All practice questions

A financial services company hosts its customer-facing portal on AWS using a multi-tier architecture. The portal is fronted by an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in private subnets. The security team needs to implement a solution to centrally monitor and aggregate security findings across all AWS accounts in the organization, continuously evaluate AWS resource configurations against security best practices (specifically checking for public S3 buckets and overly permissive security groups), and protect the web application from SQL injection attacks and HTTP flood attacks at the application layer. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

A biotechnology company runs computational workflows that simulate molecular interactions. The simulations must be processed in the exact chronological order in which they are submitted to ensure data dependency integrity. Each simulation takes between $1$ and $2$ hours to execute. The simulation requests are highly irregular, with dozens of submissions occurring simultaneously followed by days of complete inactivity. The database must scale instantly to handle the write throughput when simulations complete, but must not incur compute costs during inactive periods. Which architecture is the most cost-effective and meets these requirements?

A financial services firm hosts a customer-facing web application on AWS behind an Application Load Balancer (ALB). The security team needs to implement a solution to monitor for and automatically block SQL injection attacks at the application layer. Additionally, they must ensure that all administrative and management API actions across the entire AWS account are recorded and audited for regulatory compliance. Which combination of actions should a solutions architect recommend to meet these requirements?

A startup is launching a mobile game that stores user profile data. The game's traffic is highly unpredictable and spiky, with writes to the database increasing from 100 writes per second to over 12,000 writes per second within minutes when popular influencers stream the game. Outside of these events, traffic is minimal. The database must be highly available and scale automatically to handle these sudden spikes. Which database configuration meets these requirements most cost-effectively?

A company has an on-premises Active Directory and is migrating its web application to AWS. The application runs on Amazon EC2 instances. The solutions architect must ensure that:
1. Corporate employees can access the AWS Management Console using their existing credentials, without creating individual IAM users.
2. The EC2 instances can securely access a private Amazon S3 bucket without using long-term credentials.
3. Administrative operations in the AWS account must be restricted to standard IAM administrative roles, ensuring the root user is not used for daily activities.

Which combination of steps should the solutions architect implement to meet these security requirements?

An enterprise is migrating its multi-account environment to AWS Organizations. The security team needs to enforce compliance by preventing any member account under the `Prod-Workloads` OU from deleting or modifying administrative IAM roles prefixed with `SecurityGov-`. Additionally, the enterprise requires centralized access management integrated with their Microsoft Entra ID identity provider. The solution must ensure that administrative tasks in member accounts do not require local IAM user credentials. Which strategy should a Solutions Architect implement to meet these requirements?

A digital publishing company serves personalized web content to a global audience. The content is hosted on origin servers in an on-premises data center, which is connected to AWS via an AWS Direct Connect connection. During major news events, the platform experiences sudden HTTP flood attacks (Layer 7) that exhaust the bandwidth on the Direct Connect connection, causing severe outages for legitimate users. The company needs to implement a solution to block these attacks at the AWS network edge before they reach the Direct Connect connection and the on-premises infrastructure. Which solution will meet these requirements?

An online retail application hosted on AWS Lambda requires access to an external payment gateway API key that must be rotated every 30 days. The application also requires access to several non-sensitive configuration settings, including timeout values and API endpoints. The architecture must minimize cost while ensuring that the sensitive API key is encrypted at rest and rotated automatically without manual intervention. Which parameter management strategy should a solutions architect implement to meet these requirements with the lowest operational overhead?

An enterprise application hosted on Amazon ECS tasks in a private VPC must connect to a legacy PostgreSQL database hosted on-premises via an AWS Direct Connect connection. The database credentials must be rotated every 30 days to comply with security regulations. The rotation process must be automated, secure at rest, and must not require changes to the application deployment pipeline. Which database credential management solution meets these security requirements with the least operational overhead?

A company is using AWS Organizations to manage a multi-account environment. The security team wants to implement a centralized identity management solution that allows corporate employees to authenticate using their existing external Identity Provider (IdP) credentials and access resources across multiple AWS accounts. Additionally, the security team needs to prevent individual member accounts from disabling AWS CloudTrail logging. Which solution meets these requirements with the least operational overhead?

A ride-sharing platform is designing an event-driven system to process ride status updates (such as requested, accepted, driver_arrived, and ride_ended) sent from driver mobile applications. To maintain a correct trip history, updates for each specific ride must be processed in the exact sequence they are generated. The platform must handle sudden spikes in traffic during peak hours without losing messages, and the upstream ingestion layer must be decoupled from the downstream processing application. Which solution meets these requirements with the least operational overhead?

An organization operates a multi-account AWS environment managed under AWS Organizations. An application running on Amazon EC2 instances in a production member account must securely access and decrypt highly confidential financial data stored in an Amazon S3 bucket within a shared services account. The S3 bucket is encrypted with an AWS KMS customer managed key located in the shared services account. The solution must also retrieve database credentials that require rotation every $30$ days.

Which design should a solutions architect implement to meet these security requirements?

An organization hosts a legacy payroll application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The payroll application runs on port 8088. The target group is configured to route HTTP traffic to the EC2 instances on port 8088. The EC2 instances are in a security group that allows inbound traffic on port 8088 from the ALB's security group. However, the ALB marks all registered EC2 instances as unhealthy. A solutions architect discovers that the target group's health checks are configured to use HTTP on port 80. How should the solutions architect resolve this issue and restore the system to a healthy state?

A data processing application is deployed on Amazon EC2 instances in a private subnet (Subnet A: $10.0.2.0/24$). The application must initiate outbound database queries to an Amazon RDS PostgreSQL DB instance in another private subnet (Subnet B: $10.0.3.0/24$) on port $5432$. The application must also download external software updates over HTTPS (port $443$) through a NAT Gateway located in a public subnet (Subnet C: $10.0.1.0/24$). Custom Network Access Control Lists (NACLs) are used to secure the subnets. Which configuration of NACL rules for Subnet A will allow the required traffic while following the principle of least privilege?

A company is designing the access control mechanism for its development team. The developers need to access AWS resources to deploy applications. The security team mandates that developers must use their existing corporate directory credentials to log in, and no long-term AWS credentials should be stored on developer machines. Additionally, sensitive database credentials used by the applications must be stored securely and rotated automatically every 30 days. Which combination of AWS services and configurations should a solutions architect recommend to meet these requirements?

A logistics company hosts a shipment tracking portal on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The portal has recently experienced HTTP flood attacks targeting the search endpoint, which overloads the ALB and causes application downtime. A solutions architect must design a secure architecture that mitigates these Layer 7 DDoS attacks at the AWS edge network before they reach the ALB.

Which solution meets these requirements?

A retail technology startup has a multi-account AWS environment managed under AWS Organizations. The startup uses Okta as its central Identity Provider (IdP) for employee authentication. The security team wants to grant developers single sign-on (SSO) access to their respective AWS accounts. The solution must ensure that user access is automatically provisioned and deprovisioned when users are added or removed in Okta, while minimizing operational complexity and eliminating the use of long-term credentials. Which solution meets these requirements?

A clinical diagnostic laboratory is building an event-driven system to process patient test results generated by multiple automated analyzers. The results for each patient must be processed in the exact sequence they are completed to prevent older results from overwriting newer ones due to network latency. Results for different patients can be processed concurrently. The system must scale automatically to handle sudden increases in test volumes during peak hours.

Which solution meets these requirements with the least operational overhead?

A company runs a high-traffic web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The application is configured to listen on custom port 8080. The instances are registered with a target group behind an Application Load Balancer (ALB) that routes external traffic from port 443 to the target group. A solutions architect must configure health checks to ensure that the ASG accurately detects and replaces instances that fail at the application layer, while maintaining a secure and highly available setup.

Which configuration should the solutions architect implement?

A security architect is designing an access and credentials management solution for a multi-account AWS environment. An application running on Amazon EC2 instances in Account A ($111122223333$) must securely retrieve database credentials to connect to a PostgreSQL database in Account B ($444455556666$). The database credentials must be rotated every $30$ days without causing application downtime. The solution must adhere to the principle of least privilege, avoid long-term credentials, and ensure all data in transit and at rest is secured using customer-managed keys (CMKs). Which architecture represents the most secure and compliant design that meets these requirements?