Ten questions at a time, drawn from 120. Every answer is explained. Nothing is saved and no account is needed.
If your application requires high availability and needs to survive the failure of an entire data center, what is the best architectural approach?
Practice quiz for AWS. Scores are not saved.
If your application requires high availability and needs to survive the failure of an entire data center, what is the best architectural approach?
Answer: Distribute resources across multiple Availability Zones within the same Region.. Deploying across multiple Availability Zones provides fault tolerance because they are isolated from each other. The first option creates a single point of failure. The third option ignores availability for speed, and the fourth option fails to provide geographic or logical isolation.
From lesson: AWS Overview and Global Infrastructure
Which of the following best describes the relationship between AWS Regions and Availability Zones?
Answer: An AWS Region consists of at least two isolated Availability Zones.. Regions are geographic areas, and each contains multiple physically separated Availability Zones. The first option is incorrect because AZs are bound to a single region. The third reverses the hierarchy, and the fourth ignores that AZs are designed specifically to be isolated failures domains.
From lesson: AWS Overview and Global Infrastructure
Why would an organization choose to use Amazon CloudFront?
Answer: To cache content at Edge Locations for faster delivery to end-users.. CloudFront uses Edge Locations to cache content globally, reducing latency. The first option describes Direct Connect. The second is the opposite of the service goal, and the fourth describes security functionality within a VPC.
From lesson: AWS Overview and Global Infrastructure
A developer needs to deploy a global application that uses a service that is 'Global' rather than 'Regional'. Which service fits this description?
Answer: AWS Identity and Access Management (IAM). IAM is a global service because it manages identities across the entire account regardless of region. EC2 and RDS are regional. While S3 buckets are created in a region, the management of the S3 service involves global endpoints, but IAM is the canonical example of a strictly global service.
From lesson: AWS Overview and Global Infrastructure
How does AWS provide fault tolerance at the infrastructure level?
Answer: By separating infrastructure into Regions and Availability Zones.. AWS uses the Region/AZ model to allow customers to build resilient architectures. Single-location models are not fault-tolerant, users do not build their own data centers in AWS, and single-cable dependency would be a major vulnerability.
From lesson: AWS Overview and Global Infrastructure
An application running on an EC2 instance needs to read objects from an S3 bucket. What is the most secure way to grant this access?
Answer: Attach an IAM Role with an S3 read policy to the EC2 instance.. Attaching an IAM Role is the most secure method because it provides temporary, automatically rotated credentials. Storing keys in code is a major security risk. Public access is insecure, and IP-based ACLs are not a robust mechanism for AWS service authorization.
From lesson: IAM — Users, Roles, and Policies
A developer needs to temporarily access a resource in a different AWS account. Which IAM feature should be used?
Answer: IAM Role. IAM Roles are designed for cross-account access through a mechanism called 'Role Assumption'. Groups are for organizing users, users are for persistent identity, and policy versioning tracks changes to permissions, none of which facilitate cross-account trust.
From lesson: IAM — Users, Roles, and Policies
What is the result of an explicit 'Deny' statement in an IAM policy?
Answer: It always takes precedence over any 'Allow' statement.. In the AWS policy evaluation logic, an explicit Deny always overrides an Allow. Options ignoring the Deny or making it secondary are incorrect because security-focused Deny statements are absolute.
From lesson: IAM — Users, Roles, and Policies
How does the 'Principle of Least Privilege' apply to IAM policy design?
Answer: Providing users with access to only the resources necessary to perform their specific tasks.. Least privilege means granting only the minimum permissions required. Broad access is the opposite of the principle. Restricting only to console access is arbitrary, and removing all policies prevents any productive work.
From lesson: IAM — Users, Roles, and Policies
What happens when an IAM user is deleted?
Answer: The user loses all access to the AWS account immediately.. Deleting an IAM user immediately revokes their authentication and authorization credentials. Resources are independent of user existence, passwords are not kept, and roles are distinct entities that are not bound to the lifespan of a specific user.
From lesson: IAM — Users, Roles, and Policies
An application requires immediate access to data, but the data is rarely accessed after 30 days. Which strategy minimizes costs while maintaining performance?
Answer: Store data in S3 Standard and use lifecycle rules to transition to S3 Standard-IA after 30 days.. S3 Standard-IA is designed for data that is infrequently accessed but requires rapid retrieval, making it the most cost-effective transition. Option 0 loses data; option 2 increases cost/latency unnecessarily for the initial period; option 3 is manually intensive and error-prone.
From lesson: S3 — Storage, Lifecycle, and Versioning
What happens when you issue a DELETE request on an object in a version-enabled bucket without specifying a version ID?
Answer: A delete marker is created, hiding the current version.. In version-enabled buckets, a standard DELETE request creates a delete marker, which makes the object appear deleted to simple GET requests. Option 0 and 3 are incorrect because versioned objects remain until specifically deleted by ID. Option 1 is incorrect because the request is valid.
From lesson: S3 — Storage, Lifecycle, and Versioning
You have a bucket with versioning enabled. You want to ensure that even a root user cannot permanently delete an object version by accident. What should you add?
Answer: MFA Delete. MFA Delete requires a physical security device to authorize the permanent deletion of a version, adding a layer of protection that policies alone cannot provide against compromised root credentials. Policies can be modified, and tags do not restrict API calls.
From lesson: S3 — Storage, Lifecycle, and Versioning
A developer is concerned about storage costs for large files that are frequently uploaded but often fail during the process. Which lifecycle rule is most effective?
Answer: Abort incomplete multipart uploads. Aborting incomplete multipart uploads clears the partial data chunks that accrue storage charges and are otherwise invisible in the console. The other options do not address the specific issue of failed multipart upload segments.
From lesson: S3 — Storage, Lifecycle, and Versioning
If you want to move objects to Glacier but need to ensure the policy applies only to objects older than 90 days, how does S3 calculate the date?
Answer: Based on the object creation date or last modified date.. Lifecycle rules calculate age based on the object's creation timestamp or the last modified timestamp. It does not rely on the console access, the time of policy creation, or ad-hoc user requests.
