AWS Certified Solutions Architect Professional AWS Certified Solutions Architect Professional Free Practice Test — 30 Questions
This practice bank focuses on high-level architectural decisions required for designing secure, compliant, and resilient solutions on AWS. It exercises knowledge of multi-account governance, data residency and sovereignty, disaster recovery patterns, microservice migration strategies, and observability. Practical scenarios involve financial and e-commerce domains with strict regulatory requirements (GDPR, PCI DSS, SOX). Key decisions revolve around choosing appropriate AWS services for access control (SCPs, Lake Formation, IAM Identity Center), data caching (ElastiCache Global Datastore), event-driven orchestration (Step Functions), and centralized monitoring (X-Ray, CloudWatch Application Insights). The practice bank emphasizes trade-offs between cost, latency, and compliance, encouraging critical evaluation of options like AWS Outposts, Global Accelerator, S3 Object Lock, and cross-region replication.
What this AWS Certified Solutions Architect Professional AWS Certified Solutions Architect Professional practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Data Residency and Compliance Architectures
Many scenarios in this practice bank involve strict data sovereignty regulations (e.g., GDPR, PCI DSS) requiring all data processing and storage to remain within specific geographic boundaries. Solutions must balance low-latency access with compliance. Common approaches include deploying AWS Outposts in co-location facilities for on-premises processing or using region-scoped AWS services with SCPs to prevent cross-region data movement. Services like Amazon S3 Object Lock, S3 Versioning, and CloudTrail provide immutability and audit trails. Encryption with KMS Customer Managed Keys (CMKs) is consistently required. The practice set tests ability to select regional services and enforce boundaries via IAM and SCPs.
- Evaluate AWS Outposts vs. multi-region deployments when data must stay in a specific geography.
- Use S3 Object Lock in Compliance mode to meet retention and immutability mandates.
- Apply Service Control Policies (SCPs) at the OU level to deny non-compliant regional actions.
- Ensure cross-region replication respects data residency by using region-locked KMS keys and denying replication SCPs.
Multi-Account Governance with AWS Organizations and SCPs
Multiple questions address centralized governance across many AWS accounts using AWS Organizations, SCPs, and IAM Identity Center. SCPs serve as global guardrails that override IAM permissions, making them critical for enforcing security baselines and regulatory constraints. The practice bank illustrates how SCPs can deny specific services or regions, even for root users. IAM Identity Center is used for federated access with on-premises Active Directory, granting fine-grained permissions via permission sets. The ability to configure AWS Config aggregators for centralized compliance monitoring is also tested. Understanding the hierarchy: Organization -> OU -> Account, and how SCPs propagate, is essential.
- SCPs define maximum permissions; they do not grant access – IAM policies still needed.
- IAM Identity Center allows federation with external IdPs and centralized permission management.
- Use AWS Config aggregator in a central security account to collect configuration snapshots from all accounts.
- Deny actions with SCPs even at the root level; explicit denies override any allows.
Resilience and Disaster Recovery for Stateful Applications
Several scenarios require high availability and disaster recovery for stateful applications, such as trading platforms or e-commerce sites with session state. The practice bank emphasizes multi-Region active-passive patterns using Amazon Aurora Global Database for relational data and Amazon ElastiCache Global Datastore for caching. Route 53 routing policies (latency or failover) direct traffic to healthy regions. For database recovery, Multi-AZ deployments provide within-region resilience, while cross-region read replicas enable failover. The importance of RPO and RTO is highlighted, with solutions often needing automated failover via Route 53 health checks and Lambda automation.
- Amazon Aurora Global Database offers low-latency cross-region replication with failover in minutes.
- ElastiCache Global Datastore provides cross-region replication for session state with automatic failover.
- Use Route 53 latency-based or failover routing to direct users to the closest healthy region.
- For asynchronous replication, consider S3 Cross-Region Replication with versioning for data durability.
Observability and Monitoring Strategies
Troubleshooting performance issues in distributed microservices architectures is a recurring theme. The practice bank tests knowledge of AWS X-Ray for end-to-end tracing, Amazon CloudWatch Application Insights for anomaly detection, and centralized log analysis with Amazon OpenSearch Service. For real-time monitoring, combining CloudWatch metrics, logs, and traces is essential. AWS Config is used for continuous compliance monitoring of resource configurations. Many scenarios require not just detection but also automated remediation using Lambda functions triggered by Amazon EventBridge. The correct integration of these services to form a unified observability platform is a key decision point.
- AWS X-Ray traces requests across microservices to pinpoint latency sources.
- CloudWatch Application Insights uses machine learning to detect anomalies and suggest root causes.
- Amazon OpenSearch Service aggregates logs from multiple accounts for centralized analysis.
- AWS Config tracks resource configuration changes and enforces compliance rules.
Practice AWS Certified Solutions Architect Professional AWS Certified Solutions Architect Professional with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A multinational financial services firm is migrating its customer data lake to AWS. The data lake resides in Amazon S3 and contains sensitive Personally Identifiable Information (PII) and financial transaction records. Several internal teams require access: a development team for schema evolution and testing, an analytics team for business intelligence reporting, and a security operations team for auditing and incident response. Adherence to stringent financial regulations (e.g., PCI DSS, SOX) mandates robust access control, the principle of least privilege, and comprehensive audit trails for all data access. The firm needs a solution that allows for distinct, fine-grained permissions at the table and column level, while ensuring all data access events are logged for compliance. Which architectural approach best satisfies these requirements?
Study workflow
Turn one AWS Certified Solutions Architect Professional AWS Certified Solutions Architect Professional attempt into a study plan
- 1
Design a Multi-Region Active-Passive Disaster Recovery Architecture
1. Identify critical stateful components (database, cache) and select Aurora Global Database for RDS or ElastiCache Global Datastore for Redis. 2. Deploy primary resources in the primary region and cross-region replicas in the secondary region. 3. Configure Route 53 with failover routing records, health checks, and DNS TTLs as low as possible. 4. Automate failover using AWS Lambda functions triggered by CloudWatch alarms or Route 53 health check status. 5. Regularly test failover by simulating regional outages, ensuring RPO and RTO targets are met.
- 2
Implement Least-Privilege Access Across Multiple Accounts with SCPs
1. Identify accounts and OUs (e.g., Production, Development, Finance). 2. Define baseline SCPs at the root level to deny high-risk actions (e.g., deleting CloudTrail logs, disabling multi-factor authentication). 3. Attach additional SCPs to OUs to enforce data residency (e.g., deny all actions except in eu-west-1 for Finance OU). 4. Use IAM Identity Center permission sets to grant specific service actions within allowed boundaries. 5. Regularly review SCPs using AWS Organizations policy evaluation and IAM Access Analyzer to ensure least privilege.
- 3
Set Up Centralized Auditing and Compliance Monitoring
1. Designate a dedicated security or audit AWS account within AWS Organizations. 2. Enable AWS CloudTrail in all accounts with log file validation and send trails to a central S3 bucket in the audit account via cross-account permissions. 3. Create an AWS Config aggregator in the audit account and authorize all member accounts to send data. 4. Set up AWS Config rules for compliance checks (e.g., S3 bucket public access blocked). 5. Use Amazon EventBridge to trigger automated remediation Lambda functions when non-compliant resources are detected.
- 4
Migrate a Monolithic Application to Microservices with Zero Downtime
1. Use the strangler fig pattern: gradually replace monolith functionality with microservices behind an Amazon API Gateway. 2. For state, migrate session data to ElastiCache for Redis and transactional data to Aurora with DMS continuous replication. 3. Deploy microservices in containers on ECS or EKS, behind Application Load Balancers. 4. Route traffic incrementally using API Gateway: first test with internal users, then gradually increase percentage. 5. Monitor with AWS X-Ray and CloudWatch; revert if issues arise until full cutover.
- 5
Configure Comprehensive Observability for a Microservices Application
1. Instrument all services with AWS X-Ray SDK to capture traces and segments. 2. Enable detailed CloudWatch metrics (CPU, memory, request count) and set up composite alarms for anomaly detection using CloudWatch Application Insights. 3. Stream application logs to Amazon OpenSearch Service (formerly Elasticsearch) for centralized search and visualization. 4. Create dashboards in CloudWatch or Grafana that combine metrics, logs, and traces. 5. Set up automated responses: use EventBridge rules to send alerts to Slack or trigger Lambda to auto-scale resources.
FAQ
Questions about this exam practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
How do I enforce data residency in AWS without using third-party tools?+
Use Service Control Policies (SCPs) in AWS Organizations to deny API actions in non-compliant regions. For example, attach an SCP to an OU that denies all ec2:*, s3:* actions unless the region is eu-west-1. Combine with IAM policies and KMS keys that are region-specific. Additionally, configure S3 lifecycle policies to prevent cross-region replication when not allowed.
What is the difference between S3 Object Lock and S3 Versioning for compliance?+
S3 Versioning retains multiple versions of objects, allowing recovery but not preventing deletion of specific versions. S3 Object Lock, especially in Compliance mode, provides immutable storage by prohibiting deletion or overwrite for a retention period. Object Lock is required for regulatory mandates like SEC 17a-4, while Versioning supports accidental deletion recovery.
When should I use AWS Global Accelerator over Amazon CloudFront?+
Global Accelerator is best for non-HTTP workloads (TCP/UDP) and applications requiring static IP addresses for whitelisting. It optimizes network path over AWS global network. CloudFront is for HTTP/S content caching at edge locations. For financial trading apps needing low-latency and fixed IP, Global Accelerator is preferred.
Can Services Control Policies (SCPs) be used to grant permissions?+
No, SCPs only deny or allow actions, but they never grant permissions. They act as a permissions boundary. Even if an SCP allows an action, the IAM user or role must still have an IAM policy that explicitly grants that action. SCPs are useful for enforcing guardrails across accounts.
What is the role of AWS Config aggregator in multi-account governance?+
An AWS Config aggregator collects configuration and compliance data from multiple source accounts and regions into a single account (usually a security account). It requires authorization from member accounts. This enables centralized view of resource compliance without logging into each account, essential for auditing and operational efficiency.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.