AWS Certification Solutions Architect Associate 2022 past questions and answers

1. Store the access key in an encrypted EBS volume and rotate it monthly.
2. Attach an IAM role to the EC2 instances with a policy granting only the required S3 read actions on that bucket.
3. Create a separate IAM user for each instance and inject its key at launch.
4. Make the bucket public and restrict access by the instances' public IP addresses.

Answer: B. Attach an IAM role to the EC2 instances with a policy granting only the required S3 read actions on that bucket.

An instance profile supplies temporary credentials to the application, and a narrowly scoped role limits access to the required bucket. Stored IAM user keys remain long-lived secrets, while public access is not an appropriate substitute for identity-based authorization.

1. Add an Allow statement for CloudTrail to each account's IAM administrator policy.
2. Create an IAM permissions boundary for one administrator in each account.
3. Attach an SCP to the relevant organization unit that denies CloudTrail stop and delete actions.
4. Create an Amazon EventBridge rule that restarts CloudTrail after it is stopped.

Answer: C. Attach an SCP to the relevant organization unit that denies CloudTrail stop and delete actions.

An SCP establishes a maximum-permissions guardrail for accounts in its scope, so an IAM administrator cannot override the explicit deny. An SCP does not grant permissions; it constrains them. An event-driven restart would detect and remediate after the control was already disabled.

1. Create an S3 gateway VPC endpoint and associate it with the private subnet route tables.
2. Assign public IPv4 addresses to the instances and use an internet gateway.
3. Create a NAT gateway in each private subnet and route S3 traffic through it.
4. Create an interface endpoint for Amazon EC2 and route S3 traffic through it.

Answer: A. Create an S3 gateway VPC endpoint and associate it with the private subnet route tables.

An S3 gateway endpoint provides private connectivity through route tables and has no additional endpoint charge. Public addresses or NAT gateways introduce unnecessary internet-path exposure or cost, and an EC2 interface endpoint does not provide S3 access.

1. Put the credentials in EC2 user data and replace the instances every month.
2. Store the credentials in an S3 object and enable bucket versioning.
3. Use an IAM role for the instances and grant it unrestricted access to all databases.
4. Store the credentials in AWS Secrets Manager, enable supported rotation for the RDS database, and have the application retrieve the secret.

Answer: D. Store the credentials in AWS Secrets Manager, enable supported rotation for the RDS database, and have the application retrieve the secret.

Secrets Manager can securely store and rotate supported RDS credentials, while the application retrieves the current value at runtime using its role. User data and S3 versioning do not provide a complete secret-rotation workflow, and unrestricted IAM access violates least privilege.

1. Run one EC2 instance in one Availability Zone and create a daily AMI.
2. Place an Application Load Balancer across multiple Availability Zones and use an Auto Scaling group spanning those zones with health checks.
3. Run instances in two Availability Zones but register them with a single-instance Network Load Balancer.
4. Use a single EC2 instance with an Elastic IP address and an EBS snapshot schedule.

Answer: B. Place an Application Load Balancer across multiple Availability Zones and use an Auto Scaling group spanning those zones with health checks.

A multi-AZ load balancer and Auto Scaling group distribute requests across healthy capacity and can replace failed instances. A backup or snapshot aids recovery but does not provide continued service during an Availability Zone failure.