From lesson: S3 — Storage, Lifecycle, and Versioning
An application on an EC2 instance needs to persist data even if the instance is stopped. Which storage option should be used?
Answer: EBS Volume. EBS volumes are persistent network-attached storage that survive instance stops. Instance Store, RAM disks, and Ephemeral storage are all cleared when an instance is stopped or terminated, making them unsuitable for persistent data.
From lesson: EC2 — Instances, AMIs, and Auto Scaling
What is the primary difference between a 'Stop' and a 'Terminate' action on an EC2 instance?
Answer: Stop keeps the EBS volume; Terminate deletes it. When you terminate an instance, the associated EBS volumes are deleted by default, whereas stopping an instance preserves the root EBS volume and data. Terminated instances cannot be restarted, making the 'Stop' action the correct choice for temporary suspension.
From lesson: EC2 — Instances, AMIs, and Auto Scaling
You have a fleet of instances behind an Auto Scaling Group. You need to ensure that an instance is replaced if the web server process hangs, even if the EC2 status check passes. How do you achieve this?
Answer: Configure Auto Scaling to use ELB health checks. ELB health checks look at the application layer, allowing Auto Scaling to detect if a service is unresponsive. EC2 health checks only check hardware status, and termination protection or cooldown settings do not provide application-level monitoring.
From lesson: EC2 — Instances, AMIs, and Auto Scaling
An AMI has been created in the us-east-1 region. A developer in eu-west-1 cannot see this AMI to launch instances. Why?
Answer: AMIs are region-locked and must be copied to the new region. AMIs are region-bound resources. To use them in a different region, the 'Copy AMI' action must be performed to replicate the image metadata and data to the target region. IAM roles and S3 conversion are not the mechanisms for region-to-region sharing.
From lesson: EC2 — Instances, AMIs, and Auto Scaling
Which Auto Scaling policy type is best suited for maintaining an average CPU utilization of 50% across a group of instances?
Answer: Target Tracking Scaling. Target Tracking Scaling is designed specifically to maintain a defined metric (like average CPU) at a target value by adjusting capacity automatically. Manual, scheduled, and step scaling require static definitions or fixed rules rather than dynamic adjustment to a specific target metric.
From lesson: EC2 — Instances, AMIs, and Auto Scaling
A web server in a private subnet needs to download security patches from the internet. Which component must be configured to allow this while keeping the instance private?
Answer: NAT Gateway. A NAT Gateway allows instances in private subnets to reach the internet while blocking unsolicited inbound connections. An IGW is for public subnets, an Egress-only gateway is for IPv6, and a VPG is for VPN connections.
From lesson: VPC — Networking Fundamentals
You have a security group with an inbound rule allowing port 80. You notice that traffic is being blocked. Why might this happen?
Answer: The Network ACL associated with the subnet has a deny rule for port 80.. NACLs are evaluated before Security Groups. If an NACL denies the traffic, the Security Group setting is ignored. Security Groups are stateful (option B is false), instances do not need public IPs for internal security (option C is false), and return traffic is automatic for SGs (option D is false).
From lesson: VPC — Networking Fundamentals
Two instances in the same VPC but different subnets cannot communicate, despite both being in the same security group. What is the most likely cause?
Answer: The Network ACL is blocking the communication.. Subnets within the same VPC can communicate by default via the local route. NACLs are the only component that can block this intra-VPC traffic. The Route Table is not needed for internal traffic (option A), and an IGW is for external traffic (option B).
From lesson: VPC — Networking Fundamentals
You are designing a VPC and need to ensure that your database tier is not accessible from the internet, even if a resource is accidentally assigned a public IP. How can you best enforce this?
Answer: Place the database in a subnet with no route to an Internet Gateway.. Without a route to an IGW, a subnet is physically incapable of reaching or being reached by the internet. Security groups cannot 'deny' traffic (option B), an Egress-only gateway is for IPv6 (option C), and DNS settings do not restrict routing (option D).
From lesson: VPC — Networking Fundamentals
What happens when you add an instance to a Security Group?
Answer: The instance's rules are the union of all security groups it is assigned to.. Security groups are additive; the effective policy is the union of all rules from all assigned groups. You can assign multiple groups (option B is false), rules are cumulative (option A is false), and changes take effect immediately without a reboot (option D is false).
From lesson: VPC — Networking Fundamentals
An application processes image uploads via S3. If the Lambda function times out, it should be retried. What determines the retry behavior for this synchronous invocation?
Answer: The calling service (S3) is responsible for handling retries based on its own configuration.. Synchronous invocations are handled by the caller; S3 invokes the function and waits for a response. If it fails, the service calling it decides the retry policy. Option 0 is wrong because there is no infinite retry. Option 2 is wrong because Lambda does not retry synchronous requests. Option 3 is wrong because this is a function of the service, not the function settings.
From lesson: Lambda — Serverless Functions
A developer needs to share a common library across multiple Lambda functions to reduce deployment package size. Which AWS feature is best suited for this?
Answer: Lambda Layers. Layers allow you to package libraries and dependencies separately and import them into multiple functions. Environment variables (0) only store key-value data. VPC Endpoints (2) manage network traffic, not code sharing. Step Functions (3) coordinate workflows, not shared libraries.
From lesson: Lambda — Serverless Functions
What happens to the code defined outside the Lambda handler function when the execution environment is reused?
Answer: It persists in memory, allowing for connection reuse.. Code outside the handler executes during the 'init' phase and persists across warm starts. Option 0 describes code inside the handler. Option 1 and 3 are incorrect because the container environment is cached to improve performance.
From lesson: Lambda — Serverless Functions
Which of the following is the most efficient way to grant a Lambda function access to write logs to CloudWatch?
Answer: Attaching an IAM role with the specific 'logs:CreateLogGroup' and 'logs:PutLogEvents' permissions.. Principle of least privilege requires granting only specific actions. AdministratorAccess (0) is a security risk. Security groups (2) are for network traffic, not identity authorization. Hardcoding credentials (3) is insecure and against AWS best practices.
