Scenario Based Question | AWS SAA

An EC2 instance in a private subnet needs outbound internet access to download updates, but it must not be reachable from the internet. What should you use?

A NAT Gateway in a public subnet with a route from the private subnet to the NAT Gateway. The NAT Gateway allows outbound internet access while preventing unsolicited inbound connections.

An EC2 instance needs to access an S3 bucket, but the company does not want long-term AWS access keys stored on the instance. What is the best solution?

Attach an IAM role to the EC2 instance. The role provides temporary credentials automatically through the instance metadata service.

A developer needs temporary permission to upload a file to a private S3 bucket without receiving permanent AWS credentials. What should be used?

An S3 presigned URL. It grants temporary access to a specific S3 object or operation without exposing AWS credentials.

A company stores sensitive data in S3 and wants AWS to manage the encryption keys automatically. Which encryption option should be used?

SSE-S3, which uses Amazon S3-managed encryption keys.

A company requires control over encryption keys, key policies, auditing, and key rotation. Which service should be used?

AWS Key Management Service (AWS KMS), preferably with a customer managed KMS key when direct key control is required.

A company needs to encrypt data before sending it to AWS so AWS never receives the plaintext data. What should be used?

Client-side encryption. The application encrypts the data before transmitting it to AWS.

A company wants to ensure that no S3 bucket or object can be made publicly accessible through accidental configuration. What should be enabled?

S3 Block Public Access. It provides centralized controls to prevent public access through bucket policies, ACLs, and related settings.

An IAM user should be able to read objects from only one specific S3 bucket. How should access be configured?

Use a least-privilege IAM policy that grants only the required s3:GetObject permission for the specific bucket objects.

A company wants to allow an IAM role in Account B to access resources in Account A without sharing long-term credentials. What should be used?

Cross-account IAM role access using AWS STS temporary credentials.

A company wants centralized workforce access to multiple AWS accounts using its existing corporate identity provider. What should be used?

AWS IAM Identity Center integrated with the corporate identity provider using federation such as SAML 2.0.

An application allows users to sign in using Google, Apple, or Facebook accounts. Which AWS service is most appropriate?

Amazon Cognito, which supports user authentication and federation with social identity providers.

A company wants to filter malicious HTTP requests, including SQL injection and cross-site scripting attempts, before they reach an application. What should be used?

AWS WAF, which can inspect and filter web requests using managed and custom rules.

A public application requires enhanced DDoS protection and access to a specialized DDoS response team. Which service should be used?

AWS Shield Advanced.

A security team needs a record of API calls made throughout an AWS account for auditing and investigation. Which service should be used?

AWS CloudTrail, which records AWS API activity and management events.

A company wants to detect suspicious activity and potential threats across AWS accounts and workloads. Which service should be used?

Amazon GuardDuty, which analyzes AWS account and workload data for potential threats.

A company wants to centrally aggregate security findings from multiple AWS security services and accounts. Which service should be used?

AWS Security Hub.

An application needs to securely retrieve database passwords and API keys, and the company wants automatic secret rotation. Which service should be used?

AWS Secrets Manager.

An application needs to store non-sensitive configuration values such as feature flags and database endpoints. Which service should be used?

AWS Systems Manager Parameter Store.

A company wants to control traffic to individual EC2 instances and allow return traffic automatically for established connections. Which security control should be used?

Security groups. They operate at the instance or network interface level and are stateful.

A company wants to control inbound and outbound traffic at the subnet level using separate rules for each direction. Which security control should be used?

Network ACLs. They operate at the subnet level and are stateless.

A company wants private access from a VPC to Amazon S3 without routing traffic through the public internet or a NAT Gateway. What should be used?

A VPC Gateway Endpoint for Amazon S3.

A company wants to inspect traffic entering and leaving a VPC for advanced network threat detection and prevention. Which service should be considered?

AWS Network Firewall, which provides managed stateful network inspection and filtering.

A company wants to prevent a specific IAM user from granting permissions beyond a defined maximum, even if the user receives broader IAM policies. What should be used?

An IAM permissions boundary, which limits the maximum permissions an IAM principal can receive.

A company wants to continuously check AWS resources against security best practices and identify configuration vulnerabilities. Which service is appropriate?

Amazon Inspector for automated vulnerability management of supported workloads, while AWS Config can evaluate resource configurations against rules.

A company runs a web application on one EC2 instance and wants it to continue operating if that instance fails. What architecture should be used?

Run multiple EC2 instances across multiple Availability Zones behind a load balancer.

An application experiences unpredictable traffic spikes. The company wants EC2 capacity to increase and decrease automatically based on demand. What should be used?

An EC2 Auto Scaling group behind an Elastic Load Balancing load balancer.

A company wants its application to remain available if an entire Availability Zone fails. What is the minimum recommended architecture?

Deploy redundant application resources across multiple Availability Zones.

A company needs to route HTTP requests to different target groups based on URL paths such as /images and /api. Which load balancer should be used?

An Application Load Balancer, which supports Layer 7 routing based on paths, hosts, headers, and other HTTP attributes.

A company needs to distribute TCP traffic with extremely high performance and low latency. Which load balancer should be used?

A Network Load Balancer, which operates at Layer 4 and supports high-performance TCP and UDP traffic.

A company wants to route users to the AWS Region with the lowest network latency. Which Route 53 routing policy should be used?

Latency-based routing.

A company wants automatic DNS failover to a secondary endpoint when the primary endpoint becomes unhealthy. What should be used?

Route 53 failover routing with health checks.

A company wants to route users to different endpoints based on the geographic location of the users. Which Route 53 policy should be used?

Geolocation routing.

An order-processing application should continue accepting orders even when the backend processing service is temporarily unavailable. What should be used?

Amazon SQS to decouple the order producers from the backend consumers and buffer messages.

A company needs messages to be processed in the exact order they were sent and wants to prevent duplicate processing. Which queue should be used?

An Amazon SQS FIFO queue, which supports ordered processing and exactly-once processing capabilities under its supported configuration.

A company needs to send the same notification to multiple independent applications. Which architecture should be used?

Publish the message to an Amazon SNS topic and subscribe multiple SQS queues or other supported endpoints.

A company wants failed messages to be retried and eventually moved to a separate queue after repeated failures. What should be configured?

An SQS dead-letter queue with an appropriate redrive policy.

A company wants a workflow that coordinates multiple Lambda functions with retries, branching, and error handling. Which service should be used?

AWS Step Functions.

A company wants a Lambda function to run automatically whenever a new object is uploaded to S3. What should be configured?

An S3 event notification that invokes AWS Lambda, directly or through an event-driven integration when appropriate.

A company wants to run containers without managing EC2 servers and needs container orchestration. Which option is appropriate?

Amazon ECS with AWS Fargate.

A company wants managed Kubernetes control-plane operations while using Kubernetes for container orchestration. Which service should be used?

Amazon EKS.

A company needs a relational database that automatically fails over to a standby in another Availability Zone. Which feature should be used?

An Amazon RDS Multi-AZ deployment.

A company needs additional database read capacity but does not need a standby primarily for read scaling. What should be used?

RDS Read Replicas.

A company needs a globally distributed NoSQL database with low-latency reads and writes in multiple AWS Regions. Which service should be used?

DynamoDB global tables.

A company needs a globally distributed relational database with low-latency reads across multiple Regions. Which service should be considered?

Amazon Aurora Global Database.

A company needs object storage with high durability and automatic redundancy across multiple Availability Zones. Which service should be used?

Amazon S3.

A company needs a file system that can be mounted concurrently by multiple Linux EC2 instances across Availability Zones. Which service should be used?

Amazon EFS.

A company needs a shared file system for Windows applications using the SMB protocol. Which service should be used?

Amazon FSx for Windows File Server.

A company needs to replicate S3 data to another AWS Region for disaster recovery. What should be configured?

S3 Cross-Region Replication, with appropriate versioning and replication configuration.

A company wants to distribute static images, videos, and other content globally while reducing latency and origin load. Which service should be used?

Amazon CloudFront, which caches content at edge locations closer to users.

A company wants to reduce database load by caching frequently accessed data in memory. Which service should be used?

Amazon ElastiCache, using an appropriate engine such as Redis/Valkey or Memcached based on requirements.

A company stores objects in S3, but users around the world experience high latency when accessing them. What is the best improvement?

Use Amazon CloudFront in front of S3 to cache content closer to users.

An EC2 instance needs persistent block storage that remains available when the instance is stopped and can be backed up with snapshots. Which service should be used?

Amazon EBS.

An EC2 instance needs extremely fast temporary local storage for scratch data that does not need to survive instance termination. What should be used?

Instance store volumes.

A company needs to transfer hundreds of terabytes of data to AWS, but its internet connection is too slow. Which service should be considered?

AWS Snowball Edge for physically transferring large amounts of data to AWS.

A company needs a dedicated private network connection from its data center to AWS. Which service should be used?

AWS Direct Connect.

A company needs to quickly connect its on-premises network to a VPC using an encrypted connection over the public internet. What should be used?

AWS Site-to-Site VPN.

A company has many VPCs and on-premises networks that need centralized connectivity. Which service should be used?

AWS Transit Gateway.

A company wants private connectivity from a VPC to services such as SQS, SNS, or KMS. Which type of endpoint should be used?

An Interface VPC Endpoint powered by AWS PrivateLink.

A company has an unpredictable, event-driven workload and wants to avoid managing servers. Which compute service is most appropriate?

AWS Lambda, when the workload fits Lambda's execution, runtime, and resource constraints.

A company needs to run a long-running application with full operating-system control. Which compute service should be used?

Amazon EC2.

A company wants to automatically scale EC2 capacity based on the number of requests each instance is processing. Which scaling metric is generally best?

A workload-specific metric such as requests per target, because it more directly reflects application demand than CPU utilization alone.

A company wants EC2 instances to automatically scale while maintaining a target average CPU utilization. Which scaling policy should be used?

An EC2 Auto Scaling target tracking policy.

A company needs a database with single-digit millisecond performance and massive scalability for a key-value workload. Which service should be used?

Amazon DynamoDB.

A DynamoDB workload is unpredictable and the company does not want to provision read and write capacity in advance. Which capacity mode should be used?

DynamoDB on-demand capacity mode.

A DynamoDB workload is predictable and the company wants to optimize costs with capacity planning and auto scaling. Which capacity mode should be used?

Provisioned capacity mode with auto scaling where appropriate.

A company needs to query DynamoDB using a different partition key from the base table's primary key. What should be created?

A Global Secondary Index, or GSI.

A company needs a DynamoDB index that uses the same partition key as the base table but a different sort key. What should be used?

A Local Secondary Index, or LSI, created according to DynamoDB's index requirements.

A company needs a relational database optimized for complex analytical queries over large datasets. Which service should be used?

Amazon Redshift.

A company wants to run SQL queries directly against data stored in S3 without loading it into a traditional database. Which service should be used?

Amazon Athena.

A company stores data that is accessed frequently for 30 days and rarely afterward. What should be configured to reduce storage costs?

An S3 Lifecycle policy that transitions objects to a lower-cost storage class after the access pattern changes.

A company stores archival data that is rarely accessed and can tolerate long retrieval times. Which S3 storage class is typically most cost-effective?

S3 Glacier Deep Archive, when the retention and retrieval requirements are compatible.

A company stores data with unpredictable access patterns and wants S3 to automatically move objects between access tiers. Which feature should be used?

S3 Intelligent-Tiering.

A company wants objects to be automatically deleted after a defined retention period. What should be configured?

S3 Lifecycle expiration rules.

A company wants to reduce NAT Gateway costs for traffic destined for Amazon S3. What should be used?

A VPC Gateway Endpoint for Amazon S3, which avoids NAT Gateway processing charges for that traffic.

An EC2 workload can tolerate interruptions and is flexible about when it runs. Which purchasing option can significantly reduce compute costs?

EC2 Spot Instances.

A company has consistent compute usage and wants discounted pricing with a flexible commitment across instance families and Regions. Which option should be considered?

A Compute Savings Plan.

A company knows it will consistently use a particular EC2 instance family in a particular Region and wants commitment-based savings. Which option may be appropriate?

An EC2 Instance Savings Plan.

A workload runs only occasionally and has no long-term commitment. Which EC2 pricing option is generally most appropriate?

On-Demand Instances.

A development environment is used only during business hours. What is a simple cost optimization?

Automatically stop the environment outside of business hours and start it when needed.

A company wants recommendations for underutilized EC2 instances and potential resource rightsizing. Which service should be used?

AWS Compute Optimizer.

A company wants to receive alerts when actual or forecasted AWS spending exceeds a threshold. Which service should be used?

AWS Budgets.

A company wants to analyze AWS spending by service, account, and time period. Which service should be used?

AWS Cost Explorer.

A company wants to reduce costs for a workload that requires a relational database but has highly variable demand. Which option may be appropriate?

Aurora Serverless, if the workload and application requirements are compatible with its scaling model.

A company is moving large amounts of data out of AWS and wants to optimize costs. What should be analyzed carefully?

Data transfer charges, especially internet data transfer out and cross-Region transfer costs.

A company has a three-tier application. The web tier must be public, the application tier must not be public, and the database must be isolated. What architecture should be used?

Place the load balancer in public subnets, application servers in private subnets, and the database in private or isolated subnets. Use security groups to restrict tier-to-tier communication.

A company wants a highly available web application with automatic scaling and minimal server management. Which architecture is most appropriate?

CloudFront, when appropriate, followed by an Application Load Balancer and an EC2 Auto Scaling group spanning multiple Availability Zones.

A company wants a serverless HTTP application that performs business logic and stores data in a NoSQL database. Which architecture is most appropriate?

Amazon API Gateway → AWS Lambda → Amazon DynamoDB.

A company wants to process uploaded images asynchronously, and processing may take several minutes. Which architecture is best?

S3 upload event → SQS queue → worker service such as Lambda or ECS, depending on processing duration and resource requirements.

A company needs a database to remain available if an Availability Zone fails but does not primarily need additional read capacity. What should be used?

RDS Multi-AZ deployment.

A company needs to increase database read capacity and distribute read queries across additional database instances. What should be used?

RDS Read Replicas.

A company wants to expose a private application to customers without placing application servers directly on the public internet. What architecture is appropriate?

Use a public entry point such as an Application Load Balancer or API Gateway and keep the application servers in private subnets.

A third-party provider needs temporary access to AWS resources without receiving long-term access keys. What should be used?

A cross-account IAM role with AWS STS temporary credentials.

A company has unpredictable traffic and wants high availability with minimal operational overhead. Which architectural approach is generally best?

Use managed and serverless services where appropriate, such as API Gateway, Lambda, DynamoDB, S3, SQS, and managed load balancing.

A company needs to store years of rarely accessed data at the lowest practical storage cost and can tolerate long retrieval times. Which solution should be considered first?

S3 Glacier Deep Archive, provided that the retrieval time, minimum storage duration, and data access requirements are compatible.

A company wants to improve application performance by moving frequently accessed database records into memory. Which architectural pattern should be used?

Add a caching layer such as Amazon ElastiCache in front of the database, with an appropriate cache invalidation strategy.

A company needs to route traffic globally to the closest healthy application endpoint and improve performance for non-HTTP protocols. Which service should be considered?

AWS Global Accelerator, which uses the AWS global network and static anycast IP addresses to route traffic to healthy regional endpoints.

A company wants to automatically detect when an EC2 instance becomes unhealthy and replace it. What should be used?

An EC2 Auto Scaling group with health checks and a replacement policy.

A company needs a highly durable backup of EBS volumes that can be copied across Regions. What should be used?

EBS snapshots, which are stored in Amazon S3 and can be copied across Regions.

A company wants to protect an S3 bucket from accidental deletion or overwriting of objects. Which feature should be enabled?

S3 Versioning, potentially combined with MFA Delete where appropriate and supported by the operational requirements.

A company wants to restrict S3 access to requests originating through a specific VPC endpoint. What can be used?

An S3 bucket policy that restricts access based on the VPC endpoint condition key.