because the customer must provide and maintain adequate, stable power and network connectivity (uplinks) for the Outposts rack. Without reliable power and network, the Outpost cannot function or connect to the AWS Region for service management. C is correct because physical security of the facility (access controls, surveillance, restricted areas) is the customer’s responsibility. This is especially critical for HIPAA workloads where safeguarding systems that process ePHI includes controlling physical access to infrastructure. F is correct because customers are responsible for workload-level resilience on Outposts. For Amazon EKS on Outposts, the customer must plan capacity headroom and node group sizing to tolerate failures and maintenance events (e.g., N+1 capacity), since Outposts is a finite on-prem pool and AWS cannot automatically “burst” to local hardware that doesn’t exist. Key AWS Features / Best Practices: Outposts requires customer-provided power, cooling, rack space, and network backhaul to the Region. AWS monitors and maintains the Outposts hardware, but customers must design Kubernetes cluster capacity, pod disruption budgets, multi-node group strategies, and scaling policies appropriate to the constrained on-prem footprint. For compliance, customers align facility controls with HIPAA administrative/physical safeguards while leveraging AWS service controls and logging. Common Misconceptions: Many assume AWS manages everything “like a Region.” In reality, AWS manages the Outposts rack hardware and underlying infrastructure, but not the customer’s facility, nor the customer’s application capacity planning. Another trap is thinking the customer replaces failed components; AWS performs hardware break/fix for Outposts. Exam Tips: For Outposts responsibility questions, remember: Customer = site readiness (power/network/space/cooling), physical security, and workload architecture/capacity planning. AWS = delivery/installation, hardware ownership, hardware maintenance, and management of the Outposts infrastructure layer and supported AWS service components.

Question 8

A video streaming platform operates a fleet of Amazon EC2 instances distributed across multiple Availability Zones to handle video transcoding workloads. The instances are managed by an Amazon EC2 Auto Scaling group and receive traffic through a Network Load Balancer. Performance testing shows that the video transcoding quality and processing speed are optimal when EC2 instances maintain CPU utilization between 35-45%, with 42% being the ideal target. What should a solutions architect recommend to automatically maintain the optimal CPU utilization across all instances in the Auto Scaling group?

Question 9

A biotechnology research institute needs to implement high performance computing (HPC) infrastructure on AWS for genomic sequencing analysis. The institute's HPC workloads operate on Linux-based systems. Each genomic analysis workflow utilizes hundreds of Amazon EC2 Spot Instances, completes within 2-6 hours, and produces thousands of sequence data files that must be stored in persistent storage for collaborative research and regulatory compliance over 10+ years. The institute requires a cloud storage solution that enables transfer of existing genomic datasets from on-premises storage to long-term persistent cloud storage, making data accessible for processing by all EC2 instances. The solution must provide a high-performance file system integrated with persistent storage for reading reference genomes and writing analysis output files with low latency. Which combination of AWS services meets these requirements?

Question 10

A game development studio, GameCraft, uses two AWS accounts: a 'Sandbox' account for development and a 'Production' account for live games. The studio needs to deploy new game updates from the Sandbox account to the Production account. Initially, only a few senior engineers in the development team need access to the Production account. Over time, more engineers will require temporary access for testing. Which solution provides secure and scalable cross-account access for the engineers?

Practice Test #8

Triple AI-Verified Answers & Explanations

Practice Questions

Success Stories(29)

Other Practice Tests

Practice Test #1

Practice Test #2

Practice Test #3

Practice Test #4

Practice Test #5

Practice Test #6

Practice Test #7

Practice Test #9

Practice Test #10

Start Practicing Now