Title: AWS Solutions Architect Associate / English / Sample 25
Tags: EN SAA-C03 Source_question Security Premium_original Performance AWS_IAM IAM_Identity_Center AWS_Architecture Cost_optimization Amazon_FSx Resilience S3_Glacier_Deep_Archive AWS_Config AWS_Secrets_Manager AWS_Snowball_Edge Amazon_Aurora Amazon_ElastiCache Amazon_Simple_Queue_Service Aurora_Auto_Scaling Mixed_architecture
On every note of this deck, unless a note says otherwise:
Type: Exam-style scenario

Card ID: SOURCE-001
Domain: Performance
Service: Amazon Simple Queue Service
Difficulty: Intermediate
Question: A company is migrating a distributed application to AWS. The application serves variable workloads. The legacy platform consists of a primary server that coordinates jobs across multiple compute nodes. The company wants to modernize the application with a solution that maximizes resiliency and scalability. How should a solutions architect design the architecture to meet these requirements?
Options: AConfigure an Amazon Simple Queue Service (Amazon SQS) queue as a destination for the jobs. Implement the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure EC2 Auto Scaling to use scheduled scaling.
BConfigure an Amazon Simple Queue Service (Amazon SQS) queue as a destination for the jobs. Implement the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure EC2 Auto Scaling based on the size of the queue.
CImplement the primary server and the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure AWS CloudTrail as a destination for the jobs. Configure EC2 Auto Scaling based on the load on the primary server.
DImplement the primary server and the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure Amazon EventBridge (Amazon CloudWatch Events) as a destination for the jobs. Configure EC2 Auto Scaling based on the load on the compute nodes.
Answer: B) Configure an Amazon Simple Queue Service (Amazon SQS) queue as a destination for the jobs. Implement the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure EC2 Auto Scaling based on the size of the queue.
Explanation: Amazon SQS provides a durable buffer between producers and consumers. Workers can scale independently, and queue depth or message age can drive EC2 Auto Scaling when demand is unpredictable.
Exam Signal: Look for asynchronous work, burst absorption, backpressure, or independent scaling.
Trap: Scheduled scaling follows a clock, not the actual backlog. Amazon SNS is push-based fan-out, while SQS is the pull-based work buffer.
Diagram: Architecture map
Producer→Amazon SQS→Auto-scaled workers
Source: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html

Card ID: SOURCE-002
Domain: Performance
Service: Aurora Auto Scaling
Difficulty: Intermediate
Question: A company runs an ecommerce application on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales based on CPU utilization metrics. The ecommerce application stores the transaction data in a MySQL 8.0 database that is hosted on a large EC2 instance. The database’s performance degrades quickly as application load increases. The application handles more read requests than write transactions. The company wants a solution that will automatically scale the database to meet the demand of unpredictable read workloads while maintaining high availability. Which solution will meet these requirements?
Options: AUse Amazon Redshift with a single node for leader and compute functionality.
BUse Amazon RDS with a Single-AZ deployment. Configure Amazon RDS to add reader instances in a different Availability Zone.
CUse Amazon Aurora with a Multi-AZ deployment. Configure Aurora Auto Scaling with Aurora Replicas.
DUse Amazon ElastiCache for Memcached with EC2 Spot Instances.
Answer: C) Use Amazon Aurora with a Multi-AZ deployment. Configure Aurora Auto Scaling with Aurora Replicas.
Explanation: Aurora Replicas share the cluster storage volume and can serve read traffic. Aurora Auto Scaling adjusts the number of replicas to match changing read demand while Multi-AZ placement supports high availability.
Exam Signal: Separate read scaling from writer availability and identify unpredictable read demand.
Trap: A Multi-AZ standby primarily provides failover; it is not automatically a general-purpose read-scaling endpoint.
Diagram: Architecture map
Writer→Shared cluster storage→Auto-scaled readers
Source: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html

