Free AWS Certified Solutions Architect Associate Exam Practice
The free AWS Certified Solutions Architect practice exam helps you evaluate your ability to design secure, resilient, high-performance, and cost-optimized AWS architectures. It covers security best practices, fault-tolerant and scalable system design, performance optimization, and cost-efficient solutions across compute, storage, networking, and workloads.
Question 1
A company uses AWS Organizations and wants to ensure that no IAM principal in any member account can make an Amazon S3 bucket public, either through bucket policies or public ACLs. The security team requires a solution that is preventative and centrally enforced across all accounts.
Which solution should a solutions architect implement to meet these requirements?
A. Enable S3 Block Public Access on each bucket and require developers to keep it enabled.
B. Enable AWS Config managed rules to detect public buckets and run remediation.
C. Use a Service Control Policy (SCP) to deny s3:PutBucketPolicy and s3:PutBucketAcl for all principals in member accounts.
D. Use Amazon GuardDuty to alert on public bucket activity.
Question 2
A company runs workloads in private subnets, and an application needs to read objects from a sensitive S3 bucket. The security team requires that access must only occur from within the VPC and must not traverse the public internet, while also avoiding NAT Gateway costs.
A. Create an S3 Interface VPC endpoint (AWS PrivateLink) and configure the application to send S3 traffic through the endpoint.
B. Create a Gateway VPC endpoint for S3 and add a bucket policy that allows access only when aws:SourceVpce matches the endpoint ID.
C. Keep the NAT Gateway and add a bucket policy that denies access unless requests come from the VPC CIDR.
D. Enable S3 Transfer Acceleration.
Question 3
A company centralizes CloudTrail logs in an S3 bucket in a logging account. Security requires tamper resistance, ensuring that administrators in member accounts cannot alter or delete logs. The company also needs the ability to prove log integrity during audits.
Which action will meet these requirements?
A. Enable versioning on the central S3 bucket.
B. Use CloudTrail log file validation and configure the S3 bucket policy to allow writes only from the CloudTrail service principal, denying deletes to everyone.
C. Store logs in CloudWatch Logs only and set retention to 10 years.
D. Encrypt the logs with SSE-S3.
Question 4
A fintech company must allow a third-party auditor to review only CloudTrail logs in a centralized S3 bucket. Access must be temporary, prefix-scoped, and immediately revocable, with no changes to the application. (Select any two options.)
A. Create an IAM role in the logging account with a trust policy for the ...