From lesson: Lambda — Serverless Functions
How does Lambda scale when it receives multiple simultaneous requests?
Answer: It scales by spawning new execution environments as needed up to the account concurrency limit.. Lambda scales horizontally by creating separate execution environments for concurrent events. It does not scale vertically (memory) for concurrency (2). Queuing (3) is not the default behavior for scaling. Instances are isolated (0), not shared in one environment.
From lesson: Lambda — Serverless Functions
An application requires specific request validation before reaching the backend integration. Which feature should be used?
Answer: Request Models and Validators. Request Models and Validators enforce strict JSON schemas. Stage variables allow environment-specific configs, Binary Media Types handle non-text data, and Caching optimizes performance; none of the others validate incoming request structures.
From lesson: API Gateway
A developer needs to expose a legacy backend service via an API, but the service requires dynamic path routing. What is the best approach?
Answer: Use a Proxy Resource with a greedy path parameter. A proxy resource with a greedy path variable ({proxy+}) captures all incoming requests under a base path and forwards them to the backend. Hardcoding is inefficient; CORS handles security headers, and Authorizers handle identity, not routing.
From lesson: API Gateway
How can you securely pass credentials to a backend service that API Gateway does not manage directly?
Answer: Use an API Gateway Private Integration with Secrets Manager. Private Integrations allow secure communication via VPC Links. Using Secrets Manager via a Lambda or direct integration is secure. API Keys identify clients, not backend secrets; URL query strings are insecure, and Authorizers are for client validation, not backend secret storage.
From lesson: API Gateway
Your API is receiving a 429 Too Many Requests error. What is the most likely cause?
Answer: The request has exceeded the configured Throttling limits. HTTP 429 indicates that the request rate exceeds the defined throttling limits. Timeouts result in 504 errors, CORS issues result in 403 or 405 errors, and expired tokens result in 401 Unauthorized responses.
From lesson: API Gateway
Why would you choose a REST API over an HTTP API in API Gateway?
Answer: REST APIs offer advanced features like Request Validation, WAF support, and private endpoints. REST APIs offer deep integration features like request validation, usage plans, and WAF integration. HTTP APIs are faster and cheaper but lack those advanced controls. Both support Lambda, and HTTP API is actually the recommended default for most modern serverless needs.
From lesson: API Gateway
An application requires direct access to the underlying EC2 host's network namespace for custom packet processing. Which ECS launch type should be selected?
Answer: EC2. EC2 launch type allows control over the underlying instance, supporting host networking. Fargate isolates containers in a managed environment that prevents host network access. EKS Fargate and App Runner also hide the host networking layer.
From lesson: ECS and EKS — Containers on AWS
A developer needs to ensure that pods in an EKS cluster have granular access to S3 buckets without assigning an IAM role to the underlying worker nodes. What is the recommended approach?
Answer: Use IAM Roles for Service Accounts (IRSA). IRSA allows specific Kubernetes service accounts to assume IAM roles, providing fine-grained access. Hardcoding credentials is a security risk; attaching profiles to nodes violates least privilege; CSI drivers are for secrets, not IAM permission mapping.
From lesson: ECS and EKS — Containers on AWS
In ECS, what occurs when a container marked as 'essential' fails its health check?
Answer: The entire task is stopped and restarted. If any container marked as 'essential' in an ECS task fails, the entire task is stopped. Containers aren't restarted in isolation within the same task. The task is not automatically migrated across AZs, but the service scheduler will attempt to launch a new task.
From lesson: ECS and EKS — Containers on AWS
Why would an administrator choose EKS over ECS for a containerized application?
Answer: EKS provides better integration with native Kubernetes tools and ecosystem. EKS is chosen for its compatibility with the standard Kubernetes API and ecosystem. It is not necessarily cheaper or faster. ECS supports Docker images, and EKS (excluding Fargate) still requires managing node groups.
From lesson: ECS and EKS — Containers on AWS
Which component in EKS is responsible for automatically adjusting the number of nodes in a managed node group based on pod resource requirements?
Answer: Cluster Autoscaler. The Cluster Autoscaler monitors for unschedulable pods and adds nodes as needed. The Horizontal Pod Autoscaler adjusts the number of pods, not nodes. The Load Balancer Controller manages ingress, and CoreDNS is for service discovery.
From lesson: ECS and EKS — Containers on AWS
When you need to perform custom configuration, such as installing specific OS packages or setting up cron jobs on your EC2 instances within an Elastic Beanstalk environment, what is the best approach?
Answer: Include .ebextensions YAML configuration files in your application source bundle.. .ebextensions allow for automated, repeatable configuration changes during the provisioning process. Option 0 is inefficient for frequent updates, option 2 is not persistent, and option 3 is not a native Elastic Beanstalk feature.
From lesson: Elastic Beanstalk
Your application experiences a spike in traffic, and you notice your Elastic Beanstalk instances are struggling. Which architectural feature best ensures high availability and scalability?
Answer: Using a Load Balanced environment type with a defined Auto Scaling Group policy.. A Load Balanced environment provides an Auto Scaling Group and an ELB, which are essential for horizontal scaling. Option 0 is a single point of failure, option 1 does not scale, and option 3 does not address automatic scaling or traffic distribution.
From lesson: Elastic Beanstalk
How does Elastic Beanstalk handle an 'All-at-once' deployment compared to a 'Rolling' deployment?
Answer: All-at-once updates all instances simultaneously, causing potential downtime, whereas Rolling updates instances in batches.. All-at-once replaces code on all instances at the same time, leading to temporary downtime. Rolling deployments update in batches, maintaining capacity. The other options misstate the nature of the deployment strategies.
From lesson: Elastic Beanstalk
What is the primary function of the 'Environment Properties' in the Elastic Beanstalk console?
Answer: To manage application-level configuration without needing to change source code.. Environment properties are essentially environment variables that allow you to inject configuration into your application dynamically. Hardware specs, billing, and scaling thresholds are handled in separate configuration tabs or sections.
