Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 281Question →

A company needs to perform automated security assessments on its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it provides automated security assessments that scan Amazon EC2 instances, container images, and Lambda functions for known software vulnerabilities and unintended network reachability.

Step-by-Step Solution

1
Identify the core requirement of the scenario: the company needs to perform automated security assessments on Amazon EC2 instances to find software vulnerabilities and unintended network exposure.
The requirement is focused on host-level vulnerability scanning and network exposure checks.
This narrows down the potential services to those that inspect the internal state of EC2 instances and network paths.
2
Evaluate the functions of the available AWS security services to find the correct match.
Amazon Inspector is identified as the service designed specifically for automated vulnerability management and scanning of EC2 workloads, whereas the other options focus on threat detection, API logging, or DDoS protection.
Selecting the service that matches the host-level vulnerability scanning definition ensures compliance with AWS best practices.

Key Concept

Amazon Inspector is the primary AWS service for automated vulnerability scanning of EC2 instances, container images, and Lambda functions.
Estimated Time:45s
Question 282Question →

OceanGlide Maritime, a shipping logistics provider, is planning to migrate its on-premises infrastructure to the AWS Cloud. The migration team has identified two initial workloads to migrate:

1. A proprietary port scheduling application that runs on a legacy operating system. The team needs to move this workload to AWS quickly with zero code modifications to allow the immediate decommissioning of their physical server.
2. An on-premises commercial database engine. The team wants to migrate this database to a managed service in AWS (specifically Amazon RDS) to reduce licensing fees and offload operating system patching and backups, without changing the core database schema or application logic.

Which of the following migration strategies should the company select for these two workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehosting for the port scheduling application; Replatforming for the commercial database system

Answer

Rehosting is correct for the port scheduling application, and Replatforming is correct for the commercial database system.
The correct options are Rehosting for the port scheduling application and Replatforming for the commercial database system. Rehosting (lift-and-shift) is appropriate because the legacy port scheduling application needs to be moved quickly with zero changes. Replatforming (lift-tinker-and-shift) is appropriate because the database is moving to a managed service (Amazon RDS) to reduce maintenance tasks (patching and backups) and database licensing costs, without core architectural changes.

Step-by-Step Solution

1
Analyze the requirements for the legacy port scheduling application.
The application must be moved quickly with zero modifications to allow decommissioning of physical hardware. This matches Rehosting (lift-and-shift).
Rehosting allows rapid migration of workloads to the cloud without modifying the application code or configuration.
2
Analyze the requirements for the commercial database system.
The database must migrate to a managed service (Amazon RDS) to reduce licensing fees and administrative tasks (patching/backups) without changing the database schema or application logic. This matches Replatforming (lift-tinker-and-shift).
Replatforming involves modifying the hosting environment (e.g., moving from self-managed servers to managed Amazon RDS) to gain cloud efficiency without altering the core codebase.

Key Concept

Identifying AWS Cloud migration strategies (the 6 Rs), focusing on the distinction between Rehosting (lift-and-shift) and Replatforming (lift-tinker-and-shift).
Estimated Time:1m 30s
Question 283Question →

A startup is setting up its first AWS account to host a web application. The company's IT lead needs to perform daily operations, such as creating Amazon EC2 instances and configuring Amazon S3 buckets. Which AWS security best practice should the IT lead follow to manage these daily administrative tasks?

Show answer & explanation

Answer: Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.

Answer

Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.
The correct answer is to create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities. This aligns with the AWS best practice of protecting the root user credentials and ensuring that administrative tasks are performed by authenticated IAM identities.

Step-by-Step Solution

1
Identify the requirement for administrative daily access in a newly created AWS account.
Identified that the IT lead needs administrative privileges to create instances and configure S3 buckets.
Ensures the correct level of access is provisioned for daily operations.
2
Evaluate access options against AWS security best practices.
Determined that using the AWS account root user is discouraged for daily activities, while IAM roles cannot be used as permanent direct login identities.
Prevents credential exposure and aligns with organizational security standards.
3
Select the best practice approach of using an administrative IAM user with multi-factor authentication (MFA) enabled.
Secure administrative operations are established while keeping root user credentials protected.
Minimizes security risks and complies with the principle of least privilege.

