AWS Certified Solutions Architect – Associate 1-10

The correct answer is B.
AWS Organizations supports a Block Public Access feature for EBS snapshots, which, when enabled at the organization level, prevents snapshots in all member accounts from being shared publicly in a single step.
This is a centrally applied, organization-wide control that requires no per-account configuration or monitoring rules, so operational overhead is minimized.
To reliably “prevent” public sharing, you must choose a blocking feature rather than after-the-fact detection.
AWS Config (A) only detects issues after they occur, and an IAM policy (C) is insufficient because there are multiple paths that can bypass it.
CloudTrail (D) only records activity and does not prevent sharing itself.
Block public access for Amazon EBS snapshots – AWS Documentation

The correct answer is A.
To achieve encryption at rest with minimal changes, the best approach is to enable the native encryption features of Amazon EBS and Amazon RDS combined with an AWS KMS key.
Native EBS and RDS encryption can encrypt data at rest without changing the application code or architecture.
This protects PII on both the instance storage and the database volumes.
CloudHSM (B) requires managing dedicated hardware and increases operational overhead.
SSL (C) is encryption in transit and does not meet the encryption-at-rest requirement.
An ACM certificate (D) is not suitable for volume encryption.
Amazon EBS encryption – AWS Documentation

The correct answer is B.
For a requirement to fail over to the secondary Region only when the primary Region fails, with exactly one Region serving traffic at all times, the best fit is the combination of an Amazon Route 53 failover routing policy and health checks.
Failover routing responds only from the primary while its health check is healthy, and automatically switches to the secondary when it detects a failure.
This achieves an active-passive configuration.
A Resolver outbound endpoint (A) is used for forwarding DNS to on-premises networks.
Geolocation (C) distributes traffic based on the source region and is not suited for failover during an outage.
A Route 53 profile (D) is a feature for sharing DNS settings across VPCs and serves a different purpose.
Failover routing – Amazon Route 53

The correct answer is D.
For requirements that combine high availability and automatic recovery with isolating analytical queries from transactional processing while reading with up to 4 hours of latency, a Multi-AZ DB cluster deployment is optimal.
A Multi-AZ DB cluster has two readable standbys and automatically fails over if the primary fails.
Using the reader endpoint, analytical queries can be directed to the readable standbys without affecting the transactional performance of the primary.
The standby in a Multi-AZ DB instance (A) cannot be used for reads, so analytical queries cannot be directed to it.
Read replicas (C) can isolate reads, but because they are asynchronous they cannot on their own guarantee high availability and automatic recovery through automatic failover.
Recreating a database nightly from a snapshot (B) is operationally cumbersome and introduces greater latency.
Using Multi-AZ DB clusters – Amazon RDS

The correct answer is B.
For the requirement of WORM (Write Once Read Many) and a minimum 1-year retention, Amazon S3 Object Lock in compliance mode is the best fit.
In compliance mode, no one—including the root user or administrators—can delete or overwrite an object during the retention period.
This guarantees the immutability required for regulated data such as medical records.
Controlling uploads by approved users can be achieved with an IAM policy.
MFA delete (A) only helps prevent accidental deletion and does not guarantee the overwrite protection of WORM.
IAM or bucket policies (C) can be changed by administrators and cannot ensure immutability.
Hash tracking with Lambda (D) only detects changes after the fact rather than preventing them, and it is complex to implement.
Using S3 Object Lock – Amazon S3

The correct answer is D.
To reduce end-to-end latency for global users, AWS Global Accelerator is the best fit.
Global Accelerator routes traffic from the nearest AWS edge location over the AWS global network, reducing hops and latency compared with the public internet.
You only need to configure the existing NLBs as endpoints, so configuration changes are minimal.
Replacing with ALBs (A) adds Layer 7 features but does not solve the latency problem.
Equal-weighted Route 53 (B) only distributes traffic and does not optimize network performance.
Adding Regions (C) may improve latency but involves significant effort and cost to build out infrastructure.
What is AWS Global Accelerator – AWS Documentation

The correct answer is C.
Provisioned IOPS SSD (io1/io2) volumes deliver predictable, consistent, low-latency high performance, making them ideal for I/O-intensive critical workloads such as databases.
EBS volumes are highly durable and retain data even when the instance is stopped, so they are well suited for business-critical uses.
Instance store (A) is temporary storage whose data is lost when the instance stops, so it does not meet the durability requirement.
ElastiCache (B) is for caching and is not persistent storage.
Throughput Optimized HDD (D) is for large sequential workloads and is not suited for low-latency random I/O.
Amazon EBS volume types – AWS Documentation

The correct answer is A.
Kinesis Data Streams ingests large streams with sub-second latency, Managed Service for Apache Flink transforms them in near real time, and Data Firehose reliably delivers them to S3.
These are all serverless, fully managed services that scale automatically even at a scale of 100,000 devices.
SQS + Lambda (B) is not optimized for large-scale real-time streaming.
EC2 + Kafka + EMR (C) has high operational overhead and cost.
EventBridge + AWS Batch (D) is geared toward event-driven, batch processing and is not suited for sub-second streaming.
What is Amazon Kinesis Data Streams – AWS Documentation

The correct answer is B.
A pre-signed URL can grant temporary, authenticated upload access to S3 with a specified expiration, directly implementing the post-authentication time-window restriction.
Generating the URL with Lambda is lightweight and easy to implement, so it has the least operational overhead.
Temporary IAM credentials (A) require managing credentials and add complexity.
A custom authentication service integrated with Cognito (C) requires unnecessary development effort.
Assuming a role with STS (D) adds the management of STS and roles compared with a pre-signed URL, making it more complex.
Uploading objects using pre-signed URLs – Amazon S3

The correct answer is C.
AWS best practice is to cover a stable baseline with Reserved Instances or Savings Plans and to supplement variable bursts with cheaper Spot Instances.
Spot Instances are up to 90% cheaper, and even if they are interrupted, messages remain in SQS and can be reprocessed on another instance, making them suitable for fault-tolerant workloads such as queue processing.
Spot only (A) risks capacity shortages, and Reserved only (B) wastes cost during low load.
D scales based on backlog, but it assumes on-demand for bursts and is more expensive than Spot.
Option C, which continuously processes the baseline with RIs while inexpensively augmenting with Spot, is optimal.
Instance purchasing options – Amazon EC2