From lesson: Elastic Beanstalk
If you need to ensure zero downtime during a deployment and be able to roll back instantly if the new version fails, which deployment policy should you choose?
Answer: Immutable deployment.. Immutable deployments create an entirely new set of instances with the new version alongside the old ones; if the new ones fail, the old ones are still running. Rolling with additional batch doesn't provide the same isolation, all-at-once causes downtime, and traffic splitting is a different strategy (Canary).
From lesson: Elastic Beanstalk
An application requires high availability and needs to perform complex analytical queries without impacting transactional performance. Which architecture should be implemented?
Answer: RDS Multi-AZ with Read Replicas. Multi-AZ provides the necessary failover capabilities, and Read Replicas allow offloading analytical queries. The other options either fail to address high availability or don't provide a way to separate read and write workloads.
From lesson: RDS and Aurora
What is the primary architectural difference between standard RDS MySQL and Amazon Aurora?
Answer: Aurora uses a shared-storage, distributed architecture independent of compute. Aurora utilizes a distributed, fault-tolerant, self-healing storage system that abstracts the storage layer from the compute layer, unlike standard RDS which relies on local instance storage. The other options are factually incorrect regarding database support.
From lesson: RDS and Aurora
A developer needs to ensure that an RDS database remains available even if an entire Availability Zone fails. What is the most cost-effective configuration?
Answer: Enable Multi-AZ. Multi-AZ creates a synchronous standby copy in a different AZ, allowing automatic failover. Regional replicas are for latency or DR, not AZ failure. Snapshots and instance sizes do not provide automatic failover.
From lesson: RDS and Aurora
When using Amazon Aurora, what happens to the Read Replicas during a master instance failover?
Answer: One of the Read Replicas is automatically promoted to the new primary instance. Aurora high availability features allow for the automatic promotion of an existing Read Replica to the primary role during failover to minimize downtime. The other options describe manual or incorrect procedures.
From lesson: RDS and Aurora
Which RDS feature is best suited for migrating data from an on-premises database to AWS with minimal downtime?
Answer: AWS Database Migration Service (DMS). AWS DMS is specifically designed to perform migrations with ongoing replication, minimizing application downtime. Snapshots, Read Replicas, and Multi-AZ are operational features for existing RDS instances, not migration tools.
From lesson: RDS and Aurora
An application requires high-speed access to individual user sessions by SessionID. Which design pattern ensures the best performance and cost-efficiency?
Answer: Create a table with SessionID as the Partition Key.. Using the SessionID as the Partition Key allows direct, O(1) access to the item. Scanning is inefficient, GSI is unnecessary overhead for primary lookups, and storing everything in one item hits the 400KB limit.
From lesson: DynamoDB — NoSQL on AWS
A table experiences throttling during peak hours even though the consumed throughput is below the provisioned limit. What is the most likely cause?
Answer: The workload is creating a hot partition due to uneven key distribution.. Throttling often occurs when a single partition key receives a disproportionate amount of requests, causing it to exceed its specific throughput limit. Read consistency, regional maintenance, and item size do not typically cause partition-specific hot-spot throttling.
From lesson: DynamoDB — NoSQL on AWS
When should you prefer a Query operation over a Scan operation?
Answer: When you have a specific Partition Key and need to retrieve a subset of items efficiently.. Query uses the Partition Key to locate data immediately, whereas Scan traverses the entire table. The other options describe scenarios where Scan might be 'necessary' but not preferred, or they misinterpret the utility of Query.
From lesson: DynamoDB — NoSQL on AWS
Which of the following is true regarding DynamoDB secondary indexes?
Answer: Local Secondary Indexes (LSI) can only be created at the time of table creation.. LSI must be defined when creating a table. GSIs have their own provisioned throughput, can be projected with specific attributes, and LSI must share the same Partition Key as the base table.
From lesson: DynamoDB — NoSQL on AWS
What happens if an item reaches the 400KB limit in DynamoDB?
Answer: The write operation is rejected with a ValidationException.. DynamoDB enforces a strict 400KB limit per item; it will not split, compress, or truncate data, so the write will simply fail. This forces developers to store large data elsewhere, like S3.
From lesson: DynamoDB — NoSQL on AWS
An application requires complex data structures like sorted sets and hashes with a need for persistent storage. Which service should be chosen?
Answer: Redis. Redis supports complex data types and persistence, making it the correct choice. Memcached is a simple key-value store without persistence. DynamoDB DAX is a cache for DynamoDB, and RDS is a relational database.
From lesson: ElastiCache — Redis and Memcached
What is the primary difference between Redis and Memcached regarding high availability?
Answer: Redis supports native replication and automatic failover.. Redis provides native replication and automatic failover via Multi-AZ. Memcached is multi-threaded but lacks native replication and failover features. Redis does not persist to S3.
From lesson: ElastiCache — Redis and Memcached
A developer needs to scale read performance for an existing Redis cluster. What is the most efficient approach?
Answer: Add Read Replicas to the cluster.. Adding Read Replicas is the standard way to scale read traffic in Redis. Multi-AZ is for failover, vertical scaling is costly, and Cluster Mode is for partitioning data, not specifically for read scaling.
From lesson: ElastiCache — Redis and Memcached
Under what scenario would you choose Memcached over Redis?
Answer: When you require a simple, multi-threaded cache with no complex features.. Memcached is preferred for its simplicity and multi-threaded architecture when only simple key-value caching is needed. All other options describe features unique to Redis.
From lesson: ElastiCache — Redis and Memcached
What happens when a Redis cluster reaches its memory limit while the eviction policy is set to 'noeviction'?
Answer: Redis rejects new write commands and returns an error.. With 'noeviction', Redis will reject any write commands that would cause the memory limit to be exceeded. The other options describe different policies or recovery behaviors, none of which occur under 'noeviction'.
From lesson: ElastiCache — Redis and Memcached
An application requires strict message ordering and exactly-once processing. Which configuration should you choose?