Key Concept

AWS Account Root User and IAM Identity Best Practices
Question 284Question →

A retail startup is migrating its customer database and file sharing system to AWS. The company wants to minimize the administrative effort required to maintain infrastructure, and ensure that virtual servers can be easily replaced and automated if they become unhealthy. Which TWO AWS Cloud design principles support these goals? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Utilize managed services instead of managing physical or virtual servers to reduce maintenance overhead; Treat computing resources as temporary and disposable by automating their deployment and replacement

Answer

Utilizing managed services instead of managing physical or virtual servers, and treating computing resources as temporary and disposable by automating their deployment and replacement.
The correct options are to utilize managed services instead of managing physical or virtual servers, and to treat computing resources as temporary and disposable by automating their deployment and replacement. Using managed services reduces the administrative burden of running virtual servers (supporting the 'services, not servers' principle). Treating resources as disposable ensures that unhealthy systems can be replaced instantly through automation rather than manual troubleshooting.

Step-by-Step Solution

1
Analyze the requirements from the scenario: reducing administration overhead and ensuring easy, automated replacement of unhealthy servers.
Identified the need for managed services to minimize administration and automated, disposable resources to handle unhealthy servers.
This helps map the business requirements to specific AWS Cloud design principles.
2
Evaluate the design principles of the AWS Cloud to see which ones match these requirements.
The principle 'services, not servers' supports reducing server management, and the principle 'disposable resources' supports using automation to replace servers.
This identifies the correct architectural choices.

Key Concept

AWS Cloud design principles focus on automation, managed services, and treating servers as disposable rather than permanent fixtures.
Estimated Time:1m 0s
Question 285Question →

A digital media startup is developing a mobile photo-sharing application that requires millions of end-users to upload images directly to a private Amazon S3 bucket. Which of the following approaches aligns with AWS Identity and Access Management (IAM) best practices for granting access to these users?

Show answer & explanation

Answer: Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.

Answer

Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.
The correct option is to configure web identity federation using Amazon Cognito. According to AWS IAM best practices, mobile application users should authenticate against an identity provider (such as Amazon Cognito, Google, or Apple) and exchange their identity token for temporary AWS security credentials. These temporary credentials have limited permissions and automatically expire, removing the need to distribute long-term AWS credentials.

Step-by-Step Solution

1
Analyze the access requirement for external mobile application users who do not have AWS accounts.
Identify that creating individual IAM users for millions of end-users is unmanageable and violates security practices.
IAM users are designed for internal employees, administrators, or application services, not for transient public application consumers.
2
Evaluate how to secure client-side resource uploads without storing permanent credentials in the client application.
Determine that temporary security credentials derived from an IAM role are required.
Temporary credentials expire automatically and do not require hardcoding secrets in the client application.
3
Select the appropriate service for external identity federation.
Choose Amazon Cognito web identity federation.
Amazon Cognito acts as an identity broker, allowing users to sign in via social or enterprise identity providers and exchange their login tokens for temporary AWS credentials.

Key Concept

Identity Federation and Temporary Security Credentials
Estimated Time:2m 0s
Question 286Question →

An online event ticketing platform experiences massive, unpredictable traffic surges when tickets for major concerts go on sale. To prevent site crashes on-premises, the company had to buy and deploy excess hardware in advance, which then sat underutilized for the rest of the year. Additionally, purchasing these physical servers required significant upfront funding.

Which two benefits of the AWS Cloud directly address this company's challenges? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Trade capital expense for variable expense

Answer

The ticketing platform can address its challenges by trading capital expense for variable expense and stopping guessing capacity.
The correct benefits are stopping guessing capacity and trading capital expense for variable expense. By leveraging AWS, the ticketing platform eliminates the need to pay large upfront capital costs for servers (trading capital expense for variable expense) and no longer needs to keep idle hardware running just to handle potential traffic surges (stopping guessing capacity) because resources can scale dynamically.

