Sample questions

Design Secure Architectures

1. A compliance rule requires that log data stored in Amazon CloudWatch Logs be encrypted with a key the company manages. What should the team do?

• AAssociate a customer managed KMS key with the CloudWatch log group.
• BStore the logs in an unencrypted S3 bucket instead of CloudWatch.
• CRely on TLS in transit as sufficient to meet the at-rest requirement.
• DDisable log retention so that no data is stored long enough to matter.

CloudWatch Logs can encrypt a log group at rest with a customer managed KMS key, meeting the requirement. Moving to an unencrypted bucket removes encryption, TLS covers transit not rest, and disabling retention destroys the logs rather than protecting them.

Design Resilient Architectures

2. Multiple subscribers are attached to one SNS topic, but each should receive only the messages relevant to it (for example, only high-priority orders). How can this be done without extra filtering code in the subscribers?

• AApply an SNS filter policy so each subscriber gets only matching messages.
• BCreate a separate topic for every possible message attribute combination.
• CHave each subscriber receive all messages and discard the irrelevant ones.
• DMove to a single SQS queue and let one consumer sort the messages.

SNS subscription filter policies match message attributes so each subscriber receives only relevant messages, with no subscriber-side filtering. A topic per combination explodes in count, receiving everything wastes work, and a single queue removes the fan-out.

Design Resilient Architectures

3. An application uses an RDS Multi-AZ deployment, and the team believes it is protected against a full Regional outage. Which statement is accurate?

• AMulti-AZ replicates the database across multiple Regions automatically.
• BMulti-AZ requires no additional design for Regional disaster recovery.
• CMulti-AZ protects against an AZ failure but not a full Regional outage.
• DMulti-AZ and single-AZ offer identical protection against Regional outages.

Multi-AZ provides failover across Availability Zones within one Region; surviving a full Regional outage requires a separate multi-Region DR design. It does not replicate across Regions, and it is stronger than single-AZ for AZ failures.

Design Cost-Optimized Architectures

4. A steady, always-on production fleet is more expensive than necessary. Which TWO actions reduce its cost without hurting the workload? (Select TWO.)

• ACommit to a Savings Plan or Reserved Instances for the steady baseline.
• BRight-size the instances to match their actual utilization.
• CMove the production fleet entirely to interruptible Spot Instances.
• DIncrease every instance to a larger size to reduce their count.
• ERun the fleet on Dedicated Hosts to lower the hourly rate.

Committing to a Savings Plan or RIs discounts the steady baseline, and right-sizing removes over-provisioning — both cut cost safely. Moving production to Spot risks interruptions, upsizing can raise cost, and Dedicated Hosts are more expensive.

Design Cost-Optimized Architectures

5. A finance team asks for the biggest monthly savings on an over-provisioned, always-on environment. Which THREE actions together reduce cost the most? (Select THREE.)

• ARight-size or terminate underutilized EC2 instances.
• BApply Savings Plans or Reserved Instances to the steady baseline usage.
• CMove infrequently accessed data to lower-cost S3 storage classes.
• DUpsize every instance to the largest type to reduce their count.
• EKeep all idle non-production resources running to stay ready.
• FStore all data in S3 Standard regardless of how often it is accessed.

Right-sizing or terminating waste, committing to Savings Plans/RIs for the steady baseline, and tiering cold data to cheaper storage classes together yield the largest savings. Upsizing everything, leaving idle resources running, and keeping all data in Standard all increase cost.

Design Cost-Optimized Architectures

6. Before setting lifecycle rules, a team wants data-driven insight into which S3 objects are accessed infrequently enough to move to a cheaper class. Which feature provides this analysis?

• AS3 Transfer Acceleration, which speeds uploads but does not analyze access.
• BS3 Storage Class Analysis, which identifies data suitable for transition.
• CS3 Object Lock, which enforces retention rather than analyzing access.
• DS3 Versioning, which keeps prior versions rather than analyzing usage.

S3 Storage Class Analysis observes access patterns and identifies objects that are candidates to move to a lower-cost class, informing lifecycle rules. Transfer Acceleration, Object Lock, and Versioning address speed, retention, and versioning, not access analysis.