I85PREP
⌘ K
PCAM study materials
PCAM study resources

PCAM practice questions

One question at a time. Build your PCAM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture Design and Planning

A solutions architect is mapping business requirements to AWS accounts for a new multi-account landing zone. The company wants centralized billing, guardrails applied uniformly, and the ability to create new accounts programmatically. Which combination of AWS services should be the foundation of this design?

  1. AWS Resource Access Manager sharing resources across standalone accounts
  2. AWS Organizations with service control policies and consolidated billing Correct answer.
  3. AWS Identity and Access Management permission boundaries applied per account
  4. AWS Config aggregators with conformance packs in each account

Explanation

AWS Organizations is the service purpose-built for centrally managing many accounts, providing consolidated billing and service control policies that act as guardrails across the account tree. IAM permission boundaries and Config conformance packs operate within or across accounts but do not provide the account-creation and billing consolidation foundation that Organizations does.

Question 2Cloud Architecture Design and Planning

A team is designing a workload that must survive the loss of an entire AWS Region. Which design decision most directly satisfies a multi-Region disaster recovery requirement?

  1. Enabling versioning and cross-account backup in the primary Region
  2. Using an Application Load Balancer across three subnets in one Region
  3. Deploying the workload into at least two Availability Zones within one Region
  4. Replicating data and running recovery capacity in a second Region Correct answer.

Explanation

Region-level failure tolerance requires resources and data copies in a second Region, because Availability Zones within a single Region share a regional failure domain. Multi-AZ designs and in-Region backups address zone-level events but not the loss of the whole Region.

Question 3Cloud Architecture Design and Planning

An application running on Amazon EC2 must read objects from an Amazon S3 bucket without storing long-term credentials on the instances. Which approach follows AWS best practice?

  1. Create a shared IAM user and distribute its keys to each instance
  2. Store credentials in an environment variable set at instance launch
  3. Embed an IAM user access key in the application configuration file
  4. Attach an IAM role to the instance profile and use temporary credentials Correct answer.

Explanation

An IAM role attached through an instance profile lets the EC2 instance obtain rotating temporary credentials from the instance metadata service, eliminating long-lived secrets on disk. Embedded or shared long-term access keys create rotation and exposure risk and violate least-privilege guidance.

Question 4Cloud Architecture Design and Planning

A company needs a durable, highly available relational database for an OLTP workload and wants AWS to manage failover between Availability Zones. Which Amazon RDS configuration should the architect choose?

  1. A read replica in the same Availability Zone
  2. A Multi-AZ DB instance deployment Correct answer.
  3. A Single-AZ instance with automated backups enabled
  4. A database snapshot restored to a second instance

Explanation

A Multi-AZ DB instance deployment maintains a synchronous standby in a different Availability Zone and performs automatic failover, which is the managed high-availability pattern for OLTP. Read replicas are asynchronous and do not provide automatic failover for the primary.

Question 5Cloud Architecture Design and Planning

Which Amazon S3 storage class is designed for long-lived, rarely accessed data that can tolerate retrieval times of minutes to hours and offers the lowest storage cost among the common classes?

  1. S3 Intelligent-Tiering
  2. S3 Standard
  3. S3 One Zone-IA
  4. S3 Glacier Deep Archive Correct answer.

Explanation

S3 Glacier Deep Archive targets archival data accessed perhaps once or twice a year, with retrieval measured in hours, and has the lowest per-gigabyte storage price. S3 Standard and Intelligent-Tiering are optimized for frequent or unpredictable access, and One Zone-IA stores data in a single AZ.

Question 6Cloud Architecture Design and Planning

A workload's traffic is unpredictable, with long idle periods and short bursts. The architect wants compute that scales automatically and charges only for consumed compute time. Which compute choice best fits?

  1. A fixed-size Amazon ECS cluster on On-Demand instances
  2. Reserved Amazon EC2 instances sized for peak load
  3. Dedicated Hosts reserved for the application
  4. AWS Lambda functions invoked on demand Correct answer.

Explanation

Lambda is event-driven and billed per invocation and execution duration, which matches sporadic bursts with idle gaps. Reserved instances, Dedicated Hosts, and fixed clusters all provision capacity continuously and charge for idle time.