Card ID: SOURCE-003
Domain: Cost optimization
Service: S3 Glacier Deep Archive
Difficulty: Intermediate
Question: A company is storing backup files by using Amazon S3 Standard storage. The files are accessed frequently for 1 month. However, the files are not accessed after 1 month. The company must keep the files indefinitely. Which storage solution will meet these requirements MOST cost-effectively?
Options: AConfigure S3 Intelligent-Tiering to automatically migrate objects.
BCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 month.
CCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Standard- Infrequent Access (S3 Standard-IA) after 1 month.
DCreate an S3 Lifecycle configuration to transition objects from S3 Standard to S3 One Zone- Infrequent Access (S3 One Zone-IA) after 1 month.
Answer: B) Create an S3 Lifecycle configuration to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 month.
Explanation: An S3 Lifecycle rule automatically transitions objects after their access pattern changes. Glacier Deep Archive is designed for long-term retention when retrieval is rare and slower restore times are acceptable.
Exam Signal: Match storage class to access frequency, retention period, and retrieval-time requirement.
Trap: Standard-IA and One Zone-IA still charge for stored data and retrieval; they are not the lowest-cost fit for data kept indefinitely and almost never read.
Diagram: Architecture map
S3 Standard→Lifecycle after 30 days→Glacier Deep Archive
Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html

Card ID: SOURCE-004
Domain: Performance
Service: AWS Config
Difficulty: Intermediate
Question: A company that hosts its web application on AWS wants to ensure all Amazon EC2 instances, Amazon RDS DB instances, and Amazon Redshift clusters are configured with tags. The company wants to minimize the effort of configuring and operating this check. What should a solutions architect do to accomplish this?
Options: AUse AWS Config rules to define and detect resources that are not properly tagged.
BUse Cost Explorer to display resources that are not properly tagged. Tag those resources manually.
CWrite API calls to check all resources for proper tag allocation. Periodically run the code on an EC2 instance.
DWrite API calls to check all resources for proper tag allocation. Schedule an AWS Lambda function through Amazon CloudWatch to periodically run the code.
Answer: A) Use AWS Config rules to define and detect resources that are not properly tagged.
Explanation: The correct option most directly satisfies the stated requirements. Evaluate each choice against availability, performance, security, cost, and operational effort instead of selecting a service only because its name is familiar.
Exam Signal: Identify the decisive requirement first, then eliminate options that solve a different problem.
Trap: A plausible distractor often provides a useful AWS capability but optimizes the wrong requirement or adds unnecessary operational complexity.
Source: https://docs.aws.amazon.com/

Card ID: SOURCE-005
Domain: Security
Service: AWS Architecture
Difficulty: Intermediate
Question: A company has an Amazon S3 bucket that contains critical data. The company must protect the data from accidental deletion. Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
Options: AEnable versioning on the S3 bucket.
BEnable MFA Delete on the S3 bucket.
CCreate a bucket policy on the S3 bucket.
DEnable default encryption on the S3 bucket.
ECreate a lifecycle policy for the objects in the S3 bucket.
Answer: B) Enable MFA Delete on the S3 bucket.
D) Enable default encryption on the S3 bucket.
Explanation: The correct option most directly satisfies the stated requirements. Evaluate each choice against availability, performance, security, cost, and operational effort instead of selecting a service only because its name is familiar.
Exam Signal: Identify the decisive requirement first, then eliminate options that solve a different problem.
Trap: A plausible distractor often provides a useful AWS capability but optimizes the wrong requirement or adds unnecessary operational complexity.
Source: https://docs.aws.amazon.com/

Card ID: SOURCE-006
Domain: Performance
Service: Amazon ElastiCache
Difficulty: Intermediate
Question: A company’s website uses an Amazon EC2 instance store for its catalog of items. The company wants to make sure that the catalog is highly available and that the catalog is stored in a durable location. What should a solutions architect do to meet these requirements?
Options: AMove the catalog to Amazon ElastiCache for Redis.
BDeploy a larger EC2 instance with a larger instance store.
CMove the catalog from the instance store to Amazon S3 Glacier Deep Archive.
DMove the catalog to an Amazon Elastic File System (Amazon EFS) file system.
Answer: A) Move the catalog to Amazon ElastiCache for Redis.
Explanation: Amazon ElastiCache keeps frequently accessed data in memory, reducing database load and improving read latency when the application can tolerate cached data.
Exam Signal: Repeated reads, session data, expensive queries, or sub-millisecond access suggest caching.
Trap: A cache is not the system of record; design for expiration, eviction, invalidation, and cache misses.
Diagram: Architecture map
Application→ElastiCache→Database on cache miss
Source: https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/WhatIs.html

