AWS Certification Solutions Architect Associate 2023 past questions and answers

1. Enable S3 website hosting and allow public reads from the bucket.
2. Keep the bucket private, configure CloudFront Origin Access Control (OAC), and allow the OAC to read objects in the bucket policy.
3. Create an IAM user for CloudFront and store its access keys in the distribution configuration.
4. Allow public reads from the bucket and restrict access with an S3 lifecycle rule.

Answer: B. Keep the bucket private, configure CloudFront Origin Access Control (OAC), and allow the OAC to read objects in the bucket policy.

Origin Access Control lets CloudFront make authenticated requests to a private S3 origin, while the bucket policy grants access only to that distribution. Public access and embedded long-lived keys either leave the origin exposed or add unnecessary credential risk.

1. Use AWS Systems Manager Session Manager, attach an instance role with the required Systems Manager permissions, and create the required Systems Manager interface VPC endpoints.
2. Assign each instance a public IP address and allow SSH only from the administrator's current address.
3. Deploy a bastion host in a public subnet and open SSH from all corporate networks.
4. Store a shared SSH private key in an S3 bucket and download it to each instance at startup.

Answer: A. Use AWS Systems Manager Session Manager, attach an instance role with the required Systems Manager permissions, and create the required Systems Manager interface VPC endpoints.

Session Manager provides interactive access without inbound ports or SSH keys; an instance role and interface endpoints let the agent communicate privately with Systems Manager. Public IPs, broadly reachable bastions, and shared keys increase exposure and operational burden.

1. Store files on an unencrypted EBS volume and attach it to every instance.
2. Use an S3 bucket with public access disabled and mount it as a POSIX file system using an EC2 instance role.
3. Use an encrypted Amazon EFS file system and configure EFS access points with application-specific root directories and POSIX identities.
4. Use an Amazon EBS Multi-Attach volume as the shared POSIX file system for all instances.

Answer: C. Use an encrypted Amazon EFS file system and configure EFS access points with application-specific root directories and POSIX identities.

EFS provides shared NFS access for Linux instances, supports encryption at rest, and access points can enforce a root directory and POSIX identity for each application. S3 is object storage, and EBS Multi-Attach is not a general shared POSIX file-system solution.

1. Create an IAM user in Account B and email its access keys to the application team.
2. Make the bucket public and rely on the application to request only approved objects.
3. Copy the bucket into Account A on a schedule and share the replication credentials with the application.
4. Create a role in Account B whose trust policy permits the approved principal in Account A to assume it, and grant the role read access to the bucket.

Answer: D. Create a role in Account B whose trust policy permits the approved principal in Account A to assume it, and grant the role read access to the bucket.

A cross-account IAM role provides temporary credentials through AssumeRole and lets Account B scope permissions to the required bucket. Long-lived keys and public access weaken security, while scheduled copies add unnecessary delay and operations.

1. Configure the Amazon RDS database for Multi-AZ deployment.
2. Take a manual database snapshot each night and restore it after an outage.
3. Create a read replica in the same Availability Zone and direct all writes to it.
4. Run the database on a single EC2 instance with an attached EBS volume.

Answer: A. Configure the Amazon RDS database for Multi-AZ deployment.

RDS Multi-AZ maintains a standby in another Availability Zone and performs automatic failover for supported deployments. A snapshot requires a restore operation, and a read replica is intended primarily for read scaling rather than this automatic standby design.