Question 7Cloud Architecture Design and Planning

An architect is defining recovery objectives with the business. Which statement correctly describes the recovery point objective (RPO)?

  1. The time required to rebuild infrastructure from code
  2. The maximum acceptable time to restore service after an outage
  3. The maximum acceptable amount of data loss measured in time Correct answer.
  4. The percentage of requests that must succeed during failover

Explanation

RPO defines how much data the business can afford to lose, expressed as the time between the last recoverable copy and the failure, which drives backup and replication frequency. The time to restore service is the recovery time objective, a separate metric.

Question 8Cloud Architecture Design and Planning

A company is migrating a large portfolio of on-premises applications and wants to prioritize which applications to move first based on business value and technical complexity. Which AWS tool is designed to help build this migration portfolio assessment?

  1. AWS Systems Manager Inventory
  2. AWS Trusted Advisor
  3. AWS Compute Optimizer
  4. AWS Migration Hub Strategy Recommendations Correct answer.

Explanation

Migration Hub Strategy Recommendations analyzes application portfolios and produces migration and modernization strategies ranked by effort and value. Trusted Advisor, Compute Optimizer, and Systems Manager Inventory address best practices, rightsizing, and asset visibility rather than portfolio migration planning.

Question 9Cloud Architecture Design and Planning

A web application stores user session state in memory on each Amazon EC2 instance behind an Application Load Balancer. Users are randomly logged out when scaling events occur. Which architectural change resolves this without enabling sticky sessions?

  1. Move session state to a shared store such as Amazon ElastiCache Correct answer.
  2. Configure the load balancer to use least outstanding requests routing
  3. Increase the instance size so sessions fit in memory
  4. Enable cross-zone load balancing on the load balancer

Explanation

Externalizing session state to a shared, low-latency store decouples it from individual instances, so any instance can serve any request and scaling no longer loses sessions. Larger instances, cross-zone balancing, and routing algorithms do not remove the instance affinity that causes the logouts.

Question 10Cloud Architecture Design and Planning

A solutions architect must design a VPC for a three-tier application where the database tier is reachable only from the application tier and never from the internet. Which configuration meets this requirement?

  1. Place the database in a private subnet with a route to an internet gateway
  2. Place the database in a public subnet and rely on the database's authentication
  3. Place the database in a private subnet and allow only the application security group as a source Correct answer.
  4. Place the database in a public subnet with a restrictive network ACL

Explanation

Private subnets have no route to an internet gateway, and security groups referencing the application tier's group enforce instance-level least privilege. Public subnets and internet routes expose the database to inbound paths that authentication alone does not close.

Question 11Cloud Architecture Design and Planning

An application reads the same small configuration dataset millions of times per hour and the data changes only weekly. The database is becoming a bottleneck. Which design change most effectively reduces read pressure while keeping latency low?

  1. Increase the database instance class and storage IOPS
  2. Enable Multi-AZ on the database
  3. Add a read replica and query it for every request
  4. Introduce an in-memory cache such as Amazon ElastiCache in front of the database Correct answer.

Explanation

Caching a small, slowly changing dataset in memory absorbs repeated reads and removes most database traffic while providing sub-millisecond latency. Read replicas still execute queries, and scaling or Multi-AZ improves capacity and availability rather than eliminating redundant reads.

Question 12Cloud Architecture Design and Planning

A company wants to decouple a producer that emits bursts of messages from a consumer that processes at a steady rate, with retention of messages if the consumer fails. Which service is the most appropriate buffer?

  1. AWS Step Functions express workflows
  2. Amazon Simple Queue Service queues Correct answer.
  3. Amazon EventBridge rules
  4. Amazon Simple Notification Service topics

Explanation

SQS is a durable queue that buffers messages and retains them until a consumer deletes them, which smooths bursty producers against steady consumers. SNS and EventBridge push events to subscribers without the same queue-and-retain semantics for point-to-point work.

Question 13Cloud Architecture Design and Planning

A workload must run containers with minimal operational overhead, scale pods automatically, and integrate with AWS networking and IAM. The team does not want to manage worker nodes. Which service best matches?

  1. Amazon ECS with the Fargate launch type Correct answer.
  2. AWS Batch with managed compute environments
  3. Amazon EC2 instances running Docker directly
  4. Amazon ECS on self-managed EC2 Auto Scaling groups

Explanation

ECS with Fargate runs containers without provisioning or patching worker nodes, while still integrating with VPC networking and IAM task roles. Self-managed EC2 and direct Docker on EC2 reintroduce node operations, and Batch targets batch jobs rather than long-running services.

Question 14Cloud Architecture Design and Planning

An architect is selecting a database for a workload with a flexible document schema, millisecond latency at any scale, and global replication across Regions. Which choice fits best?

  1. Amazon DynamoDB global tables Correct answer.
  2. Amazon RDS for MySQL with read replicas
  3. Amazon Aurora with a global database
  4. Amazon Redshift with cross-Region data sharing

Explanation

DynamoDB is a key-value and document store with single-digit millisecond latency at scale, and global tables provide multi-Region active-active replication. Aurora and RDS are relational engines, and Redshift is an analytics warehouse.

Question 15Cloud Architecture Design and Planning

A solutions architect needs to give an external partner temporary, scoped access to specific AWS resources without creating IAM users in the company account. Which mechanism should be used?

  1. An IAM role with a trust policy for the partner account and scoped permissions Correct answer.
  2. IAM access keys issued to the partner and rotated monthly
  3. A shared IAM user with an MFA device
  4. AWS account root credentials delegated to the partner

Explanation

Cross-account IAM roles let the partner's principals assume temporary credentials under a trust policy and a permission policy limited to the needed resources. Long-term keys, shared users, and root credentials violate least privilege and are hard to audit or revoke.

Question 16Cloud Architecture Design and Planning

A company must keep data encrypted at rest with keys it controls, including the ability to audit key usage and rotate keys on a schedule. Which AWS Key Management Service option meets this?

  1. S3 server-side encryption with Amazon S3 managed keys
  2. Client-side encryption with a key stored in the application code
  3. Customer managed keys in AWS KMS with automatic rotation enabled Correct answer.
  4. AWS-managed keys created automatically per service

Explanation

Customer managed KMS keys give the account control over policy, auditing through CloudTrail, and scheduled automatic rotation. AWS-managed and S3-managed keys remove that control, and embedding keys in code is an insecure practice.

Question 17Cloud Architecture Design and Planning

A solutions architect is designing a highly available architecture across two Availability Zones. Which statement about a Multi-AZ load-balanced application is accurate?

  1. The application remains available if one Availability Zone fails Correct answer.
  2. The application requires a single subnet spanning both Availability Zones
  3. The application loses data written to the failed zone unless backups exist
  4. The application must use a Network Load Balancer to survive zone failure

Explanation

Spreading instances and a load balancer across two Availability Zones means the remaining zone can serve traffic when one fails, provided state is replicated or externalized. Subnets are confined to one zone, and both Application and Network Load Balancers support multi-AZ designs.

Question 18Cloud Architecture Design and Planning

An application writes to an Amazon S3 bucket that must remain readable and writable during a Regional outage. Which design achieves this with the least operational effort?

  1. Use a single bucket with versioning enabled and rely on S3 durability
  2. Copy objects to Amazon EBS volumes in a second Region on a schedule
  3. Enable S3 Cross-Region Replication to a bucket in a second Region and use a routing layer to fail over Correct answer.
  4. Take daily snapshots and restore them to a second Region after an outage

Explanation

Cross-Region Replication maintains a continuously updated copy in another Region, and a routing mechanism such as Route 53 failover or a multi-Region access point directs clients to the available copy. Snapshots and scheduled copies leave a recovery gap, and versioning alone stays in one Region.

Question 19Cloud Architecture Design and Planning

A company runs a steady-state production workload that has been stable for two years and wants to minimize compute cost while retaining the ability to change instance families at renewal. Which purchasing approach is most appropriate?

  1. Spot Instances with a capacity-optimized allocation strategy
  2. Compute Savings Plans with a one- or three-year commitment Correct answer.
  3. On-Demand Instances for all capacity
  4. Dedicated Hosts with a three-year reservation

Explanation

Compute Savings Plans offer significant discounts for a committed spend and apply across instance families, Regions, and Fargate and Lambda, which preserves flexibility at renewal. On-Demand pays full price, Spot can be interrupted, and Dedicated Hosts are for licensing or isolation needs.

Question 20Cloud Architecture Design and Planning

An architect is comparing a warm standby DR strategy with a pilot light strategy. Which statement correctly distinguishes them?

  1. Warm standby has a higher RTO than backup and restore, while pilot light has the lowest RTO of all strategies
  2. Warm standby keeps a scaled-down but fully functional copy of the workload running, while pilot light keeps only core data and minimal services running Correct answer.
  3. Warm standby keeps only backups in the DR Region, while pilot light runs full production capacity
  4. Warm standby replicates data synchronously, while pilot light never replicates data

Explanation

Warm standby runs a functional but reduced-capacity version of the full stack in the DR Region, giving a shorter RTO than pilot light, which keeps only the core data replication and a minimal skeleton of services that must be scaled out on failover. Both strategies are cheaper than multi-site active-active.

Question 21Cloud Architecture Design and Planning

A company must prove to auditors that its AWS environment enforces encryption on all newly created Amazon EBS volumes and blocks public S3 access across every account in its organization. Which combination provides preventive and detective controls?

  1. Service control policies in AWS Organizations plus AWS Config conformance packs Correct answer.
  2. AWS Config rules in each account only
  3. AWS Trusted Advisor checks plus manual quarterly reviews
  4. IAM password policies plus Amazon GuardDuty findings

Explanation

Service control policies prevent noncompliant actions such as creating unencrypted volumes or public buckets across member accounts, while Config conformance packs detect and report drift continuously. Detective-only or manual approaches cannot prevent the action from occurring.

Question 22Cloud Architecture Design and Planning

A global application serves users from multiple Regions and needs read-your-writes consistency for each user's own profile updates while keeping latency low. Which design best meets these requirements?

  1. Client-side caching of profile data with a long time-to-live
  2. Asynchronous read replicas in every Region with no routing logic
  3. A globally distributed database with session affinity or write forwarding so a user's reads follow their writes Correct answer.
  4. A single-Region primary database with all writes and reads routed there

Explanation

Read-your-writes requires that a user's subsequent read observes their prior write, which is achieved by routing that user's reads to the Region that accepted the write or by using a database feature that forwards writes to the authoritative copy. Single-Region routing sacrifices latency, and uncoordinated replicas or long caches can serve stale data.

Question 23Cloud Architecture Design and Planning

A solutions architect is choosing between Amazon SQS standard and FIFO queues for an order-processing system that must preserve the exact order of events per customer and avoid duplicate processing. Which choice and rationale are correct?

  1. FIFO queues with message group IDs per customer, because they preserve order and deduplicate within a group Correct answer.
  2. FIFO queues without message group IDs, because all messages are then globally ordered
  3. Standard queues, because they provide higher throughput and ordering is not needed
  4. Standard queues with a visibility timeout of zero, because that guarantees ordering

Explanation

FIFO queues guarantee first-in-first-out delivery and deduplication within a message group, so using the customer identifier as the group ID preserves per-customer order while allowing parallelism across customers. Standard queues do not guarantee order, and FIFO queues require a message group ID to scope ordering.

Question 24Cloud Architecture Design and Planning

A company wants to modernize a monolithic application by extracting services incrementally while keeping the existing system functional. Which migration pattern does this describe?

  1. A big-bang rehost of the monolith to Amazon EC2
  2. A lift-and-shift replatform to containers without code changes
  3. The strangler fig pattern using an API facade Correct answer.
  4. A retire-and-replace cutover with no parallel operation

Explanation

The strangler fig pattern routes traffic through a facade and gradually moves functionality to new services while the monolith continues to serve remaining features. Big-bang, lift-and-shift, and retire-and-replace approaches do not support incremental extraction with parallel operation.

Question 25Cloud Architecture Design and Planning

An architect must ensure that a batch processing job can recover from failures without reprocessing completed work and can run steps in sequence with retries. Which service is designed for this orchestration?

  1. Amazon Simple Queue Service with a single consumer
  2. AWS Lambda with recursive invocations
  3. Amazon Kinesis Data Streams with a single shard
  4. AWS Step Functions with a state machine Correct answer.

Explanation

Step Functions models each step as a state in a state machine, tracks progress, and applies retry and catch logic so completed steps are not repeated. SQS, Kinesis, and recursive Lambda calls provide transport or compute but not durable step-level orchestration.

Question 26Cloud Architecture Design and Planning

An architect is applying the AWS Well-Architected Framework to a new cloud landing zone. Which design principle belongs to the Operational Excellence pillar?

  1. Make frequent, small, reversible changes and refine operations procedures frequently Correct answer.
  2. Implement a strong identity foundation with least-privilege access
  3. Automatically recover from failure by monitoring key performance indicators
  4. Analyze and attribute expenditure so that costs can be optimized continuously

Explanation

Operational Excellence focuses on running and monitoring systems to deliver business value and on continually improving processes, which is why small reversible changes and frequent procedure refinement belong there. The other listed principles map to Cost Optimization, Reliability, and Security respectively.

Question 27Cloud Architecture Design and Planning

A solutions architect is planning a multi-account AWS environment and must decide where to enforce guardrails that apply to every account. Which construct provides organization-wide policy enforcement?

  1. Resource-based policies on each individual resource
  2. AWS Service Catalog portfolios shared with each account
  3. Service control policies in AWS Organizations Correct answer.
  4. IAM permission boundaries attached to each role

Explanation

Service control policies set the maximum available permissions for accounts in an organization and are inherited by member accounts, making them the standard mechanism for organization-wide guardrails. The other options operate per account or per resource and do not centrally constrain all principals.

Question 28Cloud Architecture Design and Planning

A media company must archive compliance records for seven years at the lowest storage cost while retaining the ability to retrieve any object within 12 hours. Which Amazon S3 storage class fits this requirement?

  1. S3 One Zone-Infrequent Access
  2. S3 Glacier Deep Archive Correct answer.
  3. S3 Standard-Infrequent Access
  4. S3 Glacier Instant Retrieval

Explanation

S3 Glacier Deep Archive is designed for long-term retention with retrieval within 12 hours and offers the lowest storage price among S3 classes. Instant Retrieval and Standard-IA both retrieve in milliseconds and cost more per gigabyte stored.

Question 29Cloud Architecture Design and Planning

An architect is documenting the shared responsibility model for a managed relational database service. Which responsibility remains with the customer?

  1. Managing access credentials and database user permissions Correct answer.
  2. Replicating storage across Availability Zones
  3. Patching the underlying database engine binaries
  4. Maintaining the physical hardware in the data center

Explanation

In the shared responsibility model for managed databases, AWS operates the infrastructure and engine patching while the customer owns data, access management, and identity configuration. Credential and permission management is therefore a customer responsibility.

Question 30Cloud Architecture Design and Planning

A company wants to run a stateless web tier whose instances must be replaced automatically when a health check fails, while keeping capacity within a defined range. Which combination should the architect choose?

  1. A single large instance with detailed monitoring and an AWS Budgets alarm
  2. An Auto Scaling group with a target tracking policy and Elastic Load Balancing health checks Correct answer.
  3. AWS Lambda provisioned concurrency behind an Application Load Balancer
  4. A placement group with partition spread and a scheduled scaling policy

Explanation

An Auto Scaling group replaces unhealthy instances when it uses Elastic Load Balancing health checks, and a target tracking policy keeps capacity near a chosen metric within minimum and maximum bounds. This directly satisfies both self-healing and bounded capacity.

Question 31Cloud Architecture Design and Planning

An architect must design a solution so that an application in one AWS account can read objects from an S3 bucket owned by another account without sharing long-term credentials. Which approach meets this requirement?

  1. Distribute an IAM user access key from the bucket owner to the consumer account
  2. Replicate the bucket to the consumer account with Cross-Region Replication
  3. Attach a bucket policy granting the consumer account's role access to the required prefix Correct answer.
  4. Enable S3 Transfer Acceleration on the bucket

Explanation

A cross-account bucket policy that names the consuming account's IAM role allows access without distributing long-lived credentials, which is the recommended pattern. Replication copies data but does not by itself grant the intended access model, and access keys violate the no-long-term-credential constraint.

Question 32Cloud Architecture Design and Planning

A solutions architect is designing a VPC peering topology among 40 VPCs that must all communicate with each other and with a shared services VPC. Which design minimizes operational effort as the number of VPCs grows?

  1. A single VPC with all workloads in one large CIDR block
  2. Site-to-Site VPN tunnels between each pair of VPCs
  3. A hub-and-spoke topology using AWS Transit Gateway with a shared services attachment Correct answer.
  4. A full mesh of VPC peering connections between every pair of VPCs

Explanation

Transit Gateway acts as a regional hub that connects many VPCs through individual attachments, avoiding the quadratic growth of peering connections in a full mesh. This keeps configuration and routing manageable as the account count increases.

Question 33Cloud Architecture Design and Planning

An application must process messages in order within a message group and must avoid duplicate processing caused by retries. Which queue configuration should the architect select?

  1. A FIFO queue with content-based deduplication enabled Correct answer.
  2. A standard queue with a long visibility timeout
  3. A standard queue with a dead-letter queue attached
  4. A FIFO queue with the maximum message retention period

Explanation

FIFO queues preserve ordering within a message group, and deduplication (content-based or via an explicit deduplication ID) suppresses duplicates introduced by retries. Standard queues provide at-least-once delivery and best-effort ordering, so they cannot meet the ordering requirement.

Question 34Cloud Architecture Design and Planning

A financial workload requires a relational database with Multi-AZ deployment for failover and read replicas for reporting queries. Which statement about this architecture is accurate?

  1. Multi-AZ failover is automatic and the standby does not serve read traffic Correct answer.
  2. The Multi-AZ standby instance serves read traffic to reduce primary load
  3. Read replicas are synchronously updated with the primary instance
  4. Read replicas must reside in the same Availability Zone as the primary

Explanation

In an RDS Multi-AZ deployment the standby is kept synchronized for failover and does not serve read traffic, and failover is managed automatically. Read replicas are separate asynchronous copies used for read scaling and can be placed in other Availability Zones or Regions.

Question 35Cloud Architecture Design and Planning

An architect must give an application running on Amazon EC2 permission to call DynamoDB without storing credentials on the instance. Which mechanism should be used?

  1. A DynamoDB resource policy granting anonymous access
  2. AWS Secrets Manager storing the account root password
  3. An IAM user access key stored in an environment variable
  4. An IAM role attached through an instance profile Correct answer.

Explanation

An instance profile delivers temporary, automatically rotated credentials from an IAM role to EC2, which removes the need to store secrets on the instance. This is the standard pattern for granting AWS API permissions to EC2 workloads.

Question 36Cloud Architecture Design and Planning

A company needs a managed data warehouse for petabyte-scale analytics with columnar storage and massively parallel query execution. Which service should the architect select?

  1. Amazon ElastiCache for Redis
  2. Amazon Redshift Correct answer.
  3. Amazon DynamoDB Accelerator
  4. Amazon RDS for MySQL

Explanation

Amazon Redshift is a managed, columnar, massively parallel processing data warehouse built for large-scale analytical queries. The other services target transactional, caching, or low-latency key-value workloads rather than analytical warehousing.

Question 37Cloud Architecture Design and Planning

An architect is designing a cost-aware architecture for a batch job that runs nightly for two hours and can tolerate interruption. Which compute option should be recommended?

  1. On-Demand Instances reserved for the full month
  2. Spot Instances with a diversified instance type fleet Correct answer.
  3. Dedicated Hosts allocated for the entire month
  4. Savings Plans committed to a three-year term

Explanation

Spot Instances offer large discounts for fault-tolerant, interruption-tolerant workloads, and diversifying across instance types and Availability Zones reduces the chance that capacity is reclaimed. A short nightly batch that tolerates interruption fits this model well.

Question 38Cloud Architecture Design and Planning

A global application must route users to the endpoint with the lowest network latency while also supporting automatic failover to a secondary Region. Which Route 53 routing approach best meets both needs?

  1. Latency-based routing with health checks and a failover record Correct answer.
  2. Simple routing with a single record set
  3. Weighted routing with equal weights on both Regions
  4. Geolocation routing with records for every country

Explanation

Latency-based routing directs each user to the Region with the lowest measured latency, and attaching health checks allows traffic to be diverted when an endpoint becomes unhealthy. This combination satisfies both the latency and failover objectives.

Question 39Cloud Architecture Design and Planning

An architect is evaluating a design that places application servers in a private subnet and a NAT Gateway in a public subnet. Which statement correctly explains why this design allows outbound internet access while preventing inbound connections?

  1. The NAT Gateway assigns each instance a public IPv4 address that is reachable from the internet
  2. Security groups in the private subnet automatically block all inbound traffic by default
  3. The NAT Gateway translates source addresses so responses return to it, and it cannot initiate inbound connections Correct answer.
  4. The private subnet's route table contains a route to an internet gateway for return traffic

Explanation

A NAT Gateway performs source network address translation, so instances in the private subnet can initiate outbound connections and receive responses, but unsolicited inbound connections cannot traverse it. The private subnet routes 0.0.0.0/0 to the NAT Gateway rather than to an internet gateway.

Question 40Cloud Architecture Design and Planning

A solutions architect must design a disaster recovery approach with an RTO of minutes and an RPO near zero for a critical database-backed application. Which strategy meets these objectives?

  1. Multi-site active-active with synchronous data replication across Regions Correct answer.
  2. Warm standby with a scaled-down but fully functional copy running in a secondary Region
  3. Pilot light with the database replicated asynchronously to a secondary Region
  4. Backup and restore from nightly snapshots to a secondary Region

Explanation

An RPO near zero requires synchronous replication so that no committed transaction is lost, and an RTO in minutes requires a running environment that can absorb traffic immediately, which is what multi-site active-active provides. Asynchronous replication leaves a nonzero data-loss window, and backup and restore has an RTO measured in hours.

Question 41Cloud Infrastructure and Networking

A company stores application logs in an Amazon S3 bucket and wants to use an S3 gateway endpoint so that traffic from EC2 instances in a private subnet reaches S3 without traversing the internet. Which configuration is required for the gateway endpoint to be used?

  1. Create an interface endpoint with a private DNS name and enable DNS resolution in the VPC
  2. Attach an internet gateway and add a 0.0.0.0/0 route that targets the gateway endpoint
  3. Associate the endpoint directly with the EC2 security group and enable source/destination check
  4. Attach the gateway endpoint to the VPC and add a route for the S3 prefix list to the subnet route table Correct answer.

Explanation

An S3 gateway endpoint is a route-table target, so it must be attached to the VPC and referenced in the route table of the subnets that need access. It uses AWS prefix lists rather than a DNS-based private name, and it does not require an internet gateway.

Question 42Cloud Infrastructure and Networking

Which AWS construct is a logically isolated virtual network where you define subnets, route tables, and gateways?

  1. AWS PrivateLink
  2. AWS Direct Connect gateway
  3. AWS Transit Gateway
  4. Amazon VPC Correct answer.

Explanation

Amazon VPC is the foundational network isolation unit in AWS, containing subnets, route tables, gateways, and security controls. The other services connect or extend networks but do not themselves provide the isolated virtual network boundary.

Question 43Cloud Infrastructure and Networking

A security team needs to allow inbound HTTPS from a partner's specific CIDR range to an Application Load Balancer while denying all other inbound traffic. Which resource enforces this at the load balancer level?

  1. A route table entry pointing to the partner CIDR
  2. A network ACL on the load balancer subnet
  3. The load balancer's security group inbound rules Correct answer.
  4. AWS WAF IP set rules attached to the listener

Explanation

Security groups attached to the load balancer control which sources may reach its listeners, and a rule scoped to the partner CIDR with no broader allow rule achieves the requirement. Network ACLs apply at the subnet boundary and are stateless, while WAF rules filter at the application layer but do not replace security group admission.

Question 44Cloud Infrastructure and Networking

What is the primary purpose of an AWS Transit Gateway in a multi-VPC architecture?

  1. To encrypt data at rest across multiple AWS accounts
  2. To assign public IP addresses to instances in private subnets
  3. To cache content at edge locations close to end users
  4. To provide a single hub that connects many VPCs and on-premises networks without full-mesh peering Correct answer.

Explanation

Transit Gateway acts as a regional hub-and-spoke router, so many VPCs and on-premises attachments can communicate through one gateway instead of pairwise peering. This simplifies routing and reduces the number of connections that must be managed.

Question 45Cloud Infrastructure and Networking

An application in a private subnet must download patches from the internet without accepting inbound connections. Which design satisfies this requirement with the least exposure?

  1. Assign Elastic IP addresses directly to each instance
  2. Enable public DNS hostnames on the instances and use an interface endpoint
  3. Attach an internet gateway to the private subnet route table with a 0.0.0.0/0 route
  4. Place a NAT gateway in a public subnet and route the private subnet's default route to it Correct answer.

Explanation

A NAT gateway in a public subnet lets private-subnet instances initiate outbound connections while blocking unsolicited inbound traffic. The private subnet route table sends the default route to the NAT gateway, which performs the translation.

Question 46Cloud Infrastructure and Networking

An architect is choosing between a security group and a network ACL for controlling traffic to a web tier. Which statement correctly describes a difference between the two?

  1. Security groups are stateful and evaluate all rules before deciding, while network ACLs are stateless and evaluate rules in numbered order Correct answer.
  2. Security groups allow only deny rules, while network ACLs allow only allow rules
  3. Security groups are stateless, while network ACLs track connection state
  4. Network ACLs apply to individual elastic network interfaces, while security groups apply to subnets

Explanation

Security groups are stateful, so return traffic for an allowed connection is automatically permitted, and all rules are evaluated together. Network ACLs are stateless and process numbered rules in order, which means return traffic must be explicitly allowed.

Question 47Cloud Infrastructure and Networking

Which service resolves domain names to IP addresses and supports private hosted zones that are visible only within associated VPCs?

  1. AWS Direct Connect
  2. AWS Global Accelerator
  3. Amazon CloudFront
  4. Amazon Route 53 Correct answer.

Explanation

Route 53 is the AWS DNS service, and private hosted zones let you resolve internal names within the VPCs you associate. Global Accelerator and CloudFront are traffic acceleration and content delivery services, and Direct Connect is a dedicated network link.

Question 48Cloud Infrastructure and Networking

A company wants to expose an internal service in one VPC to consumers in many other VPCs without VPC peering and without exposing the service to the internet. Which AWS capability is designed for this?

  1. AWS PrivateLink with an endpoint service Correct answer.
  2. A public Network Load Balancer with an Elastic IP
  3. An internet-facing Application Load Balancer with WAF
  4. VPC peering with overlapping CIDR ranges

Explanation

PrivateLink lets a provider expose a service through an endpoint service backed by a Network Load Balancer, and consumers create interface endpoints in their own VPCs. Traffic stays on the AWS network and does not require peering or public exposure.

Question 49Cloud Infrastructure and Networking

What does an AWS Direct Connect connection provide compared with a site-to-site VPN over the internet?

  1. Elastic bandwidth that scales instantly with demand without configuration
  2. A dedicated private network link between on-premises and AWS with more consistent latency Correct answer.
  3. A fully managed DNS forwarding service for hybrid workloads
  4. Automatic encryption of all traffic using IPsec by default

Explanation

Direct Connect provides a dedicated physical link into AWS, giving more predictable performance and often lower egress costs than internet-based VPN. Encryption is not automatic on a standard connection and must be added separately if required.

Question 50Cloud Infrastructure and Networking

An EC2 instance in a private subnet needs to retrieve credentials and configuration from AWS Systems Manager without using the internet. Which VPC component enables this?

  1. A NAT instance in the same private subnet
  2. Interface VPC endpoints for Systems Manager Correct answer.
  3. A VPC peering connection to a public VPC
  4. An internet gateway attached to the private subnet

Explanation

Interface endpoints powered by PrivateLink place elastic network interfaces in the subnet so instances can reach Systems Manager APIs privately. This avoids the need for internet egress or a NAT device.