Answer: FIFO Queue with individual message group IDs. FIFO Queues support exactly-once processing and ordering; however, ordering is strictly maintained within a MessageGroupId, making it the correct choice. Standard queues do not guarantee order. High throughput mode is an optimization, not a requirement for ordering.
From lesson: SQS — Simple Queue Service
A consumer is processing messages, but the same message is being picked up by multiple workers simultaneously. What is the most likely cause?
Answer: The visibility timeout is too short for the task duration. If a visibility timeout expires before the consumer deletes the message, SQS makes it visible again. Retention period and size do not trigger re-delivery. FIFO queues prevent duplicate processing rather than causing it.
From lesson: SQS — Simple Queue Service
Which mechanism should you implement to handle messages that fail processing repeatedly despite retries?
Answer: Dead Letter Queues. Dead Letter Queues are designed to isolate messages that cannot be processed after a specified number of attempts. Visibility extension is for timing, not failure isolation. Delayed delivery only affects message availability initially.
From lesson: SQS — Simple Queue Service
What is the primary architectural benefit of using SQS between two microservices?
Answer: Decoupling components so they can scale and operate independently. SQS decouples services, allowing them to communicate asynchronously. This prevents one service from crashing if the other is unavailable. It actually introduces network latency and does not provide synchronous consistency.
From lesson: SQS — Simple Queue Service
You need to transmit a 2MB payload using SQS. How can this be accomplished?
Answer: Use the SQS Extended Client Library to store payload in S3 and reference it in SQS. SQS has a hard 256KB limit. The Extended Client Library is the standard pattern for large payloads by storing them in S3. Manually splitting messages increases complexity, and you cannot increase the native SQS limit.
From lesson: SQS — Simple Queue Service
An architect needs to send a message to multiple microservices simultaneously where each service must process every message. Which architecture should be implemented?
Answer: Create an SNS topic and have each microservice subscribe to it via SQS queues.. Using an SNS topic to fan out messages to SQS queues ensures all services receive every message (fan-out pattern). SQS alone would result in competitive consumption where only one service gets the message. Kinesis is for streaming data, not Pub/Sub. Direct HTTP endpoints lack the durability provided by SQS queues.
From lesson: SNS — Simple Notification Service
A developer wants to ensure that messages sent to an SNS topic are delivered in the exact order they were published. What configuration is required?
Answer: Use an SNS FIFO topic and subscribe SQS FIFO queues.. Only SNS FIFO topics support message ordering. Standard topics are designed for best-effort ordering. SQS FIFO queues are the only valid subscriber types for SNS FIFO topics to maintain end-to-end ordering. Kinesis Firehose and delivery delays do not enforce ordering logic.
From lesson: SNS — Simple Notification Service
How can an SNS topic be protected so that only authorized users or services in another AWS account can publish messages to it?
Answer: Apply a Resource-Based Policy on the SNS topic allowing 'sns:Publish' for the external account's ARN.. Resource-Based Policies are the standard way to grant cross-account access to SNS topics. Embedding credentials is a security risk. Signing with a private key is not an SNS feature. IAM roles are for identities, not for allowing access to a specific SNS resource from outside.
From lesson: SNS — Simple Notification Service
Which mechanism does SNS provide to handle transient failures when delivering messages to HTTP endpoints?
Answer: The service uses an exponential backoff retry policy for a specified number of attempts.. SNS implements a built-in exponential backoff retry policy for HTTP/S endpoints to handle transient network issues. It does not use databases, discard immediately (unless configured to), or use manual intervention.
From lesson: SNS — Simple Notification Service
When is it appropriate to use an SNS Filter Policy?
Answer: To allow subscribers to receive only a subset of messages published to a topic.. Filter Policies allow subscribers to define criteria based on message attributes, receiving only relevant messages. This prevents the need to create separate topics for different message types. The other options are related to rate limiting, transformation, or encryption, none of which are functions of Filter Policies.
From lesson: SNS — Simple Notification Service
An architect wants to route events from different AWS accounts to a central security account. Which mechanism is most appropriate?
Answer: Configure cross-account event buses with specific resource-based policies. EventBridge natively supports cross-account event routing via custom buses and resource policies. Using IAM credentials is a security risk. S3 log aggregation is for audit, not event-driven routing. Polling is inefficient and violates the push-based nature of EventBridge.
From lesson: EventBridge
You have a rule matching S3 object creation events. Why might some events fail to reach your target?
Answer: The rule lacks permissions to invoke the target, or the target has reached its concurrency limit. EventBridge needs resource-based permissions to trigger targets like Lambda. If the target reaches its concurrency limit, the invocation will fail. The other options are incorrect because S3 events are natively integrated, and the throughput limits are much higher.
From lesson: EventBridge
What is the primary benefit of using Input Transformers in an EventBridge rule?
Answer: To convert the raw event into a specific format required by the downstream target. Input Transformers allow you to map or transform the event JSON structure into the specific payload format your target expects. They do not perform filtering, encryption, or speed optimization.
From lesson: EventBridge
When a target is down, how does EventBridge handle event delivery?
Answer: It retries for 24 hours with an exponential backoff strategy. EventBridge provides built-in retry logic that persists for up to 24 hours using exponential backoff. It does not discard immediately, wait indefinitely, or reroute to SQS without explicit configuration of a DLQ.
From lesson: EventBridge
If you need to archive events for long-term analysis and replay them later, what should you configure?
Answer: EventBridge Archives. EventBridge Archives allow you to store events and replay them at a later time. Schemas are for IDE integration, Pipes are for point-to-point integration, and Global Endpoints are for high availability across regions.
From lesson: EventBridge
An AWS Glue ETL job needs to process data stored in an S3 bucket located in a different AWS account. What is the most secure and effective way to grant access?
Answer: Attach an S3 bucket policy to the destination bucket that allows access to the Glue Job's IAM execution role.. Option 3 is correct because it follows the principle of least privilege by modifying the bucket policy to trust the Glue Job role. Option 1 is less standard for Glue. Option 2 is a security risk. Option 4 is impossible as Glue jobs don't persist data locally in that manner.
