How is this hardest-questions list ranked?

When live data is available, the list ranks public diagnostic questions by recent misses and attempt volume. While weekly data fills in, it shows a high-signal fallback set from observed public quiz misses.

What should I do after reviewing these questions?

Read the full explanation for each missed concept, retake the free diagnostic, then save or email the score report so your weak areas turn into a focused study plan.

Rolling 7-day practice signal

Hardest AWS Solutions Architect Associate questions this week

Q: What are the hardest AWS Solutions Architect Associate questions this week?

The current review set is focused on IAM & S3, Auto Scaling & ELB, CloudFront & Origin. These are the topics to review before retaking the diagnostic.

These are the public diagnostic questions people are missing most often. Use the list as a weekly study loop: review the concept, then retake the diagnostic.

Weekly review loop

Step 1Start with the most-missed topic and read the short answer explanation.
Step 2Open the full breakdown for the concept before moving to the next topic.
Step 3Retake the diagnostic and email the score report if you want the study plan.

Live

answers analyzed

practice sessions

questions to review

Live weekly data is still filling in, so this page is showing the current high-signal review set.

Weekly report

Send the current weak-area list to yourself, then use the links as a study queue before your next diagnostic attempt.

Email this report

#1 most missed

IAM & S3

Design Secure Architectures

Review

high-signal topic

A financial services company stores sensitive customer data in Amazon S3. The compliance team requires that encryption keys be managed by the company's security team, with the ability to audit key usage through AWS CloudTrail. The keys must be automatically rotated annually. A solutions architect needs to implement this with the least operational overhead. Which solution meets these requirements?

Correct answer

C. Use SSE-KMS with a customer managed key (CMK) and enable CloudTrail management events

SSE-KMS with a customer managed key (CMK) gives the security team full control over the encryption key, including key policies, grants, and the ability to enable/disable keys. CMKs automatically log all usage to CloudTrail, and AWS KMS supports automatic annual rotation for symmetric CMKs. This meets all requirements with minimal operational overhead.

Read full explanation Retake diagnostic

#2 most missed

Auto Scaling & ELB

Design Resilient Architectures

Review

high-signal topic

A company runs a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores user session data in memory on each EC2 instance. Users report that they lose their shopping cart data when the Auto Scaling group scales in and terminates instances. The solutions architect needs to fix this issue while minimizing changes to the application code. Which solution addresses the session persistence problem with the LEAST application changes?

Correct answer

A. Enable ALB sticky sessions (session affinity) using application-based cookies with a duration that matches the session timeout

ALB sticky sessions route a user's requests to the same target instance for the duration of the session, preventing session loss during normal operation. Application-based cookies give fine-grained control. While this does not fully solve the scale-in problem (sessions on terminated instances are still lost), the question asks for LEAST application changes. Sticky sessions require zero code changes — only ALB configuration.

Read full explanation Retake diagnostic

#3 most missed

CloudFront & Origin

Design High-Performing Architectures

Review

high-signal topic

A video streaming company serves on-demand content through Amazon CloudFront. The content is stored in S3. Users report buffering issues during peak hours, particularly for the initial seconds of video playback. Analysis shows that the first segment of each video has a cache miss rate of 40% at edge locations because of the large video catalog (millions of titles). The company wants to reduce the initial buffering for all videos. Which solution reduces the cache miss rate for initial video segments?

Correct answer

A. Enable Origin Shield as an additional caching layer between CloudFront edge locations and the S3 origin

Origin Shield adds a centralized caching layer between regional edge caches and the origin. With millions of titles, individual edge locations may not have a specific video cached, but Origin Shield consolidates cache misses across all edge locations into a single point. If any edge location previously requested the video, Origin Shield likely has it cached. This dramatically reduces cache misses at the origin and improves first-segment delivery for a long-tail catalog.

Read full explanation Retake diagnostic

Want the full score report?

Take the free diagnostic, get your weak areas, and save the detailed study plan behind signup.

Start the free diagnostic