Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 241Question →

A healthcare startup stores encrypted patient records in a private Amazon S3 bucket in its production AWS account. An internal compliance officer (an IAM user in the same account) requires read-only access to these records for auditing. Simultaneously, an automated diagnostic application running in an external partner's AWS account must upload new patient reports directly to the same bucket. The startup's security policy prohibits sharing credentials or setting up cross-account identity federation. Which of the following configurations represents the most secure, AWS-recommended approach to grant the required access?

Show answer & explanation

Answer: Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.

Answer

Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.
The correct answer is to attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account. Identity-based policies are optimal for managing access for users in the local account, while resource-based bucket policies are the most secure way to grant cross-account permissions directly without requiring the creation of local IAM users, the sharing of credentials, or the setup of full cross-account role assumption.

Step-by-Step Solution

1
Analyze the access requirements for the internal user.
The internal compliance officer is an IAM user in the same AWS account. An identity-based policy attached directly to the user (or their group) is the standard and most secure way to grant read access to S3.
Identity-based policies are designed to manage permissions for identities within the local account.
2
Analyze the access requirements for the external partner's application.
The application runs in an external AWS account. To grant cross-account access without sharing credentials, a resource-based S3 bucket policy should be configured to trust the external account's ARN or identity.
S3 bucket policies (resource-based) can directly grant cross-account access, eliminating the need to create IAM users or share long-term credentials.
3
Combine the configurations and evaluate best practices.
The combination of an identity-based policy for the internal user and a resource-based bucket policy for the external partner's application provides the most secure configuration while adhering to the principle of least privilege.
This avoids creating unnecessary IAM users with static keys or exposing root credentials, matching AWS security best practices.

Key Concept

Distinction between identity-based policies (attached to users/groups/roles) and resource-based policies (attached to resources like S3 buckets) for cross-account access.
Estimated Time:2m 0s
Question 242Question →

A company is designing an online retail platform on AWS and wants to ensure that a failure in the payment processing component does not disrupt the product browsing or shopping cart services. Which of the following design choices follow AWS Cloud design principles to achieve this requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying Amazon Simple Queue Service (Amazon SQS) to decouple the checkout system from the backend payment processing service; Implementing a microservices architecture where services communicate via standard web APIs

Answer

Deploying Amazon Simple Queue Service (Amazon SQS) to decouple the checkout system from the backend payment processing service, and implementing a microservices architecture where services communicate via standard web APIs
AWS Cloud architecture principles emphasize loose coupling, which minimizes dependencies between systems. Deploying Amazon Simple Queue Service (Amazon SQS) acts as a buffer between components, preventing failures in the downstream payment processor from impacting upstream checkout functions. Similarly, a microservices architecture communicates over web APIs, isolating services so that issues in one do not disrupt the availability of others.

Step-by-Step Solution

1
Identify the primary requirement: preventing a failure in one component from taking down other components.
This requirement aligns with the AWS Cloud design principle of loose coupling and isolation of failures.
By reducing dependencies between components, system reliability and resilience are enhanced.
2
Evaluate the choices to find which options promote decoupling.
Using message queues like Amazon SQS and building a microservices architecture using APIs are standard patterns to achieve loose coupling.
These solutions separate boundaries of responsibility and failure between components.

Key Concept

Loose Coupling and Decoupling Components
Question 243Question →

A global logistics company needs to evaluate its cloud environment against the Federal Risk and Authorization Management Program (FedRAMP) requirements. The company must obtain official AWS compliance documents and verify which AWS services are compliant under the FedRAMP authorization boundary. Which of the following two actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS FedRAMP partner package and authorization documents using AWS Artifact.; Consult the AWS Services in Scope by Compliance Program page to check service eligibility.

Answer

The correct actions are to download the AWS FedRAMP partner package and authorization documents using AWS Artifact, and to consult the AWS Services in Scope by Compliance Program page to check service eligibility.
The correct actions are to download the compliance documents using AWS Artifact and to consult the AWS Services in Scope by Compliance Program page. AWS Artifact is the official portal for self-service retrieval of security and compliance reports (such as FedRAMP, SOC, and PCI reports). The AWS Services in Scope by Compliance Program page lists all AWS services that meet specific compliance standards, allowing the customer to verify which services are compliant.

Step-by-Step Solution

1
Identify the requirement to retrieve AWS compliance reports and verify which services are compliant.
Recognize that AWS compliance documents must be obtained securely, and the scope of compliant services must be checked.
To ensure audit readiness and verify that only approved services are used in the compliant workload.
2
Determine the appropriate AWS tools and resources for these tasks.
Identify AWS Artifact as the central portal for security reports and the AWS Services in Scope webpage as the definitive directory for service compliance.
AWS Artifact provides self-service access to compliance reports, and the Services in Scope page details which services comply with specific standards.

Key Concept

Compliance and Governance
Question 244Question →

A real estate agency, ApexHomes, is migrating its legacy on-premises customer relationship management (CRM) system to the AWS Cloud. The agency decides to decommission the custom legacy software and transition to a commercially available Software-as-a-Service (SaaS) CRM platform obtained through the AWS Marketplace. Which cloud migration strategy is ApexHomes using?

Show answer & explanation

Answer: Repurchasing

Answer

Repurchasing
The correct strategy is Repurchasing. This strategy involves discarding the existing legacy application and replacing it with a commercially available off-the-shelf product or a Software-as-a-Service (SaaS) solution, such as moving to a new SaaS CRM platform purchased from the AWS Marketplace.

Step-by-Step Solution

1
Analyze the business scenario described in the stem.
The company is retiring its legacy CRM software and buying a license for a new SaaS product on the AWS Marketplace.
Identifying the key action helps determine which of the 6 Rs migration strategies is being applied.
2
Map the identified action to the correct migration strategy.
Discarding legacy code to purchase a commercially available SaaS platform corresponds to the Repurchasing strategy.
Repurchasing specifically refers to dropping the legacy product and shopping for a new one (often SaaS).

Key Concept

Cloud migration strategies (6 Rs), specifically Repurchasing (drop-and-shop).
Estimated Time:45s
Question 245Question →

A company uses Amazon Route 53 to host and manage its domain name system (DNS) records. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Show answer & explanation

Answer: Creating and configuring the DNS records inside the Route 53 hosted zones

Answer

Creating and configuring the DNS records inside the Route 53 hosted zones
Under the AWS Shared Responsibility Model, configuring resources, defining entries, and managing access to the services that are provisioned are customer responsibilities. Creating and configuring DNS records within Route 53 hosted zones is a configuration task managed by the customer. AWS retains responsibility for the physical servers, OS patching, and network routing of the Route 53 infrastructure.

Step-by-Step Solution

1
Identify the service type and model boundary in the scenario.
Amazon Route 53 is a fully managed DNS service provided by AWS.
Determining if a service is managed or unmanaged helps define what the customer must configure versus what AWS maintains automatically.
2
Distinguish between infrastructure security and data/configuration management.
AWS secures the physical hardware and patching of Route 53 servers, while the customer controls DNS record definitions and hosted zone settings.
Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud (configurations, access policies, data), and AWS is responsible for security 'of' the cloud (physical security, hardware, hypervisors).

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:45s
Question 246Question →

A municipal agency is planning to host citizen records on AWS. The agency's compliance team needs to obtain AWS SOC 3 reports and sign a Business Associate Addendum (BAA) with AWS. Which of the following options represent the correct service and action to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use AWS Artifact to retrieve the required SOC 3 compliance report; Use AWS Artifact to review and accept the Business Associate Addendum (BAA)

Answer

Use AWS Artifact to retrieve the required SOC 3 compliance report, and use AWS Artifact to review and accept the Business Associate Addendum (BAA).
AWS Artifact is the primary self-service portal for accessing AWS compliance reports and managing agreements. The service provides on-demand access to AWS security and compliance documents (such as SOC reports) and allows customers to review and accept agreements (such as the BAA) directly through the AWS Management Console.