Step-by-Step Solution

1
Analyze the financial and operational pain points described in the scenario.
The company faces two primary issues: significant upfront funding for physical server purchases, and underutilized hardware because they must over-provision to handle unpredictable peaks.
Understanding the specific challenges allows mapping them to the corresponding AWS Cloud benefits.
2
Evaluate the financial pain point against the AWS economic benefits.
Paying upfront for physical servers represents a capital expense. Transitioning to a model where they pay only for what they consume maps to the benefit of trading capital expense for variable expense.
Shifting from CapEx to OpEx reduces upfront risk and cash flow constraints.
3
Evaluate the capacity planning challenge against the AWS operational benefits.
Maintaining idle servers to handle traffic spikes is resolved by stopping guessing capacity. AWS allows automatic scaling to meet real-time demand, removing the need for manual pre-provisioning.
Elastic provisioning ensures applications remain available during spikes without paying for idle resources during off-peak times.

Key Concept

Understanding the 6 Advantages of Cloud Computing, focusing on trading capital expense for variable expense and stopping guessing capacity.
Estimated Time:1m 30s
Question 287Question →

An automotive manufacturer is designing a telematics system to gather diagnostic data from 10,00010,000 connected test vehicles. The data transmission is highly irregular, peaking during daily test runs and dropping to zero overnight. The company wants to avoid purchasing dedicated physical servers that would remain idle during non-test hours, preferring a model where they pay only for the compute resources consumed during active tests. Which benefit of the AWS Cloud is directly demonstrated by this approach?

Show answer & explanation

Answer: Trading capital expense for variable expense

Answer

Trading capital expense for variable expense
The correct answer is trading capital expense for variable expense. By choosing to pay only for the compute resources consumed during active tests rather than buying physical servers in advance, the automotive manufacturer avoids capital expenditures (CapEx) and adopts a pay-as-you-go variable expense (OpEx) model.

Step-by-Step Solution

1
Analyze the business requirements in the scenario.
The company wants to avoid upfront purchases of physical servers (capital expense) for irregular workloads and instead pay only for resources consumed during active periods (variable expense).
Understanding the customer's financial and technical constraints is key to mapping them to the correct AWS Cloud benefit.
2
Evaluate the AWS Cloud benefits against the identified requirements.
The practice of paying only for consumed compute resources rather than investing in physical infrastructure aligns with the benefit of 'trading capital expense for variable expense'.
AWS defines this benefit as paying only when you consume computing resources and paying only for how much you consume, rather than investing heavily in data centers and servers up front.

Key Concept

AWS Cloud Benefit: Trading capital expense for variable expense
Question 288Question →

An online retail company is auditing its cloud deployment to verify compliance with industry security standards. Under the AWS shared responsibility model, which of the following operational tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Patching the guest operating system and configuring security groups on Amazon EC2 instances

Answer

Patching the guest operating system and configuring security groups on Amazon EC2 instances
The task of patching the guest operating system and configuring security groups on Amazon EC2 instances is a customer responsibility under the shared responsibility model. Because customers launch and manage their own EC2 instances, they have full control over the guest operating system and its network access control settings, making it security 'in' the cloud.

Step-by-Step Solution

1
Identify the boundary of responsibility under the AWS Shared Responsibility Model.
AWS is responsible for security 'of' the cloud (infrastructure, physical security, virtualization), while the customer is responsible for security 'in' the cloud (data, guest OS, network configuration).
This distinction determines which operational task belongs to the customer.
2
Evaluate the options against the customer responsibility boundary.
Managing guest operating systems and local firewall configurations (security groups) on EC2 instances falls under security 'in' the cloud.
Because the customer has direct control and access to the guest OS of EC2 instances, AWS cannot manage these configurations for them.

Key Concept

Shared Responsibility Model for Compliance
Estimated Time:45s
Question 289Question →

A global logistics company is designing a real-time package tracking system on AWS. The system needs to process millions of location updates daily, with traffic spiking significantly during peak holiday seasons. The system must remain operational even if the database layer becomes temporarily unavailable. Which of the following design decisions align with AWS Cloud design principles to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon SQS queues between the ingestion service and the database layer to decouple the components.; Use Amazon EC2 Auto Scaling to automatically adjust the ingestion tier based on incoming traffic volume.

Answer

Deploying Amazon SQS queues to decouple the ingestion and database tiers, and using Amazon EC2 Auto Scaling to dynamically adjust resources based on demand, are the correct design decisions.
The correct options are using message queues to decouple systems and using auto-scaling to match resource capacity to demand. Placing a message queue between components achieves loose coupling, meaning a failure in the database does not disrupt the ingestion service. Auto-scaling allows the application to automatically scale out during peak periods and scale in during low usage, achieving elasticity.

