SAA-C03 practice questions
AWS · SAA-C03 · 300 questions
Original practice questions for the AWS Certified Solutions Architect – Associate (SAA-C03) exam, covering secure, resilient, high-performing, and cost-optimized architecture design on AWS.
This course contains the use of artificial intelligence.
About the SAA-C03 exam
- Exam fee
- $150 USD
- Time allowed
- 2 hours 10 minutes
- Questions
- 65
- Passing score
- 720 (scale 100-1000)
- Format
- Multiple choice or multiple response
Exam details published by the vendor, checked 28 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Design Secure Architectures · 90 questions
- A county IT board wants separate AWS accounts for parks, finance, and shared services, plus a guardrail so no account can disable CloudTrail. Which design best meets that requirement?
- A city clerk still signs in with the AWS account root user for everyday console work. What should the architect recommend for day-to-day access while protecting root?
- A municipal open-data portal application must write objects to an S3 bucket without embedding long-lived access keys in the app. Which approach should the architect design?
- A township finance team and parks team share one AWS account and keep colliding on permissions when both use shared admin users. How should the architect structure authorization?
- A regional emergency-services consortium needs staff from county A to administer resources in county B’s AWS account for a joint CAD reporting app. Which design provides that access without sharing passwords?
- A city directory already runs Active Directory on-premises and wants employees to use existing identities for the AWS Management Console. What should the architect recommend?
- A parks mobile app needs citizen (external) sign-in, while city staff continue to use corporate SSO for the AWS Console. How should the architect separate these identity needs?
- A county wants developers to deploy into a sandbox account but must prevent creation of IAM users that attach AdministratorAccess. Which multi-account control best enforces that guardrail?
- A library consortium attaches an S3 bucket policy that allows public GetObject for open catalogs while denying deletes except to a dedicated backup role. What does this illustrate about secure access design?
- A municipal auditor asks who patches the guest operating system on Amazon EC2 instances versus who secures the AWS data centers. Which statement correctly applies the shared responsibility model?
- A city security policy requires MFA for every human console session, including break-glass access. Which recommendation aligns with AWS MFA best practices?
- A multi-county water authority wants a landing-zone style baseline with a dedicated logging account, a security tooling account, and separate workload accounts. Which approach fits Associate-level multi-account security strategy?
- A permit portal AWS Lambda function must read and write items in DynamoDB in the same account without embedding access keys. What should the architect attach?
- A finance department insists on separate AWS accounts so the parks department cannot read tax databases. Why is account isolation an appropriate access-control choice?
- A city maps Active Directory groups to AWS IAM Identity Center permission sets for Management Console access across multiple accounts. What is the main advantage of this design?
- A contractor needs time-limited read-only access to a staging AWS account. Which design best matches temporary, conditional access?
- A municipal CI job running in account A must deploy CloudFormation stacks into account B. How should cross-account automation authenticate?
- A county wants to prevent anyone—including account administrators—from disabling Amazon GuardDuty in member accounts. Which control achieves that preventive goal?
- A parks GIS tool must call AWS APIs while respecting data residency expectations for a specific Region. How should the architect think about Regions in secure access and residency design?
- City Hall helpdesk staff keep creating IAM users with AdministratorAccess “temporarily.” How should the architect remediate this least-privilege anti-pattern?
- A school district wants teachers and staff to use Google Workspace identities for AWS Management Console access. Which approach is appropriate?
- A police evidence vault AWS account must deny broad access from outside a dedicated security organizational unit. Which Organizations design supports that containment?
- A municipal API architecture uses a resource-based policy on an Amazon SQS queue so only a named Lambda execution role can consume messages. What principle does this apply?
- A county separates production and nonproduction AWS accounts so developers do not hold production IAM permissions by default. How should production access work when needed?
- A city must prove who changed IAM policies last quarter as part of access governance. Which design element supports that accountability without replacing least privilege?
- A regional transit authority wants one login portal so staff across subsidiaries can reach multiple AWS accounts with workforce single sign-on. Which service should the architect designate as the central workforce SSO hub?
- A township accidentally committed AWS access keys to a public Git repository. Which remediation architecture best removes the reliance on long-lived keys for compute while containing the leak?
- A municipal data lake account must share a Glue Data Catalog with analytics accounts so analysts can query curated tables without copying datasets or handing out access keys. Which design best provides least-privilege cross-account data access?
- A city council policy requires separating billing owners from workload administrators so the same person cannot both pay invoices and change production IAM. Which architecture best enforces that separation of duties?
- A parks department application in a private subnet must call Amazon S3 without sending traffic across the public internet. Which design combines private connectivity with secure access controls?
- A citizen permit portal sits behind an internet-facing Application Load Balancer. How should the architect place the application servers and security groups?
- A county GIS VPC needs instances to download OS patches from the internet without giving those instances public IP addresses. Which design meets the requirement?
- A city wants to block entire subnet CIDR ranges from reaching a database subnet even if a security group rule is later misconfigured. Which control should the architect add at the subnet boundary?
- A public library website faces elevated DDoS risk during contentious community meetings. Which architecture best improves edge DDoS resilience?
- A municipal web form that accepts free-text comments has been hit with SQL injection attempts. Which control should the architect place on the public entry point?
- A parks reservation API currently stores database passwords in plaintext environment variables on its hosts. Which design best improves credential security?
- A city wants continuous detection of anomalous API activity and potentially compromised instances across accounts. Which service should the architect enable as the intelligent threat-detection control?
- A finance S3 bucket may contain Social Security numbers inside uploaded spreadsheets. Which service should the architect add to discover and classify that sensitive data?
- Citizens need email or social sign-in for a recreation registration app, while city staff will continue using corporate SSO for AWS consoles. Which service should authenticate the citizen end users of the application?
- A county must connect on-premises computer-aided dispatch (CAD) servers to a VPC for hybrid lookups without exposing CAD RDP to the open internet. Which connectivity approach should the architect choose?
- A municipal API must be reachable only from a partner VPC and must not be exposed on the public internet. Which pattern should the architect use?
- A city placed Amazon RDS in a public subnet and enabled public accessibility "for easier admin." Which redesign best hardens the database tier?
- A permit system needs TLS certificates for custom domains on an Application Load Balancer, CloudFront, and API Gateway. Which service should provision and renew those certificates?
- A township wants administrators to reach EC2 instances only through AWS Systems Manager Session Manager, with no inbound SSH from the internet. Which design change is required?
- A city must inspect and filter VPC egress to the internet with controls deeper than security groups alone. Which service should the architect evaluate for centralized egress filtering?
- An internet-facing Amazon API Gateway stage must not remain open to anonymous callers. Which approach best secures application access at the API layer?
- A county shares a Transit Gateway across departments and needs consistent firewall policies in many accounts and VPCs. Which service helps centrally manage those firewall policies?
- A city open-data static site is stored in Amazon S3 and must be delivered publicly through Amazon CloudFront without leaving the bucket widely open to direct public access. Which design should the architect use?
- A municipal microservices mesh must encrypt service-to-service calls inside the VPC and limit which tiers may talk to each other. Which controls should the architect emphasize?
- A city enables Amazon GuardDuty, Amazon Inspector, and Amazon Macie and wants one place to aggregate and prioritize those security findings. Which service provides that posture aggregation?
- A parks department streams fire-hydrant pressure readings into AWS and must keep the ingestion path off the public internet. The architecture should use a private streaming or API endpoint secured with IAM—not an out-of-scope IoT specialty service. Which design best meets that requirement?
- A county security office wants VPC Flow Logs and AWS CloudTrail delivered into a dedicated central log-archive account where investigators can read history but application teams cannot alter or delete the archives. Which approach best designs that secure logging architecture?
- A city development team committed API keys into a public GitOps repository used for a citizen-services app. Leadership wants a redesign so configuration secrets are not stored in source control. Which solution best remediates that risk?
- A municipal partner organization needs HTTPS access to an application behind a private Application Load Balancer in the city’s VPC. The city must not open the ALB security group to 0.0.0.0/0. Which connectivity approach best meets the requirement?
- A township wants continuous vulnerability assessment of EC2 instances and container images in Amazon ECR as part of its secure workload posture. Which AWS service should the architect select for that scanning use case?
- A city requires that traffic leaving private application subnets be inspected and limited to approved destinations and ports. Default routes that send private-tier traffic directly to an Internet Gateway are not allowed. Which design best enforces that egress control?
- A recreation department booking website must present only HTTPS to citizens and redirect any HTTP requests to HTTPS. Which design best implements that control on AWS?
- GuardDuty reports cryptocurrency mining activity on a county EC2 instance. Leadership wants an architecture that can automatically start containment when that finding type appears. Which design best supports detection-to-response automation?
- A municipal Windows server fleet must domain-join to a managed directory so file shares and line-of-business apps can use Active Directory identities with least-privilege admin groups. Which AWS service should anchor that design?
- A city wants an internal management API to be reachable only from inside its VPCs using Interface VPC endpoints and private DNS, with no public service endpoint exposure. Which approach best matches that requirement?
- A county records archive in Amazon S3 must be encrypted at rest with customer managed KMS keys, and key usage must be auditable. Which design best satisfies those controls?
- A citizen portal must enforce TLS 1.2 or higher for all public HTTPS entry points. Which design best provides encryption in transit with managed certificates on AWS?
- A finance team requires that only a dedicated key-admin role may schedule deletion of a customer managed KMS key used by tax systems, while application roles may only encrypt and decrypt data. Which design best enforces that separation?
- A police evidence bucket is encrypted with a customer managed KMS key. Policy requires automatic annual rotation of that CMK, and TLS certificates for related portals must stay current. Which approach best addresses key rotation for the CMK?
- A city classifies datasets as Public, Internal, or Confidential and must map that classification to S3 buckets, encryption, and access controls. Which design best uses classification to drive data security controls?
- Closed council session recordings must remain retained for 7 years and then be deleted, with strong protection against early tampering where policy requires immutability. Which Amazon S3–centric design best meets retention and protection needs?
- A municipal database backup must be copyable to a second AWS Region for disaster recovery while remaining encrypted throughout. Which approach best meets that requirement at Associate depth?
- A county must show auditors HIPAA- and CJIS-aligned control evidence for workloads on AWS, including access to official compliance reports, while the architecture itself uses encryption and tight access controls. Which combination best aligns technologies to that compliance-evidence need?
- A parks photo bucket should allow public read access to thumbnail objects but must deny public write so citizens cannot upload or overwrite objects anonymously. Which S3 data-access design best encodes that policy?
- A city wants governed, centralized backup policies covering Amazon EBS volumes, Amazon RDS databases, and Amazon EFS file systems rather than relying only on ad-hoc manual snapshots. Which service should the architect select?
- Amazon Macie reports PAN-like strings in a shared-drive style S3 bucket used by multiple departments. Which response design best remediates access after sensitive data discovery?
- A township container task must retrieve database credentials at runtime. The credentials must be encrypted at rest with KMS and readable only by the task role. Which design best meets that requirement?
- A municipal Amazon OpenSearch Service domain stores citizen feedback and must enable encryption at rest and node-to-node encryption. Which action best applies those data security controls on the service?
- A county policy requires highly sensitive case files to be encrypted on the client before any upload to Amazon S3, so plaintext never reaches S3 unencrypted even prior to server-side encryption. Which approach correctly distinguishes that requirement?
- EBS volumes that back a computer-aided dispatch (CAD) database must be encrypted at rest, and the account should prefer encryption by default for new volumes. Which design best enforces encrypted block storage for that sensitive workload?
- A city IT team shares an encrypted AMI from the production account to a disaster-recovery account so operators can launch recovery instances. The AMI copy uses a customer managed KMS key. What must the architect grant so the DR account can launch instances from that shared AMI?
- A county tax system will store sensitive assessment data in Amazon RDS. Leadership requires encryption at rest and notes that RDS encryption cannot be turned on later for an already unencrypted instance. When should the architect enable encryption?
- A library consortium must keep contested digital records immutable for a court-mandated retention period, including protection against privileged deletion. Which S3 control best meets a WORM-style legal hold requirement?
- A municipal CRM must export nightly files to partners through AWS Transfer Family. Policy requires encryption in transit for every transfer. Which design choice satisfies that requirement?
- Auditors ask a city whether it needs dedicated HSM appliances under its exclusive control for a small set of regulated keys, while most application encryption can stay on managed CMKs. How should the architect decide between AWS CloudHSM and AWS KMS?
- A city open-data portal stores non-sensitive public datasets beside confidential case files in separate S3 buckets. Security wants default encryption that matches classification. Which approach is appropriate?
- A county compliance office wants continuous collection of evidence mapped to a controls framework instead of last-minute screenshot hunts before audits. Which AWS service should the architect include for automated evidence gathering?
- A county DR runbook restores encrypted Amazon RDS snapshots into a second Region. What must the architect validate so recovery actually succeeds?
- A parks registration app must protect date-of-birth fields with application-level encryption while still using AWS KMS for key custody. Which pattern should the architect design?
- Internal Application Load Balancers for a municipal intranet only need trust from city-managed devices, not from public browsers on the internet. Which certificate approach fits?
- A municipal data lake on S3 serves many departments. Coarse IAM on whole buckets is too blunt for table- and column-level access. Which service should the architect use for fine-grained lake permissions?
- Security policy states that EBS snapshots containing municipal data must never be shareable publicly. Which control direction should the architect enforce?
- A city application stores Amazon RDS credentials that must change every 30 days without manual ticket chaos. Which design implements that credential security control?
- A utility analytics warehouse on Amazon Redshift must protect data at rest and require encrypted client connections. What should the architect enable?
- A county publishes a meter-data retention schedule: keep objects online for three years, then move them to Glacier storage classes, then expire them. How should the architect enforce that policy automatically in S3?
Design Resilient Architectures · 78 questions
- A city permit API spikes when storm season opens, overwhelming workers that process applications synchronously. How should the architect loosely couple intake from processing so each tier can scale independently?
- A city outage notification system must deliver the same alert to SMS subscribers, email lists, and a Lambda function that writes an audit record. Which pattern fits?
- A business-license approval process needs multi-step orchestration with wait states and human approval callbacks before the license is issued. Which AWS service should the architect choose for that workflow?
- A recreation booking site serves a static front end, calls business logic through an API, and must avoid storing session state on servers. Which architecture best matches a serverless multi-tier pattern?
- A GIS processing fleet is packaged as containers and sees bursty CPU demand. The city wants to avoid oversized always-on EC2 fleets. Which compute approach fits?
- A municipal CRM follows a classic three-tier design: web, application, and database. How should the architect place the tiers for a scalable, loosely coupled layout on AWS?
- A city is splitting a monolith into microservices that must stay loosely coupled as new domain events appear. Which integration approach reduces point-to-point spaghetti?
- Session state for a citizen portal currently lives in memory on a single EC2 instance, blocking scale-out. What should the architect do?
- A report-download site must deliver PDFs quickly to citizens worldwide from objects stored in Amazon S3. Which service should sit in front for global edge caching?
- Read-heavy catalog queries are overwhelming the primary Amazon RDS database for a city services directory. Writes remain modest. How should the architect scale reads?
- A county clerk receives nightly partner permit files over SFTP into Amazon S3 and then kicks off processing. Which approach best replaces a self-managed bastion FTP server while keeping the transfer managed?
- A city’s permit-api fleet runs in an Auto Scaling group and must receive HTTP traffic with path-based routing and instance health checks. Which load balancer should the architect choose?
- Seasonal tax-deadline traffic spikes overwhelm a city’s web tier that today only upsizes to larger instance types. What scaling approach should the architect prefer for elasticity?
- A city property-lookup API saturates its origin database during peak citizen traffic. Which design best protects the database while improving response times?
- Municipal microservices each need database credentials, and instances must stay interchangeable as Auto Scaling replaces them. How should secrets be supplied?
- A city media desk runs containerized image-resizers that sit idle most nights and must not pay for idle capacity. Which approach best meets scale-to-zero for intermittent work?
- A city needs object storage for a public media vault, block storage for a CAD database, and a shared file system for engineering lifts. Which combination matches those access patterns?
- Partner cities must call a municipal REST API with throttling and API keys without the platform team managing custom reverse proxies. Which service should front the API?
- Several municipal microservices require Kubernetes APIs and custom controllers, while a simple batch job only needs containers without Kubernetes. How should orchestration be chosen?
- A payments notifier must publish events so billing and auditing can consume them independently without the notifier knowing every subscriber. Which pattern best fits?
- A legacy IIS permit application must become more portable and scale as discrete units before a full rewrite. What is an appropriate first architecture move?
- Legacy vendor systems must exchange messages using JMS/AMQP with a city’s cloud workloads, while new cloud-native apps prefer simpler messaging. When is Amazon MQ the right choice?
- A mobile 311 app needs clients to request flexible field shapes from municipal backends without many bespoke REST round-trips. Which managed API approach fits?
- PDF generation for permit packets must not block the citizen API. How should the architect decouple and scale the workers?
- A multi-tier permit system needs relational transactions, durable attachment storage, and fast session state for web servers. Which service mix best matches those tiers?
- Uploaded citizen documents must be virus-scanned asynchronously, with infected files moved to a quarantine bucket without blocking the upload API. Which event-driven design fits?
- A GIS desktop tool keeps long-lived local state, while a related web API should scale behind a load balancer. Which design principle should guide the web tier?
- A hybrid municipal portal serves static open-data files from S3 and dynamic pages from an ALB-backed app. How should Amazon CloudFront be composed?
- License-number assignment must process requests in order with exactly-once style handling, while citizen notification blasts can be best-effort. Which queue choice is correct?
- A Lambda function consumes Amazon SQS batches for permit enrichment, but one poison message must not block the rest of the fleet. What consumer pattern should be used?
- Nightly municipal batch jobs currently depend on cron on a single EC2 server. How should scheduling be modernized for resilience and scale?
- A small team wants to deploy a simple Java permit web app with platform-managed load balancing and scaling but without deep container orchestration. Which option fits?
- Clients submitting long-running records requests need a fast acknowledgment while work continues asynchronously. Which edge pattern best fits?
- A fleet of CMS instances behind an Auto Scaling group must read and write a common content folder. Which storage service fits that shared file access pattern?
- Operators propose promoting RDS read replicas to “decouple” write-heavy permit processing spikes. What clarification should the architect make?
- A city operations center needs Kafka-compatible streaming so several existing consumer apps can share the same topics, while a separate telemetry lane only needs an AWS-native stream. How should the architect choose?
- A city’s microservices team must ingest a brittle on-premises mainframe feed into modern permit services without letting mainframe outages stall the new apps. Which loosely coupled pattern best isolates the modern tier?
- A county ECS service behind an Application Load Balancer must add tasks when each target is overloaded with requests. Which metric-driven scaling approach fits?
- A city standardizes how partners and internal services talk to the permit platform: partners need a synchronous HTTP contract, while internal services should react asynchronously. Which design matches?
- A 911 CAD reporting database must survive an Availability Zone outage with automatic failover and minimal operator heroics. Which database HA design should the city choose?
- A city defines RPO of 1 hour and RTO of 4 hours for the building-permit system and wants the lowest ongoing DR cost that still meets those targets. Which DR strategy fits?
- A county ERP team wants a cost-aware multi-Region DR design that keeps a minimal core warm in a second Region and scales out only when disaster strikes. Which pattern is that?
- A citizen portal needs a faster RTO than pilot light and can afford a scaled-down but always-running copy in another Region. Which DR pattern matches?
- A statewide emergency bulletin site must stay available with near-zero RTO across Regions using DNS steering and replicated content. Which approach fits?
- A municipal web app has a primary ALB in one Region and a DR ALB in another. How should DNS fail users over when the primary becomes unhealthy?
- Private subnets in a city’s VPC lose all outbound internet access when the single shared NAT gateway’s Availability Zone fails. How should the architect remove that SPOF?
- A city web fleet must apply security baselines without SSH patching live instances. Which immutable infrastructure approach fits?
- A county must harden durability of land-record objects in Amazon S3 against accidental deletes and Regional loss. Which combination best fits?
- A municipal web tier must survive loss of an Availability Zone without manual redeploy. Which HA design should the architect use?
- A Lambda-heavy city API opens many short database connections and must ride through RDS failover without connection storms failing the app. Which service helps?
- A county’s DR runbook scales out EC2 and load balancers in a standby Region on failover day. What must be true beforehand so scale-out is not throttled?
- Operators need early warning that the city’s multi-AZ web tier is degrading. Which HA operations approach fits?
- A multi-service permit path is failing intermittently across API Gateway, Lambda, and DynamoDB. How should architects gain workload visibility to find the broken dependency?
- A city wants backups that survive both Regional issues and an account-level compromise of the workload account. Which approach strengthens resilience?
- A legacy on-premises app cannot be rewritten soon, but the city must improve reliability in AWS while planning a later migration. Which approach fits Associate-level constraints?
- After AZ or Region recovery drills, rebuilt municipal environments sometimes drift from the known-good baseline. How should automation protect infrastructure integrity?
- A statewide records system needs low-RPO multi-Region reads and the ability to promote a secondary Region if the primary fails. Which database pattern fits?
- An architect proposes relying only on EBS snapshots to claim multi-AZ high availability for a running EC2 database volume. What is the correct distinction?
- Smart-meter ingest must keep accepting readings even if the downstream database is briefly unavailable. Which fault-tolerance pattern fits?
- After an AZ failure, failover targets for a city’s multi-AZ app are unreachable even though instances launched. What networking baseline should architects verify?
- A city 311 contact center wants spoken responses and text sentiment analysis without standing up DIY machine-learning servers that become single points of failure. Which approach best improves reliability for the voice and text pipeline?
- A county permit system uses active-passive databases with a manual promote during outages. Tabletop reviews show promote steps often miss the published RTO. What should the architect emphasize first?
- A municipality must archive sealed court recordings that require extreme durability across devices and facilities, not a single server disk. Which storage choice best matches that durability need?
- A city’s citizen portal Auto Scaling group currently registers targets in only one Availability Zone behind an Application Load Balancer. Leadership wants production-grade high availability. What should the architect change?
- A public-health reporting system requires an RTO measured in hours and an RPO measured in minutes. Leadership currently funds only nightly backups with restore from scratch. Which direction should the architect recommend?
- During a city payroll outage, operators argue about whether the fault is the application or an AWS Regional service event. What should HA runbooks emphasize?
- A municipality wants a resilient stack for a public website: web tier that can lose instances, a relational database that survives AZ loss, and object storage that can recover in another Region. Which composition best fits?
- Several partner cities call a shared regional API on API Gateway. One city can exhaust request quotas and starve others. What should the architect apply to protect shared resilience?
- Architects drew a multi-AZ design with Route 53 health checks and Auto Scaling for a voter-results API, but the design has never been failed over in production-like conditions. What validates that recovery actually works?
- A parks recreation site suffers outages when in-place package updates fail mid-deploy on long-lived instances. Which deploy approach best reduces change-related downtime?
- A city’s multi-Region DR plan replicates compute templates and databases, but after failover the standby Region cannot decrypt application secrets. What dependency was likely missed?
- A municipal CAD integration needs ultra-low-latency TCP load balancing with health checks across Availability Zones at Layer 4. Which load balancer fits best?
- A license portal still stores session files and uploads on a single instance’s local disk, so any instance death loses state. How should the architect redesign for distributed resilience?
- Finance questions why warm standby for the utility outage portal costs more than backup-only restore. How should the architect frame the trade-off?
- A library events API runs in an Auto Scaling group behind a load balancer. Occasionally an instance fails its health checks. What self-healing behavior should the architect rely on?
- A city CMS needs a shared POSIX file system that multiple web instances across Availability Zones can use, and content must survive loss of one AZ. Which file storage approach fits?
- A county is using AWS Application Migration Service to move a permitting app. What must the cutover target architecture include for resilience?
- A metro government runs a complex multi-Region citizen portal and wants Associate-level readiness checks that confirm Regional stacks can take traffic before a planned failover. Which capability class should architects be aware of?
Design High-Performing Architectures · 72 questions
- A GIS team needs a home directory that many EC2 analysis instances can mount concurrently with POSIX semantics. Which storage service should the architect choose?
- A city engineering CAD database on EC2 needs consistent low-latency IOPS for its data disks. Which EBS guidance is most appropriate?
- A county open-data program will publish multi-terabyte media datasets that many researchers read in parallel. Which storage platform best fits that scale?
- Public-works engineers still open hot CAD drawings from on-premises file shares, but leadership wants those files backed by durable cloud object storage. Which hybrid approach fits?
- A transit agency archives large sequential video files on an EC2-attached volume where throughput matters more than tiny random IOPS. Which EBS type is appropriate?
- A permitting database EC2 host needs a simple, cost-effective boot disk plus a separately tuned data disk. What volume layout should the architect use?
- A city finance department needs a high-performance SMB file share integrated with Active Directory for Windows desktops. Which managed service best fits?
- A county emergency-management office runs a burst HPC-style flood model on AWS that needs extremely high-throughput parallel file access for scratch and working datasets. Which storage service best fits this high-performance compute pattern?
- A regional evidence unit must upload multi-gigabyte case media from distant field offices into Amazon S3 when WAN latency is high. Which approach best improves large remote ingest performance?
- A city GIS team shares home directories on Amazon EFS. Analysts open thousands of small map tiles and config files, not a few large sequential streams. Which EFS configuration choice best matches that access pattern?
- A municipal media desk runs a video transcode fleet on EC2 and needs extremely fast local scratch during each job, but finished masters must remain durable evidence. Where should the scratch workspace live?
- An elections office expects election-night media spikes and wants storage that can absorb unpredictable growth without mid-event volume resizing. Which design best scales ahead of that spike?
- A township must place three workloads: a relational permitting database, a CMS that needs a shared POSIX file tree for web nodes, and long-term backups plus media archives. Which storage-type mapping is correct?
- A county plans to migrate multi-terabyte on-premises file shares into Amazon EFS, FSx, or S3 with scheduling, bandwidth control, and integrity validation. Which service best accelerates that large-scale transfer?
- A city tax portal sees seasonal filing spikes and runs a stateless EC2 web fleet behind a load balancer. How should compute scale to meet request demand?
- A county assessor runs nightly parcel GIS batch jobs that need managed provisioning of compute for containerized or AMI-based workers. Which service best fits this large-scale batch pattern?
- A city’s open-data program needs distributed Apache Spark jobs to transform large civic datasets before publishing. Which AWS service is the appropriate managed big-data processing cluster choice?
- A parks department runs event-driven image moderation on AWS Lambda and must meet a latency SLO. CPU for Lambda scales with memory. What should the architect do?
- A municipal permitting platform decomposes into container microservices and the team wants elastic compute without managing EC2 capacity for the nodes. Which compute option best removes EC2 node operations?
- A public-works team needs containerized model inference that requires GPU instance types. Managed Rekognition does not cover their custom model. Which compute placement meets the special-hardware need?
- A city records portal accepts citizen uploads on an API tier and must virus-scan files with a separate worker fleet. How should the architect enable each tier to scale independently under load?
- A county security office runs CPU-bound encryption jobs and a separate in-memory analytics workload. Which instance-family guidance is appropriate?
- A 311 application stack includes an EC2 Auto Scaling group and a DynamoDB table. The architect must define when capacity grows. What is the sound approach?
- Field inspectors use a mobile app that must execute light logic with ultra-low latency near users, not only from a distant Region. Which associate-level design awareness is most appropriate?
- A utility AMI platform emits one meter event that must trigger analytics, alerting, and archival compute paths without blocking the producer. Which messaging pattern best enables elastic fan-out?
- Municipal Kubernetes services on Amazon EKS must add pods when CPU or custom metrics rise. Which scaling approach fits container orchestration performance needs?
- A bursty 311 webhook invokes AWS Lambda and occasionally throttles during storm-related spikes. What should the architect do to meet burst concurrency needs?
- A health-department Java API needs a load-balanced, elastic web environment without the team wiring a custom Auto Scaling group and load balancer from scratch. Which service fits?
- A library consortium needs common computer-vision checks on uploaded photos and wants strong performance with minimal GPU fleet operations. What should the architect prefer?
- A utility writes high-scale meter readings to DynamoDB. Hot partitions are causing throttling on a few keys. Which access-pattern design best improves performance?
- A county property-search site is read-heavy against Amazon RDS and frequently repeats the same queries. How should the architect improve database read performance?
- A finance office runs OLTP on Aurora MySQL and also runs heavy reporting queries. How should traffic be separated for high-performing database access?
- A city permitting database on Amazon Aurora PostgreSQL sees sudden IOPS spikes when inspectors sync field photos and plan reviews after lunch. Storage grows unpredictably as new permit years open. Which design best meets the spiky I/O and growing footprint without constant manual resize tickets?
- A serverless city permit API uses many concurrent AWS Lambda functions that open short-lived connections to Amazon RDS. During renewal season the database hits maxconnections and new Lambdas fail. What should the solutions architect introduce to stabilize connection churn?
- A municipality is choosing databases for two workloads: (1) millions of meter-ID lookups with simple key access, and (2) a permitting app that needs multi-table joins and transactional integrity. Which pairing best matches access patterns?
- A county fraud team needs to explore how vendors, subcontractors, purchase orders, and shared addresses connect across years of procurement data. Lookups are relationship-heavy, not simple primary-key gets. Which AWS database service fits this graph-style investigation?
- A city’s parks work-order app already runs on MongoDB-compatible document APIs on premises. Architects want a managed AWS service that preserves that document model with minimal application rewrite. Which service should they select?
- A regional 911 analytics team needs a managed wide-column store that speaks Cassandra Query Language (CQL) for existing telemetry tables. Which AWS service matches that requirement?
- A county clerk must move an on-premises Oracle licensing database to Amazon Aurora PostgreSQL with schema conversion and ongoing replication until cutover. Which AWS approach fits this heterogeneous migration?
- During a city game-day festival app, citizen sessions and a live scavenger-hunt leaderboard need sub-millisecond reads and writes far hotter than the primary database should absorb. Which service should front those patterns?
- A regional building-department portal must keep database latency low for local staff while surviving an Availability Zone outage, and later may serve a second metro Region for DR locality. How should the architect place the database tier for performance and HA?
- Utility telemetry arrives as a write-heavy stream (Amazon Kinesis into Amazon DynamoDB), while an open-data catalog is read-heavy with relatively few writes. What capacity and key-design mindset should the architect apply?
- A seasonal tax-appeal departmental app needs full relational SQL compatibility but sits nearly idle most months and spikes for a few weeks. Which database option best fits variable load without oversized always-on capacity?
- Finance analysts need columnar scans across years of utility usage for ad-hoc reports. Cashiers still need single-row transactional updates on active accounts. Which design keeps each engine in its lane?
- A city publishes a global static open-data portal (HTML, JS, CSV, GeoJSON) and needs low time-to-first-byte for citizens worldwide. Which AWS design best improves performance?
- Field inspectors run a custom TCP client against a municipal API. They sit on varied ISPs, need stable anycast entry IPs, and want fast regional failover that is not limited to HTTP caching. Which service should front the dual-Region endpoints?
- Architects are laying out a three-tier VPC for a municipal web app: internet-facing load balancers, private application instances, and private databases. Which subnet and routing approach supports scale and correct exposure?
- A county wants one hostname for citizens but must route /permits, /payments, and /inspections to different microservice target groups. Which load balancer capability fits?
- Several county VPCs must consume a shared partner case-management API privately without building a full VPC peering mesh to the partner network. Which approach scales private connectivity cleanly?
- A records center still on premises must move multi-terabyte nightly batches into AWS with consistent high bandwidth. Leadership also wants a resilient backup path if the primary link fails. Which hybrid design fits?
- A county organization has many VPCs (parks, courts, utilities, shared services) that need scalable transitive connectivity without a brittle peering mesh. Which hub service should they use?
- During VPC design for a growing municipality, the network team proposes /28 subnets for every application tier to “save” addresses. What IP planning guidance should the solutions architect give for future scale?
- A latency-sensitive GIS app tier chats constantly with Redis and a database. Architects also require Multi-AZ resilience for the overall stack. How should they place resources?
- A TCP-based GIS streaming service must handle extreme concurrent connection counts from sensors and thick clients with ultra-low latency at layer 4. Which load balancer is the better fit?
- Remote municipal IT admins need encrypted user-level access from laptops into VPC private resources for after-hours support. Site-to-Site VPN already links headquarters, but individual teleworkers are not on that office network. What should the architect provide?
- A citizen API is deployed in us-east-1 and us-west-2. The architect wants DNS to send each user to the Region that currently offers the lower latency. Which Route 53 policy fits?
- Security wants to insert scalable inline network appliances (IDS/firewall) into VPC traffic flows without hand-building fragile per-instance routes for every new appliance. Which load balancing pattern supports that insertion model?
- A county records office runs analytics jobs in private VPC subnets that read large case-file objects from Amazon S3 and meter metadata from Amazon DynamoDB. Staff want higher, more predictable throughput and to keep that traffic on the AWS network instead of hairpinning through the internet or a NAT gateway. Which design best meets those goals?
- A municipal water department needs to ingest high-frequency hydrant pressure telemetry from thousands of field sensors so downstream services can react within seconds. Which AWS service is the most appropriate high-throughput streaming ingest layer for this architecture?
- A city’s 311 analytics team wants a managed path that continuously batches streaming complaint events into an Amazon S3 data lake and optionally into Amazon OpenSearch Service for near-real-time dashboards, without operating custom consumer fleets. Which service best fits?
- A finance office drops nightly CSV budget extracts into Amazon S3. Analysts complain Athena queries scan too much data and run slowly. Which approach best improves analytic performance for those ad-hoc SQL workloads?
- City council staff need occasional interactive SQL against open-data files already landing in Amazon S3, but the IT board refuses to stand up and pay for a always-on data warehouse cluster. Which service best enables that ad-hoc querying pattern?
- Multiple city departments share one Amazon S3 data lake, but police, parks, and finance each need different column- and table-level permissions for sensitive datasets. Which AWS capability is best suited to govern that fine-grained lake access?
- Department heads need interactive visual dashboards of curated budget-spend datasets already prepared in the analytics environment. Which AWS service best provides that business-intelligence visualization layer?
- A public-works GIS team keeps nightly-updated project files on an on-premises NFS share and wants an efficient, scheduled replication into Amazon S3 for analytics without rewriting applications as custom rsync fleets. Which service best fits?
- A city’s legacy backup application still speaks tape or block volume protocols, but leadership wants those backups to land in durable AWS storage as a controlled hybrid ingest path. Which service best bridges that legacy path?
- An elections office must process multi-terabyte historical ballot and precinct datasets with Apache Spark transformations before loading analytic tables. Which AWS service best provides managed big-data compute for that heavy processing?
- Regional partner agencies must upload telemetry into the city’s analytics platform, but security policy forbids exposing raw Amazon S3 buckets publicly on the internet. Which approach best provides private, authenticated ingest access points?
- A smart-city architecture office must choose ingest patterns: streetlight controllers emit sub-second voltage samples, while the finance system exports ledger files once each night. How should the team match ingest frequency to those needs?
- Several city technology partners already operate Kafka clients and require Kafka-compatible tooling for an event pipeline into municipal systems. Which AWS service best provides a managed Kafka-compatible streaming option?
- During a holiday parade, citizen phone apps will spike location and crowd-density telemetry far above normal weekday rates. What should architects do when planning Amazon Kinesis Data Streams and Amazon Data Firehose capacity for that day?
- After ingest pipelines land municipal ordinances, meeting minutes, and permit PDFs into the analytics platform, clerks need full-text search across those documents. Which service best supports that search and log-analytics style access pattern?
Design Cost-Optimized Architectures · 60 questions
- A police records bureau stores cold case PDFs in Amazon S3 Standard even though they are almost never retrieved. Leadership wants to cut storage cost while keeping the objects durable in AWS for rare legal holds. Which approach best reduces cost?
- A city’s media archive in Amazon S3 has unpredictable access: some campaign videos go viral for a week, then sit untouched for months. Which storage class strategy best optimizes cost when access patterns are unknown?
- A computer-aided dispatch (CAD) database on Amazon EC2 uses Amazon EBS. Metrics show moderate IOPS needs well within gp3 capabilities, but the volume was provisioned as io2 for “future proofing.” What cost-aware storage change should the architect recommend?
- Engineering shares rarely touched CAD drawing archives on Amazon EFS. Most files are old reference sets opened a few times a year. How can the city lower EFS storage cost for that cold shared data?
- A municipality’s AWS Backup plan retains Amazon EBS snapshots forever, and storage costs grow every month even though policy only requires 35 days of operational recovery points. What change best addresses the cost of retention?
- IT must migrate large on-premises file shares to Amazon S3 for a records digitization project. A proposal suggests dozens of self-managed EC2 rsync workers. Which alternative better balances transfer effectiveness and operational cost?
- A field office needs block storage for a legacy application but wants to avoid buying a full on-premises disk array for mostly cold data. Which hybrid approach best minimizes local disk purchase while using Amazon S3 as durable backing store?
- The GIS office publishes a large open geospatial dataset in Amazon S3 that external researchers download heavily, driving up the city’s request and data-transfer bills. Which S3 feature best shifts those request and download costs to the requesters?
- Finance wants monthly chargeback reports that show Amazon S3 spend by department (parks, police, public works). What foundational practice enables that cost allocation?
- A digitization team uploads many large scanned permit packets to Amazon S3 daily. Leadership asks how to reduce PUT request overhead and stored bytes without changing durability goals. Which upload strategy best helps?
- A municipal GIS team provisioned 10 TB Amazon EBS volumes for mapping servers, but CloudWatch metrics show only about 1 TB used for months. What should the city architect do to cut storage cost without changing the application design?
- A small city wants Windows file shares for a handful of department apps and is comparing Amazon FSx for Windows File Server with a self-managed Windows file cluster on EC2. Which cost guidance should the architect emphasize?
- A county clerk must archive closed case PDFs that are rarely opened but, when needed, must appear within milliseconds for courtroom staff. Which Amazon S3 storage class best balances archive cost with that restore latency?
- A parks department shares CAD drawings on Amazon EFS. Traffic is usually low, with short bursts when planners open large plan sets. How should the architect control EFS throughput cost?
- After a public-works VM cleanup, the finance office still sees unexpected storage charges. Which approach best finds forgotten unattached Amazon EBS volumes?
- A city's CAD reporting fleet runs the same EC2 instance size 24/7 year-round with predictable CPU. Which purchasing approach most improves compute cost efficiency?
- A planning department runs overnight GIS tile-generation jobs that can restart from checkpoints if a worker stops. Which compute choice best reduces cost?
- An internal city-hall form API is invoked only a few dozen times per day and has no need for a persistent server. Which design most reduces idle compute cost?
- A municipality runs nonproduction container workloads that can tolerate interruption. Which approach best lowers container compute cost?
- CloudWatch shows a city's public web Auto Scaling group averaging very low CPU and memory on oversized instance types. What should the architect do first to cut waste?
- A county keeps a few bastion hosts that admins use rarely overnight, but each host must preserve in-memory session state when brought back. Which cost-saving compute action fits?
- A citizen portal must handle lunchtime spikes and quiet nights. Leadership proposes one very large EC2 instance. What cost-and-elasticity guidance should the architect give?
- A utilities API needs only TCP load balancing without HTTP routing, WAF integration, or path-based rules. How should the architect choose a load balancer with cost in mind?
- The city's nonproduction account mirrors production sizes and runs all night and weekend. Which change best reduces nonprod compute cost while keeping weekday testing?
- A town council asks whether every municipal app should run on AWS Outposts 'to be modern.' Which cost-aware recommendation is appropriate?
- Operators guess that a permitting app needs memory-optimized EC2 instances, but metrics show CPU saturation with comfortable free memory. What should the architect recommend?
- A public-safety department has a fixed monthly AWS compute allotment and needs early warning before overruns. Which service configuration supports that guardrail?
- Several micro AWS accounts for tiny city projects show idle Auto Scaling groups still billing. How should finance and architects improve accountability and cut waste?
- IoT hydrant sensors can preprocess readings at the edge or ship raw streams centrally. When is edge processing the cost-sensible architecture choice?
- A county assessor runs heavy valuation jobs once per month and currently keeps a large EC2 grid powered all month. What cost-optimized alternative should the architect propose?
- A civic events app sees unpredictable traffic spikes, while a meter-reading API has steady, well-known load. How should DynamoDB capacity modes be chosen for cost?
- A business-license database is busy during renewal season and nearly idle the rest of the year. Which relational option best aligns cost with that duty cycle?
- A city portal repeatedly reads the same reference data from Amazon RDS, driving a costly sprawl of read replicas. What cost-aware alternative should the architect evaluate?
- A serverless permit API opens many short database connections and forces the city to run a larger RDS instance than query CPU warrants. How can RDS Proxy help cost?
- A records system keeps daily Amazon RDS snapshots with a 365-day retention 'just in case,' far beyond the city's documented 7-day recovery policy. What should the architect recommend for backup cost?
- A county assessor still runs Oracle on premises and wants lower database license cost in AWS while keeping a managed relational engine. Which migration approach best targets that cost goal?
- A city permitting portal stores short-lived citizen session keys with simple key-value lookups and wants lower operations cost than an always-on relational database. Which design fits best?
- A municipal analytics warehouse on Amazon Redshift is busy only during weekday business hours and sits idle nights and weekends. Which cost control best matches that usage pattern?
- A township finance Aurora cluster feels slow, and staff want to jump to a much larger instance class immediately. What should the architect do first to avoid unnecessary cost?
- A parks department DynamoDB table accumulates ephemeral push-notification receipts that are useless after a few days and keep growing storage cost. Which control best limits that spend?
- A county runs RDS for both production tax systems and short-lived developer sandboxes. How should Multi-AZ be applied to control database cost without harming production RTO?
- Cost Explorer shows several county RDS instances nearly idle overnight while still accruing instance charges. Which action best reduces that waste?
- Heavy council dashboard queries keep forcing a municipal Aurora OLTP cluster to larger instance classes. Which architecture change best controls that database cost?
- A city clerk RDS database needs solid baseline performance but does not require provisioned io2-level IOPS. Which storage choice best balances cost and capability?
- A regional water authority considers an Aurora or RDS cross-Region read replica for a second office. When is that replica the cost-aware choice?
- A small township VPC has private-subnet workloads that need occasional outbound internet access. Leadership wants to limit NAT cost while understanding HA trade-offs. Which guidance is most accurate?
- Nightly municipal backups from private subnets go to Amazon S3 through a NAT Gateway, and data-processing charges are high. Which change most directly cuts that network cost?
- A city open-data site serves mostly static PDFs and images from an ALB/EC2 origin, and egress bills keep climbing. Which architecture change best reduces origin and data-transfer cost?
- A multi-county records bureau moves steady high-volume traffic between on-premises systems and AWS. Leadership asks whether AWS Direct Connect or Site-to-Site VPN is the cost-aware hybrid link. What should the architect do?
- A permit application's chatty app tier and database generate large cross-AZ data-transfer charges inside one Region. Which cost-aware placement approach is most appropriate while retaining HA?
- Several partner agencies need private access to a municipal API without building a full VPC peering mesh and extra NAT paths. Which approach can reduce cost and complexity?
- A citizen mobile API on API Gateway occasionally sees abusive request spikes that drive expensive downstream scale-out. Which control best caps that cost risk?
- A county ordered a Direct Connect port much larger than measured hybrid traffic after a cautious overestimate. What is the cost-aware next step?
- A city now has many VPCs and a growing mesh of peering links that is hard to operate. Leadership asks whether Transit Gateway is worth its attachment costs. What evaluation is most appropriate?
- Finance notices rising data-transfer charges and suspects unnecessary cross-Region replication in a parks account. Which approach best finds that waste?
- Citizens download large zoning PDFs that currently hairpin through EC2 and a NAT Gateway before reaching users. Which delivery path is more cost-efficient for public downloads?
- A county already has AWS Direct Connect for primary hybrid connectivity and needs failover. The SLA allows a VPN backup. Which design best controls redundancy cost?
- A municipal shared-services VPC accumulated many interface VPC endpoints for rarely used AWS APIs, and hourly endpoint ENI charges are noticeable. What should the architect do?
- A transit agency evaluates AWS Global Accelerator for a public API already fronted by DNS failover and CloudFront for static content. When is Global Accelerator the cost-aware choice?
- A city finance office cannot attribute NAT Gateway and Transit Gateway attachment charges back to parks, utilities, and public-safety departments. Which practice best enables that chargeback?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by Amazon Web Services.