Step-by-Step Solution

1
Identify the compliance and governance needs of the agency.
The agency needs to download official compliance reports (SOC 3) and accept a specific agreement (BAA) with AWS.
Understanding the compliance requirement determines which AWS service is needed.
2
Determine the AWS service designed for compliance reports and agreements.
AWS Artifact is the dedicated service for retrieving AWS security reports and accepting agreements.
AWS Artifact provides on-demand access to compliance documents and manages agreements directly through the console.

Key Concept

AWS compliance reports and agreements are managed through AWS Artifact.
Estimated Time:1m 0s
Question 247Question →

A logistics provider, GlobalCargo Logistics, is evaluating its application portfolio to migrate to the AWS Cloud. The migration team has identified two specific workloads:

1. A legacy shipping optimization application running on-premises. The company wants to migrate this application to AWS with minimal modifications, but intends to move the self-managed database to Amazon RDS for Oracle to reduce administrative overhead.
2. A proprietary, monolithic billing application. The company wants to decompose this monolith into a serverless, microservices-based architecture using AWS Lambda and Amazon DynamoDB to maximize scalability and reduce operational costs.

Which migration strategies should GlobalCargo Logistics use for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replatforming for the shipping optimization application; Refactoring for the billing application

Answer

Replatforming for the shipping optimization application and Refactoring for the billing application
Replatforming (also known as lift-tinker-and-shift) involves making small optimizations to an application during migration without changing the core architecture, such as moving a self-managed database to a fully managed service like Amazon RDS. Refactoring (also known as re-architecting) involves modifying the core architecture of the application to take full advantage of cloud-native features, such as breaking a monolith into a serverless architecture using AWS Lambda and Amazon DynamoDB.

Step-by-Step Solution

1
Analyze the migration requirements for the shipping optimization application.
The application is migrated with minimal modification, but the database is moved to a managed service (Amazon RDS).
Moving a self-managed database to a managed service to reduce overhead without altering core application code represents Replatforming (lift-tinker-and-shift).
2
Analyze the migration requirements for the billing application.
The monolithic application is decomposed and redesigned into a cloud-native, serverless microservices architecture.
Redesigning an application to use serverless services like AWS Lambda and Amazon DynamoDB represents Refactoring (re-architecting).

Key Concept

Cloud migration strategies (6 Rs)
Question 248Question →

An agricultural technology firm, GreenGrow Solutions, is migrating its legacy inventory tracking system to the AWS Cloud. The system consists of a web server and a self-managed PostgreSQL database currently running on-premises. To minimize application code modifications, the team decides to migrate the web server to Amazon EC2 without changes. However, they decide to move the database to Amazon Relational Database Service (Amazon RDS) for PostgreSQL to eliminate database administration tasks like patching and backups. Which migration strategy is GreenGrow Solutions applying to the database tier?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
The correct answer is Replatforming. GreenGrow Solutions is optimization-tuning their database by moving it from a self-managed virtual machine to a fully managed service (Amazon RDS) to reduce administrative overhead (like patching and backups) without changing the core application code or database engine type.

Step-by-Step Solution

1
Analyze the database migration requirements from the scenario.
The web server is migrated without changes, but the database is moved to Amazon RDS to reduce administrative overhead.
To identify how each tier of the application is handled during the migration.
2
Compare the database migration details against the 6 Rs migration strategies.
Migrating a self-managed database to a fully managed database service (Amazon RDS) without changing the database type represents Replatforming.
To align the migration actions with the correct cloud migration terminology.
3
Evaluate the distractors based on definitions and cloud economics.
Rehosting is direct lift-and-shift; Refactoring requires code rewrites; Retaining keeps the database on-premises and does not convert OpEx to CapEx.
To eliminate the incorrect options and confirm the single correct answer.

Key Concept

Identifying migration strategies (6 Rs) when moving workloads to AWS, specifically distinguishing between Rehosting and Replatforming.
Question 249Question →

An online education platform hosts its virtual classroom application on Amazon EC2 instances. To ensure that the platform remains highly available even if an entire data center experiences a power outage, the platform's architecture deploys EC2 instances across multiple Availability Zones behind an Application Load Balancer. Which AWS Cloud design principle is directly represented by this setup?

Show answer & explanation

Answer: Design for failure

Answer

Design for failure
The design principle of designing for failure encourages building systems that can automatically withstand and recover from infrastructure outages. By deploying application instances across multiple Availability Zones, the system is designed to tolerate the complete failure of an entire data center without causing service disruption.

Step-by-Step Solution

1
Analyze the scenario requirements.
The scenario describes deploying EC2 instances across multiple physical locations (Availability Zones) to protect against a localized data center power outage.
Identifying the target threat (data center failure) and the redundancy mechanism (multiple Availability Zones) is necessary to determine the relevant design principle.
2
Map the redundancy mechanism to AWS design principles.
The mechanism assumes that an entire data center can fail and ensures the system remains operational, which directly maps to the principle of designing for failure.
Selecting the correct principle requires matching the practice of planning for component or site outages with the designated principle name.

Key Concept

Design for failure
Estimated Time:45s
Question 250Question →

A company is conducting a security audit of its AWS infrastructure. The audit reveals that the IT team uses the AWS account root user for daily configuration tasks, and several application servers use embedded long-term AWS access keys to write data to Amazon S3. Which of the following actions should the company take to align with AWS Identity and Access Management (IAM) security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks.; Configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.

Answer

Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks, and configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.
The correct actions are securing the root user with multi-factor authentication (MFA) while using individual IAM users for daily administrative activities, and configuring application servers to use IAM roles with temporary credentials rather than long-term access keys. These actions adhere to the principle of least privilege, guarantee auditability, and minimize the risk of compromised long-term credentials.

Step-by-Step Solution

1
Analyze the security risk of using the AWS account root user for daily configuration tasks.
The root user possesses unrestricted privileges that cannot be locked down. Continued operational use increases the attack surface.
AWS security standards state that the root user should be secured with MFA and restricted to a tiny subset of account-level administrative actions.
2
Address the risk of hardcoded long-term credentials on application servers.
Long-term access keys are permanent until rotated manually, presenting a leak risk if credentials are checked into repositories or compromised.
AWS recommends replacing static credentials with IAM roles, which leverage short-term, temporary security credentials that rotate automatically.
3
Evaluate and discard insecure administrative models.
Shared credentials (like shared IAM users or shared root accounts) break audit trails, and requesting AWS to manage client keys violates the Shared Responsibility Model.
Every administrator must have a unique identity, and the customer retains operational control over IAM configuration.

Key Concept

Applying core IAM security principles including root account protection, temporary credentials via IAM roles, and distinct administrative identities.
Estimated Time:2m 0s
Question 251Question →

StayBooker, a hotel reservation platform, is planning to migrate its applications to the AWS Cloud. The migration team has identified two specific workloads:

1. An on-premises employee payroll processing application that they want to completely replace with a commercial cloud-hosted software-as-a-service (SaaS) subscription.
2. A legacy mainframe application that cannot be migrated to the cloud at this time due to complex hardware dependencies, which they must keep running in their on-premises environment.

Which two of the following migration strategies represent the correct approach for these workloads?

Select all that apply

Show answer & explanation

Answer: Repurchasing; Retaining

Answer

The correct migration strategies are Repurchasing and Retaining.
Repurchasing is the correct strategy for the payroll application because it involves replacing the custom system with a commercially available SaaS solution. Retaining is the correct strategy for the legacy mainframe because it keeps the application in the on-premises environment due to constraints preventing migration.

