Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 221Question →

A financial services company wants to reallocate its IT staff from tasks like managing power infrastructure, cooling systems, and physical hardware rack installations to focus on developing new customer-facing applications. Which benefit of the AWS Cloud directly supports this transition?

Show answer & explanation

Answer: Stop spending money running and maintaining data centers

Answer

Stop spending money running and maintaining data centers
The correct option is 'Stop spending money running and maintaining data centers'. By offloading physical infrastructure management (power, cooling, cabling, and racking) to AWS, organizations can redirect engineering resources toward developing core software applications.

Step-by-Step Solution

1
Identify the current operational challenges described in the scenario.
The company is spending time and resources on power, cooling, and physical rack installations.
To determine which cloud benefit resolves these specific overhead tasks.
2
Match these challenges to the correct AWS Cloud benefit.
These activities are physical data center maintenance tasks, which map to stopping spending money running and maintaining data centers.
AWS manages the physical infrastructure so customers can focus on business projects instead of infrastructure operations.

Key Concept

Focusing business resources on value-adding activities instead of physical infrastructure maintenance by leveraging managed cloud services.
Estimated Time:45s
Question 222Question →

A genomic research institute, GenePulse, is migrating its legacy DNA sequencing analysis platform to AWS. The platform's application tier runs on legacy virtual machines, while its database tier uses a proprietary relational database that requires expensive licensing and intensive database administration. The institute wants to migrate to AWS to eliminate database licensing costs and minimize operational overhead, but it has strict timeline constraints that forbid modifying the application's core code or architecture. Which migration strategy should GenePulse adopt for this platform?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
Replatforming is the correct strategy because it allows the organization to achieve direct benefits (such as shifting from a self-managed database to a fully managed service to eliminate licensing fees and reduce admin overhead) without changing the core application logic or architecture.

Step-by-Step Solution

1
Identify the migration goals and constraints in the scenario.
The goals are to eliminate proprietary database licensing fees and reduce administration overhead. The key constraint is that the application's core code or architecture cannot be modified.
Understanding both what the customer wants to achieve and what they cannot change is required to select the correct migration strategy.
2
Compare the requirements against the characteristics of the migration strategies.
Rehosting is rejected because it keeps the proprietary database. Refactoring is rejected because it requires code changes. Repurchasing is rejected because the custom application is kept. Replatforming fits because shifting to a managed database service (e.g., Amazon RDS or Aurora) eliminates proprietary licenses and reduces administrative tasks without rewriting application code.
Evaluating each strategy ensures the selected option satisfies all operational goals while respecting the constraints.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Estimated Time:2m 0s
Question 223Question →

An organization wants to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. The application must not store long-term AWS credentials on the instance. Which of the following solutions represents the AWS-recommended best practice to grant the necessary permissions?

Show answer & explanation

Answer: Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.

Answer

Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.
The correct option is to create an IAM role with S3 read permissions and associate it with the EC2 instance. This method uses temporary security credentials that are automatically distributed and rotated by AWS, fulfilling the security requirement of not storing long-term credentials on the instance.

Step-by-Step Solution

1
Define permissions using an IAM policy that allows read-only access to the target Amazon S3 bucket.
An IAM policy document specifying the allowed S3 actions is created.
This establishes the minimum required permissions following the principle of least privilege.
2
Create an IAM role and attach the read-only S3 policy to it.
An IAM role is created with the necessary permissions associated.
An IAM role allows AWS services to assume permissions dynamically without long-term credentials.
3
Associate the IAM role with the EC2 instance via an instance profile.
The EC2 instance is now authorized to retrieve temporary credentials from the instance metadata service.
This enables the application to authenticate securely and automatically rotate credentials without hardcoding them.

Key Concept

AWS IAM Roles for EC2 Instances
Question 224Question →

An online education platform is expanding its services to support medical residency programs and needs to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA). To do this, the platform's administrator needs to review AWS security documentation and formally accept the AWS Business Associate Addendum (BAA). Which of the following tasks can the administrator perform using AWS Artifact to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS compliance reports, such as SOC and PCI-DSS documents, to review the security controls of AWS infrastructure; Formally accept agreements with AWS, such as the Business Associate Addendum (BAA) for HIPAA compliance

Answer

Downloading AWS compliance reports to review security controls of the AWS infrastructure and formally accepting agreements with AWS, such as the Business Associate Addendum (BAA), are correct.
AWS Artifact serves as the self-service portal to download AWS security and compliance reports (such as SOC and PCI reports) and to manage and accept agreements (such as the BAA for HIPAA compliance).

Step-by-Step Solution

1
Identify the service mentioned in the question.
The question asks about tasks performed using AWS Artifact.
AWS Artifact is the central repository for AWS compliance-related information.
2
Determine the two primary capabilities of AWS Artifact.
AWS Artifact consists of two main sections: AWS Artifact Reports (providing compliance reports like SOC, PCI, ISO) and AWS Artifact Agreements (allowing customers to accept agreements like the HIPAA BAA).
This matches the requirements of downloading compliance reports and signing the BAA.
3
Evaluate the other options to rule out services that are not AWS Artifact.
API logging is handled by AWS CloudTrail, vulnerability scanning is done by Amazon Inspector, and physical data center security audits are not permitted for customers.
This isolates the correct options and ensures no incorrect alternatives are selected.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and allows customers to accept agreements like the Business Associate Addendum (BAA).
Question 225Question →

A financial services company is launching a new credit scoring application. The company wants to avoid the high upfront costs of purchasing physical servers and networking equipment, preferring to pay for compute resources only as they are consumed during the development and testing phases. Which benefit of the AWS Cloud is directly demonstrated by this business decision?

Show answer & explanation

Answer: Trading capital expense for variable expense

Answer

Trading capital expense for variable expense
The correct answer is trading capital expense for variable expense. By using AWS, the company avoids the upfront capital expenditure (CapEx) of buying physical servers and networking hardware. Instead, they pay a variable operating expense (OpEx) that scales with their actual usage during development and testing.

Step-by-Step Solution

1
Analyze the scenario requirements
The company wants to avoid high upfront costs (capital expenditures) for physical servers and pay only for the resources they consume as they go (variable operational expenses).
Identifying the financial shift from upfront hardware investment to pay-as-you-go pricing helps map the scenario to the correct AWS Cloud benefit.
2
Match the scenario to the 6 AWS Cloud benefits
The scenario aligns perfectly with the benefit of trading capital expense for variable expense.
AWS allows businesses to pay for what they use rather than investing heavily in physical data centers and servers before knowing how they will be used.

Key Concept

Trading capital expense for variable expense (CapEx to OpEx)
Question 226Question →

A financial services firm, WealthFlow, is planning to migrate its infrastructure to the AWS Cloud. The migration team has identified two specific workloads for the first phase:

* A legacy customer relationship management (CRM) system that requires significant maintenance. The team decides to replace it entirely with a cloud-native Software-as-a-Service (SaaS) platform.
* A core transaction processing application running on-premises virtual machines. The team wants to move this application to AWS quickly with minimal modifications to the code or architecture to meet a tight datacenter exit deadline.

Which migration strategies under the AWS Migration 6 Rs framework should the firm use for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Repurchasing for the CRM system; Rehosting for the transaction processing application

Answer

The firm should use Repurchasing for the CRM system and Rehosting for the transaction processing application.
The correct strategy for the legacy CRM system is Repurchasing because the firm is discarding the existing system to adopt a SaaS solution. The correct strategy for the transaction processing application is Rehosting because they are moving virtual machines to AWS with minimal modifications to speed up the datacenter exit.

Step-by-Step Solution

1
Analyze the CRM system migration requirement
The team decided to replace the legacy CRM system entirely with a Software-as-a-Service (SaaS) platform, which corresponds to the Repurchasing strategy.
Repurchasing is defined as moving to a different product, typically a SaaS model.
2
Analyze the transaction processing application migration requirement
The team needs to migrate virtual machines quickly with minimal changes to meet a tight datacenter exit deadline, which corresponds to the Rehosting strategy.
Rehosting (lift-and-shift) involves migrating applications to the cloud without modifying their code or architecture, allowing for rapid migration.

Key Concept

AWS Migration strategies (6 Rs)
Question 227Question →

A retail company plans to expand its online operations to Europe and must verify that the underlying AWS infrastructure complies with the General Data Protection Regulation (GDPR). Which AWS service should the company use to download official AWS compliance reports and accept agreements?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary portal for retrieving AWS compliance documentation, including SOC reports, PCI reports, and GDPR compliance resources, and accepting agreements.

Step-by-Step Solution

1
Identify the core requirement of the retail company.
The company needs to obtain official AWS compliance documents and agreements (such as for GDPR) to verify the security and compliance of the AWS infrastructure.
This establishes that the target service must be a compliance document repository.
2
Evaluate the available AWS services to find the correct document portal.
AWS Artifact is identified as the portal designed specifically for retrieving compliance reports and accepting agreements.
Knowing the functions of AWS Artifact versus other security and management tools allows for selecting the correct answer.

Key Concept

AWS compliance reports and agreements retrieval via AWS Artifact
Estimated Time:45s
Question 228Question →

A logistics provider is migrating its package routing application to AWS. Currently, the company maintains its own data centers to handle holiday shipping surges, which leaves servers underutilized for the rest of the year. Additionally, their IT team spends a significant portion of their time managing physical hardware updates and power infrastructure instead of developing routing algorithms. Which of the following AWS Cloud benefits directly address these specific challenges? (Select two.)

Select all that apply

Show answer & explanation

Answer: Stop spending money running and maintaining data centers; Stop guessing capacity

Answer

The correct answers are the benefits of stopping spending money running and maintaining data centers, and stopping guessing capacity.
The option about stopping spending money running and maintaining data centers directly addresses the logistics provider's struggle with managing physical hardware updates and power infrastructure. The option about stopping guessing capacity addresses the challenge of seasonal surges, preventing underutilized infrastructure during the rest of the year.

Step-by-Step Solution

1
Identify the primary operational pain points in the scenario: managing physical hardware/power infrastructure, and paying for idle server capacity during off-peak times.
Two distinct areas of inefficiency: physical data center management and rigid capacity provisioning.
These challenges map directly to standard AWS Cloud benefits.
2
Align the physical infrastructure challenge with the correct AWS benefit.
The effort spent on hardware and power is addressed by stopping spending money running and maintaining data centers.
AWS manages the physical infrastructure, freeing up IT resources.
3
Align the capacity underutilization challenge with the correct AWS benefit.
The challenge of holiday surges and idle resources is solved by stopping guessing capacity.
Elastic scaling allows resources to automatically match demand rather than relying on upfront capacity guesses.

Key Concept

Benefits of the AWS Cloud
Question 229Question →

A manufacturing enterprise, StellarFab, is planning to migrate its application portfolio to the AWS Cloud. The migration team is evaluating two specific workloads:

1. A legacy Enterprise Resource Planning (ERP) application that they want to completely replace with a cloud-based Software as a Service (SaaS) platform.
2. A database-backed inventory application that they want to migrate to AWS. To reduce operational overhead, they plan to move the database to Amazon RDS without modifying the application's core code.

Which two migration strategies are being described for these workloads?

Select all that apply

Show answer & explanation

Answer: Repurchasing; Replatforming

Answer

Repurchasing and Replatforming are the two correct migration strategies.
The manufacturing company is using Repurchasing for the ERP application by replacing it with a cloud-based SaaS platform. They are using Replatforming for the database-backed inventory application by moving it to Amazon RDS to reduce operational overhead without modifying the application code.

Step-by-Step Solution

1
Analyze the first workload requirement: The legacy Enterprise Resource Planning (ERP) application is being replaced by a cloud-based Software as a Service (SaaS) platform.
Identify that replacing an existing application with a different product (like SaaS) corresponds to the Repurchasing strategy.
Repurchasing is defined as moving to a different product, often a SaaS platform.
2
Analyze the second workload requirement: The database-backed inventory application is being moved to Amazon RDS to reduce operational overhead without modifying the core code.
Identify that migrating a database to a managed service like Amazon RDS without modifying the application code is a Replatforming strategy.
Replatforming (lift-tinker-and-shift) involves making minor optimization adjustments, such as using managed services, without changing the application's underlying architecture.

Key Concept

Identifying AWS migration strategies (6 Rs)
Estimated Time:1m 0s
Question 230Question →

A startup is deploying a serverless backend application using AWS Lambda. Under the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Writing and securing the application code running inside the Lambda functions; Configuring Identity and Access Management (IAM) execution roles for the Lambda functions

Answer

Under the AWS Shared Responsibility Model for AWS Lambda, the customer is responsible for writing and securing the application code and configuring Identity and Access Management (IAM) execution roles.
In serverless compute services like AWS Lambda, the boundary of responsibility shifts upwards. AWS manages the physical security, virtual machines, operating system, and the runtime software stack. The customer remains responsible for configuration and data management, specifically securing the application code written for the function and configuring IAM execution roles to control access to other AWS resources.

Step-by-Step Solution

1
Identify the AWS service model type for AWS Lambda.
AWS Lambda is a serverless (managed) service where physical infrastructure, virtualization, operating systems, and managed runtime environments are handled entirely by AWS.
Understanding the service model helps determine the boundary of shared responsibility.
2
Distinguish between responsibilities for security 'of' the cloud (AWS) and security 'in' the cloud (customer) for Lambda.
AWS secures the execution environment, OS patching, runtime version maintenance, and physical hardware. The customer secures their own code, configuration settings, and access control (IAM).
This separation determines the specific operational tasks assigned to each party.

Key Concept

AWS Shared Responsibility Model for Serverless/Managed Services
Question 231Question →

A SaaS company is designing a real-time telemetry processing platform for autonomous utility grids. The platform must process streams of incoming sensor data, validate the data payloads, and store the validated data for downstream analytics. The engineering team wants to implement an architecture that adheres to the AWS design principles of 'loose coupling' and 'services, not servers' to minimize operational maintenance and prevent data loss during traffic spikes.

Which TWO architectural decisions should the team implement to align with these design principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Ingest and queue the data streams using Amazon Simple Queue Service (Amazon SQS) queues between the ingestion and processing layers.; Deploy a serverless data processing pipeline using AWS Lambda functions that write results directly to Amazon DynamoDB.

Answer

Ingest and queue the data streams using Amazon Simple Queue Service (Amazon SQS) queues between the ingestion and processing layers, and deploy a serverless data processing pipeline using AWS Lambda functions that write results directly to Amazon DynamoDB.
The correct architecture uses Amazon SQS to queue messages, which ensures that the ingestion and processing components are loosely coupled and can scale or fail independently without losing data. Additionally, using AWS Lambda and Amazon DynamoDB leverages the 'services, not servers' principle, allowing the company to build and run applications without the operational burden of provisioning and managing virtual servers.

Step-by-Step Solution

1
Analyze the requirements for 'loose coupling' to find a solution that reduces interdependencies between components.
Amazon SQS acts as a message broker that decouples layers, allowing the processing layer to consume messages at its own pace without affecting the ingestion layer.
This isolates layers, satisfying the loose coupling principle.
2
Analyze the requirements for 'services, not servers' to find solutions that offload system administration.
AWS Lambda and Amazon DynamoDB are fully managed, serverless services that do not require provisioning, configuring, or managing virtual servers.
This satisfies the services, not servers principle by offloading operational overhead to AWS.
3
Evaluate the distractors against these principles to confirm why they are incorrect.
Monolithic architectures, hardcoded IP addresses, and manual vertical scaling of EC2 instances introduce tight coupling and significant administrative overhead.
These options are anti-patterns that contradict the target AWS design principles.

Key Concept

AWS Cloud design principles focus on loose coupling (reducing interdependencies between components) and services, not servers (using managed/serverless offerings to minimize operational overhead).
Question 232Question →

A company runs a retail website on AWS. During updates, the operations team manually logs into Amazon EC2 instances to update software packages and configuration files. This manual process has caused configuration drift, leading to intermittent application failures across different servers. To fix this, the team decides to use AWS CloudFormation to automatically provision new, identical EC2 instances from a pre-configured Amazon Machine Image (AMI) for every deployment, and terminate the old ones. Which AWS Cloud design principle is demonstrated by this new deployment strategy?

Show answer & explanation

Answer: Disposable resources, by replacing configuration-drifted servers with newly bootstrapped, standardized instances instead of updating them in place.

Answer

Disposable resources, by replacing configuration-drifted servers with newly bootstrapped, standardized instances instead of updating them in place.
The strategy of terminating old servers and launching new, identical instances using automated templates (AWS CloudFormation) and pre-configured images (AMIs) demonstrates the principle of disposable resources. In cloud computing, resources should be treated as temporary and easily replaceable, which prevents configuration drift and ensures consistency across environments.

Step-by-Step Solution

1
Identify the core problem described in the scenario.
The operations team is experiencing configuration drift and application failures due to manual, in-place server updates.
Understanding the problem helps identify which cloud design pattern directly addresses it.
2
Analyze the proposed solution.
The team will use AWS CloudFormation to automatically spin up new instances using a standard AMI and terminate the old ones.
This shows the team is moving away from maintaining long-running, manually updated servers and instead programmatically replacing them.
3
Map the solution to AWS cloud design principles.
Replacing resources programmatically rather than updating them in place corresponds to the design principle of 'disposable resources instead of fixed servers'.
This aligns with the AWS Well-Architected Framework recommendation to treat infrastructure as temporary and easily replaceable.

Key Concept

Disposable resources instead of fixed servers
Question 233Question →

A financial services company is setting up daily administrative access to their AWS infrastructure for a new operations team. To comply with security audits, they must ensure individual accountability and adhere to the principle of least privilege. Which of the following security practices should the company implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each team member and assign permissions by placing them in an IAM group with appropriate policies.; Enable Multi-Factor Authentication (MFA) for each individual user account and the AWS account root user.

Answer

Create individual IAM users for each team member, manage their permissions using IAM groups, and enable Multi-Factor Authentication (MFA) on all accounts.
Establishing individual IAM users and organizing them into groups ensures that user activity is auditable and permissions adhere to the principle of least privilege. Requiring MFA for all users, including the root user, enforces a strong secondary layer of access validation to protect resources from credential leakage.

Step-by-Step Solution

1
Evaluate the requirement for individual accountability and permission control.
Determine that shared credentials must be avoided and that permissions must be managed centrally and specifically for roles.
Creating individual IAM users ensures that all actions can be audited to a specific person, while IAM groups allow efficient distribution of minimum necessary permissions.
2
Evaluate identity authentication security measures.
Determine that Multi-Factor Authentication (MFA) should be enforced for all administrative and root accounts.
MFA is the primary AWS recommendation to safeguard credentials from being compromised.

Key Concept

AWS Identity and Access Management (IAM) Security Best Practices
Estimated Time:1m 30s
Question 234Question →

A financial organization is deploying a microservices-based application using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security group rules to control inbound and outbound network traffic to the containerized services; Defining Identity and Access Management (IAM) task roles to restrict what AWS resources the containerized applications can access

Answer

The customer is responsible for configuring security group rules to control network traffic and defining IAM task roles to restrict container access to AWS resources.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. When using AWS Fargate, this includes defining IAM task roles to govern application-level access to other AWS resources, and configuring security group rules to control inbound and outbound network traffic to the containerized service.

Step-by-Step Solution

1
Identify the AWS service and its deployment model.
Amazon ECS on AWS Fargate is identified as a serverless container service.
The service model dictates the boundary of responsibility. Fargate shifts host management responsibilities to AWS.
2
Differentiate between infrastructure security and configuration security.
Infrastructure security (physical security, host OS patching, hypervisor management) belongs to AWS. Configuration security (IAM, network access rules, application configuration) belongs to the customer.
This determines which duties are classified as security 'of' the cloud versus security 'in' the cloud.
3
Select the operations that correspond to customer configurations.
Configuring security groups and setting up IAM task roles are selected.
These tasks involve configuring access permissions and network security rules for the customer's specific workloads.

Key Concept

Shared Responsibility Model
Estimated Time:1m 30s
Question 235Question →

An agricultural technology company processes petabytes of multispectral satellite imagery to monitor crop health. The data processing workloads spike significantly during harvest seasons, while resource utilization remains extremely low during winter. The company's chief technology officer wants to focus engineering resources on developing crop analytics algorithms rather than managing physical hypervisors, cooling systems, and power grids. Additionally, the company seeks to benefit from the aggregated customer usage in the cloud to achieve lower pay-as-you-go pricing for storage. Which two AWS Cloud benefits directly address these business requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Benefit from massive economies of scale; Stop spending money running and maintaining data centers

Answer

Benefit from massive economies of scale & Stop spending money running and maintaining data centers
The scenario highlights two distinct needs: offloading physical infrastructure management and gaining cost efficiency through aggregated vendor volume. Offloading hypervisor and facility maintenance directly maps to the benefit of stopping spending money running and maintaining data centers. Obtaining lower pay-as-you-go prices through aggregate cloud usage maps to the benefit of benefiting from massive economies of scale.

Step-by-Step Solution

1
Analyze the scenario requirements regarding physical operations.
The requirement to eliminate the need for managing physical hardware, cooling, and power facilities maps to stopping spending money running and maintaining data centers.
This benefit offloads physical facility management to AWS so that the organization can focus on core business applications.
2
Analyze the scenario requirements regarding cost optimization and aggregate cloud usage.
The requirement to achieve lower pay-as-you-go pricing through aggregated usage maps to benefiting from massive economies of scale.
AWS aggregates usage from hundreds of thousands of customers, enabling higher purchasing power and translating it into lower pay-as-you-go prices.
3
Review options and eliminate distractors.
Options that propose inverting variable and capital expenses, using static peak capacity planning, or deploying monolithic architectures on dedicated hardware are identified as incorrect and eliminated.
These distractors represent common misconceptions about cloud economics, capacity planning, and architectural best practices.

Key Concept

Define the benefits of the AWS Cloud
Question 236Question →

A retail enterprise is undergoing a Payment Card Industry Data Security Standard (PCI DSS) audit for its payment processing system hosted on AWS. The external auditors require evidence that the physical infrastructure of the AWS data centers hosting the services meets the required security standards. According to the AWS Shared Responsibility Model, which action should the retail enterprise take to meet this requirement?

Show answer & explanation

Answer: Retrieve the AWS PCI DSS compliance reports and Attestation of Compliance (AoC) from AWS Artifact.

Answer

Retrieve the AWS PCI DSS compliance reports and Attestation of Compliance (AoC) from AWS Artifact.
Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud, which includes the physical security of data centers. Because customers cannot access or physically audit AWS data centers, AWS undergoes independent third-party audits to verify compliance. The resulting compliance reports, such as the PCI DSS Attestation of Compliance (AoC), are made available on-demand to customers via AWS Artifact.

Step-by-Step Solution

1
Identify the compliance requirement and responsibility boundary.
The requirement is to verify the physical security and compliance of AWS data centers. Under the Shared Responsibility Model, AWS is solely responsible for physical security.
Since customers have no physical access to AWS facilities, they must rely on third-party audits performed on AWS's infrastructure.
2
Determine the AWS service that provides access to third-party compliance reports.
AWS Artifact is identified as the portal that grants on-demand access to AWS's security and compliance documentation.
This is the official method for customers to download compliance reports, such as PCI DSS and SOC, to hand over to their auditors.

Key Concept

Retrieving AWS compliance documentation under the Shared Responsibility Model using AWS Artifact.
Question 237Question →

An enterprise is migrating its legacy document-indexing application to AWS. The application currently runs on a cluster of self-managed virtual machines that parse uploaded files, extract text, and index the content into a local database. The migration team's initial plan is to deploy a fleet of Amazon EC2 instances in an Auto Scaling group, running a self-managed search index cluster on those instances. A solutions architect reviews this plan and recommends replacing the self-managed search index cluster with Amazon OpenSearch Service, and using AWS Lambda to trigger the parsing and indexing process directly from Amazon S3 uploads. Which design principle of the AWS Cloud is the architect primarily advocating for by recommending Amazon OpenSearch Service and AWS Lambda over self-managed EC2 instances?

Show answer & explanation

Answer: Services not servers

Answer

Services not servers
The correct answer is 'Services not servers'. This design principle encourages utilizing managed services (such as Amazon OpenSearch Service) and serverless technologies (such as AWS Lambda) to offload the operational burden of provisioning, configuring, patching, and securing physical servers and operating systems. This allows the organization to focus on writing code and developing features rather than managing infrastructure.

Step-by-Step Solution

1
Analyze the migration team's initial architecture.
The initial design relies on Amazon EC2 instances running self-managed virtual servers and a self-managed search cluster.
Understanding the baseline helps identify what operational overhead is present.
2
Evaluate the solutions architect's proposed recommendations.
The architect suggests using Amazon OpenSearch Service (a managed service) and AWS Lambda (a serverless service) instead of self-managed virtual machines.
Identifying the target services determines the operational model transition.
3
Map the change in operational model to AWS Cloud design principles.
Moving from self-managed servers on EC2 to fully managed and serverless offerings directly shifts administrative tasks (like OS patching, server provisioning, and cluster management) to AWS, which represents the principle of 'services not servers'.
This links the architecture recommendation to the correct design principle.

Key Concept

The AWS Cloud design principle of 'services not servers' encourages organizations to leverage managed services and serverless architectures to minimize administrative overhead and focus on business logic rather than infrastructure maintenance.
Question 238Question →

A logistics company uses AWS Elastic Beanstalk to deploy and scale a web application. The platform automatically provisions Amazon EC2 instances, an Application Load Balancer, and an Auto Scaling group to support the workload. The company's security team is defining the operational boundaries for securing this deployment.

Which of the following tasks remains the sole responsibility of the customer under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.

Answer

Configuring security group rules to restrict network access to the EC2 instances and applying updates to the application code.
The correct option is correct because managing security groups and application code are customer responsibilities (security 'in' the cloud). Even though AWS Elastic Beanstalk automates deployment, the provisioned EC2 instances run in the customer's environment, leaving network access rules (security groups) and code security under the customer's control.

Step-by-Step Solution

1
Analyze the service model in the scenario.
AWS Elastic Beanstalk is a Platform as a Service (PaaS) that provisions standard Infrastructure as a Service (IaaS) resources, including Amazon EC2 instances, under the customer's control.
Identifying the service model helps determine where the boundary of responsibility lies for the operating system and network settings.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS manages the physical infrastructure, virtualization hypervisors, and data center facilities. The customer manages the guest operating system, network firewalls (security groups), and application code.
Applying the Shared Responsibility Model principles isolates customer duties from AWS duties.
3
Evaluate the choices based on the customer's operational responsibilities.
Configuring security groups and updating application code are customer duties (security 'in' the cloud), whereas physical security, hypervisor patching, and data center compliance belong to AWS.
Verifying each option ensures the correct option matches the customer's responsibility profile.

Key Concept

Under the AWS Shared Responsibility Model, customers retain control and responsibility for configuration tasks (such as security groups and application updates) on resources provisioned in their accounts, even when deployed through managed or platform-level services.
Question 239Question →

ApexLogistics Group is evaluating its on-premises application portfolio in preparation for a migration to the AWS Cloud. The migration team has identified the following two workloads:

* A commercial third-party fleet tracking system that the team wants to deprecate in favor of a modern Software-as-a-Service (SaaS) alternative purchased through the AWS Marketplace.
* An archive database used for a closed business unit that has no active users and is no longer needed by any department.

Which migration strategies should the company select for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Repurchasing; Retiring

Answer

The correct strategies are repurchasing and retiring.
The correct strategies are repurchasing and retiring. Replacing an existing custom or third-party application with a SaaS product from the AWS Marketplace represents a repurchasing strategy. Shutting down an unused, unneeded archive database represents a retiring strategy.

Step-by-Step Solution

1
Analyze the migration plan for the fleet tracking system
The fleet tracking system is being replaced by purchasing a third-party SaaS alternative via AWS Marketplace, which corresponds to the Repurchasing migration strategy.
The repurchasing strategy involves discarding the existing software and switching to a new product, commonly a cloud-based SaaS platform.
2
Analyze the migration plan for the archive database
The database belongs to a closed business unit, is no longer needed, and has no active users, which corresponds to the Retiring migration strategy.
The retiring strategy involves turning off and decommissioning applications that are no longer useful to simplify the cloud portfolio and reduce maintenance costs.

Key Concept

Cloud migration strategies (6 Rs)
Question 240Question →

A company needs to grant a newly hired customer support team read-only access to specific Amazon S3 buckets. Which of the following identity and access management (IAM) practices should the administrator use to configure this access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM group and add the individual customer support IAM users to it.; Attach the S3 read-only IAM policy directly to the IAM group.

Answer

Create an IAM group to manage the customer support users collectively, and attach the Amazon S3 read-only IAM policy directly to that group.
The correct practices involve creating an IAM group to manage the customer support team collectively and attaching the S3 read-only IAM policy directly to that group. This aligns with the AWS best practice of using groups to manage permissions for multiple users with similar access needs, ensuring administrative overhead is reduced and permissions are inherited consistently.

Step-by-Step Solution

1
Group creation
An IAM group is created for the customer support team, and individual IAM user accounts are created for each agent and added to this group.
This establishes a logical boundary for managing permissions for a team of people with the same job function, following standard identity management practices.
2
Policy attachment
The S3 read-only IAM policy is attached directly to the group.
By attaching the policy to the group, all users added to the group automatically inherit the required permissions without needing direct policy assignment.

Key Concept

AWS IAM permissions management using IAM groups and policies to control access to resources.
PreviousPage 12 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin