AWS Certification Solutions Architect Associate 2026 past questions and answers

1. Create an S3 gateway VPC endpoint and associate it with the private-subnet route tables.
2. Create a NAT gateway in each Availability Zone and route S3 traffic through it.
3. Attach an internet gateway to the VPC and assign public IP addresses to the servers.
4. Create an S3 interface endpoint and configure each server to use a public S3 endpoint.

Answer: A. Create an S3 gateway VPC endpoint and associate it with the private-subnet route tables.

An S3 gateway endpoint routes traffic privately through the AWS network and has no additional endpoint charge. NAT gateways add hourly and data-processing costs; public IPs are unnecessary.

1. Run a daily script that finds unencrypted EBS volumes and encrypts them after creation.
2. Enable EBS encryption by default in the Region and specify the customer managed KMS key.
3. Require each application team to encrypt its EBS volumes in its launch templates.
4. Configure an S3 bucket policy to require encryption for EBS snapshots.

Answer: B. Enable EBS encryption by default in the Region and specify the customer managed KMS key.

Regional EBS encryption-by-default applies encryption automatically to new volumes and snapshots, and the default KMS key can be set to the required customer managed key. A post-creation script leaves an exposure window and requires more operations.

1. Put the password in an encrypted user-data script and update the script every 90 days.
2. Store the password as an environment variable in each application instance.
3. Store the credential in AWS Secrets Manager, configure rotation for the database, and have the application retrieve the secret.
4. Store the password in an S3 object and grant the application read access to the bucket.

Answer: C. Store the credential in AWS Secrets Manager, configure rotation for the database, and have the application retrieve the secret.

Secrets Manager supports managed rotation for compatible RDS databases and lets the application retrieve the current secret at runtime. User data, environment variables, and S3 objects require custom rotation and create avoidable credential exposure risks.

1. An internet gateway with restrictive security group rules.
2. A NAT instance in each private subnet.
3. An interface VPC endpoint for S3 in every Availability Zone.
4. An S3 gateway VPC endpoint associated with the relevant route tables.

Answer: D. An S3 gateway VPC endpoint associated with the relevant route tables.

An S3 gateway endpoint provides private S3 access through route tables without hourly endpoint charges. An interface endpoint has per-AZ hourly charges, while an internet gateway or NAT instance is unnecessary for this private route.

1. Amazon S3 Standard, which stores data redundantly across multiple Availability Zones.
2. Amazon S3 One Zone-IA, which stores data in a single Availability Zone.
3. An EBS volume attached to one web server in one Availability Zone.
4. An instance store volume on each web server, without persistent replication.

Answer: A. Amazon S3 Standard, which stores data redundantly across multiple Availability Zones.

S3 Standard is designed to store objects redundantly across multiple Availability Zones, without customer-managed replication. One Zone-IA and the listed instance-attached storage choices do not provide the same AZ resilience.