AWS certification question bank
304 reviewed practice questions across 9 certifications. Search and filter the bank, or open any question to see the correct answer and per-option explanations.
Domain 1: Design Secure Architectures (30%)
IAM & Access Control
Practice this topic →- easyA Lambda function must read objects from one specific S3 bucket and nothing else. What is the MOST secure way to grant this access?
- mediumA partner AWS account needs read access to CloudTrail logs in your S3 bucket. Which approach follows AWS best practices for cross-account access?
- easyWhich combination of measures best protects highly privileged IAM users according to AWS best practices?
- hardA company uses AWS Organizations with dozens of member accounts. Security wants to guarantee that no member account can disable CloudTrail or move resources to unapproved Regions, even if an account administrator tries. What should they use?
- mediumA mobile app needs user sign-up/sign-in with MFA, social identity providers (Google, Apple), and JWT tokens the backend can validate — without building an auth system. Which service provides this?
- mediumA mobile app needs sign-up/sign-in for millions of end users, with social login and temporary AWS credentials for calling an API backend. What should you use?
Network Security
Practice this topic →- mediumA solutions architect needs to deny traffic from a specific malicious IP range at the subnet boundary. Security groups only support allow rules. Which control can explicitly DENY the IP range?
- mediumAn application behind an Application Load Balancer is experiencing SQL injection attempts and cross-site scripting in HTTP requests. Which AWS service provides managed rules to block these common web exploits at layer 7?
- mediumEC2 instances in a private subnet must download OS patches from the internet, but must NOT accept inbound connections initiated from the internet. What should the architect deploy?
- easyWhich AWS service automatically protects resources such as CloudFront distributions and Elastic Load Balancers against common network and transport layer (layer 3/4) DDoS attacks at no additional cost?
- mediumInstances in private subnets must call the Amazon SNS API, and security policy forbids routing that traffic through an internet gateway or NAT gateway. What provides private connectivity to the AWS service?
- mediumA three-tier app must allow the web tier's instances to reach the app tier on port 8080, and nothing else. Instances in both tiers change frequently due to Auto Scaling. What's the most maintainable security-group design?
- mediumA login API behind an ALB is under a credential-stuffing attack — thousands of requests from rotating IPs. Which WAF feature mitigates this without blocking legitimate users?
- mediumWeb tier → app tier → database tier. You want the app tier to accept traffic ONLY from web-tier instances, and the DB tier only from app-tier instances — without hardcoding IPs. What mechanism expresses this?
Data Protection & Encryption
Practice this topic →- mediumCompliance requires that the company controls the keys used to encrypt data in S3, including the ability to rotate keys and audit every key usage. Which encryption option meets these requirements?
- mediumAn application stores RDS database credentials in a configuration file. The security team requires centralized secret storage with built-in automatic rotation. Which service should be used?
- easyA company wants to serve HTTPS traffic through an Application Load Balancer using a publicly trusted certificate that is provisioned and renewed automatically at no cost. Which service should provide the certificate?
- hardA web application stores regulated data in RDS. Which TWO controls together provide defense-in-depth for BOTH data at rest and application access? (Select TWO.)
- easyA security team wants a single account-level control that prevents any S3 bucket in the account from becoming publicly accessible, regardless of how bucket policies or ACLs are configured. What should they enable?
- mediumWhich TWO AWS services provide threat detection and API-activity auditing across an AWS account? (Select TWO.)
- hardA media company sells premium videos served via CloudFront. Videos must be accessible only to paying subscribers for a limited time. Which mechanism enforces this?
- hardAccount A's KMS key encrypts S3 objects that account B must read. Both permissions exist — the key policy lists account B, and B's role allows kms:Decrypt — yet access still fails. What's missing?
Domain 2: Design Resilient Architectures (26%)
High Availability
Practice this topic →- easyA web tier runs on a single EC2 instance in one Availability Zone. The company needs the application to keep serving requests if that AZ fails. What is the simplest resilient redesign?
- mediumA production RDS for PostgreSQL database must fail over automatically to a standby within minutes if the primary DB instance or its AZ becomes unavailable. Which configuration provides this?
- mediumA site runs in two Regions. Users should be directed to the secondary Region automatically when health checks detect the primary Region's endpoint is unhealthy. Which Route 53 feature accomplishes this?
- mediumA global app has identical deployments in eu-west-1 and us-east-1. Users in Europe should reach the European deployment and US users the American one — routed by user geography, not measured latency. Which Route 53 policy?
- mediumA web tier stores user sessions in local memory on each EC2 instance. When Auto Scaling replaces instances, users lose sessions. What change makes the tier properly stateless?
- hardA global application needs a relational database readable with low latency in three Regions, able to promote a secondary Region to full read-write within about a minute for regional DR. Which option fits?
- mediumWhen an Auto Scaling group terminates an instance, in-flight uploads must finish and a cleanup script must run before the instance dies. Which feature holds the instance in a wait state for this?
- mediumAn Aurora cluster's writer instance fails. What happens to availability and what is the expected failover time?
Decoupling & Messaging
Practice this topic →- easyA payment API sometimes fails when the downstream invoice-generation service is overloaded or unavailable. Orders must not be lost. Which change makes the architecture resilient?
- mediumWhen an order is placed, three independent systems — fulfillment, analytics, and notifications — must each receive the event. The systems should not know about each other, and adding future consumers should not require producer changes. Which design fits best?
- mediumA queue carries financial transactions that must be processed exactly once and strictly in order. Which queue type should be selected?
- mediumA consumer repeatedly fails to process a small number of malformed SQS messages, blocking the queue and generating reprocessing noise. What is the standard mechanism to isolate these messages for later analysis?
- mediumWorker failures occasionally poison SQS messages — after 3 receives they should move aside for inspection, then return to the queue once fixed. Which configuration does this?
Disaster Recovery
Practice this topic →- hardA workload requires recovery in a second Region with RTO under 1 hour and near-zero RPO, but full multi-site active/active is too expensive. Which DR strategy best balances these requirements?
- mediumThe company must centrally manage and audit backups for EC2 (EBS), RDS, EFS, and DynamoDB across accounts, with scheduled policies and retention rules. Which service is designed for this?
- easyA business can tolerate losing at most 15 minutes of data. Which statement correctly captures what the backup design must satisfy?
- mediumWhich disaster-recovery approach keeps only the minimal data-replication components running in the DR Region — the data layer always live but the application stack provisioned only when needed?
- easyDR policy requires encrypted backups of RDS and EBS in a second region, managed under one policy with retention rules. What's the simplest compliant approach?
Resilient Storage
Practice this topic →- mediumObjects in an S3 bucket must be protected against both accidental deletion and overwrites, while retaining S3's multi-AZ durability. What should be enabled?
- mediumAn Auto Scaling group of EC2 instances across three AZs must all read and write the same file system, which must remain available if one AZ fails. Which storage service fits?
- mediumAn EBS volume's data must survive an AZ outage and be recoverable into a different AZ within minutes. What mechanism enables this?
Domain 3: Design High-Performing Architectures (24%)
Compute Selection
Practice this topic →- easyImages uploaded to S3 must be resized. Work is bursty — zero to thousands of uploads per hour — and each resize finishes in seconds. Which compute option is the best operational fit?
- mediumA latency-sensitive API has constant high traffic, requires sub-millisecond internal calls between microservices, and needs full control of the runtime environment including a custom kernel module. Which platform is most appropriate?
- mediumA nightly analytics job runs thousands of parallel, fault-tolerant tasks for 4 hours. Tasks can be interrupted and retried without harm. Which approach provides scalable, efficient capacity?
- mediumA database on EC2 needs consistently high IOPS beyond what general-purpose volumes deliver, with provisioned IOPS independent of volume size. Which EBS volume family is designed for this?
- mediumA platform must ingest clickstream events in real time and let multiple downstream applications each process the same stream independently, with replay of recent records. Which service is designed for this?
- mediumA tightly-coupled HPC workload needs the lowest possible network latency between its EC2 instances within a single AZ. Which EC2 placement group should be used?
- mediumA real-time multiplayer game needs millions of concurrent TCP connections at ultra-low latency, with a static IP for whitelisting. Which load balancer fits?
- mediumA latency-sensitive API on Lambda has acceptable median latency but occasional multi-second spikes on the first request after idle. What eliminates these cold-start spikes?
Database Selection & Scaling
Practice this topic →- mediumA reporting feature adds heavy read traffic to an RDS MySQL database, slowing the primary writer. Most reads are tolerant of slight staleness. What is the standard way to scale reads?
- mediumA session store needs single-digit-millisecond key-value reads and writes that must scale to unpredictable internet-scale traffic, with no relational queries required. Which database is the best fit?
- hardA DynamoDB-backed catalog suffers hot-key read spikes on popular items during flash sales, pushing reads from ~5ms to higher latency. What reduces read latency and offloads repeated reads MOST effectively?
- hardA DynamoDB table uses a partition key with only a handful of distinct values (e.g., a status field), so a few keys receive most of the traffic and get throttled. What's the fix?
- hardA DynamoDB table throttles during a promotion: reads hit a single 'promo' partition key, while the rest of the table sits idle. What's the fix?
Caching & Content Delivery
Practice this topic →- easyUsers worldwide download static media from a single-Region S3 bucket and experience high latency. What reduces latency with minimal architecture change?
- mediumA product service re-computes the same complex SQL query for every request, and the result changes only hourly. The team wants microsecond-to-millisecond lookups and to relieve the database. What should they add?
- hardA real-time bidding API (non-cacheable, dynamic TCP traffic) must reduce latency for global users hitting an ALB in one Region. CloudFront cannot cache this traffic. Which service improves performance using the AWS global network?
- mediumA distributed team uploads large files to an S3 bucket in one Region and uploads are slow over long distances. The content itself doesn't need edge caching. Which feature improves upload speed most directly?
- hardA session store needs an in-memory cache with persistence, replication, failover, and data structures like sorted sets for leaderboards. Which ElastiCache engine is required?
- mediumA cache needs persistence, replication with failover, pub/sub for cache invalidation events, and sorted-set data structures. Which ElastiCache engine?
Scalability & Elasticity
Practice this topic →- mediumWeb traffic roughly doubles every weekday at noon and halves overnight, but the exact level varies. The architecture must maintain response times without paying for permanent peak capacity. Which approach is most appropriate?
- mediumA fleet of containers exposes HTTP/HTTPS APIs that need path-based routing to different services and integration with AWS WAF. Which load balancer type is required?
Domain 4: Design Cost-Optimized Architectures (20%)
Cost-Optimized Storage
Practice this topic →- easyRegulatory archives must be retained 7 years, are retrieved at most once a year, and a retrieval time of several hours is acceptable. Which S3 storage class minimizes storage cost?
- mediumApplication logs in S3 are actively queried for 30 days, rarely read for the next 60 days, and must be retained for 1 year. Which approach reduces cost automatically over time?
- mediumA data lake holds objects whose access frequency is unknown and changes over time; some objects go untouched for months then spike. Retrieval must remain millisecond-latency. Which storage class automatically optimizes cost?
- mediumAn infrequently accessed EC2 data volume uses a large general-purpose SSD where a cheaper option would suffice. Which EBS volume type is the least expensive for cold, infrequently accessed data?
- easyMost files on an EFS file system are rarely accessed. Which feature reduces cost automatically without moving files to another service?
- mediumA compliance team must retain audit logs for 7 years. Retrievals happen rarely and can wait up to 12 hours. Which S3 storage class minimizes cost for this archive?
- easyLog objects must be kept 7 years: queried daily for 30 days, rarely after a year, almost never after that. What's the most cost-effective storage strategy?
Cost-Optimized Compute
Practice this topic →- mediumA production database server runs 24/7 on EC2 at a stable size for at least the next year. The company wants the largest legitimate discount without changing the architecture. What should they purchase?
- easyCost Explorer shows a fleet of EC2 instances averaging 5% CPU for months. The team wants the lowest-effort way to cut compute spend while keeping capacity headroom. What should they do first?
- mediumAn internal tool serves a few dozen requests per day, mostly during business hours, with occasional idle days. Which compute approach minimizes cost?
- easyAn account's bill is growing and the team suspects idle EC2 instances, underutilized EBS volumes, and over-provisioned databases. Which AWS service analyzes resource utilization and recommends rightsizing?
- mediumA company runs workloads across dozens of AWS accounts. They want combined volume discounts and a single bill with per-account visibility. Which AWS Organizations feature provides this?
- mediumNightly video-transcoding jobs are checkpointed and can restart without data loss. Which EC2 purchasing option cuts compute cost the most?
- mediumA stateless web tier compiles cleanly on ARM64. Which change most improves price-performance with zero app redesign?
Cost-Optimized Databases & Networking
Practice this topic →- hardWhich TWO choices can reduce database cost for the described workloads? (Select TWO.)
- hardInstances in private subnets transfer terabytes to S3 through a NAT gateway, generating high hourly and data-processing charges. What is the most cost-effective fix that keeps the traffic off the internet?
- mediumA dev environment's private subnets need occasional outbound internet (package updates — a few GB/month). Production needs managed HA. Most cost-effective approach for dev?
Domain 2: Security and Compliance (30%)
Security Basics
Practice this topic →- easyUnder the AWS shared responsibility model, who is responsible for patching the guest operating system on an Amazon EC2 instance?
- easyWhich TWO items is AWS responsible for under the shared responsibility model? (Select TWO.)
- easyWhat is the recommended best practice for using the AWS account root user?
- easyWhich AWS service provides intelligent threat detection by continuously monitoring for malicious activity and unauthorized behavior?
- easyWhy does AWS recommend enabling multi-factor authentication (MFA) on the root user and privileged IAM users?
- mediumWhich AWS service continuously records resource configurations and lets you evaluate them against desired settings — useful for compliance auditing?
- mediumUnder the shared responsibility model for Amazon RDS, which task remains the CUSTOMER's responsibility?
- mediumA company wants to manage billing and enforce permission guardrails across its 30 AWS accounts from one place. Which service provides this?
- easySecurity asks 'who terminated that EC2 instance yesterday?' Which service answers API-activity questions like this?
- easyWhat's the FIRST security action AWS recommends for a brand-new account's root user?
- mediumYour security team wants to run a penetration test against your own EC2 instances on AWS. What is required first?
- easyUnder the shared responsibility model, who is responsible for encrypting company data stored in Amazon S3?
- mediumYour compliance officer needs AWS's SOC 2 and ISO 27001 reports for an audit. Where can they download them?
- easyWhat does the 'principle of least privilege' mean when writing IAM policies?
Domain 1: Cloud Concepts (24%)
Cloud Essentials
Practice this topic →- easyWhich is a key benefit of running workloads on AWS compared to on-premises data centers?
- easyWhich set correctly lists the pillars of the AWS Well-Architected Framework?
- easyA startup can provision servers in minutes instead of waiting weeks for hardware procurement. Which cloud benefit does this illustrate?
- easyAn e-commerce site automatically adds server capacity before holiday traffic peaks and releases it afterward. Which cloud characteristic does this demonstrate?
- easyMoving from on-premises servers to AWS changes IT spending primarily from capital expenditure (CapEx) to what model?
- easyWhich list correctly names the AWS Well-Architected Framework's six pillars?
- easyWhich statement best describes the financial benefit of moving from on-premises servers to AWS?
- mediumWhich framework does AWS provide to help organizations plan their cloud adoption across people, processes, and technology?
- mediumWhich AWS design approach best delivers HIGH AVAILABILITY — minimizing downtime when a single component fails?
- mediumAn e-commerce site automatically adds capacity during a flash sale and releases it afterward, paying only for what it used. Which cloud characteristic does this demonstrate?
- mediumIn AWS migration guidance, what do the '6 R's' describe?
- easyA bank keeps sensitive records in its data center but runs its customer-facing app on AWS, connected via Direct Connect. Which deployment model is this?
- easyWhy can AWS offer lower prices than most companies could achieve running their own data centers?
- easyA startup doesn't know how much traffic its launch will get. Which cloud advantage lets it avoid buying servers sized for a guessed peak?
Domain 3: Cloud Technology and Services (34%)
Core AWS Services
Practice this topic →- easyWhich TWO components are part of the AWS global infrastructure? (Select TWO.)
- easyWhich AWS service lets you run code in response to events without provisioning or managing servers?
- easyWhich AWS service provides object storage for storing and retrieving any amount of data, such as images, backups, and static website files?
- easyWhich AWS service caches content at edge locations worldwide to deliver it to users with lower latency?
- easyWhich AWS service is a fully managed NoSQL database that provides single-digit-millisecond performance at any scale?
- easyWhich AWS service provides managed relational databases supporting MySQL, PostgreSQL, Oracle, and SQL Server?
- easyWhich AWS service collects metrics, logs, and events from AWS resources and lets you set alarms and dashboards?
- easyA batch rendering job can be interrupted and restarted anytime — it's not time-sensitive. Which EC2 purchase option minimizes cost?
- easyWhich AWS infrastructure component is designed to serve cached content closest to end users — lowering latency for a global audience?
- mediumA mobile game needs single-digit-millisecond reads at massive scale for player session data — key-value lookups only, no joins or SQL. Which database service fits?
- mediumA web app needs to route HTTP requests to different backend services based on the URL path (e.g., /api vs /images). Which Elastic Load Balancing type fits?
- mediumWhich TWO statements correctly match AWS storage services to their type? (Select TWO.)
- easyA team wants to define their entire AWS environment — VPCs, databases, and roles — as version-controlled templates that can be deployed repeatably. Which service does this?
- easyWhich AWS service inspects your account and recommends improvements across cost, performance, security, fault tolerance, and service quotas?
- mediumA company needs genuine AWS infrastructure and APIs inside its own data center for latency and residency reasons. Which service delivers AWS hardware on-premises?
- easyA studio must move 80 TB of footage to S3 but its internet upload would take weeks. Which AWS service ships a physical device to load data offline?
- mediumWhere do you see AWS service issues and scheduled maintenance that could affect YOUR specific resources?
- easyA team wants managed Apache Spark and Hadoop clusters for large-scale data processing. Which AWS service is designed for this?
- easyAn enterprise wants a dedicated private network connection between its data center and AWS that bypasses the public internet. Which service provides it?
Domain 4: Billing, Pricing, and Support (12%)
Billing & Support
Practice this topic →- easyA company manages 20 AWS accounts under AWS Organizations. Which benefit does consolidated billing provide at no extra cost?
- easyWhich AWS tool lets you visualize and analyze your spending patterns over time with graphs and filters?
- mediumA company needs a Technical Account Manager (TAM), 24/7 phone support, and architectural guidance. Which AWS Support plan provides this?
- mediumA finance team wants (a) to visualize WHERE last quarter's spend went by service, and (b) alerts when next month's forecast exceeds a threshold. Which two tools map to these needs?
- easyA startup wants 24/7 access to AWS engineers by phone/chat plus a Technical Account Manager for proactive guidance. Which support plan is the minimum tier that includes a TAM?
- easyBefore deploying anything, a team wants an estimate of what a proposed architecture would cost per month. Which AWS tool provides this?
- mediumWhich statement about the AWS Free Tier is correct?
- mediumA company wants commitment-based discounts on compute spend but needs flexibility to change instance families and even move workloads between EC2, Fargate, and Lambda. Which pricing model fits?
- mediumFinance wants automatic alerts when daily spend deviates unusually from normal patterns — not just when a budget threshold is crossed. Which feature does this?
- mediumHow does AWS typically charge for data transferred INTO AWS services (data ingress) from the internet?
- mediumWhich factors drive Amazon S3 Standard storage costs? (Select TWO.)
- mediumBesides sending alerts, what else can AWS Budgets do when a threshold is breached?
- mediumWhich payment options exist for EC2 Reserved Instances? (Select TWO.)
Domain 1: Fundamentals of AI and ML (20%)
AI/ML Foundations
Practice this topic →- easyA team wants a system that learns patterns from historical data to predict future sales — without writing explicit rules. Which approach is this?
- easyA retailer wants to group customers into natural segments based on purchase behavior — but there are no labeled categories to learn from. Which ML approach applies?
- mediumWhich workload is the best fit for a GENERATIVE AI approach rather than traditional ML?
- mediumA team wants to train a custom ML model on their own structured data with full control over algorithms and infrastructure. Which service fits — and which is the wrong choice?
- easyA company wants to group customers by purchasing behavior without any predefined labels. Which ML approach fits?
- mediumA firm needs to (a) extract text and tables from scanned PDF invoices and (b) detect sentiment and entities in the extracted text. Which two services map to these jobs?
- mediumWhy is a test dataset kept separate during model development?
Domain 3: Applications of Foundation Models (28%)
Generative AI & Bedrock
Practice this topic →- easyA company wants to build generative AI apps using foundation models from multiple providers (Anthropic, Meta, Amazon) through a single API — without managing infrastructure or training models. Which AWS service?
- mediumA chatbot built on a foundation model keeps giving outdated answers because the model was trained before the company's latest documentation was written. Which technique grounds responses in the company's current documents without retraining?
- mediumA team needs a foundation model to adopt a consistent brand tone and domain terminology in its responses. They want results fast without training infrastructure. What should they try FIRST?
- mediumA finance team receives thousands of scanned invoices and needs to extract vendor names, line items, and totals into structured data. Which AWS service is purpose-built for this?
- easyWhich prompt-engineering technique gives the model a few input/output examples so it learns the desired response pattern without any training?
- mediumA company wants (a) a chatbot that answers questions from their document set, and (b) the assistant to complete multi-step tasks like looking up an order and issuing a refund. Which Bedrock capabilities map to each?
- mediumA summarization app needs MORE creative, varied outputs from the same model. Which inference parameter should be increased?
Domain 4: Guidelines for Responsible AI (14%)
Responsible AI
Practice this topic →- mediumA hiring-screening model consistently ranks candidates from one demographic group lower. Which responsible-AI dimension does this violate, and what's the first step to address it?
- mediumA company launching a customer-facing chatbot needs configurable filters that block harmful content, redact PII, and restrict disallowed topics — applied consistently across whichever foundation model they use. What's the AWS-native control?
- mediumA company deploying a generative AI assistant wants to address responsible-AI concerns. Which TWO practices directly reduce the risk of harmful or biased outputs? (Select TWO.)
Domain 2: Fundamentals of Generative AI (24%)
Generative AI Concepts
Practice this topic →- mediumA content team complains that their generative-AI writing assistant produces nearly identical drafts every run. Which inference parameter should they raise to get more varied, creative output?
- mediumA support portal should find articles that mean the same thing even when users phrase questions differently. What converts text into a form that enables this semantic search?
- mediumIn a retrieval-augmented generation (RAG) design, what role do embeddings and a vector store play?
- easyWhat is Amazon Bedrock's core value proposition?
- mediumA GenAI assistant occasionally invents plausible-sounding but false facts (hallucinations). Which TWO techniques directly reduce hallucination? (Select TWO.)
Domain 5: Security, Compliance, and Governance for AI (14%)
AI Security & Governance
Practice this topic →- mediumA team is building a generative-AI assistant over customer records. Which TWO controls belong in a sound AI data-governance plan? (Select TWO.)
- mediumBefore sending customer data to a foundation model, a compliance team requires PII redaction and audit logging of prompts. Which approach addresses both?
Domain 1: Development with AWS Services (32%)
Serverless & APIs
Practice this topic →- easyA Lambda function processes uploaded images. Processing occasionally takes 20 minutes and the function times out. What is the maximum Lambda execution timeout, and what's the right fix if the task regularly exceeds it?
- mediumA real-time chat application needs persistent two-way communication between clients and backend — messages pushed in both directions without polling. Which API Gateway type should be used?
- mediumA DynamoDB table backs a flash-sale feature with unpredictable, spiky traffic that can jump 10x within minutes. The team wants to avoid throttling without capacity planning. Which capacity mode fits best?
- mediumWhenever a DynamoDB item is updated, a Lambda function must replicate the change to an OpenSearch index for full-text search. What's the native integration pattern?
- mediumAn order-processing queue must guarantee messages are processed exactly once and strictly in the order sent. Which SQS configuration is required?
- mediumA Lambda function calling a downstream database is overwhelming the database during traffic spikes. How can you cap the function's concurrent executions while leaving the rest of the account unaffected?
- hardConsumers occasionally fail while processing SQS messages, and some messages are being processed twice. Which TWO configurations help correct this? (Select TWO.)
- mediumA team wants to shift 5% of production traffic to a new Lambda version while keeping instant rollback, all without changing client code. Which feature enables this?
- mediumA Lambda function needs a database password. Which approach keeps the secret out of code AND rotates it automatically?
- mediumA mobile team wants a GraphQL API with real-time subscriptions over WebSockets and built-in offline data sync. Which service is designed for this?
- hardA DynamoDB table needs queries by an attribute that isn't the partition key, and new query patterns will emerge after launch. Which index type supports this — and what's its key constraint?
- mediumPayment events must be processed exactly once, in strict order. Which SQS configuration delivers both guarantees?
- mediumAn order pipeline has 7 steps — some parallel, some with retries, one needing human approval — spanning hours. Which service models this reliably?
- mediumA read-heavy REST API calls a Lambda that queries DynamoDB — most requests repeat the same lookups. Which API Gateway feature reduces backend load without code changes?
- mediumWhenever a new order item is written to a DynamoDB table, a Lambda function must update a search index. What mechanism delivers the item-change events?
Domain 2: Security (26%)
Application Security
Practice this topic →- mediumA Lambda function needs to read items from a DynamoDB table. What's the correct way to grant the function access — following least-privilege?
- hardA mobile app needs users to sign in with social providers and then read their own S3 objects directly. Which Cognito components are required, and what role does each play?
- mediumAn application stores a third-party database password that must rotate automatically every 30 days without code changes. Which service is designed for this?
- hardA Lambda function must encrypt large payloads before writing them to S3, with keys managed under centralized control and rotation. The AWS Encryption SDK is used. What does 'envelope encryption' mean in this design?
- mediumAn API Gateway REST API must authorize requests using a custom JWT scheme that Cognito can't validate. What's the integration point for custom authorization logic?
- hardA backend receives Cognito JWTs from a SPA and must verify them locally without calling Cognito on every request. What's the correct verification approach?
- mediumAn application on an EC2 instance must write to S3. Which credential approach follows AWS best practice?
- mediumA team stores (a) non-secret config values and (b) database credentials requiring automatic rotation. Which split is correct?
- mediumA browser SPA on https://app.example.com calls an API Gateway REST API — preflight OPTIONS requests fail and calls get blocked. What's the fix?
Domain 3: Deployment (24%)
CI/CD & Observability
Practice this topic →- mediumA team wants zero-downtime deployments where a new environment runs alongside the old, traffic shifts only when the new version is verified, and rollback is instant. Which deployment strategy is this?
- mediumA team wants a Lambda deployment that shifts 10% of traffic to the new version, waits 5 minutes for alarm checks, then completes the shift. Which CodeDeploy deployment configuration matches?
- easyA small team wants to deploy a Node.js web app to AWS without managing infrastructure — upload code, get load balancing, auto scaling, and health monitoring handled automatically. Which service fits?
- mediumA developer is writing infrastructure-as-code for a serverless app (Lambda + API Gateway + DynamoDB) and wants terse syntax with local test/debug support. Which tool is designed for this?
- mediumFive Lambda functions share the same heavy utility library, and updating it means redeploying all five packages. What Lambda feature centralizes shared code?
- mediumA team wants new Lambda versions rolled out gradually — 10% of traffic first, automatically rolling back if CloudWatch alarms fire. Which service orchestrates this?
- mediumWhich mapping of AWS CI/CD services to their jobs is correct?
- easyA small team wants to deploy a Node.js web app to AWS quickly — they don't want to manage servers, load balancers, or scaling configuration. Which service fits?
Domain 4: Troubleshooting and Optimization (18%)
Debugging & Optimization
Practice this topic →- mediumRequests through API Gateway → Lambda → DynamoDB are intermittently slow, and the team needs to see which hop adds latency. What tool provides this distributed trace?
- mediumA latency-sensitive API backed by Lambda shows occasional 2-3 second spikes on first requests after idle periods — cold starts. What's the most direct fix?
- mediumA DynamoDB-backed product catalog serves the same items to millions of readers, and read latency/cost needs to drop. What DynamoDB-specific option adds microsecond read caching without code rewrites?
- mediumRequests through API Gateway → Lambda → DynamoDB are slow, but no single component looks wrong in logs. Which tool shows WHERE latency accumulates across the request path?
- mediumA Lambda function's Throttles metric spikes during traffic bursts, and invocations get dropped. What's the direct fix — and which approach is a common mistake?
- mediumA latency-sensitive Lambda function occasionally responds slowly on the first invocation after idle periods. Which fix directly eliminates cold-start latency?
- mediumSome SQS messages keep failing Lambda processing and disappearing after repeated retries. The team needs to capture and inspect these poison messages. What's the mechanism?
Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)
Monitoring & Remediation
Practice this topic →- easyAn ops team needs an automated notification whenever any production EC2 instance's CPU stays above 90% for 10 minutes. What should they configure?
- easyBy default, EC2 instances publish metrics to CloudWatch every 5 minutes. How do you get 1-minute metric granularity for faster incident response?
- mediumAn ops team wants CloudWatch alarms on EC2 memory utilization and disk space. CPUUtilization works fine, but memory and disk metrics don't appear in CloudWatch. Why, and what's the fix?
- mediumAn ops team wants non-compliant resources remediated automatically — e.g., when an S3 bucket becomes public, a runbook removes the public access within minutes. What's the standard event-driven pattern?
- mediumCompliance requires application logs kept 7 years and queryable, but CloudWatch Logs costs too much at that retention. What's the cost-effective archive pattern?
- mediumAn ops team gets paged by many CloudWatch alarms that all stem from the same underlying incident. Which feature reduces this alarm noise?
Domain 3: Deployment, Provisioning, and Automation (22%)
Deployment & Automation
Practice this topic →- mediumAn operations team must apply OS security patches to hundreds of EC2 instances on a schedule, with approval controls and compliance reporting. Which service handles this natively?
- mediumSomeone changed a security group rule manually in the console, and the CloudFormation stack no longer matches its template. How does ops detect this kind of out-of-band change going forward?
- mediumAdmins currently SSH through a bastion host with port 22 open and shared key pairs. Security wants auditable shell access without inbound ports or SSH keys. What replaces the bastion?
- mediumOps needs a repeatable, approval-gated process to restart a fleet of instances in batches with health checks between batches. Which SSM capability provides prebuilt or custom multi-step workflows?
Domain 5: Networking and Content Delivery (18%)
Networking Operations
Practice this topic →- mediumInstances in a private subnet can reach the internet via a NAT gateway, but the ops team wants to eliminate the NAT gateway's data-processing charges for traffic to S3 and DynamoDB. What's the fix?
- mediumAn ALB target group shows targets unhealthy — instances run fine and the app answers on port 8080, but health checks fail. What's the FIRST thing to verify?
- mediumPrivate subnets across three AZs need resilient outbound internet access. What's the operationally sound design?
Domain 2: Reliability and Business Continuity (22%)
Reliability & DR
Practice this topic →- mediumAn ops team must centrally manage backups across EC2/EBS, RDS, DynamoDB, and EFS — with scheduled plans, retention policies, and cross-account copies for DR. Which service consolidates this?
- mediumAn Auto Scaling group behind an ALB keeps unhealthy instances in service — the app returns 500s but the ASG health check still reports the instances healthy. What fixes the detection gap?
- mediumA production RDS instance must survive an Availability Zone outage with minimal downtime and no manual failover steps. What configuration provides this?
- hardRegulations require backups that CANNOT be deleted or altered — even by administrators or compromised credentials — for 7 years. Which feature enforces this?
Domain 4: Security and Compliance (16%)
Security Operations
Practice this topic →- mediumOps needs continuous proof that all EBS volumes are encrypted and no security group allows 0.0.0.0/0 on port 22. Which TWO services/features provide this? (Select TWO.)
- mediumOps suspects an S3 bucket or IAM role grants access to an external AWS account. Which tool analyzes resource policies and flags external access automatically?
- mediumOps must keep hundreds of EC2 instances patched to an approved baseline on a schedule, with reports on compliance. Which Systems Manager capability is designed for this?
Domain 1: Data Ingestion and Transformation (34%)
Ingestion & ETL
Practice this topic →- easyA data team needs to run Python-based ETL jobs to transform S3 data into a queryable form — without provisioning servers. Which service is designed for this?
- mediumA team needs to land streaming clickstream data directly into S3 as batched files, with optional format conversion — no custom consumers needed. Which Kinesis service fits best?
- mediumA company already runs Apache Kafka on-premises and wants the same Kafka APIs/ecosystem on AWS with minimal migration friction. Which service fits?
- mediumApplication logs must be delivered to S3 in near-real-time, optionally transformed, with zero infrastructure to manage and no consumer applications reading the stream. Which service fits best?
- easyA data lake in S3 adds new files daily. Analysts want to query them in Athena without manually defining table schemas. What keeps table metadata up to date automatically?
- mediumA new event stream's volume is unpredictable — spiky, ranging 10x between quiet and peak. The team wants no capacity planning or shard management. Which Kinesis mode applies?
Domain 2: Data Store Management (26%)
Data Stores & Lakes
Practice this topic →- easyAn analytics team needs to run complex SQL joins and aggregations over terabytes-to-petabytes of structured data for BI dashboards. Which service is designed for this workload?
- mediumAthena queries over a 10 TB S3 data lake are slow and expensive — Athena bills per TB scanned. What design change most reduces both cost and latency?
- mediumAnalysts run infrequent, ad-hoc SQL queries directly against raw files in an S3 data lake — no regular reporting workload. What's the most cost-effective query layer?
- mediumA large fact table in Redshift is always joined to a customer dimension table on customer_id. Which distribution minimizes data movement across nodes during those joins?
- mediumAnalysts run complex SQL joins over terabytes of curated data several times a day, need sub-minute response, and concurrency for ~50 users. Which engine fits best?
Domain 4: Data Security and Governance (18%)
Data Governance
Practice this topic →- mediumAnalysts need column-level access control over a data lake in S3 — some columns (like salary) visible only to HR. Which service provides centralized, fine-grained data-lake permissions?
- mediumA pipeline occasionally ingests files with nulls and schema drift, silently corrupting dashboards. What AWS capability evaluates data quality rules and can stop or alert on bad batches?
- hardAnalysts should query a data lake table but must not see the salary column. Which Lake Formation capability enforces this — and why is a table-level deny insufficient?
- mediumAnalysts should query a data lake table but only see non-sensitive columns — salary and SSN must be hidden. Which approach enforces column-level access centrally?
- easyBefore opening a data lake to more teams, governance wants an automated inventory of which S3 objects contain PII. Which service discovers this?
Domain 3: Data Operations and Support (22%)
Data Operations
Practice this topic →- mediumA data team has existing Apache Airflow DAGs orchestrating their pipelines and wants managed hosting on AWS without rewriting workflows. Which service runs Airflow natively?
- mediumA nightly Glue ETL job silently fails some weeks — dashboards go stale before anyone notices. What's the standard way to get alerted on job failures?
- mediumA team has interdependent ETL jobs — job B only after job A succeeds, with retries and alerting — and wants managed Apache Airflow. Which service runs Airflow on AWS without self-managing?
- mediumBefore data lands in the curated zone, the team must validate row counts, null rates, and value ranges — failing checks should stop the pipeline. Which Glue feature expresses these rules?
Domain 1: Detection (16%)
Detection & Response
Practice this topic →- mediumA security team wants a single pane of glass aggregating findings from GuardDuty, Inspector, Macie, and third-party tools across all accounts, with severity scoring and automated remediation. Which service?
- mediumWhich service detects a pattern like 'IAM credentials being used from an unusual geography combined with crypto-mining API calls' as a managed threat-detection finding?
- mediumA security team uses GuardDuty, Inspector, and third-party tools — each producing findings in different formats. They want one normalized store where findings can be correlated and routed to response. What's the aggregation point?
- mediumA GuardDuty finding shows an EC2 instance talking to a known-malicious IP. The team wants to visualize related API calls, network flows, and IAM activity around it — without building queries. Which service is designed for this triage?
Logging & Audit
Practice this topic →- mediumWhich TWO services record WHO did WHAT and WHEN in an AWS account — forming the audit trail for security investigations? (Select TWO.)
- mediumSecurity wants one audit trail capturing API activity across all 80 accounts in the AWS Organization, delivered to a dedicated log-archive account. What is the cleanest setup?
Domain 4: Identity and Access Management (20%)
IAM Deep Dive
Practice this topic →- hardA platform team wants every developer to manage their own IAM roles, but no role a developer creates may exceed a defined permission ceiling. Which mechanism enforces this ceiling on self-service role creation?
- hardAccount A's application (running as an IAM role) must read objects in Account B's S3 bucket. What's the complete permission requirement for a cross-account role assumption pattern?
- mediumYou want developers to create IAM roles for their Lambda functions but never grant those roles more permissions than a defined maximum. What enforces that ceiling?
Domain 5: Data Protection (18%)
Encryption & Key Management
Practice this topic →Domain 2: Incident Response (14%)
Incident Response
Practice this topic →- mediumCloudTrail shows an IAM user's access key making API calls from an unknown IP — the key is compromised. What's the correct FIRST response?
- hardGuardDuty flags an EC2 instance communicating with a known botnet C2 server. The IR playbook requires isolating the instance while preserving it for forensics. What's the correct containment step?
- mediumGuardDuty flags an EC2 instance for crypto-mining. IR must preserve evidence while cutting the instance off from the network immediately. Which first actions isolate it?
Domain 3: Infrastructure Security (18%)
Infrastructure Security
Practice this topic →- mediumA public web application behind an ALB faces repeated SQL-injection attempts and L7 floods. Which AWS services address application-layer attacks? (Choose the best single answer.)
- mediumA security review requires defense-in-depth at the network layer for a three-tier app. Which TWO controls operate at DIFFERENT network layers and complement each other? (Select TWO.)
- easyA team pushes container images to ECR and wants vulnerabilities detected automatically on push and continuously as new CVEs publish. What should they use?
- easyWhy can a security group allow outbound HTTPS to the internet without an explicit inbound rule for the response traffic?
Domain 6: Security Foundations and Governance (14%)
Domain 1: Network Design (30%)
Hybrid Connectivity
Practice this topic →- mediumA company needs a dedicated, private connection from their data center to AWS with consistent low-latency bandwidth that bypasses the public internet. Which service provides this?
- mediumAn organization has 50 VPCs across 3 Regions plus on-premises networks that all need to communicate. VPC peering would create an unmanageable mesh. What provides scalable hub-and-spoke connectivity?
- hardA live-streaming platform needs global TCP/UDP traffic delivered with the lowest possible latency to a regional endpoint — not HTTP content caching. Which service fits?
- hardA financial firm's production workloads depend on Direct Connect to AWS. Leadership requires the hybrid link to survive any single facility or device failure. What's the resilient design?
- mediumA company will peer five VPCs and later connect on-prem networks over Direct Connect. What is the most important design decision up front?
- easyA workload needs consistent, low-latency private connectivity between a data center and AWS with predictable bandwidth — the connection must not traverse the public internet. Which option fits?
- hardOn-prem needs private connectivity to 30 VPCs across regions via a single Direct Connect link, with full VPC-to-VPC segmentation control. Which architecture scales?
Domain 2: Network Implementation (26%)
DNS & Edge Routing
Practice this topic →- hardOn-premises servers must resolve private Route 53 hosted zone records, and AWS resources must resolve the on-premises corporate DNS zone. Which Route 53 Resolver feature pair enables both directions?
- mediumA SaaS runs active endpoints in us-east-1 and eu-west-1. European users should hit the EU stack — and if it becomes unhealthy, traffic must failover automatically. Which Route 53 configuration applies?
- hardA Transit Gateway connects prod, dev, and shared-services VPCs. Prod and dev must NOT reach each other but both must reach shared services. How is this enforced at the TGW layer?
- hardA failover record should point to an internal ALB in a private subnet. Route 53 health checkers can't reach private IPs. How do you health-check it?
Domain 4: Network Security, Compliance, and Governance (24%)
Network Security
Practice this topic →- hardSecurity policy requires all egress traffic from workload VPCs to be inspected by an inline stateful firewall before reaching the internet. Which managed service provides this?
- hardA company must expose an internal API to partner VPCs — without internet exposure, VPC peering (CIDRs overlap), or giving partners broad network access. What's the secure sharing mechanism?
- hardSecurity policy requires all outbound internet traffic from 20 workload VPCs to pass through deep packet inspection. What's the scalable architecture?
- mediumA security team needs full packet copies from specific EC2 instances sent to an appliance for deep-packet inspection — without installing agents. What provides this?
Domain 3: Network Management and Operations (20%)
Network Operations
Practice this topic →- mediumAn EC2 instance in one VPC can't reach an RDS instance in a peered VPC. Security groups look correct. Which AWS tool analyzes the full network path — route tables, NACLs, peering — and identifies the blocking hop?
- mediumAn app intermittently loses connectivity to a partner API. Ops suspects a stateless rule is dropping return traffic. Which log record would confirm a blocked connection attempt?
- hardTen VPCs attach to a Transit Gateway. Two 'shared services' VPCs must be reachable by all, but the eight workload VPCs must not reach each other. How is this enforced?
- mediumA VPC runs dual-stack. IPv6 instances in a private subnet must reach the internet but must NOT accept inbound connections initiated from the internet. What provides this?
- easyOps wants a single topology view of Transit Gateways, attachments, and on-prem devices across all regions and accounts — including DX and VPN status. Which service provides it?
Domain 1: Design Solutions for Organizational Complexity (26%)
Multi-Account Architecture
Practice this topic →- mediumAn enterprise wants separate AWS accounts per environment (dev/staging/prod) and per business unit, with centrally enforced guardrails and shared logging. Which approach provides scalable multi-account governance?
- hardShared services (DNS, security inspection, logging collectors) must be reachable from 100+ workload VPCs across accounts. What's the scalable way to provide centralized shared services?
- mediumA company wants to guarantee — across 50 accounts — that workloads run only in two approved Regions, even for account admins. Which mechanism enforces this?
- mediumA company needs a governed multi-account environment — account vending with guardrails, centralized logging, and a dashboard — provisioned quickly rather than hand-built. Which service delivers the managed landing zone?
- mediumA security team in a dedicated account must centrally manage GuardDuty findings, Security Hub, and Config aggregator for the whole organization — without using the management account daily. What pattern applies?
Domain 4: Accelerate Workload Migration and Modernization (20%)
Migration & Modernization
Practice this topic →- mediumA legacy application runs on physical servers. The business wants to migrate quickly with minimal code changes now, then modernize later. Which migration strategy fits best?
- hardA 4 TB Oracle database must migrate to Aurora PostgreSQL with under 30 minutes of downtime. Which approach achieves near-zero-downtime migration including heterogeneous schema conversion?
- mediumBefore designing a migration, architects need inventory: which servers exist, their dependencies, and utilization for right-sizing. Which TWO AWS tools support this discovery? (Select TWO.)
- hardTwo migration needs: (a) 500 TB over a slow, congested link — bandwidth math says months; (b) 20 TB on a decent connection that must sync repeatedly until cutover. Which services fit each?
- medium200 on-prem VMs must reach AWS in 6 months. The team wants minimal app changes now, then modernize later. Which migration approach and service fit?
Domain 2: Design for New Solutions (29%)
Complex Solution Design
Practice this topic →- hardA financial services app needs: RPO near zero, RTO under 5 minutes, and cost sensitivity for non-production environments. Which DR architecture balances all three constraints?
- hardA global app needs low-latency reads for users on three continents with writes consolidated to one Region — no multi-Region write conflict handling allowed. Which design fits?
- hardA payments system needs RTO under 15 minutes and RPO under 1 minute in a second Region, but finance rejects the cost of full capacity standby. Which DR strategy fits the budget and targets?
- hardAn on-premises app generates files that must stay locally accessible with low latency while tiering seamlessly to cloud storage with NFS/SMB access. Which hybrid storage pattern fits?
- hardA global app must accept writes in two regions simultaneously, survive a full regional outage with near-zero RPO, and resolve write conflicts. Which data-layer combination supports true active-active?
Domain 3: Continuous Improvement for Existing Solutions (25%)
Architecture Optimization
Practice this topic →- mediumA company with 40 accounts in AWS Organizations can't tell which teams drive cost growth and wants per-team visibility plus right-sizing recommendations. Which combination addresses this?
- mediumAn Aurora MySQL cluster's read traffic has grown 10x; the writer is fine but read queries queue. What's the simplest scaling path that keeps the current architecture?
- mediumA data lake holds 3 PB in S3 Standard. Access patterns: hot for 90 days, occasional for a year, then rare but must stay retrievable for compliance. What's the most cost-effective design?
- mediumLeadership can't tell which team owns which cloud spend. What's the foundational step toward per-team cost allocation and accountability?
- easyAcross dozens of accounts, leadership wants data-driven recommendations to downsize over-provisioned EC2 instances and pick better instance types. Which service generates these recommendations from utilization history?