AWS Solutions Architect: 1061 practice exam questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

AWS Solutions Architect practice exam: 1061 questions with full explanations

4 domains 1061 questions 130 min exam
Questions on the exam
65
Time allowed
130 minutes format →
Passing score
720 of 1000 — vendor, checked September 4, 2026 detail →
Exam fee
$150 — vendor, checked September 4, 2026 detail →

1061 practice exam questions for AWS Certified Solutions Architect – Associate, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AWS Solutions Architect readiness check →

AWS Solutions Architect exam format →  ·  AWS Solutions Architect passing score →  · AWS Solutions Architect exam cost →

Questions by domain

Sample questions

Create an IAM role with the required S3 permissions: What is the recommended solution?

Design Secure Architectures Easy
A developer has embedded AWS access keys directly into an Amazon EC2 application to allow it to read objects from Amazon S3. A security audit flags this as a vulnerability. What is the recommended solution?
  1. Create an IAM role with the required S3 permissions and attach it to the EC2 instance as an instance profile ✓
    Correct. IAM roles attached to EC2 instances provide temporary, automatically rotated credentials via the instance metadata service. No long-term credentials are stored in code or environment variables.
  2. Rotate the embedded access keys every 90 days by enabling automatic rotation in AWS Secrets Manager
    Incorrect. While Secrets Manager can automate credential rotation, it does not eliminate the static keys embedded in the application. The recommended approach for EC2 workloads is an IAM instance role, which supplies automatically rotated temporary credentials with no static keys at all.
  3. Encrypt the embedded access keys with an AWS KMS customer managed key and decrypt them at application runtime
    Incorrect. Encrypting the static access keys does not remove the risk, because the application still decrypts them at runtime and the decryption grant itself becomes a secret to protect. IAM roles remove the need for static keys entirely.
  4. Move the access keys out of the code and into an environment variable set on the EC2 instance
    Incorrect. Keeping the access keys in an environment variable is still a long-term credential stored on the instance and does not address the fundamental static-credential risk. IAM roles provide automatically rotated temporary credentials instead.
The trap
Thinking environment variables or encrypted keys are acceptable — IAM roles with no static credentials are always the correct approach for EC2 workloads.

All 325 Design Secure Architectures questions →

Amazon SNS: Which AWS service best supports this pattern?

Design Resilient Architectures Easy
A company wants to send order confirmation notifications to multiple downstream services simultaneously when an order is placed. Each downstream service must receive every notification. Which AWS service best supports this pattern?
  1. AWS Step Functions
    AWS Step Functions orchestrates multi-step workflows. It is not a messaging or notification service and does not fan out messages to independent subscribers.
  2. Amazon SQS
    Amazon SQS is a message queue where each message is consumed by one consumer. It does not natively fan out a single message to multiple independent consumers.
  3. Amazon SNS ✓
    Amazon SNS is a pub/sub service that fans out a single message to multiple subscribers simultaneously. Every subscriber receives every message published to the topic.
  4. Amazon Kinesis Data Streams
    Amazon Kinesis is designed for high-throughput streaming data, not for simple notification fan-out to a fixed set of downstream services.
The trap
Confusing SQS (one consumer per message) with SNS (all subscribers receive every message).

All 272 Design Resilient Architectures questions →

AWS Direct Connect with a dedicated 10 Gbps connection: Which connectivity solution meets these requirements?

Design High-Performing Architectures Hard
A company processes 50 TB of daily data transfers between its on-premises HPC cluster and Amazon S3. The data transfer must complete within an 8-hour nightly window and requires consistent bandwidth without competition from internet traffic. The company cannot tolerate jitter or variable latency. Which connectivity solution meets these requirements?
  1. AWS Site-to-Site VPN over the public internet, encrypting traffic across shared and highly variable network paths
    AWS VPN encrypts traffic over the public internet. Internet routing introduces variable latency, jitter, and bandwidth variability depending on internet congestion — directly violating the 'consistent bandwidth, no jitter' requirement.
  2. Amazon S3 Transfer Acceleration, speeding uploads through CloudFront while still using the public internet
    S3 Transfer Acceleration speeds up S3 uploads via CloudFront edge locations but still uses the public internet for the on-premises segment. It does not provide dedicated bandwidth or eliminate jitter from internet routing.
  3. AWS DataSync running over an AWS VPN tunnel, inheriting the bandwidth variability and jitter of the public internet
    DataSync accelerates and manages data transfers, but when combined with VPN (public internet), it inherits the bandwidth variability and jitter of the public internet. DataSync over Direct Connect would be more appropriate, but that option is not listed.
  4. AWS Direct Connect with a dedicated 10 Gbps connection providing private, consistent, and jitter-free bandwidth ✓
    AWS Direct Connect provides a private, dedicated physical connection between on-premises and AWS. It delivers consistent bandwidth, deterministic latency, and no bandwidth competition with public internet traffic — meeting all requirements. A 10 Gbps connection can transfer 50 TB in ~11 hours at full speed (or faster with multiple connections/ECMP).
The trap
Choosing VPN because 'it's encrypted and connects on-prem to AWS' — VPN uses the public internet, which has variable bandwidth and jitter. Direct Connect is the private, dedicated connection.

All 256 Design High-Performing Architectures questions →

Store the records in S3 Intelligent-Tiering: Which solution best meets these requirements?

Design Cost-Optimized Architectures Medium
A solutions architect is reviewing five years of compliance records stored in Amazon S3. Access frequency changes unpredictably, some records must be readable immediately, and the records must remain resilient across Availability Zones. The company accepts a small monitoring charge and wants to reduce storage cost without managing manual restores. Which solution best meets these requirements?
  1. Store the records in S3 One Zone-IA because the records are accessed infrequently.
    One Zone-IA is not equivalent to multi-AZ storage, so it does not satisfy the stated resilience requirement for compliance records.
  2. Store the records in S3 Standard-IA and transition them after 30 days.
    Standard-IA provides immediate access, but its infrequent-access economics and retrieval or minimum-duration considerations are less suitable for unpredictable changes in access frequency.
  3. Store the records in S3 Intelligent-Tiering. ✓
    Intelligent-Tiering is designed for changing or unknown access patterns and can provide immediate access while automatically optimizing storage cost.
  4. Store the records in S3 Glacier Flexible Retrieval and restore them before every read.
    Flexible Retrieval requires restoration before reading, violating the requirement for immediate access and adding operational handling.
The trap
When access patterns are unpredictable, prioritize a class that can adapt automatically; verify that archival classes do not impose a restore delay.

All 208 Design Cost-Optimized Architectures questions →

Create an IAM role in Company A's account with a trust: What is the most secure way to grant this access witho

Design Secure Architectures Medium
Company A has an AWS account with production S3 buckets. Company B needs read access to these buckets from their own AWS account. What is the most secure way to grant this access without sharing credentials?
  1. Make the S3 buckets publicly readable and rely on the obscurity of the randomly generated bucket names to deter access
    Incorrect. Making buckets public exposes the data to the entire internet, and relying on hard-to-guess bucket names is security through obscurity, which is not a recognized access control.
  2. Create an IAM role in Company A's account with a trust policy allowing Company B's account to assume it, then grant the role S3 read permissions ✓
    Correct. Cross-account IAM role assumption is the AWS-recommended pattern. Company A creates a role with a trust policy specifying Company B's account ID. Company B's users/services call STS AssumeRole to get temporary credentials scoped to that role — no static credentials are shared.
  3. Create an IAM user in Company B's account and attach an inline policy referencing the ARNs of Company A's S3 buckets to grant direct cross-account read access
    Incorrect. An IAM policy in one account cannot by itself grant access to resources owned by another account. Cross-account access requires either a role in the resource account or a resource-based bucket policy, not a standalone IAM user in the requesting account.
  4. Create an IAM user in Company A's account, generate long-term access keys, and share those keys directly with Company B's team
    Incorrect. Sharing IAM user access keys is a security anti-pattern that creates long-term credentials which are hard to rotate and audit, and it violates the principles of least privilege and account isolation.
The trap
Sharing IAM user access keys between accounts — always use cross-account role assumption for temporary, auditable, rotatable cross-account access.

All 325 Design Secure Architectures questions →

Configure an Amazon SQS queue as the destination: Which design meets these requirements with the least operati

Design Resilient Architectures Medium
A company's video processing application receives upload events from Amazon S3. Processing each video takes up to 10 minutes. If the processing service is temporarily unavailable, events must be retained and retried automatically. Which design meets these requirements with the least operational overhead?
  1. Configure Amazon SNS to deliver the S3 event notifications directly to the processing service endpoint over HTTPS
    Incorrect. Amazon SNS delivers in real time and retries HTTP endpoints for a limited window (typically minutes). If the processing service is down longer than that window, messages are lost.
  2. Use Amazon Kinesis Data Streams to ingest the S3 upload events and have the processing service read them
    Incorrect. Amazon Kinesis Data Streams is built for high-throughput, ordered streaming analytics and adds unnecessary complexity compared to SQS for a simple retry-and-decoupling use case.
  3. Use Amazon EventBridge to capture the S3 events and invoke an AWS Lambda function that calls the service
    Incorrect. EventBridge with Lambda is bounded by the 15-minute Lambda timeout and has limited retry durability. For processing that may be unavailable for a while, SQS provides better durability and decoupling.
  4. Configure an Amazon SQS queue as the destination for the S3 event notifications and have the service poll it ✓
    Correct. Amazon SQS retains messages for up to 14 days and supports visibility timeouts and dead-letter queues, providing durable, automatic retry without any additional infrastructure to manage.
The trap
Choosing EventBridge for all event-driven patterns — SQS is the right tool when durable retry and offline consumer tolerance is required.

All 272 Design Resilient Architectures questions →

CloudFront Functions for URL path rewriting: Which combination of CloudFront compute options is most appropria

Design High-Performing Architectures Hard
A company uses Amazon CloudFront for its global web application. They need to implement two features: (1) rewrite URL paths for A/B testing (append ?version=B to 5% of requests based on a simple cookie check) and (2) perform JWT authentication validation by calling an external authorization service before forwarding to the origin. Which combination of CloudFront compute options is most appropriate?
  1. CloudFront Functions for JWT validation at the viewer request and Lambda@Edge for the simple URL path rewriting at the origin request
    This reverses the capabilities: CloudFront Functions cannot make the outbound network call that external JWT validation needs, while a simple path rewrite needs no network call and fits CloudFront Functions, so the roles are swapped.
  2. CloudFront Functions for URL path rewriting (viewer request), Lambda@Edge for JWT validation with external service call (origin request) ✓
    CloudFront Functions run at viewer request/response events with sub-millisecond execution, sub-1ms latency, and JavaScript-only runtime — perfect for simple path rewrites. Lambda@Edge is needed for JWT validation because it can make external network calls (to the auth service), has longer execution time limits (5 seconds at viewer events), and full Node.js/Python runtimes.
  3. Lambda@Edge for both the A/B URL path rewriting at viewer request and the JWT validation with the external authorization service call at the origin
    Lambda@Edge can do both, but using it for a trivial cookie-based path rewrite is wasteful; CloudFront Functions cost about one-sixth as much and run faster for simple rewrites, so this pairing is not the most appropriate.
  4. CloudFront Functions for both the A/B URL path rewriting and the JWT validation call out to the external authorization service before the origin
    CloudFront Functions have no outbound network access, so they cannot call the external authorization service for JWT validation; that requirement forces Lambda@Edge for the origin-request step.
The trap
CloudFront Functions cannot make network calls to external services — Lambda@Edge is required for any edge function that needs to communicate with external systems like authentication services.

All 256 Design High-Performing Architectures questions →

Use gp3 volumes and provision capacity: Which solution best meets these requirements?

Design Cost-Optimized Architectures Medium
A transaction-processing application runs on EC2 and stores its boot volume and database files on EBS. Monitoring shows that capacity requirements are growing, while performance is usually moderate with brief periods requiring higher IOPS and throughput. The team must minimize storage cost without sacrificing the observed performance or changing the block-storage design. Which solution best meets these requirements?
  1. Move the database files to Regional EFS and retain only the operating system on EBS.
    EFS provides shared managed NFS file storage, but replacing the application’s EBS block-storage design with a file system does not meet the stated requirement to retain block storage.
  2. Use gp3 volumes and provision capacity, IOPS, and throughput independently according to measured requirements. ✓
    gp3 allows capacity, IOPS, and throughput to be adjusted independently, avoiding payment for unnecessary performance while accommodating growth.
  3. Use provisioned IOPS SSD volumes sized for peak performance throughout the year.
    Provisioned IOPS SSD is appropriate for demanding latency or IOPS requirements, but maintaining peak performance continuously increases cost when demand is usually moderate.
  4. Use HDD volumes for the boot volume and database files because they provide economical storage capacity.
    HDD options target large sequential workloads and are not suitable as boot volumes, so this design violates the application’s block-storage requirements.
The trap
When capacity and performance needs do not scale together, consider a volume type that lets them be provisioned independently.

All 208 Design Cost-Optimized Architectures questions →

AWS Solutions Architect exam: the facts

How many questions are on the AWS Solutions Architect exam?

65, as published by the exam vendor.

How long is the AWS Solutions Architect exam?

130 minutes. Across 65 questions that is about 120 seconds per question.

What topics does the AWS Solutions Architect exam cover?

4 domains: Design Secure Architectures, Design Resilient Architectures, Design High-Performing Architectures, Design Cost-Optimized Architectures. Weights: Design Secure Architectures 0.3%, Design Resilient Architectures 0.26%, Design High-Performing Architectures 0.24%, Design Cost-Optimized Architectures 0.2%.

How many AWS Solutions Architect practice exam questions does Certsqill have?

1061, spread across 4 exam domains. Every one shows all options, which is correct, and why each of the others is not.

Would you pass AWS Solutions Architect today?

Five minutes, and you get a score per domain — not one number, but which section to open tonight.

Test your AWS Solutions Architect readiness — free
Certsqill AWS Solutions Architect question bank · 1061 questions across 4 domains · Every answer, right and wrong, comes with its own explanation.