From lesson: Glue — ETL Service
A developer wants to ensure that a Glue ETL job only processes new data files added since the last run. Which feature should be enabled?
Answer: Job Bookmarks. Job Bookmarks are specifically designed to track state information to prevent redundant processing of data. Crawlers discover metadata, Auto Scaling manages compute resources, and Indexing improves query performance, none of which manage file state between runs.
From lesson: Glue — ETL Service
When configuring an AWS Glue connection to access a database inside a private VPC, what component is strictly required for the Glue job to communicate with the DB?
Answer: An Elastic Network Interface (ENI). An ENI is required to place the Glue job inside the VPC, allowing it to reach private IP addresses. The Data Catalog is for metadata, the S3 endpoint is for S3 traffic only, and IAM Users are not used for VPC networking.
From lesson: Glue — ETL Service
You have a massive dataset in S3 that you need to transform. You are concerned about the cost of keeping the Glue Job running. Which feature should you enable to optimize resource utilization?
Answer: Glue Auto Scaling. Auto Scaling automatically adds or removes workers based on the workload, which is the direct answer for cost optimization. Development Endpoints are for coding environments, Triggers are for scheduling, and Blueprints are for templates.
From lesson: Glue — ETL Service
What is the primary function of the AWS Glue Data Catalog within an ETL pipeline?
Answer: To provide a central repository for metadata and schema definitions.. The Catalog acts as the 'glue' that holds metadata, allowing different services to understand the schema of your data. It does not run transformations, encrypt data (KMS does), or serve as a streaming compute engine (Kinesis does).
From lesson: Glue — ETL Service
Which file format would be most cost-effective for a query that only selects two columns out of a 100-column table stored in S3?
Answer: Parquet. Parquet is a columnar format, allowing Athena to read only the specific columns needed. CSV, JSON, and XML are row-based or semi-structured, requiring Athena to scan more data, which increases query costs.
From lesson: Athena — Serverless SQL on S3
Why does partitioning your S3 data significantly improve Athena query performance?
Answer: It allows Athena to skip reading entire folders of data that do not meet filter criteria.. Partitioning creates a logical structure that enables Athena to use predicate pushdown to ignore non-relevant data. It does not reduce storage, compress files, or change the internal data format.
From lesson: Athena — Serverless SQL on S3
A developer needs to query data using SQL but cannot afford to maintain a database cluster or manage server infrastructure. Which service is best suited for this?
Answer: Amazon Athena. Athena is a serverless query service that runs directly on S3 data. RDS and provisioned Redshift require managing instances and clusters, while ElastiCache is an in-memory store, not a SQL analysis engine for S3.
From lesson: Athena — Serverless SQL on S3
How can you optimize Athena costs when dealing with log files that are currently stored as thousands of individual 10KB JSON files?
Answer: Use an AWS Glue job to consolidate the files into fewer, larger Parquet files.. Consolidating small files into fewer, larger columnar files reduces metadata overhead and read costs. Transfer acceleration helps with uploads, GZIP helps with size but not file count, and more partitions would not solve the small-file overhead.
From lesson: Athena — Serverless SQL on S3
What is the primary benefit of using AWS Glue Data Catalog in conjunction with Amazon Athena?
Answer: It allows for the creation of centralized metadata tables that Athena can reference for schema information.. The Glue Data Catalog stores the metadata, allowing Athena to know the schema and location of data in S3. It is not a storage layer for results, it does not force replication, and it is not a visualization tool.
From lesson: Athena — Serverless SQL on S3
When configuring a SageMaker Training Job, what is the primary benefit of choosing 'Pipe' mode over 'File' mode for data input?
Answer: Pipe mode streams data directly into the training algorithm, reducing startup time and storage overhead. Pipe mode streams data directly from S3, which saves time compared to File mode, where the full dataset must be downloaded before training starts. File mode downloads the full data, while the others are incorrect descriptions of how the data ingress mechanism functions.
From lesson: SageMaker — ML Training and Deployment
A data scientist needs to deploy a model that requires custom inference logic and specific Python dependencies not included in the pre-built SageMaker containers. What is the recommended approach?
Answer: Package the model and code into a custom Docker image and push it to Amazon ECR. For custom dependencies and logic, creating a custom Docker container and hosting it in ECR is the standard best practice. Script mode is an option, but for complex environments, custom containers are more robust. Modifying images via SSH or pointing to S3 buckets for code are not standard SageMaker deployment workflows.
From lesson: SageMaker — ML Training and Deployment
What is the purpose of a SageMaker Endpoint Configuration?
Answer: It defines the production variants, instance types, and autoscaling policies for an endpoint. The Endpoint Configuration defines how the endpoint functions, including traffic distribution (variants) and infrastructure settings. Training jobs define hyperparameters, artifacts are in S3/Model objects, and VPC settings are usually in the CreateTrainingJob call, not the Endpoint Config.
From lesson: SageMaker — ML Training and Deployment
Which SageMaker feature should be used to test a new model version by routing 10% of production traffic to it while keeping 90% on the stable version?
Answer: Production Variants. Production Variants allow you to split traffic across multiple models on a single endpoint. Multi-Model Endpoints serve many models on demand but are for memory efficiency, not traffic splitting. Experiments track metrics, and Pipelines are for workflows.
From lesson: SageMaker — ML Training and Deployment
Why is it recommended to use SageMaker Model Monitor for deployed endpoints?
Answer: To automatically detect data drift and quality issues in production data. Model Monitor tracks data quality and concept drift to alert you when input data deviates from training data. It does not optimize latency, manage OS patches, or automatically trigger retraining (though it can be integrated with Pipelines to do so, that is not its primary function).
From lesson: SageMaker — ML Training and Deployment
Which mechanism in Amazon Bedrock allows an organization to integrate their private data sources with foundation models without full retraining?
Answer: Knowledge Bases for Amazon Bedrock. Knowledge Bases enable RAG (Retrieval-Augmented Generation), allowing models to query private data. Provisioned Throughput is for scaling, Glue is for ETL, and EMR is for big data processing, none of which facilitate RAG.
From lesson: Bedrock — Foundation Models on AWS
When configuring a model for high-volume inference, what is the purpose of Provisioned Throughput in Bedrock?
Answer: To ensure a dedicated amount of model capacity for consistent performance. Provisioned Throughput provides guaranteed capacity for consistent latency. It does not reduce costs (it is typically more expensive), it does not provide internet access, and it does not facilitate model switching.
From lesson: Bedrock — Foundation Models on AWS
How does Bedrock guarantee that customer data used for inference is not used to improve the base foundation models?
Answer: By providing a data privacy guarantee where inputs are not used for base model training. AWS design ensures inputs/outputs are not used to train base models. IAM controls access, KMS encrypts data at rest, and logs are controlled by customer preferences, but they do not define the training privacy policy.
From lesson: Bedrock — Foundation Models on AWS
What is the primary benefit of using Agents for Amazon Bedrock?
Answer: It enables models to execute multi-step tasks by invoking API functions. Agents allow models to orchestrate tasks using APIs. It is serverless (no GPU management), not for training from scratch, and while it might interact with databases, its primary purpose is agentic task automation.
From lesson: Bedrock — Foundation Models on AWS
If you need to ensure that your model responses follow specific brand guidelines and tone, which feature should you implement?
Answer: Prompt engineering with system instructions. System instructions (or system prompts) define the behavior and tone. Evaluation jobs measure quality, cross-region inference handles availability, and embedding models are for vector conversion, not tone control.
From lesson: Bedrock — Foundation Models on AWS
An application requires monitoring of EC2 disk usage, which is not available in standard CloudWatch metrics. How should this be implemented?
Answer: Install the CloudWatch agent on the instance to push custom metrics. Disk usage is an OS-level metric and not exposed by the hypervisor to CloudWatch, so the agent is required. Option 0 only provides standard CPU/Network/Disk IO metrics. Option 2 does not provide disk capacity. Option 3 is not a native service feature.
From lesson: CloudWatch — Monitoring and Alarms
A team needs to perform an automated action when a specific metric threshold is breached. Which service must be used in conjunction with a CloudWatch Alarm to execute the logic?
Answer: Amazon SNS. CloudWatch Alarms use SNS topics to notify users or trigger downstream services like Lambda or SQS. CloudTrail tracks API calls, Config tracks resource compliance, and Systems Manager is for configuration management, not alarm notification routing.
From lesson: CloudWatch — Monitoring and Alarms
Why would an administrator change the 'Evaluation Periods' of an alarm to 3 out of 3 instead of 1 out of 1?
Answer: To prevent flapping or false positives from transient spikes. Increasing the evaluation periods (M of N) ensures the alarm only triggers if the issue persists across multiple periods, reducing noise from momentary spikes. This does not change metric granularity, cost, or the number of metrics checked.
From lesson: CloudWatch — Monitoring and Alarms
What happens to a CloudWatch Alarm that is in an 'ALARM' state when the underlying metric stops reporting data and the 'Treat missing data as' is set to 'ignore'?
Answer: The alarm remains in the ALARM state. If 'ignore' is selected, the alarm maintains its last known state despite the absence of new data points. It does not auto-resolve to OK or switch to insufficient status, nor is it deleted.
From lesson: CloudWatch — Monitoring and Alarms
You have a fleet of 500 EC2 instances and need to aggregate their CPU usage into one dashboard. What is the most efficient way to achieve this?
Answer: Use Metric Math to calculate the average across all instance IDs. Metric Math allows users to perform operations across multiple metrics using a single expression, making it perfect for dashboarding aggregate performance. Individual widgets are unmanageable. Detailed monitoring increases cost without aggregating data. A single alarm on a single instance doesn't represent the aggregate fleet health.
From lesson: CloudWatch — Monitoring and Alarms
A company wants to ensure that all API calls made in their AWS account across all regions are captured for auditing purposes. What is the most efficient way to achieve this?
Answer: Enable a single multi-region trail in the primary region.. A multi-region trail automatically replicates its configuration to all regions and captures activity globally. Creating individual trails is inefficient, CloudWatch does not automatically collect account-wide API calls without a trail, and RAM does not support CloudTrail sharing.
From lesson: CloudTrail — Audit Logging
You have configured a trail to deliver logs to an S3 bucket. You need to ensure that the logs have not been altered or tampered with after they were delivered. Which feature should you enable?
Answer: CloudTrail log file integrity validation. Log file integrity validation uses SHA-256 hashing and RSA digital signatures to verify the log file's authenticity. S3 Object Lock and Versioning protect against deletion, but do not provide cryptographic proof of file content integrity.
From lesson: CloudTrail — Audit Logging
Which of the following activities would be captured by default in a standard CloudTrail management event log?
Answer: Creating a new IAM user via the AWS CLI. Creating an IAM user is a management plane operation (write-only), which is captured by default. Downloading S3 objects, executing Lambda, and reading DynamoDB data are all data plane operations, which must be explicitly configured as data events.
From lesson: CloudTrail — Audit Logging
An auditor requests a report on anomalous API call patterns, such as spikes in unauthorized access attempts. Which CloudTrail feature is best suited for this?
Answer: CloudTrail Insights. CloudTrail Insights analyzes management events to detect unusual API call rates or errors. Event selectors define what to log, and management/data events are categories of logs, not analytical tools.
From lesson: CloudTrail — Audit Logging
Why is it recommended to configure a S3 lifecycle policy on the bucket used for CloudTrail logs?
Answer: To transition older log files to cheaper storage classes like S3 Glacier. Logs accumulate over time, increasing storage costs. Lifecycle policies move older logs to archive tiers like Glacier. Encryption is handled by bucket policies/KMS settings, not lifecycle, and overwriting is managed by S3 naming conventions, not lifecycle rules.
From lesson: CloudTrail — Audit Logging
When you execute 'cdk deploy', what is the specific role of CloudFormation in the process?
