AWS Certification Solutions Architect Associate 2024 past questions and answers

1. Store an IAM user's access key and secret key in the application's configuration file.
2. Attach an IAM role to the EC2 instances with permissions limited to the required S3 bucket prefix.
3. Make the bucket public and rely on an unpredictable object key prefix.
4. Grant the EC2 instances the AmazonS3FullAccess managed policy.

Answer: B. Attach an IAM role to the EC2 instances with permissions limited to the required S3 bucket prefix.

An instance profile supplies temporary role credentials, and a narrowly scoped policy can restrict access to the required prefix. Long-lived keys, public access, and broad full-access permissions increase exposure unnecessarily.

1. Assign public IPv4 addresses to the instances and add an internet gateway.
2. Route the S3 traffic through a NAT gateway in a public subnet.
3. Create an S3 gateway VPC endpoint and associate it with the private-subnet route tables.
4. Create an interface endpoint for every S3 bucket and add a default route to it.

Answer: C. Create an S3 gateway VPC endpoint and associate it with the private-subnet route tables.

An S3 gateway endpoint provides private connectivity from VPC route tables to S3 and avoids NAT gateway processing charges for that path. A NAT gateway is unnecessary, and S3 gateway endpoints are not created per bucket.

1. Configure S3 server-side encryption with AWS KMS keys using a customer-managed KMS key, and retain the relevant AWS CloudTrail events.
2. Enable S3 default encryption with SSE-S3; this provides customer-managed key rotation and key-usage audit events.
3. Encrypt the bucket name with a KMS key and use S3 Block Public Access.
4. Use TLS for requests and disable server-side encryption because the files are encrypted in transit.

Answer: A. Configure S3 server-side encryption with AWS KMS keys using a customer-managed KMS key, and retain the relevant AWS CloudTrail events.

SSE-KMS with a customer-managed key provides control over key policies and rotation, and KMS API activity can be audited with CloudTrail. SSE-S3 does not give the customer management of the encryption key, while TLS protects data in transit rather than at rest.

1. Create a company IAM user for the auditor and email the user long-term access keys.
2. Add the auditor's account to the company's organization and grant administrator access.
3. Make the selected resources public for the duration of the audit.
4. Create a least-privilege IAM role with a trust policy for the auditor's account and require an external ID.

Answer: D. Create a least-privilege IAM role with a trust policy for the auditor's account and require an external ID.

A narrowly scoped cross-account role grants temporary credentials without distributing long-lived keys. Requiring an external ID helps mitigate the confused deputy risk; organization membership and public access are not appropriate.

1. Deploy the DB instance as a Multi-AZ DB instance.
2. Create a read replica in the same Availability Zone and direct writes to it.
3. Take a manual snapshot every hour and restore it after a failure.
4. Increase the DB instance storage size and keep it in one Availability Zone.

Answer: A. Deploy the DB instance as a Multi-AZ DB instance.

A Multi-AZ DB instance maintains a synchronous standby in another Availability Zone and supports automatic failover for availability. A read replica is primarily for read scaling and does not replace the Multi-AZ failover design.