Step-by-Step Solution

1
Analyze the first workload: replacing an on-premises payroll application with a SaaS subscription.
This matches the 'Repurchasing' strategy, which is often referred to as drop-and-shop.
Replacing existing applications with commercial SaaS options is the defining feature of Repurchasing.
2
Analyze the second workload: keeping a legacy mainframe application on-premises due to hardware dependencies.
This matches the 'Retaining' strategy.
Keeping applications in their source environment because they cannot be migrated yet is classified as Retaining.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Question 252Question →

A startup is preparing for a security audit and needs to download official AWS compliance documentation. Which AWS service provides on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports and ISO certifications?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the correct service because it is specifically designed to provide customers with on-demand access to AWS security and compliance reports (such as SOC 1/2/3 and ISO certifications) and agreements.

Step-by-Step Solution

1
Identify the user requirement, which is to find and download official AWS compliance documentation (such as SOC and ISO reports) to support a security audit.
Access to official AWS security and compliance reports is required.
These reports demonstrate that the underlying AWS infrastructure meets specific security standards.
2
Select the AWS service designed as a self-service portal for retrieving these specific audit reports and compliance agreements.
AWS Artifact is the designated service for this purpose.
AWS Artifact provides on-demand access to AWS compliance documents.

Key Concept

AWS Artifact is the central repository for on-demand access to AWS compliance reports and agreements.
Estimated Time:45s
Question 253Question →

An energy technology provider is migrating its financial billing system to AWS. The company's compliance department needs to obtain a confidential AWS System and Organization Controls (SOC) 1 Type II report to prove to their external auditors that the AWS infrastructure controls are operating effectively. Which AWS resource should the company use to locate, accept the terms of, and download this report?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the go-to portal for downloading AWS compliance documents, such as SOC 1, SOC 2, and PCI DSS reports. It provides a secure, self-service interface where customers can accept the terms of the documents and download them to share with external auditors.

Step-by-Step Solution

1
Determine the user's primary requirement.
The requirement is to retrieve AWS's own third-party security and compliance reports (SOC 1 Type II).
This establishes the scope as compliance report retrieval rather than active resource monitoring or account log auditing.
2
Evaluate the capabilities of the available AWS security and governance services.
AWS Artifact provides on-demand access to AWS compliance reports and agreements. AWS Config monitors resource configurations. AWS CloudTrail records API calls. AWS Support manages customer cases.
This highlights the differences in service purposes to find the correct tool.
3
Select the correct service based on the evaluated capabilities.
AWS Artifact is the specific portal where customers accept agreements and download SOC and PCI reports.
Only AWS Artifact meets the direct, self-service download requirement for the SOC 1 Type II report.

Key Concept

AWS Artifact serves as the central, self-service portal for accessing AWS compliance reports, including SOC, PCI, and ISO certifications.
Question 254Question →

A mobile gaming startup is deploying a high-throughput, low-latency leaderboard and player session store using Amazon ElastiCache for Redis. The startup needs to secure this environment to protect user session tokens from unauthorized external access while maintaining compliance with regional data privacy standards. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring VPC security groups to restrict network access to the cache cluster nodes

Answer

Configuring VPC security groups to restrict network access to the cache cluster nodes
The correct answer is configuring VPC security groups to restrict network access to the cache cluster nodes. Under the AWS Shared Responsibility Model, firewall configuration and network access controls (such as security groups) are always the customer's responsibility, regardless of whether the service is IaaS or a managed database/cache service.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon ElastiCache for Redis is a managed database/caching service.
Managed services shift the management of the underlying physical infrastructure, operating system, and database software patching to AWS.
2
Determine the boundary of customer responsibility for managed services under the Shared Responsibility Model.
The customer remains responsible for data protection, identity and access management (IAM), and network traffic configuration (such as security groups).
This isolates the customer's responsibility to security 'in' the cloud, specifically network firewall rules and access credentials.
3
Evaluate the choices to find the one matching the customer's responsibility.
Configuring VPC security groups is a customer task, whereas patching the guest OS, maintaining physical security, and performing physical audits are AWS responsibilities.
This correctly identifies the boundary of network security configuration for ElastiCache nodes.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 5s
Question 255Question →

An online media streaming company is undergoing a security audit. The compliance team needs to access AWS security documents and accept standard agreements regarding content protection. Which TWO of the following tasks can the team perform using AWS Artifact to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Download AWS security and compliance documents, such as SOC and PCI reports; Review and accept AWS compliance agreements, such as a Business Associate Addendum (BAA)

Answer

Downloading AWS security and compliance documents, such as SOC and PCI reports, and reviewing and accepting AWS compliance agreements, such as a Business Associate Addendum (BAA).
AWS Artifact is the central portal for retrieving AWS compliance reports and managing agreements. The option to download compliance documents (such as SOC/PCI reports) and the option to review and accept compliance agreements (such as a BAA) correctly identify the core functionalities of AWS Artifact.

Step-by-Step Solution

1
Analyze the business requirement of accessing security documents and accepting agreements.
Identify that AWS Artifact is the primary self-service portal for security reports and agreements.
AWS Artifact enables customers to download compliance reports (such as SOC and PCI) and sign agreements (such as a BAA).
2
Evaluate the distractors against the Shared Responsibility Model and other security services.
Eliminate options involving instance scanning, API auditing, and physical data center security.
These tasks are handled by Amazon Inspector, AWS CloudTrail, and AWS internal physical security teams respectively.

Key Concept

AWS Artifact is a self-service compliance portal that provides on-demand access to AWS security and compliance reports and online agreements.
Estimated Time:1m 0s
Question 256Question →

A consulting firm is storing client project documents in an Amazon Simple Storage Service (Amazon S3) bucket. Under the AWS Shared Responsibility Model, which operational task is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring S3 bucket policies and enabling data encryption

Answer

Configuring S3 bucket policies and enabling data encryption
Under the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud. For Amazon S3, this includes managing access permissions using S3 bucket policies and deciding how to encrypt the stored objects.

Step-by-Step Solution

1
Determine the service model type for Amazon S3 in the scenario.
Amazon S3 is a managed storage service.
Determining the service type helps define the boundary between customer and AWS responsibilities.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for S3.
AWS manages physical security, hardware, and server operating systems. The customer manages data access configurations, user permissions, and data encryption.
Since the customer owns the data and access configuration, configuring S3 bucket policies and enabling encryption falls under customer responsibility.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:45s
Question 257Question →

A company is using Amazon DynamoDB to store user profile data for a mobile application. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Identity and Access Management (IAM) policies to restrict table access; Enabling client-side encryption for the data before it is written to the table

Answer

Configuring Identity and Access Management (IAM) policies to restrict table access and Enabling client-side encryption for the data before it is written to the table
Configuring access control policies and managing data encryption (like client-side encryption) are customer responsibilities because they fall under 'security in the cloud'. The customer has sole control over who is authorized to access their database resources and how their data is encrypted before or during transit.

Step-by-Step Solution

1
Analyze the service type
Amazon DynamoDB is a fully managed (PaaS/serverless) database service.
Managed services shift the responsibility of operating system patching, hardware provisioning, and database engine maintenance to AWS.
2
Identify customer responsibilities for managed services
The customer is still responsible for data protection (like client-side encryption) and access management (IAM policies).
Under the Shared Responsibility Model, the customer is always responsible for the security of their data and who has access to it ('security in the cloud').

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for 'security of the cloud' (managed database engine, OS patching, hardware, and physical security), while the customer is responsible for 'security in the cloud' (data classification, client-side encryption, and access management/IAM policies).
Question 258Question →

A startup needs to grant a new database administrator access to manage Amazon RDS databases. Which of the following actions aligns with AWS security best practices for identity management?

Show answer & explanation

Answer: Create a dedicated IAM user for the database administrator and attach an identity-based policy containing only the permissions required for Amazon RDS management.

Answer

Create a dedicated IAM user for the database administrator and attach an identity-based policy containing only the permissions required for Amazon RDS management.
The correct option outlines the standard AWS identity best practice: creating a distinct, individual IAM user for each person requiring access and attaching an identity-based policy restricted to only the resources they need (least privilege).

Step-by-Step Solution

1
Identify the type of identity required for an internal human user who needs permanent, daily access.
An individual IAM user must be created rather than sharing credentials or using temporary roles directly for daily login without federation.
This establishes accountability and ensures that individual actions can be audited.
2
Determine the minimum permissions required for the user to perform their specific job function.
An identity-based IAM policy should be created and attached to the user, granting access only to Amazon RDS resources.
This adheres to the principle of least privilege, minimizing the security footprint of the user credentials.

Key Concept

AWS identity management best practices including the use of individual IAM users and the principle of least privilege.
Estimated Time:45s
Question 259Question →

A public sector organization is migrating a legacy database to AWS and must ensure the architecture meets strict government compliance guidelines. The organization needs to retrieve AWS's third-party compliance reports and must understand the compliance boundaries under the AWS Shared Responsibility Model. Which of the following describes the correct service for retrieving these reports and the compliance responsibility division if they deploy the database on Amazon EC2?

Show answer & explanation

Answer: AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.

Answer

AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.
AWS Artifact is the dedicated service for retrieving AWS compliance documents, including SOC and PCI reports. Because the database is hosted on Amazon EC2, it functions as an Infrastructure as a Service (IaaS) model where the customer is responsible for patching the guest operating system and the database engine.

Step-by-Step Solution

1
Identify the service required to retrieve AWS's official third-party compliance audits and certificates.
AWS Artifact is identified as the portal providing on-demand access to AWS compliance reports (e.g., SOC, PCI, FedRAMP).
AWS Artifact serves as the centralized repository for compliance documentation.
2
Determine the boundary of responsibility for an Amazon EC2-based database deployment.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer is responsible for security 'in the cloud,' which includes the guest operating system, applications, database engines, and patching.
Under the Shared Responsibility Model, AWS manages security 'of the cloud' (physical host, virtualization layer) while the customer manages security 'in the cloud' (guest OS, database, and configurations).

Key Concept

AWS Artifact is the primary portal for compliance reports, and customers are responsible for guest OS and application patching on EC2 under the Shared Responsibility Model.
Question 260Question →

An agricultural analytics firm, AgroOptima, is planning to migrate its application portfolio to the AWS Cloud. The migration team is evaluating the strategies for two specific workloads:

1. A predictive crop-yield analytics application that runs on on-premises virtual machines. To reduce database administration tasks, the team plans to move the application's database to Amazon RDS for PostgreSQL, while hosting the application itself on Amazon EC2 without modifying its core code.
2. A legacy invoicing system with high license maintenance costs. The company plans to decommission this system entirely and transition to a third-party Software-as-a-Service (SaaS) billing solution purchased through AWS Marketplace.

Which combination of migration strategies is AgroOptima using for these two workloads?

Show answer & explanation

Answer: Replatforming for the analytics application and Repurchasing for the invoicing system

Answer

Replatforming for the analytics application and Repurchasing for the invoicing system
The correct option is Replatforming for the analytics application and Repurchasing for the invoicing system. Shifting a self-managed database to a managed service like Amazon RDS during migration, while hosting the application itself on Amazon EC2 without code modifications, represents a Replatforming (lift-tinker-and-shift) strategy. Discarding a legacy system to adopt a new commercial Software-as-a-Service (SaaS) solution via AWS Marketplace represents a Repurchasing strategy.

Step-by-Step Solution

1
Analyze the migration strategy for the first workload (analytics application).
The database is shifted to Amazon RDS (a managed service) to reduce operational overhead, while the main application code remains unmodified on EC2.
This 'lift-tinker-and-shift' approach matches the Replatforming strategy.
2
Analyze the migration strategy for the second workload (invoicing system).
The legacy invoicing system is decommissioned and replaced with a commercial SaaS solution purchased via AWS Marketplace.
Transitioning to a different product/license model matches the Repurchasing strategy.
3
Combine the two identified strategies to find the matching option.
The combination is Replatforming and Repurchasing.
This corresponds to the correct option.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Estimated Time:2m 0s
PreviousPage 13 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin