AWS Solutions Architect Professional Practice Test

Answer choices

1. A. Use a single VPC peering connection and keep adding nontransitive peer routes as more VPCs are created.
2. B. Build a fleet of EC2 routers and manage BGP sessions on the instances manually.
3. C. Use AWS PrivateLink to connect every VPC to every other VPC bidirectionally.
4. D. Use AWS Transit Gateway for the VPC, VPN, and Direct Connect attachments.

Wrong-answer review

• A. Use a single VPC peering connection and keep adding nontransitive peer routes as more VPCs are created.: VPC peering is not transitive, so it becomes unwieldy for many VPCs and on-premises paths.
• B. Build a fleet of EC2 routers and manage BGP sessions on the instances manually.: Self-managed routers add operational burden that Transit Gateway is meant to remove.
• C. Use AWS PrivateLink to connect every VPC to every other VPC bidirectionally.: PrivateLink exposes services privately, but it is not a bidirectional routing fabric for all VPC traffic.

Answer choices

1. A. Use AWS Client VPN from every application server to the database VPC.
2. B. Use Cost Explorer recommendations to select the secondary database Region.
3. C. Trigger a Lambda function that waits several days before deleting old database exports.
4. D. Use Amazon Aurora Global Database with a primary Region for writes, secondary Regions for low-latency reads, and a documented switchover or failover plan to promote a secondary cluster.

Answer choices

1. A. Use one shared IAM user for the operations team across all production accounts.
2. B. Deploy AWS WAF and assume it covers identity misuse and data access in private services.
3. C. Reduce blast radius with scoped identities, centralized logs, encryption, segmented access paths, and governance guardrails.
4. D. Disable CloudTrail in development accounts to reduce log volume.

Answer choices

1. A. Move all workloads into one account so a single IAM policy can control every team.
2. B. Use AWS License Manager to group accounts and enforce security guardrails.
3. C. Use VPC sharing as the only control for account separation and policy enforcement.
4. D. Use AWS Organizations to place the acquired accounts into OUs and apply policies by business unit.

Answer choices

1. A. Use security groups as the only control and allow 0.0.0.0/0 where troubleshooting is easier.
2. B. Put all application teams in the same IAM role and distinguish access by resource tags only.
3. C. Use cost allocation reports to detect unauthorized access after the fact.
4. D. Limit blast radius with scoped roles, account boundaries, segmentation, encryption, centralized logs, detection, and governance controls.

Answer choices

1. A. Stop and start the Redis cluster every evening with Instance Scheduler.
2. B. Configure ElastiCache for Redis Auto Scaling to add or remove read replicas based on a scaling policy such as CPU utilization or current connections.
3. C. Move the cache data to S3 Standard-IA for automatic tiering.
4. D. Place an Application Load Balancer in front of Redis nodes to route clients to the cheapest Region.

Answer choices

1. A. Enable a CloudFront distribution for the source application and call the migration complete.
2. B. Use AWS Migration Hub and discovery data to assess dependencies, plan migration waves, track progress, and reduce cutover risk.
3. C. Run AWS DMS full load for all databases without mapping the applications that consume them.
4. D. Send production traffic to the target before validating migrated dependencies.

Answer choices

1. A. Run a custom proxy in one account and route all workload traffic through it.
2. B. Deploy self-managed Active Directory domain controllers in every account.
3. C. Create or use a management account, create an AWS Organization, and invite the standalone accounts to join as member accounts for consolidated billing.
4. D. Delete IAM users in each account and recreate them from a central script.

Answer choices

1. A. Review container-service utilization, storage access patterns, scaling behavior, and commitments before choosing cost changes.
2. B. Use Application Migration Service to copy every workload into a new account as the cost fix.
3. C. Configure Auto Scaling to terminate all compute whenever CPU falls below 20 percent.
4. D. Delete IAM users that have not logged in during the current month.

Answer choices

1. A. Use AWS Migration Hub with discovery data to group servers by application, assess dependencies, and plan migration waves.
2. B. Provision the target Kubernetes cluster first and decide migration waves after workloads are live.
3. C. Use a spreadsheet of server names as the only migration tracking system.
4. D. Cut over all container services at once because they share the same base image.