Exam: AWS Certified Solutions Architect - Associate

Answer: C
✅ Explanation
✅ C. Use the Auto Recovery feature in Amazon EC2 to automatically stop and start the EC2 instance in case of a failure. Use a trigger in Amazon S3 to push the metadata to the instance when it is back up and running.
🔍 Here's why C is correct:
❗ Requirements:
Only one EC2 instance should be running.
-It should automatically restart or relaunch if there's performance degradation.
-On restart, the instance must retrieve metadata from Amazon S3.
✅ Why Option C fits:
Auto Recovery in EC2 monitors the instance using CloudWatch alarms (based on StatusCheckFailed) and will automatically recover the instance (relaunch it on new hardware if needed).
-Once restarted, you can use an S3 event trigger or a script in user-data to retrieve metadata from Amazon S3.
-It ensures availability and data consistency without launching multiple instances (which is key for legacy apps limited to one instance).

Answer: ACE
✅Explanation:
A. Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail.
This step detects when a new IAM user is created — which is the triggering event. ✅
C. Create an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda function to disable any access keys and delete the login profiles that are associated with the IAM user.
This ensures the IAM user's credentials are immediately disabled. You need both:
Disabling access keys (if any were created)
Deleting the login profile (prevents password-based access)
✅
E. Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule. Subscribe the security team’s group email address to the topic.
This ensures the security team is notified whenever a new IAM user is created.
✅

Answer: ADE
✅ Correct Answers:
A. Add Amazon RDS DB read replicas, and have your application direct read queries to them.
D. Use ElastiCache in front of your Amazon RDS DB to cache common queries.
E. Shard your data set among multiple Amazon RDS DB instances.
✅Explanation of Correct Choices:
A. Add Amazon RDS DB read replicas, and have your application direct read queries to them.
Read replicas offload read traffic from the primary DB.
Ideal for read-heavy workloads.
-Helps reduce CPU usage on the primary instance.
D. Use ElastiCache in front of your Amazon RDS DB to cache common queries.
Reduces the need for repeated queries to the database.
-Very effective for frequent, read-heavy queries (e.g., product catalogs, profiles).
-Low latency and decreases DB CPU load.
E. Shard your data set among multiple Amazon RDS DB instances.
Distributes data across multiple DBs.
-Allows horizontal scaling and reduces load on a single instance.
-More complex to implement, but scalable.

Answer: A
✅ Explanation
A. ELB SSL termination. ❌ (Violation)
-Why it's a violation:
-With SSL termination at the ELB (Elastic Load Balancer), the connection between the client and the ELB is encrypted, but the traffic between the ELB and your backend instances is typically unencrypted unless you explicitly re-encrypt it.
-This breaks encryption in transit, violating the policy unless you implement end-to-end encryption, which requires SSL between ELB and backend as well.
So, by default, this is a violation unless re-encryption is in place.
B. ELB Using Proxy Protocol v1.
-Not a violation:
-Proxy Protocol v1 just adds connection information (like client IP) to the headers. It doesn’t affect encryption and works with encrypted or unencrypted connections.
-It's compatible with encrypted data paths and not inherently a security violation.
C. CloudFront Viewer Protocol Policy set to HTTPS redirection.
Not a violation:
-This enforces clients to use HTTPS by redirecting HTTP to HTTPS. It ensures encryption in transit from the viewer to CloudFront.
-It strengthens encryption compliance.
D. Telling S3 to use AES256 on the server-side.
Not a violation:
This is Server-Side Encryption with S3-managed keys (SSE-S3) using AES-256. It ensures data at rest in S3 is encrypted.
-Complies with encryption at rest requirements.
✅ Correct Answer (Violation of policy):
A. ELB SSL termination

Correct Answer: B
✅ Explanation
-A solutions architect is designing a solution where users will be directed to a backup static error page if the primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53 where their domain is pointing to an Application Load Balancer (ALB).
-Which configuration should the solutions architect use to meet the company's needs while minimizing changes and infrastructure overhead?
A. Point a Route 53 alias record to an Amazon CloudFront distribution with the ALB as one of its origins. -Then, create custom error pages for the distribution.
B. Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page hosted within an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.
C. Update the Route 53 record to use a latency-based routing policy. Add the backup static error page hosted within an Amazon S3 bucket to the record so the traffic is sent to the most responsive endpoints.
D. Set up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance hosting a static error page as endpoints. Route 53 will only send requests to the instance if the health checks fail for the ALB.

Answer: A
✅ Explanation
✅ Correct Answer: A. Launch the EC2 instances in a cluster placement group in one Availability Zone.
🧠 Explanation:
-For High Performance Computing (HPC) workloads that require frequent inter-node communication with low latency and high network throughput, the best practice is to place EC2 instances:
-Physically close together (to reduce latency).
-On high-bandwidth, low-latency networks.
-This is exactly what a Cluster Placement Group provides.
✅ Why A is correct:
-Cluster Placement Groups pack instances close together in the same Availability Zone.
-Designed for high-performance networks, often using Elastic Network Adapter (ENA).
-Ideal for tightly coupled HPC workloads, like scientific modeling, genomics, simulations, and analytics.

Answer: B
✅ Explanation:
The existing system is a Windows file server farm that uses Distributed File System Replication (DFSR) — this clearly points to a Windows-based file system architecture.
✅ Amazon FSx for Windows File Server:
Is a fully managed native Windows file system.
-Supports SMB protocol, NTFS, and Windows ACLs.
-Can be joined to Active Directory.
Is ideal for replacing on-prem Windows file servers, especially when DFS namespaces and DFS replication (DFSR) are involved.

Answer: D
✅ Correct Answer: D. Implement code in microservice 1 to send data to an Amazon SQS queue. Implement code in microservice 2 to process messages from the queue.
✅ Explanation:
-You are building two ECS-based microservices where:
-Microservice 1 performs the first, faster step.
-Microservice 2 performs a slower, second step.
Both need to scale independently.
-To meet these needs, you want:
-Decoupling (so each microservice runs independently).
-Asynchronous communication (because processing times differ).
-Scalable architecture (each service scales based on its own workload).
-Why Amazon SQS is the best fit:
-Fully managed message queue that decouples microservices.
-Microservice 1 sends messages (i.e., tasks) to the queue quickly and continues processing.
-Microservice 2 reads messages from the queue and processes them at its own pace.
-ECS tasks for microservice 2 can scale based on queue depth using CloudWatch alarms and Application Auto Scaling.
Provides durability, reliability, and fault tolerance.

Answer: BE
✅ Explanation
✅ Correct Answers:
B. Add Aurora Replica.
E. Add an Amazon CloudFront distribution in front of the Application Load Balancer.
🔍 Explanation of Correct Choices:
✅ B. Add Aurora Replica
Aurora Replicas offload read traffic from the primary instance.
-Helps during traffic spikes by handling more concurrent reads.
-Supports auto-scaling of read capacity, improving performance and fault tolerance.
✅ E. Add an Amazon CloudFront distribution in front of the Application Load Balancer
CloudFront caches static and dynamic content at edge locations.
-Reduces direct load on your EC2 instances and Application Load Balancer.
-Improves latency and absorbs traffic spikes globally.
-Especially helpful for news content, which typically includes static assets (images, articles).