Card ID: SOURCE-007
Domain: Cost optimization
Service: S3 Glacier Deep Archive
Difficulty: Intermediate
Question: A company needs to store its accounting records in Amazon S3. The records must be immediately accessible for 1 year and then must be archived for an additional 9 years. No one at the company, including administrative users and root users, can be able to delete the records during the entire 10-year period. The records must be stored with maximum resiliency. Which solution will meet these requirements?
Options: AStore the records in S3 Glacier for the entire 10-year period. Use an access control policy to deny deletion of the records for a period of 10 years.
BStore the records by using S3 Intelligent-Tiering. Use an IAM policy to deny deletion of the records. After 10 years, change the IAM policy to allow deletion.
CUse an S3 Lifecycle policy to transition the records from S3 Standard to S3 Glacier Deep Archive after 1 year. Use S3 Object Lock in compliance mode for a period of 10 years.
DUse an S3 Lifecycle policy to transition the records from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 1 year. Use S3 Object Lock in governance mode for a period of 10 years.
Answer: C) Use an S3 Lifecycle policy to transition the records from S3 Standard to S3 Glacier Deep Archive after 1 year. Use S3 Object Lock in compliance mode for a period of 10 years.
Explanation: An S3 Lifecycle rule automatically transitions objects after their access pattern changes. Glacier Deep Archive is designed for long-term retention when retrieval is rare and slower restore times are acceptable.
Exam Signal: Match storage class to access frequency, retention period, and retrieval-time requirement.
Trap: Standard-IA and One Zone-IA still charge for stored data and retrieval; they are not the lowest-cost fit for data kept indefinitely and almost never read.
Diagram: Architecture map
S3 Standard→Lifecycle after 30 days→Glacier Deep Archive
Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html

Card ID: SOURCE-008
Domain: Resilience
Service: Amazon FSx
Difficulty: Intermediate
Question: A company runs multiple Windows workloads on AWS. The company’s employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files. What should a solutions architect do to meet these requirements?
Options: AMigrate all the data to Amazon S3. Set up IAM authentication for users to access files.
BSet up an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
CExtend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
DExtend the file share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.
Answer: C) Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
Explanation: A Multi-AZ deployment maintains a synchronously replicated standby and supports managed failover, making it an availability solution for relational databases.
Exam Signal: High availability and automatic failover point to Multi-AZ; read throughput points to replicas.
Trap: Read replicas scale reads but do not replace the synchronous standby used for managed failover.
Diagram: Architecture map
Primary DB→Synchronous replication→Standby in another AZ
Source: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Card ID: SOURCE-009
Domain: Security
Service: AWS Secrets Manager
Difficulty: Intermediate
Question: A company is developing a two-tier web application on AWS. The company’s developers have deployed the application on an Amazon EC2 instance that connects directly to a backend Amazon RDS database. The company must not hardcode database credentials in the application. The company must also implement a solution to automatically rotate the database credentials on a regular basis. Which solution will meet these requirements with the LEAST operational overhead?
Options: AStore the database credentials in the instance metadata. Use Amazon EventBridge rules to run a scheduled AWS Lambda function that updates the RDS credentials and instance metadata at the same time.
BStore the database credentials in a configuration file in an encrypted Amazon S3 bucket. Use Amazon EventBridge rules to run a scheduled AWS Lambda function that updates the RDS credentials and the credentials in the configuration file at the same time. Use S3 Versioning to ensure the ability to fall back to previous values.
CStore the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.
DStore the database credentials as encrypted parameters in AWS Systems Manager Parameter Store. Turn on automatic rotation for the encrypted parameters. Attach the required permission to the EC2 role to grant access to the encrypted parameters.
Answer: C) Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.
Explanation: AWS Secrets Manager securely stores secret values and can automate rotation. Applications retrieve secrets at runtime under IAM control.
Exam Signal: Database passwords, API tokens, secret rotation, and runtime retrieval suggest Secrets Manager.
Trap: Do not store secrets in code or AMIs. AWS KMS protects keys but is not a secret-value repository.
Diagram: Architecture map
Application role→Secrets Manager→Rotated credential
Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Card ID: SOURCE-010
Domain: Performance
Service: AWS Architecture
Difficulty: Intermediate
Question: A hospital recently deployed a RESTful API with Amazon API Gateway and AWS Lambda. The hospital uses API Gateway and Lambda to upload reports that are in PDF format and JPEG format. The hospital needs to modify the Lambda code to identify protected health information (PHI) in the reports. Which solution will meet these requirements with the LEAST operational overhead?
Options: AUse existing Python libraries to extract the text from the reports and to identify the PHI from the extracted text.
BUse Amazon Textract to extract the text from the reports. Use Amazon SageMaker to identify the PHI from the extracted text.
CUse Amazon Textract to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.
DUse Amazon Rekognition to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.
Answer: C) Use Amazon Textract to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.
Explanation: AWS Lambda runs event-driven code without managing servers and scales through concurrent executions. It is a strong fit for short-lived, stateless processing.
Exam Signal: Event-driven execution, bursty demand, and minimal server operations suggest Lambda.
Trap: Account for timeout, concurrency, cold-start, payload, and ephemeral-storage limits.
Diagram: Architecture map
Event source→AWS Lambda→Managed scaling
Source: https://docs.aws.amazon.com/lambda/latest/dg/welcome.html

Card ID: SOURCE-011
Domain: Cost optimization
Service: AWS Architecture
Difficulty: Intermediate
Question: A company runs a photo processing application that needs to frequently upload and download pictures from Amazon S3 buckets that are located in the same AWS Region. A solutions architect has noticed an increased cost in data transfer fees and needs to implement a solution to reduce these costs. How can the solutions architect meet this requirement?
Options: ADeploy Amazon API Gateway into a public subnet and adjust the route table to route S3 calls through it.
BDeploy a NAT gateway into a public subnet and attach an endpoint policy that allows access to the S3 buckets.
CDeploy the application into a public subnet and allow it to route through an internet gateway to access the S3 buckets.
DDeploy an S3 VPC gateway endpoint into the VPC and attach an endpoint policy that allows access to the S3 buckets.
Answer: D) Deploy an S3 VPC gateway endpoint into the VPC and attach an endpoint policy that allows access to the S3 buckets.
Explanation: The correct option most directly satisfies the stated requirements. Evaluate each choice against availability, performance, security, cost, and operational effort instead of selecting a service only because its name is familiar.
Exam Signal: Identify the decisive requirement first, then eliminate options that solve a different problem.
Trap: A plausible distractor often provides a useful AWS capability but optimizes the wrong requirement or adds unnecessary operational complexity.
Source: https://docs.aws.amazon.com/

Card ID: SOURCE-012
Domain: Resilience
Service: Amazon Aurora
Difficulty: Intermediate
Question: A company runs an on-premises application that is powered by a MySQL database. The company is migrating the application to AWS to increase the application’s elasticity and availability. The current architecture shows heavy read activity on the database during times of normal operation. Every 4 hours, the company’s development team pulls a full export of the production database to populate a database in the staging environment. During this period, users experience unacceptable application latency. The development team is unable to use the staging environment until the procedure completes. A solutions architect must recommend replacement architecture that alleviates the application latency issue. The replacement architecture also must give the development team the ability to continue using the staging environment without delay. Which solution meets these requirements?
Options: AUse Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.
BUse Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Use database cloning to create the staging database on-demand.
CUse Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Use the standby instance for the staging database.
DUse Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.
Answer: B) Use Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Use database cloning to create the staging database on-demand.
Explanation: Aurora Replicas share the cluster storage volume and can serve read traffic. Aurora Auto Scaling adjusts the number of replicas to match changing read demand while Multi-AZ placement supports high availability.
Exam Signal: Separate read scaling from writer availability and identify unpredictable read demand.
Trap: A Multi-AZ standby primarily provides failover; it is not automatically a general-purpose read-scaling endpoint.
Diagram: Architecture map
Writer→Shared cluster storage→Auto-scaled readers
Source: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html

Card ID: SOURCE-013
Domain: Mixed architecture
Service: Amazon FSx
Difficulty: Intermediate
Question: A company has a large Microsoft SharePoint deployment running on-premises that requires Microsoft Windows shared file storage. The company wants to migrate this workload to the AWS Cloud and is considering various storage options. The storage solution must be highly available and integrated with Active Directory for access control. Which solution will satisfy these requirements?
Options: AConfigure Amazon EFS storage and set the Active Directory domain for authentication.
BCreate an SMB file share on an AWS Storage Gateway file gateway in two Availability Zones.
CCreate an Amazon S3 bucket and configure Microsoft Windows Server to mount it as a volume.
DCreate an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication.
Answer: D) Create an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication.
Explanation: The correct option most directly satisfies the stated requirements. Evaluate each choice against availability, performance, security, cost, and operational effort instead of selecting a service only because its name is familiar.
Exam Signal: Identify the decisive requirement first, then eliminate options that solve a different problem.
Trap: A plausible distractor often provides a useful AWS capability but optimizes the wrong requirement or adds unnecessary operational complexity.
Source: https://docs.aws.amazon.com/

Card ID: SOURCE-014
Domain: Performance
Service: AWS Architecture
Difficulty: Intermediate
Question: A company is preparing to deploy a new serverless workload. A solutions architect must use the principle of least privilege to configure permissions that will be used to run an AWS Lambda function. An Amazon EventBridge rule will invoke the function. Which solution meets these requirements?
Options: AAdd an execution role to the function with lambda:InvokeFunction as the action and * as the principal.
BAdd an execution role to the function with lambda:InvokeFunction as the action and Service: lambda.amazonaws.com as the principal.
CAdd a resource-based policy to the function with lambda:* as the action and Service: events.amazonaws.com as the principal.
DAdd a resource-based policy to the function with lambda:InvokeFunction as the action and Service: events.amazonaws.com as the principal.
Answer: D) Add a resource-based policy to the function with lambda:InvokeFunction as the action and Service: events.amazonaws.com as the principal.
Explanation: AWS Lambda runs event-driven code without managing servers and scales through concurrent executions. It is a strong fit for short-lived, stateless processing.
Exam Signal: Event-driven execution, bursty demand, and minimal server operations suggest Lambda.
Trap: Account for timeout, concurrency, cold-start, payload, and ephemeral-storage limits.
Diagram: Architecture map
Event source→AWS Lambda→Managed scaling
Source: https://docs.aws.amazon.com/lambda/latest/dg/welcome.html

Card ID: SOURCE-015
Domain: Cost optimization
Service: AWS Snowball Edge
Difficulty: Intermediate
Question: A company uses 50 TB of data for reporting. The company wants to move this data from on premises to AWS. A custom application in the company’s data center runs a weekly data transformation job. The company plans to pause the application until the data transfer is complete and needs to begin the transfer process as soon as possible. The data center does not have any available network bandwidth for additional workloads. A solutions architect must transfer the data and must configure the transformation job to continue to run in the AWS Cloud. Which solution will meet these requirements with the LEAST operational overhead?
Options: AUse AWS DataSync to move the data. Create a custom transformation job by using AWS Glue.
BOrder an AWS Snowcone device to move the data. Deploy the transformation application to the device.
COrder an AWS Snowball Edge Storage Optimized device. Copy the data to the device. Create a custom transformation job by using AWS Glue.
DOrder an AWS Snowball Edge Storage Optimized device that includes Amazon EC2 compute. Copy the data to the device. Create a new EC2 instance on AWS to run the transformation application.
Answer: C) Order an AWS Snowball Edge Storage Optimized device. Copy the data to the device. Create a custom transformation job by using AWS Glue.
Explanation: AWS Snowball Edge transfers large datasets using a physical device when network bandwidth, transfer windows, or remote locations make online migration impractical.
Exam Signal: Tens of terabytes, limited bandwidth, and a fixed migration deadline suggest Snow Family.
Trap: Include shipping time and operational handling when comparing offline transfer with DataSync or network links.
Diagram: Architecture map
On-premises data→Snowball Edge→AWS import
Source: https://docs.aws.amazon.com/snowball/latest/developer-guide/whatisedge.html

Card ID: PREMIUM-001
Domain: Security
Service: AWS IAM
Difficulty: Intermediate
Question: A company needs to control user permissions, groups, roles and workloads with least-privilege policies. Which AWS service or design best meets the requirement with the least unnecessary complexity?
Options: AIAM Identity Center
BAmazon GuardDuty
CAmazon Macie
DAWS IAM
Answer: D) AWS IAM
Explanation: AWS IAM is the best fit because it is designed to control user permissions, groups, roles and workloads with least-privilege policies. It is a global service and highly available; roles provide temporary credentials for workloads.
Exam Signal: Decisive requirement: control user permissions, groups, roles and workloads with least-privilege policies.
Trap: An execution role grants what workload can do; a resource policy defines who can access the resource.
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Card ID: PREMIUM-002
Domain: Security
Service: AWS IAM
Difficulty: Intermediate
Question: A solutions architect is evaluating AWS IAM for a production workload. Which statement BEST describes its availability or scaling behavior?
Options: AIt removes the need to design failure handling, monitoring, or recovery.
BIt scales only through manual hardware replacement during maintenance windows.
CIt always runs in one Availability Zone and cannot be made resilient.
DIt is a global service and highly available; roles provide temporary credentials for workloads.
Answer: D) It is a global service and highly available; roles provide temporary credentials for workloads.
Explanation: It is a global service and highly available; roles provide temporary credentials for workloads.
Exam Signal: Match the service boundary to the required availability and scaling model.
Trap: An execution role grants what workload can do; a resource policy defines who can access the resource.
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Card ID: PREMIUM-003
Domain: Security
Service: AWS IAM
Difficulty: Intermediate
Question: A company uses AWS IAM in a security-sensitive workload. Which action follows AWS security best practices?
Options: ADisable encryption and audit logging to reduce latency and operational cost.
BStore long-lived credentials in source code so instances can recover them after restart.
CPrefer permanent access keys, require MFA for sensitive actions and reduce wildcard policies.
DGrant wildcard administrator permissions to every workload to prevent access failures.
Answer: C) Prefer permanent access keys, require MFA for sensitive actions and reduce wildcard policies.
Explanation: Prefer permanent access keys, require MFA for sensitive actions and reduce wildcard policies.
Exam Signal: Prefer least privilege, temporary credentials, encryption, isolation, and auditable changes.
Trap: Convenience is not a security control. Broad permissions and embedded credentials increase blast radius.
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Card ID: PREMIUM-004
Domain: Security
Service: AWS IAM
Difficulty: Advanced
Question: A team is estimating the cost and operational effort of AWS IAM. Which statement is the MOST accurate?
Options: AThere is no additional charge by the IAM; the actual cost lies in the operational risk of excessive permissions.
BThe bill is fixed and cannot change when usage patterns or resource sizes change.
CThe service is always free regardless of requests, storage, data transfer, or optional features.
DSelecting the highest-priced configuration always provides the lowest total cost of ownership.
Answer: A) There is no additional charge by the IAM; the actual cost lies in the operational risk of excessive permissions.
Explanation: There is no additional charge by the IAM; the actual cost lies in the operational risk of excessive permissions.
Exam Signal: Consider usage dimensions, operational effort, and the architecture's actual demand pattern.
Trap: Do not optimize only the unit price; include data transfer, requests, idle capacity, and management effort.
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Card ID: PREMIUM-005
Domain: Security
Service: AWS IAM
Difficulty: Advanced
Question: Which statement about AWS IAM is correct?
Options: AAWS IAM has identical behavior, quotas, and availability in every Region without verification.
BAn execution role grants what workload can do; a resource policy defines who can access the resource.
CAWS IAM automatically replaces every adjacent AWS service in the architecture.
DUsing AWS IAM removes the need for IAM, monitoring, backups, and failure handling.
Answer: B) An execution role grants what workload can do; a resource policy defines who can access the resource.
Explanation: The correct statement captures an important exam distinction for AWS IAM. Use that distinction to eliminate services that solve a neighboring but different requirement.
Exam Signal: Know the service boundary and the closest commonly confused alternative to AWS IAM.
Trap: An execution role grants what workload can do; a resource policy defines who can access the resource.
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Card ID: PREMIUM-006
Domain: Security
Service: IAM Identity Center
Difficulty: Intermediate
