Independent: not affiliated with AWS. Free to try; the study bundle adds a study guide and two practice exams.
5 original questions, none of them in the practice exams.
Pick an answer. Show answer explains every option and links its AWS source.
5 questions / Explanations link AWS sources / Last updated Oct 27, 2026
Question 1
Multiple choice
Domain 1 / Architecture Design and Implementation Built for the Cloud
An e-commerce company's order service writes every order as a message to an Amazon SQS queue. For each order whose status is PAID, a fulfillment workflow in AWS Step Functions must start with the customer's shipping profile attached; the profile is served by an internal HTTPS API. Orders in any other status must be ignored. The team wants to keep the queue and the state machine as they are and does not want to write or operate integration code. Which approach meets these requirements?
Show answerHide answer
Answer: B
Why
A pipe is EventBridge's point-to-point integration: it reads the SQS source, applies the optional filter so that only PAID orders continue (and only those are charged), runs the optional enrichment, here an API destination that returns the shipping profile, and sends the enriched event to the Step Functions target. All of it is configuration, and the EventBridge guide uses this same queue, API destination and state machine chain as its worked example.
Why not the others
AEvent bus rules match events sent to a bus; an SQS queue does not publish to a bus by itself, and an input transformer reshapes an event but cannot call the profile API.
CIt works, but the profile call and the StartExecution call are integration code that the team must deploy, monitor and maintain.
DA filter policy can drop unpaid orders, but SNS passes the message through unchanged, so nothing adds the shipping profile, and the producer has to change.
A manufacturer runs 2,000 Linux build and telemetry servers in its own data centers. The servers must upload results to Amazon S3 and read configuration from AWS Secrets Manager. The security standard forbids long-term AWS access keys anywhere outside AWS. The company already issues an X.509 certificate to every server from its own certificate authority and rotates the certificates automatically. Which approach meets the standard with the least new infrastructure?
Show answerHide answer
Answer: C
Why
IAM Roles Anywhere issues temporary security credentials to workloads outside AWS that present an X.509 certificate from a certificate authority registered as a trust anchor, so no long-term AWS credential is stored on any server and the company's existing PKI is the identity. The profile names the roles a session can assume and can carry a session policy that limits what the credentials may do.
Why not the others
AAccess keys of IAM users are long-term credentials, which the standard forbids outside AWS, and rotating them every 30 days does not make them temporary.
BThe instance metadata service answers only on EC2 instances; a VPN gives the servers a network path, not an AWS identity.
DIt also avoids long-term keys, but the company would have to build, secure and operate a token service for 2,000 servers, where Roles Anywhere accepts the certificates the servers already hold.
A retailer runs an order-ingest service on an Amazon Aurora MySQL cluster with one writer and two readers on provisioned, non-NVMe instance classes. The load is steady and write-heavy. Cost Explorer shows that I/O requests are about 40 percent of the cluster's monthly cost, and finance wants a predictable bill. Which change reduces the cost with the least operational effort?
Show answerHide answer
Answer: D
Why
Aurora I/O-Optimized removes the per-request charges for read and write I/O, so the cluster pays for instance usage and storage only, which is the predictable bill finance asked for. AWS names it the best choice when I/O spending is 25 percent or more of total Aurora database spending, and it is a modification of the existing cluster, with no downtime for non-NVMe-based instance classes.
Why not the others
AServerless v2 changes how compute is billed; under Aurora Standard the cluster still pays per million I/O requests.
BReserved DB instances discount instance hours only; I/O requests are billed the same.
CA cache serves repeated reads; the I/O here is write traffic, which a cache does not absorb, and it adds a cost line.
Domain 4 / Resilience, Migration, and Business Continuity
A media company keeps 300 TB of project files on NetApp ONTAP arrays in two of its own data centers. Linux render nodes mount the files over NFS, Windows editing workstations over SMB, and a database server over iSCSI. The company must keep a copy in AWS that stays current for disaster recovery, keep its snapshot schedules, clones and deduplication, and later move the workloads to AWS without changing how the applications mount storage. Which storage service should the solutions architect recommend?
Show answerHide answer
Answer: A
Why
FSx for ONTAP is ONTAP as a managed service: one file system serves NFS, SMB, iSCSI and NVMe, supports NetApp's SnapMirror replication, snapshots, cloning, deduplication and compression, and AWS describes it as the way for ONTAP customers to migrate, back up or burst file-based applications to AWS without changing application code or how data is managed.
Why not the others
BEFS serves NFS only, so the SMB workstations and the iSCSI database have no path, and DataSync copies files rather than carrying over SnapMirror relationships, snapshots or clones.
CS3 File Gateway exposes S3 objects through NFS or SMB shares with a local cache; it is not an ONTAP replica, offers no iSCSI, and the applications would be re-pointed at object storage.
DElastic Disaster Recovery replicates servers through an agent on a supported operating system; a NetApp storage controller is not such a server, and the recovered instances would not provide an ONTAP file system to mount.
A retailer's platform team keeps its fleet in the desired state with AWS Systems Manager State Manager associations on fixed schedules, and makes operational changes with Automation runbooks and deployment pipelines, all from one operations account. During sales events and the year-end freeze no association may run, and the runbooks and pipelines must be able to check whether changes are allowed right now. The business keeps the freeze dates as events in Microsoft Outlook, and the dates change every year. The team wants the least custom code and does not want to retype the dates into schedules or policies. What should the solutions architect recommend?
Show answerHide answer
Answer: B
Why
Change Calendar keeps its events in a ChangeCalendar document and imports .ics files exported from Outlook. In a calendar that is open by default the state is CLOSED during each event, and a State Manager association that names the calendar runs only while it is open. GetCalendarState returns the current state, the state at a given time or the next change, so a runbook step or a pipeline can check it before acting.
Why not the others
AA calendar that is closed by default blocks everything except during its events, so the imported freeze events would open it during the freeze and keep associations blocked the rest of the year.
CThe function, the table, the API and a call in every association document, runbook and pipeline are all custom code to build and maintain, where Change Calendar already provides the Outlook import, the association gate and the state API.
DA service control policy never reads the Outlook events, so the dates must be retyped into the policy every year, and it returns no calendar state that a runbook or pipeline could check.
The study bundle has two practice exams with 150 original questions, an answer key and an explanation for every answer, plus the 66-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
150 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.