Answer: It processes the synthesized JSON/YAML template to manage resource lifecycles.. CloudFormation is the underlying engine that interprets the template generated by CDK to perform CRUD operations on AWS resources. Option 0 is wrong because the CLI handles the synthesis, not the deployment logic. Option 2 is wrong because CDK code is transpiled to a template, not machine code. Option 3 is wrong because CloudFormation manages drift and state, it does not destroy everything unless specifically instructed.
From lesson: AWS CDK and CloudFormation — IaC
What is the primary benefit of using high-level 'constructs' in AWS CDK compared to writing raw CloudFormation templates?
Answer: They automatically handle complex boilerplate configurations like IAM roles and VPC peering.. High-level constructs (L2/L3) provide sensible defaults and pre-configured resources, significantly reducing boilerplate code. Option 0 is false as CDK respects IAM. Option 2 is false as CDK is language-agnostic in principle. Option 3 is false as networking is still required in the infrastructure design.
From lesson: AWS CDK and CloudFormation — IaC
Why is 'cdk diff' a critical step in the deployment pipeline?
Answer: It compares the current state of the AWS environment with the intended state defined in the CDK code.. The diff command identifies changes between the actual infrastructure and the declared code, preventing unexpected deletions or replacements. Option 0 is irrelevant to IaC. Option 1 is a task for dependency managers. Option 3 is wrong because diff does not trigger a deploy.
From lesson: AWS CDK and CloudFormation — IaC
If you need to share a database connection string from one CDK stack to another, what is the recommended approach?
Answer: Use CloudFormation exports and imports or SSM Parameter Store to pass the reference.. Using SSM or Stack Outputs/Imports provides a secure and managed way to link stacks. Option 0 is fragile and hard to maintain. Option 2 is a security risk. Option 3 is impossible as memory is not shared between disparate stack deployments.
From lesson: AWS CDK and CloudFormation — IaC
What happens if a stack deployment fails halfway through using CDK?
Answer: CloudFormation automatically initiates a rollback to the last known good state.. CloudFormation ensures atomicity by rolling back changes when an error occurs, ensuring the environment remains stable. Option 0 is incorrect because rollback handles this. Option 2 is incorrect because it violates resource consistency. Option 3 is incorrect because stacks are recoverable.
From lesson: AWS CDK and CloudFormation — IaC
An application requires high-performance block storage that can be attached to multiple EC2 instances simultaneously. Which solution should be used?
Answer: Amazon EFS. EFS provides a managed NFS file system that supports simultaneous connections from multiple instances. EBS is limited to a single instance connection. Instance Store is ephemeral and local, while S3 is object storage, not block storage.
From lesson: AWS Interview Questions
A web application's traffic fluctuates drastically throughout the day. Which approach provides the most cost-effective scalability for EC2 instances?
Answer: Using an Auto Scaling group with a target tracking policy. Target tracking scaling policies automatically adjust capacity to maintain a specific metric, ensuring cost efficiency. Manual schedules are static and inflexible. Provisioning for peak is wasteful, and a single instance creates a bottleneck.
From lesson: AWS Interview Questions
A developer needs to ensure that data stored in S3 is encrypted at rest automatically. Which is the most appropriate configuration?
Answer: Enabling Server-Side Encryption (SSE-S3 or SSE-KMS). Server-Side Encryption is handled by S3 transparently at the platform level. Client-side encryption adds overhead to the application. Bucket keys optimize performance but are not the primary mechanism for encryption. Access points are for network control, not encryption.
From lesson: AWS Interview Questions
What is the primary benefit of using a VPC Endpoint instead of an Internet Gateway for private instance access to S3?
Answer: It ensures traffic never leaves the AWS private network. VPC Endpoints allow private communication with AWS services within the internal network, improving security and performance. It does not replace IAM roles. While it saves on NAT Gateway data processing charges, the primary benefit is network isolation.
From lesson: AWS Interview Questions
If an RDS instance experiences a sudden spike in read requests, which architectural change is best suited to improve performance without affecting write performance?
Answer: Creating an RDS Read Replica. Read Replicas are specifically designed to offload read-heavy traffic from the primary instance. Multi-AZ is for high availability and failover, not read performance. Scaling up increases costs for both read and write operations. S3 is not a relational database replacement.
From lesson: AWS Interview Questions
An application requires sub-millisecond latency for a frequently accessed dataset. Which architecture pattern provides the most efficiency?
Answer: Implement an Amazon ElastiCache layer in front of the database. ElastiCache provides in-memory performance, which is ideal for sub-millisecond requirements. S3 is for object storage (slower), increasing IOPS is expensive and limited by network latency, and Read Replicas are for scaling read heavy database traffic, not caching.
From lesson: AWS Architecture Design Questions
A company wants to decouple a web application where the frontend sends data and the backend processes it asynchronously. Which service is best?
Answer: Amazon SQS. SQS is a message queuing service designed for decoupling components. SNS is for pub/sub messaging, Step Functions is for workflow orchestration, and Kinesis is for real-time streaming data ingestion.
From lesson: AWS Architecture Design Questions
To secure an application's private subnets while allowing access to software updates, what should be configured?
Answer: A NAT Gateway in a public subnet. A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while blocking inbound traffic. Internet Gateways must be in public subnets, VPC Endpoints are for AWS service communication, and Bastion hosts are for management, not software updates.
From lesson: AWS Architecture Design Questions
An architect needs to ensure data durability and cost-effective long-term storage for archived logs. Which is the optimal storage class?
Answer: S3 Glacier Deep Archive. Glacier Deep Archive is the lowest-cost storage for data that is rarely accessed and suitable for long-term archiving. Standard is for frequently accessed data, One Zone-IA lacks the durability of multi-AZ storage, and EBS is block storage, not object storage.
From lesson: AWS Architecture Design Questions
How can you achieve high availability for a web server hosted on EC2 instances across multiple Availability Zones?
Answer: Place all instances behind an Application Load Balancer. An Application Load Balancer distributes traffic across instances in multiple AZs, providing high availability. Elastic IPs do not perform load balancing, Placement Groups are for low-latency cluster performance, and NAT instances provide internet access, not application load balancing.
From lesson: AWS Architecture Design Questions