Step-by-Step Solution

1
Analyze the requirements for decoupling and operational resilience when the database is unavailable.
Decoupling components using a message queue allows the ingestion tier to continue processing updates even if the database is down.
This implements the loose coupling design principle.
2
Analyze the requirement for handling varying volumes of traffic and holiday spikes efficiently.
Implementing Amazon EC2 Auto Scaling allows the compute tier to scale dynamically with demand.
This implements the elasticity design principle, ensuring resources are only provisioned when needed.

Key Concept

AWS Cloud design principles: Loose Coupling and Elasticity
Question 290Question →

A logistics company is deploying a tracking application on a fleet of Amazon EC2 instances that requires access to a private Amazon DynamoDB table. Additionally, an external audit team needs temporary access to view the company's billing dashboards for a period of one week. Which of the following configurations should the administrator implement to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with DynamoDB access permissions and associate it with the EC2 instances using an instance profile.; Create an IAM role with billing read-only permissions that the external audit team can assume temporarily.

Answer

The correct configurations are to create an IAM role with DynamoDB access permissions for the EC2 instances, and to create an IAM role with billing read-only permissions that the external audit team can assume temporarily.
Creating an IAM role with DynamoDB access permissions and associating it with the EC2 instances allows the application to dynamically retrieve temporary credentials. Creating a separate IAM role with billing read-only permissions allows the external audit team to assume the role temporarily for the duration of the audit without possessing permanent user accounts.

Step-by-Step Solution

1
Evaluate the requirement for applications running on EC2 instances to access DynamoDB.
AWS security best practice dictates using IAM roles (attached via instance profiles) for application authentication rather than hardcoded long-lived credentials.
This prevents credentials leakage and automatically rotates temporary security credentials.
2
Evaluate the requirement to grant temporary access to external auditors for viewing billing dashboards.
Creating a dedicated IAM role for the third-party auditors to temporarily assume meets the security requirement.
This adheres to the principle of least privilege and avoids the need to share permanent root credentials or create long-term IAM users.

Key Concept

AWS Identity and Access Management (IAM) Roles and Access Control Best Practices
Estimated Time:1m 30s
Question 291Question →

A human resources software provider hosting its applications on AWS is undergoing an external compliance audit. The provider must officially accept a global Data Processing Addendum (DPA) with AWS and obtain the official ISO 27001 certification report for the underlying AWS data center infrastructure. Which AWS service should the provider use to satisfy both of these requirements?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact is the correct service because it serves as the central resource for retrieving AWS compliance reports and managing compliance agreements.
The correct option is AWS Artifact. AWS Artifact contains two main sections: AWS Artifact Reports, which provides on-demand downloads of AWS security and compliance reports (such as ISO certifications and SOC reports), and AWS Artifact Agreements, which allows customers to review and accept agreements (such as the Data Processing Addendum) on behalf of their AWS accounts.

Step-by-Step Solution

1
Identify the primary requirement: retrieving official AWS compliance documentation (ISO 27001 certification) and accepting a legal agreement (Data Processing Addendum) with AWS.
Recognize that these are standard compliance tasks involving AWS-managed infrastructure audits and terms of service.
AWS manages and audits its own physical infrastructure, providing these reports and agreements to customers for their compliance verification.
2
Evaluate the capabilities of AWS Artifact.
AWS Artifact Reports provides the ISO certification, and AWS Artifact Agreements allows accepting the Data Processing Addendum.
AWS Artifact is specifically designed as the self-service portal for compliance-related documents and agreements.

Key Concept

AWS Artifact is the self-service portal that provides on-demand access to AWS compliance reports and allows customers to accept agreements with AWS.
Question 292Question →

A cloud administrator needs to grant the same read-only permissions to ten new security analysts. Which AWS Identity and Access Management (IAM) feature should the administrator use to manage and apply these permissions to all ten analysts at once?

Show answer & explanation

Answer: IAM User Groups

Answer

IAM User Groups
IAM User Groups allow administrators to specify permissions for a collection of users. This makes it easy to manage permissions for multiple users at once, ensuring consistency and adhering to AWS best practices.

