AWS Certified Solutions Architect - Associate Free Sample Questions

A partition placement group provides the best balance for this scenario. It spreads instances across distinct underlying hardware (partitions/racks) within an Availability Zone, reducing correlated failures. At the same time, it keeps the instances geographically close within that AZ, which is crucial for low-latency communication. A cluster placement group offers the lowest latency but places instances on the same rack, making it vulnerable to a single rack failure. A spread placement group across multiple AZs would introduce higher latency, which is not suitable for the trading application's requirements.

A gateway VPC endpoint for Amazon S3 allows traffic from the VPC to S3 to travel over the AWS private network, avoiding the public internet. This is a critical component for meeting the security requirement.

Enhanced VPC Routing forces all COPY and UNLOAD traffic between the Redshift cluster and data repositories (like S3) to go through the VPC. When used with a VPC endpoint, it ensures the traffic stays on the AWS private network.

AWS Secrets Manager is the ideal service for this use case. It provides native integration with Amazon RDS for automated credential rotation, which updates the secret in Secrets Manager and the password in the database simultaneously. Since the application cannot be modified, using IAM authentication or an RDS Proxy would not work. By granting the EC2 instance's IAM role permission to read the secret, the application can fetch the current credentials at runtime without hardcoding them.

This is the most cost-effective strategy. Purchasing Reserved Instances for the 2 instances that run 24/7 provides the highest discount for the constant baseline. For the predictable peak during business hours, Scheduled Scaling can be used to increase the desired capacity. Using Spot Instances for this additional capacity provides significant savings, and is appropriate because the stateless application can tolerate interruptions. This blended approach correctly matches purchasing options to usage patterns.

Amazon Aurora Global Database is specifically designed for this use case. It provides low-latency global reads by placing read replicas in different regions, which have a typical replication lag of under a second. It also offers a robust disaster recovery solution, allowing for a failover to a secondary region in typically less than one minute. This meets both the performance and resiliency requirements with minimal application changes, as the application can use region-specific endpoints.

This architecture meets all requirements. Kinesis Data Streams is designed for high-volume streaming data. Using the device ID as the partition key ensures that data from each device is processed in order. AWS Lambda provides scalable, serverless processing. Kinesis Data Firehose is the simplest, most cost-effective way to durably store the raw streaming data in Amazon S3 for later analysis.

This statement is false. A VPC endpoint policy is an IAM resource policy that you attach to an endpoint. You can use this policy to control access to the service. The policy can restrict access to specific resources (like S3 buckets) and also to specific API actions (like s3:GetObject or s3:PutObject). This allows for granular control over what actions can be performed on which resources through the endpoint.

Amazon EFS provides a shared file system that can be mounted concurrently by multiple EC2 instances, even across different Availability Zones. This makes it the perfect solution for this scenario. Both the primary and standby instances can read and write to the same EFS file system, ensuring that the temporary data is always available to the active instance. EBS volumes are tied to a single AZ, and instance stores are ephemeral and cannot be shared.

Service Control Policies (SCPs) are the correct tool for this requirement. SCPs are a type of organization policy that you can use to manage permissions in your organization. They offer central control over the maximum available permissions for all accounts in your organization. An explicit Deny in an SCP overrides any Allow from IAM policies and applies to all principals in the account, including the root user. This makes them ideal for enforcing security guardrails.

Enabling caching directly on the API Gateway stage is the simplest and most integrated solution. It allows you to cache the responses from your backend Lambda function, reducing the number of calls made to the function and the downstream DynamoDB table. This provides a low-latency experience for frequently requested data without requiring significant changes to the Lambda function or adding another service like ElastiCache to manage.