Question: A company needs to centralize human access to various AWS accounts and applications using single login and permission sets. Which AWS service or design best meets the requirement with the least unnecessary complexity?
Options: AAmazon Macie
BAWS Secrets Manager
CIAM Identity Center
DAWS Organizations and SCPs
Answer: C) IAM Identity Center
Explanation: IAM Identity Center is the best fit because it is designed to centralize human access to various AWS accounts and applications using single login and permission sets. It integrates with AWS Organizations and distributes permission sets consistently between accounts.
Exam Signal: Decisive requirement: centralize human access to various AWS accounts and applications using single login and permission sets.
Trap: IAM Identity Center is focused on access to the workforce; Amazon Cognito meets customer identities in applications.
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Card ID: PREMIUM-007
Domain: Security
Service: IAM Identity Center
Difficulty: Intermediate
Question: A solutions architect is evaluating IAM Identity Center for a production workload. Which statement BEST describes its availability or scaling behavior?
Options: AIt scales only through manual hardware replacement during maintenance windows.
BIt integrates with AWS Organizations and distributes permission sets consistently between accounts.
CIt removes the need to design failure handling, monitoring, or recovery.
DIt always runs in one Availability Zone and cannot be made resilient.
Answer: B) It integrates with AWS Organizations and distributes permission sets consistently between accounts.
Explanation: It integrates with AWS Organizations and distributes permission sets consistently between accounts.
Exam Signal: Match the service boundary to the required availability and scaling model.
Trap: IAM Identity Center is focused on access to the workforce; Amazon Cognito meets customer identities in applications.
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Card ID: PREMIUM-008
Domain: Security
Service: IAM Identity Center
Difficulty: Intermediate
Question: A company uses IAM Identity Center in a security-sensitive workload. Which action follows AWS security best practices?
Options: AGrant wildcard administrator permissions to every workload to prevent access failures.
BConnect a reliable source of identity, use MFA and grant group access instead of isolated users.
CStore long-lived credentials in source code so instances can recover them after restart.
DDisable encryption and audit logging to reduce latency and operational cost.
Answer: B) Connect a reliable source of identity, use MFA and grant group access instead of isolated users.
Explanation: Connect a reliable source of identity, use MFA and grant group access instead of isolated users.
Exam Signal: Prefer least privilege, temporary credentials, encryption, isolation, and auditable changes.
Trap: Convenience is not a security control. Broad permissions and embedded credentials increase blast radius.
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Card ID: PREMIUM-009
Domain: Security
Service: IAM Identity Center
Difficulty: Advanced
Question: A team is estimating the cost and operational effort of IAM Identity Center. Which statement is the MOST accurate?
Options: AThe bill is fixed and cannot change when usage patterns or resource sizes change.
BSelecting the highest-priced configuration always provides the lowest total cost of ownership.
CThe service is always free regardless of requests, storage, data transfer, or optional features.
DReduces the effort to manage users IAM duplicates and long-term credentials in many accounts.
Answer: D) Reduces the effort to manage users IAM duplicates and long-term credentials in many accounts.
Explanation: Reduces the effort to manage users IAM duplicates and long-term credentials in many accounts.
Exam Signal: Consider usage dimensions, operational effort, and the architecture's actual demand pattern.
Trap: Do not optimize only the unit price; include data transfer, requests, idle capacity, and management effort.
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Card ID: PREMIUM-010
Domain: Security
Service: IAM Identity Center
Difficulty: Advanced
Question: Which statement about IAM Identity Center is correct?
Options: AIAM Identity Center automatically replaces every adjacent AWS service in the architecture.
BUsing IAM Identity Center removes the need for IAM, monitoring, backups, and failure handling.
CIAM Identity Center is focused on access to the workforce; Amazon Cognito meets customer identities in applications.
DIAM Identity Center has identical behavior, quotas, and availability in every Region without verification.
Answer: C) IAM Identity Center is focused on access to the workforce; Amazon Cognito meets customer identities in applications.
Explanation: The correct statement captures an important exam distinction for IAM Identity Center. Use that distinction to eliminate services that solve a neighboring but different requirement.
Exam Signal: Know the service boundary and the closest commonly confused alternative to IAM Identity Center.
Trap: IAM Identity Center is focused on access to the workforce; Amazon Cognito meets customer identities in applications.
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html