Step-by-Step Solution

1
Identify the goal: granting the same set of permissions to a collective set of individual IAM users (ten security analysts).
Determine that individual policy attachments are inefficient and error-prone.
Grouping users simplifies administrative overhead.
2
Evaluate the available IAM features for managing permissions for multiple users collectively.
Identify that IAM User Groups are designed specifically to attach permission policies to multiple users simultaneously.
IAM User Groups promote the best practice of managing permissions at the group level rather than the user level.

Key Concept

IAM User Groups are collections of IAM users that allow administrators to specify and manage permissions for multiple users easily.
Question 293Question →

A healthcare provider uses Amazon Simple Storage Service (Amazon S3) to store encrypted patient records. During a security audit, it is discovered that a bucket policy was improperly configured, allowing public read access to the records. Under the AWS Shared Responsibility Model, which of the following statements correctly identifies the party responsible for this configuration error and the reason?

Show answer & explanation

Answer: The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.

Answer

The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.
The correct answer states that the customer is responsible for configuring access control, bucket policies, and identity management. S3 is a managed object storage service, but under the AWS Shared Responsibility Model, the customer is always responsible for data access permissions and configuration (security 'in' the cloud).

Step-by-Step Solution

1
Analyze the service type and resource configuration described in the scenario.
The scenario involves Amazon S3 bucket policy configuration, which controls access to data stored in S3.
Identifying the resource and setting helps determine where it falls under the Shared Responsibility Model.
2
Determine the boundary between security 'of' the cloud and security 'in' the cloud.
AWS manages security 'of' the cloud (infrastructure, physical security, virtualization layer). The customer manages security 'in' the cloud (data classification, identity and access management, and configuration of resource policies).
Differentiating these boundaries shows that configuring S3 bucket access policies is a customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for configuring access controls and bucket policies for data stored in Amazon S3 (security 'in' the cloud), while AWS manages the underlying storage infrastructure (security 'of' the cloud).
Question 294Question →

An indie game development studio is launching a new multiplayer game. The studio wants its engineers to focus entirely on writing game code and designing player experiences, rather than spending time on racking, stacking, and powering physical servers. Which benefit of the AWS Cloud is directly demonstrated by this approach?

Show answer & explanation

Answer: Stop spending money running and maintaining data centers

Answer

Stop spending money running and maintaining data centers
The option describing 'Stop spending money running and maintaining data centers' is correct because AWS handles the physical infrastructure, power, cooling, and hardware maintenance, allowing the game studio to focus on their application code and customer experience.

Step-by-Step Solution

1
Analyze the business scenario and identify the core operational challenge.
The game studio wants to avoid the physical work of racking, stacking, cabling, and powering physical servers.
This physical infrastructure work represents the overhead of managing a physical data center.
2
Map the operational challenge to one of the six benefits of the AWS Cloud.
By using AWS, the studio offloads the management of physical infrastructure to AWS, which directly aligns with the benefit of not spending money running and maintaining data centers.
AWS manages the physical infrastructure, freeing up engineering resources to focus on business-differentiating tasks.

Key Concept

AWS Cloud Benefit: Stop spending money running and maintaining data centers
Question 295Question →

A media streaming company is deploying a serverless image processing pipeline using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Writing and securing the application code run within the Lambda functions; Managing the IAM execution roles and access policies assigned to the Lambda functions

Answer

The customer is responsible for writing and securing the application code run within the Lambda functions and managing the IAM execution roles and access policies assigned to the Lambda functions.
For serverless services like AWS Lambda, AWS manages the entire underlying execution environment, including the physical infrastructure, virtualization layer, operating system, and runtime. The customer retains control and responsibility for the application code written and deployed, as well as the Identity and Access Management (IAM) configurations, such as the execution roles that grant the function permissions to interact with other AWS resources.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
AWS Lambda is a serverless (managed) service.
The customer's responsibilities vary depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Serverless.
2
Apply the Shared Responsibility Model boundaries for serverless services.
AWS manages the physical infrastructure, virtualization, host operating system, and runtime. The customer manages application code, data, and access configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices against these boundaries.
Writing secure code and configuring IAM execution roles are customer responsibilities, whereas OS/runtime patching, physical security, and virtualization maintenance are AWS responsibilities.
This identifies the two correct customer-managed security actions.

Key Concept

Shared Responsibility Model for Serverless Services
Question 296Question →

A smart home IoT provider experiences significant daily fluctuations in data processing demands as users interact with their devices primarily during morning and evening hours. Additionally, the company runs a heavy data aggregation job once per month that lasts for 24 hours. The engineering team is transitioning this workload from an on-premises data center to AWS to optimize costs. Which of the following strategies represent correct applications of AWS cloud economics to minimize operational costs for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Utilizing EC2 Auto Scaling to automatically scale compute capacity in response to the daily morning and evening IoT traffic spikes, paying only for the resources consumed.; Using On-Demand or Spot Instances for the 24-hour monthly data aggregation job, rather than purchasing Reserved Instances that would remain idle for the rest of the month.

Answer

The correct strategies are utilizing EC2 Auto Scaling to dynamically adjust to daily traffic spikes, and using On-Demand or Spot Instances for the monthly 24-hour aggregation job.
The correct strategies align resource costs with usage patterns. Using Auto Scaling ensures the company only pays for active compute capacity during morning and evening IoT spikes. Similarly, using On-Demand or Spot Instances for the short 24-hour monthly workload avoids the continuous cost of Reserved Instances, which would otherwise sit idle for the vast majority of the month.

Step-by-Step Solution

1
Analyze the workload characteristics
Two distinct workloads exist: a daily fluctuating IoT workload with morning/evening peaks, and an intermittent 24-hour monthly workload.
Different workload patterns require different cost-optimization strategies in cloud economics.
2
Evaluate the daily fluctuating workload strategy
Elasticity is the best approach. Dynamic scaling matches resource supply with demand, avoiding overprovisioning costs.
Auto Scaling allows the company to transition from a fixed capacity model to a variable pay-as-you-go model.
3
Evaluate the monthly 24-hour workload strategy
On-Demand or Spot Instances are best because they only incur costs for the 24 hours of execution, whereas Reserved Instances would charge for unused hours.
Reserved Instances are designed for continuous, steady-state workloads (high utilization), not intermittent tasks.
4
Identify the correct choices
Selecting Auto Scaling for daily demand and On-Demand/Spot for the monthly job optimizes TCO.
These choices align with the pay-as-you-go pricing model and elastic resource provisioning.

Key Concept

Cloud economics principles emphasizing the shift from Capital Expenses (CapEx) to Operating Expenses (OpEx), leveraging elasticity to align resource supply with demand, and selecting correct pricing models based on workload utilization patterns.
Question 297Question →

A startup is designing a secure architecture on AWS. The security team wants to implement a solution that continuously monitors the AWS environment for unauthorized behavior, such as unusual API calls or potential database attacks. Additionally, they need to run automated scans on their container images to check for known software vulnerabilities before deployment. Which AWS services should the startup use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection, while Amazon Inspector provides automated vulnerability scanning for container images.
Amazon GuardDuty is the correct choice for threat detection because it continuously monitors log sources for malicious or unauthorized activities. Amazon Inspector is the correct choice for vulnerability management because it automatedly scans container images in Amazon ECR for software vulnerabilities.

Step-by-Step Solution

1
Identify the service responsible for continuous monitoring and active threat detection in the AWS environment.
Amazon GuardDuty is identified as the service that monitors logs (like CloudTrail and VPC Flow Logs) to detect unauthorized behavior and threats.
The requirement specifies the need to continuously monitor the AWS environment for unauthorized behavior.
2
Identify the service responsible for automated software vulnerability scanning of container images.
Amazon Inspector is identified as the service that scans container images in Amazon ECR for known vulnerabilities.
The requirement specifies the need to run automated scans on container images for software vulnerabilities.

Key Concept

AWS threat detection and vulnerability management services
Estimated Time:1m 0s
Question 298Question →

A gaming company, PixelQuest Games, wants to migrate its multiplayer matchmaking system to the AWS Cloud. The current matchmaking system is a monolithic application that suffers from scaling bottlenecks during peak tournament hours. To achieve dynamic scalability and high cost-efficiency, the company decides to split the monolith into microservices and rewrite the application code to run on serverless services such as AWS Lambda and Amazon DynamoDB. Which migration strategy is PixelQuest Games implementing?

Show answer & explanation

Answer: Refactoring

Answer

Refactoring
Refactoring (or Re-architecting) is the correct answer because PixelQuest Games is modifying the architecture by splitting a monolithic application into microservices and rewriting the code to utilize cloud-native, serverless components. This strategy is chosen to meet business requirements for scalability and cost-efficiency that cannot be achieved with the existing architecture.

Step-by-Step Solution

1
Analyze the business requirements and the architectural changes being made to the matchmaking application.
The company is breaking a monolithic application into microservices and rewriting the code to run on serverless services like AWS Lambda and Amazon DynamoDB.
Identifying the scope of changes helps determine which of the 6 Rs migration strategies is being applied.
2
Map these changes to the defined AWS migration strategies.
Modifying, re-architecting, or rewriting code to use cloud-native features such as serverless technology is defined as Refactoring (also known as Re-architecting).
This differentiates Refactoring from other strategies that do not involve code or architectural changes.

Key Concept

Cloud migration strategies (the 6 Rs), specifically Refactoring / Re-architecting.
Question 299Question →

A company needs to grant programmatic access to an external third-party Software-as-a-Service (SaaS) monitoring tool to read configuration metrics from their AWS account. The SaaS tool does not run on AWS infrastructure. According to AWS Identity and Access Management (IAM) best practices, which configuration should the administrator implement to grant this access?

Show answer & explanation

Answer: Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.

Answer

Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.
The correct option outlines the standard AWS security recommendation for granting third-party access. By configuring a cross-account IAM role, the third-party tool can obtain temporary security credentials to perform API actions. Requiring an external ID is a vital security best practice that prevents the 'confused deputy' problem in multi-tenant integrations.

Step-by-Step Solution

1
Analyze the access requirement for an external SaaS tool that does not run on AWS infrastructure.
The tool requires programmatic access to AWS APIs from outside the company's AWS environment.
Understanding the caller's origin is necessary to choose between identity federation, IAM users, or cross-account roles.
2
Evaluate the credentials policy for third-party access.
Using temporary credentials via IAM roles is identified as the secure, recommended method instead of sharing static, long-term access keys.
IAM roles allow the external entity to assume permissions dynamically, eliminating the need to store and rotate permanent access keys.
3
Define the relationship using a cross-account role with an external ID.
A trust relationship is configured between the customer account and the SaaS provider account, utilizing an external ID to mitigate the confused deputy vulnerability.
This establishes secure delegation of access specifically tailored for multi-tenant third-party SaaS integrations.

Key Concept

Cross-account IAM delegation and external ID best practices for third-party integrations
Question 300Question →

A retail company, Nova Retail, is planning the migration of its legacy inventory database to the AWS Cloud. Currently, the database is hosted on-premises on a virtual machine, and the operations team spends substantial effort on operating system patching, backups, and storage provisioning. To reduce this administrative burden, Nova Retail decides to migrate the database to Amazon Relational Database Service (Amazon RDS) for Oracle, keeping the database engine and the application code unchanged. Which migration strategy is Nova Retail executing for this database?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
The correct strategy is replatforming because the company is making a platform optimization—moving from a self-managed database to the fully managed Amazon RDS platform to reduce administrative tasks like patching and backups—while keeping the application code and database engine unchanged.

Step-by-Step Solution

1
Analyze the migration target and changes being made.
The target is Amazon RDS for Oracle, and the core application code and database engine remain unchanged.
Identifying the scope of changes helps distinguish between Rehost (no changes/EC2), Replatform (managed services/RDS), and Refactor (code changes).
2
Determine the cloud service model shift.
The database is moving from a self-managed environment (on-premises VM) to a fully managed service (Amazon RDS).
Moving to a managed service to reduce administrative tasks (like patching and backups) without changing the core application structure constitutes a platform optimization (tinkering).
3
Map the optimization to the 6 Rs migration strategies.
Since optimization is achieved by switching the platform to Amazon RDS without modifying application code, this is classified as Replatforming.
This matches the definition of Replatforming, which focuses on shifting to managed services to gain cloud benefits without re-architecting.

Key Concept

Identifying migration strategies (specifically Replatforming) when moving to managed services
PreviousPage 15 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin