All practice questions

1473 questions

All types1,473 Multiple choice755 Multiple select693 Matching25

A logistics company is migrating its vehicle tracking application to the AWS Cloud. The application is currently hosted on an on-premises Linux server and connects to a self-managed MySQL database. The company wants to reduce administrative overhead and physical server maintenance. They decide to deploy the application's code to AWS Elastic Beanstalk and migrate the MySQL database to Amazon RDS for MySQL, without modifying the application's core code or architecture. Which migration strategy is the company using for this migration?

Rehosting

Replatforming

Refactoring

Repurchasing

Show answer & explanation

Answer: Replatforming

Answer

Replatforming

Replatforming is the correct migration strategy because the company is moving its workload to managed cloud platforms (AWS Elastic Beanstalk and Amazon RDS) to reduce administrative overhead and maintenance, while keeping the core application code and architecture unchanged. This represents a typical 'lift-tinker-and-shift' approach.

Step-by-Step Solution

Analyze the migration requirements to check for modifications to the application code or architecture.

The scenario states that the application core code and architecture will remain unmodified.

This rules out Refactoring (which requires rewriting core code) and Repurchasing (which requires replacing the application entirely with a different product).

Evaluate the target AWS environment and managed services to identify optimizations.

The company is deploying the application to AWS Elastic Beanstalk and migrating the database to Amazon RDS for MySQL.

Moving workloads to managed platforms (such as Elastic Beanstalk and RDS) to reduce administrative overhead represents a platform optimization (tinkering) rather than a simple as-is virtual server migration.

Identify the migration strategy based on these findings.

Since the workload is optimized to run on managed services without changing the core architecture, it matches the definition of Replatforming (lift-tinker-and-shift).

Rehosting would move the workloads as-is to virtual servers (like EC2) without using platform optimizations, whereas this scenario uses managed services.

Key Concept

AWS Cloud Migration Strategies (6 Rs)

Question 182Question →

A global maritime cargo shipping firm is evaluating its application portfolio for migration to the AWS Cloud. During the analysis, the migration team identifies two specific workloads:

1. A bespoke legacy port operations scheduler running on an outdated, highly customized IBM AIX Unix operating system that cannot be virtualized in standard x86 environments. The firm plans to keep this scheduler operational on-premises for the next two years.
2. A monolithic core logistics dispatch system. The team plans to migrate the application server as-is, but will migrate its underlying commercial relational database to Amazon Aurora PostgreSQL to reduce licensing costs and management overhead, without modifying the application's core code.

Which two of the following migration strategies represent the correct approach for these workloads?

Select all that apply

Retaining for the port operations scheduler, as it will remain on-premises due to platform incompatibility and business requirements.

Replatforming for the logistics dispatch system, as the database is moved to a managed database service (Amazon Aurora) to optimize operations and reduce licensing costs without modifying the core application code.

Rehosting for the logistics dispatch system, as the application and its database are migrated to AWS without any modifications to their configuration or platform components.

Refactoring for the logistics dispatch system, as changing the underlying database engine to Amazon Aurora requires a complete rewrite of the application's architecture to be cloud-native.

Repurchasing for the port operations scheduler, as the unsupported Unix system must be retired and replaced with a modern commercial off-the-shelf software product.

Show answer & explanation

Answer: Retaining for the port operations scheduler, as it will remain on-premises due to platform incompatibility and business requirements.; Replatforming for the logistics dispatch system, as the database is moved to a managed database service (Amazon Aurora) to optimize operations and reduce licensing costs without modifying the core application code.

Answer

The correct strategies are Retaining for the port operations scheduler and Replatforming for the logistics dispatch system.

The correct strategies are Retaining and Replatforming. Retaining is appropriate for the port operations scheduler because it runs on unsupported hardware (IBM AIX Unix on non-x86 architecture) and the business has chosen to keep it on-premises. Replatforming is appropriate for the logistics dispatch system because it involves moving the application to the cloud with minor optimizations—specifically, moving the database to a managed service (Amazon Aurora) to save licensing costs—without modifying the core application code.

Step-by-Step Solution

Analyze the migration constraints for the port operations scheduler.

The scheduler runs on an outdated, highly customized Unix OS (IBM AIX) that cannot be virtualized on standard x86 cloud environments, and the business plans to keep it operational on-premises.

This identifies that the workload cannot currently move to the cloud without substantial effort, and keeping it on-premises matches the definition of Retaining.

Analyze the migration goals and constraints for the logistics dispatch system.

The application server will be migrated as-is, but the database will be changed to a managed service (Amazon Aurora) to optimize costs without changes to the core application code.

Making minimal adjustments (tinkering) to leverage cloud benefits (like migrating to a managed database) without changing the core application architecture defines Replatforming.

Match the analyzed strategies to the options.

The option stating Retaining is correct for the scheduler, and the option stating Replatforming is correct for the dispatch system are identified as the correct selections.

This confirms the alignment of the business scenarios with the standard AWS Cloud Adoption Framework (CAF) 6 Rs migration strategies.

Key Concept

Identifying and applying the AWS 6 Rs migration strategies based on technical requirements, operating system dependencies, and business constraints.

Question 183Question →

A smart grid utility company manages thousands of IoT sensors across a metropolitan area. The company is migrating its data analytics workloads to AWS. They previously struggled with provisioning hardware for winter heating demand spikes, often keeping idle physical servers online during summer. Additionally, their engineering team spent 35% of their weekly hours troubleshooting physical hardware failures and upgrading rack cabling, rather than optimizing grid algorithms. Which of the following AWS Cloud benefits directly address these specific challenges? (Select TWO.)

Select all that apply

Stop guessing capacity, allowing resources to scale dynamically with demand and eliminating idle infrastructure.

Stop spending money running and maintaining data centers, shifting the engineering focus from rack maintenance and physical hardware failures to core software optimization.

Trading variable expenses for capital expenses (CapEx), allowing the utility to capitalize on physical infrastructure assets for long-term depreciation benefits.

Implementing elasticity by securing fixed, permanent infrastructure capacity up front to ensure the system is always prepared for maximum theoretical grid load.

Leveraging monolithic architecture designs to consolidate grid monitoring tools into a single tightly coupled system, reducing network traffic between components.

Show answer & explanation

Answer: Stop guessing capacity, allowing resources to scale dynamically with demand and eliminating idle infrastructure.; Stop spending money running and maintaining data centers, shifting the engineering focus from rack maintenance and physical hardware failures to core software optimization.

Answer

The correct benefits are stopping guessing capacity and stopping spending money running and maintaining data centers.

The correct answers are the benefits of stopping guessing capacity and stopping spending money running and maintaining data centers. The utility company's challenge with seasonal load variation (winter spikes vs. summer idleness) is directly resolved by stopping guessing capacity, which enables dynamic scaling in response to real-time demands. The engineering team's overhead of maintaining physical racks and resolving hardware failures is solved by stopping spending money running and maintaining data centers, which shifts these infrastructure operational tasks to AWS, allowing the engineers to focus on business-differentiating grid algorithms.

Step-by-Step Solution

Identify the operational issues described in the utility company's scenario.

The scenario highlights two distinct problems: (1) managing demand spikes during winter while dealing with idle server hardware during summer, and (2) engineers spending substantial time on physical server maintenance and cabling instead of developing grid algorithms.

Understanding the specific business pain points helps map them directly to the corresponding cloud benefits.

Map the issue of seasonal spikes and idle hardware to an AWS Cloud benefit.

The ability to scale resources dynamically up and down based on demand maps to the benefit of 'stop guessing capacity' (elasticity).

This benefit ensures resources are only active when needed, eliminating the cost of idle servers.

Map the issue of physical hardware maintenance and rack configuration to an AWS Cloud benefit.

Removing the burden of physical infrastructure management maps to the benefit of 'stop spending money running and maintaining data centers'.

AWS manages the underlying infrastructure, allowing the customer's technical staff to focus on strategic tasks like grid optimization.

Evaluate the options to identify which selections correctly describe these two benefits while avoiding common misconceptions.

The options detailing 'stop guessing capacity' and 'stop spending money running and maintaining data centers' are correct. The options involving trading variable expenses for capital expenses, fixing permanent capacity, or using monolithic architectures are incorrect.

Confirming the correct options ensures alignment with official AWS Cloud benefits and rules out distractors.

Key Concept

Defining the benefits of the AWS Cloud, specifically stopping guessing capacity and stopping spending money running and maintaining data centers.

Question 184Question →

An online gaming studio is deploying a multiplayer game database using Amazon RDS for PostgreSQL. To meet security compliance standards, the studio must define the security boundaries between their team and AWS. Which of the following operational tasks remains the responsibility of the customer under the AWS Shared Responsibility Model?

Configuring database-level user permissions and setting up security group rules to control network access to the database instance.

Applying security patches to the guest operating system on which the PostgreSQL database engine runs.

Replacing faulty physical storage volumes and underlying server hardware in the AWS availability zone.

Retrieving AWS compliance and third-party audit reports for the physical data center facility via the Amazon RDS console.

Show answer & explanation

Answer: Configuring database-level user permissions and setting up security group rules to control network access to the database instance.

Answer

Configuring database-level user permissions and setting up security group rules to control network access to the database instance.

Under the AWS Shared Responsibility Model, for a managed service like Amazon RDS, the customer is responsible for configuring access to the database, which includes managing database user permissions and defining firewall rules using security groups to control inbound network traffic.

Step-by-Step Solution

Analyze the service type in the scenario.

Amazon RDS is a managed service (PaaS/DBaaS), meaning AWS manages the underlying operating system, hardware, and database engine maintenance.

The customer's responsibility depends on the type of service deployed (IaaS vs. PaaS).

Identify customer-managed controls for Amazon RDS.

The customer is responsible for data security 'in' the database, including user access credentials, database schemas, and security group firewall rules.

Firewalls (security groups) and application/database-level access controls are always customer-managed.

Key Concept

Shared Responsibility Model for Managed Services (Amazon RDS)

Estimated Time:1m 0s

Question 185Question →

A financial services institution deploys an AWS Outposts rack in its on-premises data center to run latency-sensitive algorithmic trading applications. Under the AWS Shared Responsibility Model, which TWO tasks are the responsibility of the customer?

Select all that apply

Providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility

Configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost

Replacing failed physical components, such as memory modules or power supplies, in the Outpost rack

Patching and upgrading the virtualization hypervisor software running on the Outpost hosts

Retrieving official AWS compliance reports directly from the Outposts physical management interface

Show answer & explanation

Answer: Providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility; Configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost

Answer

The customer is responsible for providing physical access security, electrical power, and cooling (HVAC) for the Outposts hardware within the local facility, as well as configuring security groups and network access control lists (NACLs) to regulate traffic to and from the instances deployed on the Outpost.

Under the Shared Responsibility Model for AWS Outposts, the customer is responsible for securing the physical location, power, and cooling of the Outposts rack at their site. In addition, the customer is responsible for configuring security groups and network access control lists to regulate traffic flow to and from the instances. AWS maintains responsibility for the infrastructure software, including the virtualization hypervisor, and performs physical hardware replacements.

Step-by-Step Solution

Analyze the deployment architecture and physical location of the resources.

AWS Outposts is a hybrid service where physical hardware owned by AWS is placed within the customer's local on-premises facility.

Shared responsibility boundaries shift when physical infrastructure is housed outside of AWS data centers.

Differentiate physical responsibilities between standard AWS regions and AWS Outposts.

Unlike standard services where AWS manages physical data center security, utility power, and HVAC, for Outposts, these site environmental and physical security responsibilities belong to the customer.

AWS has no physical access or control over the customer's on-premises building.

Identify logical and virtual resources control responsibilities.

The customer is responsible for configuring security groups and network access control lists (NACLs) to secure logical network traffic.

AWS provides the software-defined networking capability, but the configuration of access rules remains under customer control.

Differentiate physical hardware maintenance responsibilities.

AWS is responsible for physical component replacement and hypervisor patching.

AWS manages the infrastructure lifecycle and updates of the Outposts service as a fully managed offering.

Key Concept

AWS Shared Responsibility Model for AWS Outposts

Question 186Question →

A news streaming startup wants to launch its application to users in Europe, Asia, and North America. By using AWS, they deploy their application's resources across multiple AWS Regions worldwide in a matter of minutes to ensure low-latency access for all users. Which benefit of the AWS Cloud is this startup directly utilizing?

Stop guessing capacity

Trade fixed expense for variable expense

Go global in minutes

Deploy monolithic application architectures

Show answer & explanation

Answer: Go global in minutes

Answer

Go global in minutes

The correct answer is the option stating 'Go global in minutes'. AWS allows customers to easily deploy applications in multiple Regions around the world with just a few clicks. This enables businesses to provide lower latency and a better user experience for their customers at a minimal cost.

Step-by-Step Solution

Analyze the business scenario

The startup needs to deploy applications globally across Europe, Asia, and North America quickly and with low latency.

Identifying key constraints and goals (multi-region, speed, low latency) helps align with AWS cloud benefits.

Map the goal to AWS Cloud benefits

Deploying globally in a few clicks to multiple regions represents 'Go global in minutes'.

AWS global infrastructure allows rapid deployment across regions, matching the 'Go global in minutes' benefit.

Key Concept

Go global in minutes

Question 187Question →

A financial technology startup is preparing for a compliance audit. An external auditing firm requires temporary, read-only access to the startup's AWS resources. The external auditors do not possess AWS accounts, and the startup's security policy strictly prohibits creating permanent IAM users for third-party entities. Which of the following is the most secure, AWS-recommended method to grant the auditors access?

Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.

Create a shared IAM user named 'Auditor-Group' with read-only policies, generate a set of permanent access keys, and share them securely with the auditing firm.

Create an IAM role with the required permissions and grant the startup's AWS Account Root User the ability to assume this role, then share the root user credentials with the auditors.

Submit a ticket to AWS Support asking AWS to manage, monitor, and configure the temporary auditor access to the startup's resources on their behalf.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.

Answer

Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.

The correct option is to configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role. This aligns with AWS security best practices by utilizing temporary security credentials, avoiding the creation of long-term IAM credentials (such as access keys), and maintaining the principle of least privilege without creating permanent IAM users in the startup's AWS account.

Step-by-Step Solution

Identify the access requirements and constraints.

The auditors need temporary, read-only access without creating permanent IAM users or using pre-existing AWS accounts.

This establishes the boundaries for acceptable security configurations.

Evaluate the mechanism for external user access.

Federating identity using AWS IAM Identity Center maps the external auditor identities to a temporary role.

Federation avoids static credential management and delegates authentication to the trusted third-party provider.

Select the option that matches AWS identity best practices.

Using IAM Identity Center to provision temporary access via role assumption is selected.

This follows the principle of least privilege and avoids credentials exposure.

Key Concept

Identity Federation and Temporary Credentials

Question 188Question →

A financial services startup is planning to launch a new algorithmic trading simulation platform. The platform experiences massive, unpredictable traffic spikes during market hours ( $9:30\text{ AM}$ to $4:00\text{ PM}$ EST) but is virtually idle at night. Additionally, the startup must perform a weekly risk analysis batch job every Sunday, which requires high-performance compute resources for exactly $3$ hours and can be interrupted without losing progress. The startup wants to optimize its cost structure by shifting capital expenditures (CapEx) to operating expenditures (OpEx) while maximizing the cost benefits of cloud economics.

Which two AWS billing and architectural strategies will best align with the company's financial goals of reducing Total Cost of Ownership (TCO) and leveraging the economic benefits of elasticity? (Select TWO.)

Select all that apply

Designing the trading simulation platform to dynamically scale compute instances up and down using Amazon EC2 Auto Scaling based on real-time demand metrics.

Utilizing Amazon EC2 Spot Instances to run the weekly risk analysis batch jobs.

Purchasing 3-Year All Upfront Dedicated Host Reserved Instances for the trading simulation platform's compute tier.

Deploying the application on oversized EC2 instances to handle the peak market volume, relying on the scalability of the instances to support future growth.

Configuring the weekly risk analysis batch job to run on On-Demand EC2 instances to guarantee zero interruption, regardless of cost.

Show answer & explanation

Answer: Designing the trading simulation platform to dynamically scale compute instances up and down using Amazon EC2 Auto Scaling based on real-time demand metrics.; Utilizing Amazon EC2 Spot Instances to run the weekly risk analysis batch jobs.

Answer

The correct strategy involves scaling the trading platform dynamically using Amazon EC2 Auto Scaling and running the interruptible weekly risk analysis batch jobs on Amazon EC2 Spot Instances.

Leveraging Amazon EC2 Auto Scaling allows the platform to scale dynamically during unpredictable peak market hours and scale down to minimum capacity at night, optimizing operational costs (OpEx) through elasticity. Utilizing Amazon EC2 Spot Instances for the weekly risk analysis batch job is highly cost-effective because the job can tolerate interruptions, letting the startup take advantage of spare AWS capacity at deep discounts.

Step-by-Step Solution

Analyze the platform's traffic pattern and identify the elasticity requirements.

The platform has highly variable demand (

9:30\text{ AM}

4:00\text{ PM}

peak, idle at night), indicating a strong need for elasticity to match resource supply with demand.

Elasticity prevents paying for idle resources during off-peak times.

Evaluate the weekly risk analysis workload characteristics.

The batch job is weekly, runs for

3

hours, and is interruptible, making it a perfect fit for EC2 Spot Instances.

Spot Instances offer up to

90\%

cost reduction for fault-tolerant workloads.

Assess the financial goal of shifting CapEx to OpEx.

Avoid options that require upfront payments or long-term capacity lock-in (such as 3-Year All Upfront Dedicated Host Reserved Instances).

Upfront reservations behave like capital expenses, reducing financial flexibility.

Identify the combinations of decisions that optimize Total Cost of Ownership (TCO) and support elasticity.

Combining Auto Scaling for variable traffic and Spot Instances for interruptible batch jobs maximizes the economic benefits of the cloud.

This combination minimizes runtime costs and eliminates capital expenditures.

Key Concept

Shifting CapEx to OpEx, leveraging Spot instances for fault-tolerant batch workloads, and using Auto Scaling to achieve elasticity.

Question 189Question →

A food delivery platform wants to prevent an outage in its payment processing component from causing the entire ordering application to crash. Which AWS Cloud design principle should the platform implement to achieve this?

Tight coupling

Loose coupling

Vertical scaling

Manual over-provisioning

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling

Loose coupling ensures that application components are independent. In this scenario, decoupling the payment system from the rest of the ordering application ensures that if the payment system is down, customers can still browse menus and add items to their cart.

Step-by-Step Solution

Analyze the scenario requirement of isolating a component failure (payment processing) to prevent it from affecting the rest of the application.

Identified the need to remove direct dependencies between the application components.

Removing direct dependencies prevents a cascading failure where one down component causes the entire application to crash.

Select the AWS Cloud design principle that describes building independent components that interact without being tightly integrated.

Loose coupling is selected as the correct design principle.

Loose coupling allows components to remain operational and scale independently, ensuring high availability and fault isolation.

Key Concept

Loose coupling is an AWS Cloud design principle where components are decoupled, reducing dependencies so that a failure in one component does not cascade to others.

Estimated Time:45s

Question 190Question →

A smart-grid utility company experiences unpredictable surges in data processing demands during severe weather events, while data volume remains minimal during normal operations. The company wants to ensure its infrastructure can automatically scale to handle these sudden peaks without paying for idle capacity during quiet periods. Which benefit of the AWS Cloud directly addresses this requirement?

Stop guessing capacity, which allows the company to scale resources dynamically in response to real-time demand fluctuations rather than pre-purchasing excess infrastructure.

Trading variable expenses for fixed expenses, which ensures the company has a predictable, flat monthly infrastructure bill regardless of weather-induced usage spikes.

Scalability, which requires the customer to manually pre-provision maximum compute capacity in advance to accommodate future grid expansion.

Centralized monolithic design, which groups all data processing services onto a single, high-capacity server to eliminate communication overhead during storm events.

Show answer & explanation

Answer: Stop guessing capacity, which allows the company to scale resources dynamically in response to real-time demand fluctuations rather than pre-purchasing excess infrastructure.

Answer

Stop guessing capacity, which allows the company to scale resources dynamically in response to real-time demand fluctuations rather than pre-purchasing excess infrastructure.

The benefit of 'stopping guessing capacity' allows organizations to avoid over-provisioning or under-provisioning resources. Instead of guessing how much infrastructure is needed for peak storm demand, AWS automatically scales resources up or down as demand dictates, reducing costs and preventing outages.

Step-by-Step Solution

Analyze the company's requirement to handle unpredictable, temporary surges in data volume without paying for idle capacity during off-peak periods.

The company needs a mechanism that matches resource allocation directly to fluctuating real-time demand, avoiding both over-provisioning and under-provisioning.

This aligns with the AWS benefit of not having to guess capacity limits beforehand.

Evaluate the options against the 6 benefits of the AWS Cloud.

The concept of scaling dynamically to match demand rather than pre-provisioning for peak loads is known as 'stop guessing capacity'.

This benefit ensures resources are scaled in and out dynamically, preventing wasted spend and ensuring availability.

Key Concept

Stop guessing capacity as an AWS Cloud benefit

Question 191Question →

A healthcare company is preparing for an external audit and must retrieve AWS security and compliance documents, such as the AWS Service Organization Control (SOC) reports. Which AWS portal provides on-demand, self-service access to these agreements and reports?

AWS Artifact

Amazon Inspector

AWS CloudTrail

AWS Config

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact

AWS Artifact is the primary resource for downloading AWS security and compliance reports (such as SOC and PCI reports) as well as managing agreements with AWS. It provides self-service access to these documents directly from the AWS Management Console.

Step-by-Step Solution

Identify the company's core requirement.

The requirement is to retrieve official compliance reports, such as AWS SOC reports, for audit purposes.

This establishes which category of service is needed (compliance reporting).

Evaluate the available AWS services that match this need.

AWS Artifact is the service dedicated to providing on-demand compliance reports and agreements, whereas the others focus on resource scanning, auditing, or configuration tracking.

This confirms the correct service selection.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.

Question 192Question →

An enterprise runs a legacy monolithic application on-premises. The infrastructure costs $500,000 annually in hardware depreciation (capital expense),$ 100,000 in data center power and cooling, and $200,000 in dedicated system administration salaries. The application's utilization is highly variable, requiring 80% of total capacity during a 3-month holiday peak, but dropping to just 10% during the remaining 9 months of the year. The company plans to migrate this application to AWS and re-architect it using Amazon EC2 Auto Scaling and Amazon Aurora. Which of the following best describes the primary economic shift and driver that will yield the greatest Total Cost of Ownership (TCO) reduction for this seasonal workload?

Shifting from a capital expense (CapEx) model with fixed capacity to an operating expense (OpEx) model, leveraging elasticity to dynamically scale resources to match the seasonal demand variation, thereby eliminating idle capacity costs during off-peak months.

Increasing capital expenses (CapEx) to acquire permanent AWS cloud infrastructure assets, which converts the variable operational costs of power and cooling into predictable long-term depreciable assets.

Achieving high scalability by pre-provisioning AWS resources at 80% peak capacity year-round, which converts the operational staff costs into fixed capital expenses while ensuring performance.

Rehosting the monolithic architecture directly without modifications to automatically convert all system administration payroll costs into AWS-managed software-as-a-service operational expenses.

Show answer & explanation

Answer: Shifting from a capital expense (CapEx) model with fixed capacity to an operating expense (OpEx) model, leveraging elasticity to dynamically scale resources to match the seasonal demand variation, thereby eliminating idle capacity costs during off-peak months.

Answer

The correct option correctly identifies that the primary financial driver is shifting from a Capital Expenditures (CapEx) model to an Operating Expenditures (OpEx) model, combined with leveraging AWS elasticity to dynamically scale down capacity during off-peak times. This directly minimizes the total cost of ownership by eliminating idle resource waste.

Step-by-Step Solution

Analyze the on-premises cost structure and utilization patterns.

The on-premises environment uses a capital expense (CapEx) model with high fixed costs ($500,000 hardware depreciation) sized for peak capacity, resulting in 90% idle capacity for 9 months of the year.

To calculate the potential savings of cloud migration, we must first understand the baseline expenditures and the waste patterns of the legacy infrastructure.

Identify the primary economic shift when migrating to AWS.

The company shifts from a CapEx model (upfront hardware investments) to an operating expense (OpEx) model, where they pay only for running resources on a variable basis.

Recognizing the shift from CapEx to OpEx is fundamental to understanding AWS cloud economics.

Evaluate the role of elasticity in reducing the Total Cost of Ownership (TCO).

Elasticity allows the application to automatically scale in/out using Amazon EC2 Auto Scaling, meaning the company only pays for 80% capacity during the 3-month peak, and drops to 10% capacity for the other 9 months.

Matching supply to demand directly eliminates the cost of idle resources, which is the main source of waste in seasonal on-premises environments.

Synthesize the options to select the correct driver.

The option advocating the shift from CapEx to OpEx coupled with elasticity to eliminate off-peak idle costs represents the correct cloud economic principle.

This option correctly applies both the CapEx-to-OpEx shift and the concept of elasticity to address the seasonal business scenario.

Key Concept

The economic benefits of shifting from Capital Expenditures (CapEx) to Operating Expenditures (OpEx) and utilizing elasticity to match capacity with demand.

Estimated Time:2m 0s

Question 193Question →

A digital health startup is transitioning its core genomic sequencing pipelines to AWS. Previously, the company had to buy expensive high-performance computing (HPC) hardware upfront, which took months to write off as capital depreciation. On AWS, they pay only for the compute hours their pipelines consume, allowing them to fund ongoing development directly from their operational budget. However, their CFO notices that because AWS aggregates usage from hundreds of thousands of active customers, the pay-as-you-go pricing for these compute resources is significantly lower than what the startup could negotiate on their own. Which benefit of the AWS Cloud is primarily responsible for the lower per-unit resource cost observed by the CFO?

Benefit from massive economies of scale

Trade capital expense for variable expense

Stop guessing capacity

Stop spending money running and maintaining data centers

Show answer & explanation

Answer: Benefit from massive economies of scale

Answer

Benefit from massive economies of scale

The correct answer is the option stating 'Benefit from massive economies of scale'. By aggregating resource usage across hundreds of thousands of active customers, AWS can achieve higher economies of scale. This translates into lower pay-as-you-go prices for individual customers than they could achieve on their own.

Step-by-Step Solution

Analyze the scenario details to identify the primary financial benefit being queried.

The CFO is noticing a lower per-unit resource cost obtained through aggregated customer demand.

This isolates the question from the general pay-as-you-go benefits to the specific driver of reduced pricing.

Differentiate between the AWS Cloud benefits related to cost.

Trading capital expense for variable expense describes the shift from CapEx to OpEx. Benefiting from massive economies of scale describes the lower per-unit pricing achieved through aggregation.

Ensures the correct classification of AWS's pricing advantage vs. the customer's billing model.

Select the benefit that corresponds to aggregated usage reducing unit pricing.

The correct benefit is 'Benefit from massive economies of scale'.

AWS passes these savings onto customers in the form of lower prices.

Key Concept

AWS Cloud economies of scale drive lower pricing through customer aggregation.

Question 194Question →

A healthcare technology company is hosting its customer portal on AWS. The static frontend files are stored in an Amazon S3 bucket, and the backend application is exposed via Amazon API Gateway. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Configuring bucket policies and access control lists (ACLs) to restrict access to the static web assets

Configuring API Gateway resource policies and authorization to control access to the backend APIs

Applying operating system patches to the servers running the Amazon S3 storage service

Managing the physical security and access controls of the data centers where the API Gateway is deployed

Ensuring the physical destruction of decommissioned hard drives that stored the patient data

Show answer & explanation

Answer: Configuring bucket policies and access control lists (ACLs) to restrict access to the static web assets; Configuring API Gateway resource policies and authorization to control access to the backend APIs

Answer

The customer is responsible for configuring S3 bucket policies and access control lists (ACLs) to secure static web assets, as well as configuring API Gateway resource policies and authorization settings to control API access.

Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes managing identity and access management (IAM), data classification, and configuring resource-specific access controls. For Amazon S3, this entails setting up bucket policies and ACLs. For Amazon API Gateway, this involves establishing authorization methods and resource policies to control API invocation.

Step-by-Step Solution

Determine the AWS service models in use.

Amazon S3 and Amazon API Gateway are fully managed, abstract services.

Knowing the service type helps define the boundary between what AWS manages (underlying OS, virtualization, physical infrastructure) and what the customer configures.

Distinguish between security 'of' the cloud and security 'in' the cloud.

AWS handles OS patching, physical data center security, and hardware decommissioning. The customer must configure access controls, identity policies, and resource authorization.

This maps the responsibilities correctly according to the Shared Responsibility Model.

Select the options representing customer-managed configurations.

S3 bucket policies/ACLs and API Gateway authorization/resource policies are correct. Hardware and operating system tasks are incorrect.

Only access control configurations on these managed services fall under the customer's scope.

Key Concept

AWS Shared Responsibility Model

Estimated Time:1m 30s

Question 195Question →

A maritime logistics enterprise is planning to migrate its fleet management system to the AWS Cloud. The system consists of a legacy monolithic desktop client application and a backend Microsoft SQL Server database. The enterprise wants to deploy the desktop client application as-is onto Amazon EC2 instances to meet a tight migration deadline. Simultaneously, they decide to migrate the database to Amazon RDS for SQL Server to offload database patching, backups, and OS maintenance. Which of the following correctly identifies the migration strategies chosen for the desktop client application and the database?

Rehosting for the client application and Refactoring for the database

Replatforming for the client application and Rehosting for the database

Rehosting for the client application and Replatforming for the database

Refactoring for the client application and Repurchasing for the database

Show answer & explanation

Answer: Rehosting for the client application and Replatforming for the database

Answer

Rehosting for the client application and Replatforming for the database

The correct option is the one stating 'Rehosting for the client application and Replatforming for the database'. Rehosting (lift-and-shift) involves moving applications to the cloud as-is without modification, which fits the plan for the client application. Replatforming (lift-tinker-and-shift) involves making minimal platform optimizations, such as migrating a self-managed database to a managed database service like Amazon RDS, to reduce administrative overhead without altering core application code.

Step-by-Step Solution

Analyze the migration plan for the client application.

The application is migrated as-is without change to Amazon EC2, which corresponds to Rehosting (lift-and-shift).

To identify the correct migration strategy from the 6 Rs for the first component.

Analyze the migration plan for the database.

The SQL Server database is migrated to a managed service (Amazon RDS) to reduce administrative overhead without changing the core database engine, which corresponds to Replatforming (lift-tinker-and-shift).

To identify the correct migration strategy from the 6 Rs for the second component.

Combine the identified strategies and select the option that matches.

The correct combination is Rehosting for the client application and Replatforming for the database.

To select the option that accurately represents both migration paths.

Key Concept

Distinguishing between AWS migration strategies (6 Rs), specifically Rehosting (lift-and-shift) and Replatforming (lift-tinker-and-shift).

Estimated Time:2m 0s

Question 196Question →

A software startup wants to allow a third-party vendor to run automated test suites against resources in its AWS development account. The vendor requires programmatic access for a limited time, and the startup must ensure that no long-term credentials are shared or stored. Which of the following is the most secure AWS-recommended method to grant this access?

Create a permanent IAM user with administrator permissions and share the access keys with the vendor.

Generate and share access keys from the AWS account root user to ensure the vendor has full access to run any test.

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.

Submit a support ticket requesting that the AWS Support team run the testing suite within the customer's environment.

Show answer & explanation

Answer: Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.

Answer

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.

The correct answer is to create an IAM role. IAM roles allow external entities to assume permissions and receive temporary security credentials via the AWS Security Token Service (STS). This avoids the need to distribute or manage long-term secrets, fulfilling the requirement of temporary access securely.

Step-by-Step Solution

Identify the key requirements of the scenario.

The third-party vendor requires programmatic access for a limited time, and credentials must not be long-term or shared.

This establishes that the solution must support temporary access without sharing permanent credentials.

Compare the security mechanisms of IAM users, roles, and the root user.

IAM users and root users utilize long-term credentials, whereas IAM roles issue temporary credentials that expire automatically.

Choosing the correct IAM entity ensures adherence to AWS security best practices.

Verify ownership and operational boundaries under the Shared Responsibility Model.

Executing scripts and configuring access is a customer-side responsibility, ruling out direct management by AWS Support.

This eliminates options that assume AWS manages tenant-level operational tasks.

Key Concept

Using IAM roles for temporary, cross-account, or third-party access instead of sharing long-term credentials.

Estimated Time:1m 15s

Question 197Question →

A startup is building a document-processing application that converts uploaded files into different formats. Rather than deploying virtual servers to run the conversion software and maintaining the operating systems, the startup chooses to use Amazon S3 for storage and AWS Lambda to run the conversion script on demand. Which AWS Cloud design principle is best demonstrated by this architectural decision?

Loose coupling

Services, not servers

Elasticity

Disposable resources

Show answer & explanation

Answer: Services, not servers

Answer

Services, not servers

The correct answer is the design principle of using services, not servers. By leveraging managed and serverless offerings like Amazon S3 and AWS Lambda, the startup removes the operational overhead of provisioning, configuring, patching, and maintaining physical or virtual servers. This allows developers to focus entirely on application logic rather than infrastructure administration.

Step-by-Step Solution

Analyze the operational choices made in the scenario.

The startup is replacing traditional self-managed virtual servers with Amazon S3 and AWS Lambda, which are fully managed and serverless.

Understanding what is being replaced and what is being adopted helps identify the core architectural shift.

Determine the primary operational benefit of the chosen services.

The startup no longer has to patch operating systems, manage server lifecycles, or handle lower-level infrastructure administration.

Identifying the target benefit points directly to the design principle that values offloading operational tasks.

Match the architectural choice to the corresponding AWS Cloud design principle.

Choosing to utilize managed and serverless offerings to eliminate server management is defined as the 'Services, not servers' design principle.

This confirms the correct principle that matches the description of eliminating virtual server management.

Key Concept

AWS Cloud Design Principles - Services, not servers

Question 198Question →

A global logistics company, LogiRoute, is migrating its on-premises infrastructure to the AWS Cloud. The migration team has identified two specific workloads:

1. A custom inventory database that they want to migrate to Amazon RDS to automate database patching and backups, without making any changes to the database structure or code.
2. A legacy document archiving system that is no longer used by any business departments and provides no ongoing value.

Which two of the following migration strategies represent the correct approach for these workloads? (Select TWO.)

Select all that apply

Replatforming for the custom inventory database

Retiring for the legacy document archiving system

Rehosting for the custom inventory database

Refactoring for the custom inventory database

Retaining for the legacy document archiving system

Show answer & explanation

Answer: Replatforming for the custom inventory database; Retiring for the legacy document archiving system

Answer

The correct strategies are Replatforming for the custom inventory database and Retiring for the legacy document archiving system.

Replatforming is correct for the database workload because it optimizes operations by adopting a managed database service (Amazon RDS) without modifying the schema or code. Retiring is correct for the archiving system because it is no longer used by the business, making decommissioning the optimal choice.

Step-by-Step Solution

Analyze the custom inventory database workload, which is being moved to Amazon RDS (a managed service) to reduce operational tasks like patching and backups without code alterations.

Determine that this lift-tinker-and-shift approach is Replatforming.

Replatforming involves modifying the platform to adopt managed services without changing the core application code.

Analyze the legacy document archiving system workload, which is decommissioned because it is no longer used and has no business value.

Determine that this decommissioning approach is Retiring.

Retiring refers to identifying assets that are no longer useful and turning them off during the migration.

Key Concept

AWS Cloud Migration Strategies (6 Rs)

Estimated Time:1m 0s

Question 199Question →

An educational institution uses Amazon Simple Storage Service (Amazon S3) to store student records. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Configuring bucket policies to restrict access to authorized users

Enabling encryption on the stored objects

Managing physical access to the storage hardware

Replacing failed hard drives in the storage arrays

Patching the underlying host operating systems of the S3 service

Show answer & explanation

Answer: Configuring bucket policies to restrict access to authorized users; Enabling encryption on the stored objects

Answer

Configuring bucket policies to restrict access and enabling encryption on the stored objects are customer responsibilities under the AWS Shared Responsibility Model.

For managed services like Amazon S3, AWS manages the infrastructure, OS patching, and physical security. The customer remains responsible for managing their data, which includes configuring bucket access policies and setting up object encryption.

Step-by-Step Solution

Analyze the AWS service model for Amazon S3.

Amazon S3 is an abstract managed service. AWS maintains the underlying hardware, virtualization, and OS layers.

This helps locate the responsibility boundary for this service.

Determine customer responsibilities for data and access within S3.

The customer owns the data and is responsible for setting bucket access policies and managing data protection features like encryption.

This identifies the customer's operational obligations.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (hardware, host software, physical facilities), while customers manage security 'in' the cloud (access policies, data encryption, IAM).

Estimated Time:1m 0s

Question 200Question →

A company has recently created a new AWS account. To ensure the account is secure, which two actions should the administrator perform on the AWS account root user? (Select TWO.)

Select all that apply

Enable multi-factor authentication (MFA) for the root user.

Delete any active access keys associated with the root user.

Use the root user credentials for daily administrative and operational tasks.

Create an IAM role for the root user to restrict its permissions when accessing database services.

Use the root user to monitor and manage physical access controls in AWS data centers.

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the root user.; Delete any active access keys associated with the root user.

Answer

Enabling multi-factor authentication (MFA) for the root user and deleting any active access keys associated with the root user.

Enabling multi-factor authentication (MFA) and deleting active access keys are primary security best practices for the AWS account root user. MFA provides an additional security layer for console logins, while removing access keys prevents programmatic administrative API access.

Step-by-Step Solution

Identify the recommended practices for securing the AWS account root user.

The root user has unrestricted access and should not be used for daily tasks or programmatic API calls.

Securing the root user prevents full compromise of the AWS account.

Select security actions that mitigate credentials exposure and add security layers.

Enabling MFA and removing access keys reduces the risk of credential compromise.

MFA prevents unauthorized console access, and removing access keys prevents unauthorized programmatic access.

Key Concept

AWS Account Root User Security Best Practices

PreviousPage 10 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept