Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 301Question →

A company hosts its customer database on an Amazon EC2 instance. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Installing security patches on the guest operating system

Answer

Installing security patches on the guest operating system
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud'. For Amazon EC2 (an Infrastructure as a Service offering), this includes configuration, updates, and security patching of the guest operating system. The correct option correctly identifies guest operating system patching as the customer's responsibility.

Step-by-Step Solution

1
Determine the service category for Amazon EC2
Amazon EC2 is classified as an Infrastructure as a Service (IaaS) offering.
IaaS services require the customer to perform administrative and configuration tasks starting from the operating system layer.
2
Distinguish between 'security in the cloud' and 'security of the cloud'
Guest operating system maintenance belongs to the customer ('security in the cloud'), whereas physical, hardware, and virtualization infrastructure security belongs to AWS ('security of the cloud').
This allocation defines the boundaries of the Shared Responsibility Model.

Key Concept

Shared Responsibility Model (IaaS Boundary)
Estimated Time:45s
Question 302Question →

A financial technology startup is developing a mobile payment application and decides to use Amazon Cognito User Pools for user identity management and authentication. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user pool; Configuring the app client settings and securing the client secrets used by the mobile application to interact with the user pool

Answer

Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user pool, and configuring the app client settings and securing the client secrets used by the mobile application to interact with the user pool.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon Cognito, this includes configuring security controls such as password policies, enabling multi-factor authentication (MFA), setting up app client credentials, and protecting application-side secrets. AWS handles the security 'of' the cloud, which includes physical host security, OS patching, database management, and service availability.

Step-by-Step Solution

1
Analyze the service model of Amazon Cognito.
Amazon Cognito is classified as a managed platform service. For managed services, AWS takes care of the underlying infrastructure, operating system, and platform layer, while the customer remains responsible for configuration, data classification, and access management.
Understanding the service type (IaaS vs. PaaS/Managed) is the first step in delineating responsibilities in the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities for Amazon Cognito.
The customer controls identity policy definitions (e.g., password strength, MFA enforcement) and user access parameters. Additionally, because the client application integrates with Cognito, securing the client credentials/secrets and configuring these integration clients falls on the customer.
Configuring security settings inside the service and securing customer-facing application integration are aspects of security 'in' the cloud.
3
Evaluate the AWS-side responsibilities for Amazon Cognito.
AWS handles physical security of the storage facilities, operating system updates for the servers running Cognito, and the database persistence/replication layer.
Infrastructure tasks, hardware maintenance, and physical security belong to security 'of' the cloud, handled by AWS.

Key Concept

Shared Responsibility Model for Managed Services
Question 303Question →

A company is designing a web application on AWS where the frontend and database communicate through an Amazon SQS queue. This configuration ensures that if the database becomes temporarily unavailable, the frontend can still receive requests and store them in the queue. Which AWS Cloud design principle is this company applying?

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling
The correct answer is loose coupling. By introducing a message queue between the frontend and database, the components are decoupled. This means the frontend does not need to wait for a direct response from the database to accept requests, protecting the frontend from crashing if the database is offline.

Step-by-Step Solution

1
Analyze the scenario details to identify the main architectural mechanism being used.
The components (frontend and database) interact via a message queue (Amazon SQS) instead of communicating directly and synchronously.
This shows that the components are decoupled from one another.
2
Identify the AWS design principle that describes minimizing dependencies between system components to prevent cascading failures.
Loose coupling is the design principle that advocates for independent components that interact through clear, well-defined interfaces like message queues.
By using a message queue, the failure of the database does not crash the frontend, which is the primary benefit of a loosely coupled design.

Key Concept

Loose coupling is a core design principle of the AWS Cloud that ensures components remain independent, thereby reducing the risk of a single point of failure and increasing the application's overall resilience.
Question 304Question →

A manufacturing firm, AeroParts, is preparing to migrate its IT portfolio to the AWS Cloud. The migration team has identified two workloads:

1. An on-premises web application database that they want to move to Amazon RDS to reduce database administration overhead, without changing the core application logic.
2. Several old testing servers that are no longer actively used by any department.

Which TWO migration strategies should the company use for these workloads?

Select all that apply

Show answer & explanation

Answer: Replatforming; Retiring

Answer

The correct strategies are Replatforming and Retiring.
Replatforming is the strategy of moving workloads to the cloud while making minor optimizations (like shifting to Amazon RDS to reduce database administration) without changing the core application logic. Retiring is the strategy of turning off or decommissioning IT systems that are no longer needed, such as the unused testing servers.

Step-by-Step Solution

1
Analyze the first workload, which involves moving a database to Amazon RDS (a managed service) without making changes to the application's core logic.
Identify that adopting a managed database service without changing application architecture corresponds to Replatforming.
Replatforming allows organizations to gain cloud benefits like managed services without a full rewrite.
2
Analyze the second workload, which consists of legacy testing servers that are no longer actively used.
Identify that decommissioning unused assets corresponds to Retiring.
Retiring helps organizations reduce costs by shutting down servers that are no longer needed.

Key Concept

Identifying AWS Cloud migration strategies (the 6 Rs), specifically Replatforming and Retiring.
Estimated Time:1m 0s
Question 305Question →

A global telecommunications provider is preparing for a regulatory audit of its customer portal. The compliance team must review the confidential AWS ISO 27001 Certification report to verify physical security, and ensure that the guest operating system patches are applied on their database running on Amazon EC2. Which combination of actions should the provider take to satisfy both requirements?

Show answer & explanation

Answer: Download the ISO 27001 Certification report through AWS Artifact after accepting the online non-disclosure agreement, and manage the guest operating system updates on the Amazon EC2 instances.

Answer

Download the ISO 27001 Certification report through AWS Artifact after accepting the online non-disclosure agreement, and manage the guest operating system updates on the Amazon EC2 instances.
The correct action is to download the confidential ISO 27001 Certification report through AWS Artifact, which requires accepting an online NDA, and to manage the guest operating system updates on the Amazon EC2 instances because under the AWS Shared Responsibility Model, patching the guest OS on an EC2 instance is the customer's responsibility.

Step-by-Step Solution

1
Identify the appropriate channel to retrieve confidential AWS compliance reports.
AWS Artifact is identified as the central portal for secure, on-demand download of AWS compliance documents, which requires accepting a non-disclosure agreement (NDA) before downloading confidential reports like the ISO 27001 Certification.
Confidential compliance reports are not publicly available or stored in operational logs like CloudTrail.
2
Determine the responsibility boundaries for patching the operating system of an Amazon EC2 instance under the AWS Shared Responsibility Model.
The customer is fully responsible for managing the guest operating system, including applying security patches and updates.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning AWS manages security 'of' the cloud (physical infrastructure, virtualization layer), while the customer is responsible for security 'in' the cloud (guest OS, applications, data).

Key Concept

Retrieving compliance documentation via AWS Artifact and applying the AWS Shared Responsibility Model to Infrastructure as a Service (IaaS) resources.
Estimated Time:1m 30s
Question 306Question →

A global e-commerce corporation is preparing for an annual security audit to verify compliance with payment card industry and international security standards. The compliance team needs to obtain AWS's formal compliance reports and verify the division of security obligations for their hosted databases. Which of the following actions should the team perform to meet these compliance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS SOC and PCI-DSS compliance reports directly from AWS Artifact; Review the AWS Shared Responsibility Model to identify which database security controls are managed by AWS versus the customer

Answer

Downloading AWS SOC and PCI-DSS compliance reports directly from AWS Artifact, and reviewing the AWS Shared Responsibility Model to identify which database security controls are managed by AWS versus the customer.
AWS Artifact provides on-demand access to AWS security and compliance reports, such as SOC and PCI-DSS documents. Additionally, reviewing the AWS Shared Responsibility Model helps organizations clarify their compliance boundaries by defining which database security controls are AWS's responsibility and which must be managed by the customer.

Step-by-Step Solution

1
Access AWS Artifact to retrieve official compliance documents.
The team obtains the required SOC and PCI-DSS compliance reports directly from the console.
AWS Artifact is the primary portal for retrieving AWS's compliance reports and agreements.
2
Consult the AWS Shared Responsibility Model to determine security boundaries.
The team distinguishes database security controls managed by AWS (like physical hardware security) from customer-managed controls (like database configuration).
The Shared Responsibility Model clearly defines security obligations between AWS and the customer.

Key Concept

AWS Compliance and Governance via AWS Artifact and the Shared Responsibility Model
Estimated Time:1m 30s
Question 307Question →

A gaming studio based in Japan plans to launch a multiplayer game for users in Europe and North America. To ensure low-latency gameplay, the studio deploys its game servers across multiple AWS Regions close to their players within a single afternoon, rather than purchasing physical infrastructure in overseas data centers.

Which AWS Cloud benefit is directly demonstrated by this gaming studio's deployment?

Show answer & explanation

Answer: Go global in minutes

Answer

Go global in minutes
The scenario describes a gaming company deploying resources to multiple AWS Regions globally to ensure players in different parts of the world experience low latency. This is a direct application of the 'Go global in minutes' benefit of the AWS Cloud.

Step-by-Step Solution

1
Analyze the gaming studio's deployment requirements.
The studio needs to deploy servers across multiple geographic regions (Europe and North America) to achieve low latency for international players.
Identifying the primary business and technical goal helps isolate the correct cloud benefit.
2
Evaluate the AWS Cloud benefits against the scenario.
Deploying resources globally in a short time frame directly aligns with the benefit of 'Go global in minutes'.
Matching the scenario to the official AWS Cloud benefits guarantees a correct conceptual mapping.

Key Concept

Go global in minutes
Question 308Question →

A startup specializing in satellite imagery analysis processes high-resolution images collected from orbital passes. The processing workloads are highly fluctuating: they require immense computational power for a few hours after a satellite passes, followed by long periods of idle time. The startup wants to transition away from their on-premises server infrastructure to optimize operations using AWS Cloud benefits. Which two of the following options describe how specific AWS Cloud benefits address the startup's operational challenges?

Select all that apply

Show answer & explanation

Answer: Trading capital expense for variable expense, which allows the startup to pay only for the compute resources consumed during active processing periods instead of investing heavily in upfront physical hardware.; Stopping guessing capacity, which eliminates the need to predict and pre-purchase physical infrastructure to handle peak processing workloads, allowing resources to scale dynamically based on demand.

Answer

Trading capital expense for variable expense and stopping guessing capacity are the correct benefits.
The correct options are those that identify trading capital expense for variable expense and stopping guessing capacity. Paying only for active compute usage directly aligns with trading capital expense for variable expense. Dynamically adjusting resources to match the incoming satellite data flow directly aligns with stopping guessing capacity.

Step-by-Step Solution

1
Analyze the workload pattern of the startup
The satellite imagery processing is highly fluctuating, requiring immense computational power during brief periods and remaining idle otherwise.
Understanding the workload demand patterns is necessary to align them with the correct cloud benefits.
2
Evaluate the financial benefit applicable to the workload pattern
Instead of purchasing physical hardware upfront (capital expense) that sits idle most of the time, paying only for compute capacity when active represents a variable expense.
This confirms the alignment with the benefit of trading capital expense for variable expense.
3
Evaluate the capacity management benefit applicable to the workload pattern
By leveraging dynamic scaling to handle the high-volume peaks without pre-provisioning physical infrastructure, the startup stops guessing capacity.
This confirms the alignment with the benefit of stopping guessing capacity.
4
Identify and eliminate incorrect distractor options based on common misconceptions
Distractors that misdefine elasticity, reverse CapEx/OpEx pricing models, or advocate for monolithic architectures are eliminated.
Eliminating invalid configurations ensures that only official AWS Cloud benefits are selected.

Key Concept

Benefits of the AWS Cloud
Question 309Question →

An enterprise is auditing its AWS environment. The audit team discovers that the development group shares a single set of IAM access keys to perform administrative actions. Additionally, the AWS account root user is frequently used to run daily database backup scripts. Which of the following actions should the security team take to remediate these security findings in accordance with AWS best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each developer, assign them to an IAM group with an administrative policy attached, and require multi-factor authentication (MFA) for console access.; Configure an IAM role with the required permissions for the database backup scripts, and assign this role to the Amazon EC2 instance running the database.

Answer

To remediate these issues, the security team should establish individual IAM users within an administrator group requiring MFA, and assign an IAM role to the EC2 instance hosting the database backup scripts.
Remediating administrative access requires implementing individual accountability. Creating individual IAM users, placing them into an administrative group, and enabling MFA ensures that administrative operations can be tracked and secured. For the backup scripts, assigning an IAM role directly to the EC2 instance allows it to retrieve temporary credentials automatically, removing both the root user dependency and the risk of exposing long-term access keys.

Step-by-Step Solution

1
Identify credentials risk for administrative staff.
Sharing a single set of IAM access keys prevents individual accountability and violates the principle of individual user identity.
Establishing individual IAM users mapped to groups with MFA enforces secure administrative access.
2
Identify credentials risk for the automated backup scripts.
Using the root user or root access keys for automated tasks presents an extreme security risk, as root access cannot be restricted.
Transitioning the script to use an IAM role attached to the EC2 instance provides secure, temporary credentials without hardcoded keys.
3
Map the remediation to AWS security best practices.
Select the options that implement individual IAM users/groups with MFA, and service roles for AWS compute resources.
This alignment ensures compliance with the principle of least privilege and credential safety.

Key Concept

Applying IAM identity best practices, securing the root account, using group-based permissions with MFA, and leveraging IAM roles for EC2 instances to avoid hardcoded credentials.
Question 310Question →

A gaming studio is deploying its multiplayer matchmaking service on AWS. The application experiences unpredictable peaks and valleys in player activity throughout the day. To optimize costs and maintain performance, the studio configures the system to automatically provision additional compute resources during peak hours and terminate them when player activity subsides.

Which AWS Cloud design principle is directly demonstrated by this design?

Show answer & explanation

Answer: Elasticity

Answer

Elasticity
Elasticity is the correct answer because it refers to the ability to scale resources dynamically matching supply to demand. The scenario describes a system that provisions resources during peak demand and decommissions them when demand drops, which is a classic implementation of elasticity.

Step-by-Step Solution

1
Analyze the business scenario and operational requirements.
The studio needs compute resources to automatically scale out when demand increases and scale in (terminate instances) when demand drops.
This bidirectional adjustment matches resource capacity with fluctuating demand to control costs.
2
Map this behavior to AWS Cloud design principles.
The ability to dynamically scale resources up and down to match demand is the definition of elasticity.
Elasticity allows users to pay only for the capacity they use, avoiding over-provisioning.

Key Concept

Elasticity in the AWS Cloud
Question 311Question →

A retail company is designing its access management strategy on AWS. The company needs to configure access for its application developers and an application running on an Amazon EC2 instance. Which of the following actions follow AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Organize developer IAM users into an IAM group and attach permissions policies directly to the group.; Attach an IAM role to the Amazon EC2 instance to grant the application temporary credentials for accessing other AWS resources.

Answer

Organizing developer IAM users into an IAM group and attaching permissions to the group, and attaching an IAM role to the Amazon EC2 instance to grant the application temporary credentials.
Organizing developer IAM users into an IAM group and attaching policies to the group makes permission management efficient and consistent. Attaching an IAM role to the Amazon EC2 instance ensures the application uses temporary, secure credentials rather than hardcoded secrets.

Step-by-Step Solution

1
Determine how to manage credentials for applications running on Amazon EC2 instances.
IAM roles should be used to provide temporary, automatically rotated security credentials to applications.
This avoids storing permanent, hardcoded access keys on the instance, which is a major security risk.
2
Determine how to manage permissions for multiple application developers.
IAM users should be added to an IAM group, and policies should be attached to the group rather than individual users.
This simplifies administration and ensures consistent permissions management as the team changes.
3
Examine the remaining options against the AWS Shared Responsibility Model and root account best practices.
Sharing root user credentials and expecting AWS to rotate customer access keys are flagged as incorrect.
The root user must not be shared for daily tasks, and managing IAM credentials falls under the customer's responsibility for security in the cloud.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Question 312Question →

A digital fitness platform offers live-streamed workout sessions to users. During peak morning and evening hours, traffic to the platform spikes significantly, while it remains minimal during the night. The platform's management wants to ensure the service remains responsive during peak hours without paying for idle server capacity during low-demand periods. Which of the following cloud computing benefits directly address these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trade capital expense for variable expense by paying only for the server resources consumed during active streaming hours.; Stop guessing capacity by dynamically scaling resources to match the fluctuating demand of workout sessions.

Answer

Trading capital expense for variable expense and stopping guessing capacity are the core benefits that allow a business to dynamically adjust to fluctuating demand without paying for idle capacity.
The platform has fluctuating demand (peak and low-demand hours) and wants to optimize spending. The benefit of 'stopping guessing capacity' allows the system to scale down when traffic is low. The benefit of 'trading capital expense for variable expense' ensures they pay only for the resources consumed during active periods, avoiding capital investments.

Step-by-Step Solution

1
Analyze the business scenario's requirements.
The platform needs to handle peak capacity without maintaining or paying for underutilized servers during off-peak hours.
This establishes the need for flexible, pay-as-you-go resource provisioning.
2
Evaluate the 6 core benefits of cloud computing against the requirements.
Stopping guessing capacity allows resources to scale with fluctuating demand, and trading capital expense for variable expense ensures costs match resource usage.
These benefits directly translate to eliminating upfront costs and matching infrastructure dynamically with user load.

Key Concept

AWS Cloud Benefits: Trade capital expense for variable expense, and Stop guessing capacity.
Question 313Question →

An educational technology (EdTech) company is expanding its online learning platform to serve school districts across Europe, Asia, and South America. Instead of renting space in physical colocation facilities and purchasing server racks in each region, the company deploys its web servers and databases using AWS infrastructure. This deployment enables the company to provide low-latency access to students globally within hours, while eliminating overhead costs such as facility power, cooling, and hardware maintenance.

Which of the following benefits of the AWS Cloud are directly demonstrated by this migration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes; Stop spending money running and maintaining data centers

Answer

The correct benefits demonstrated are 'Go global in minutes' and 'Stop spending money running and maintaining data centers'.
The scenario highlights two distinct benefits of migrating to AWS. First, deploying web servers and databases to serve school districts across Europe, Asia, and South America to achieve low-latency access within hours demonstrates the benefit of 'Go global in minutes'. Second, eliminating overhead costs such as facility power, cooling, and hardware maintenance demonstrates the benefit of 'Stop spending money running and maintaining data centers' because AWS manages the underlying physical infrastructure.

Step-by-Step Solution

1
Analyze the scenario to identify global deployment indicators.
The text states the company provides low-latency access to students across Europe, Asia, and South America within hours, which aligns with the global footprint capabilities of AWS.
Deploying workloads worldwide quickly using the AWS network structure is the definition of global reach in minutes.
2
Analyze the scenario to identify physical infrastructure indicators.
The text states the company eliminates overhead costs related to server racks, colocation, facility power, cooling, and hardware maintenance, which aligns with offloading physical management to AWS.
AWS manages physical data centers, removing the operational burden and costs from customers.
3
Evaluate the distractors against AWS core concepts.
The distractors represent incorrect cost concepts (trading variable for capital), incorrect architectural concepts (monolithic coupling), or incorrect elasticity concepts (manual provisioning for predictable workloads).
Eliminating options with incorrect definitions or reversed logic confirms the correct selections.

Key Concept

Define the benefits of the AWS Cloud
Estimated Time:1m 30s
Question 314Question →

A logistics company migrates its package tracking systems to AWS. Over time, the company notices that AWS frequently lowers its service pricing due to the collective resource usage of millions of customers. Which benefit of the AWS Cloud is directly demonstrated by these price reductions?

Show answer & explanation

Answer: Benefit from massive economies of scale

Answer

Benefit from massive economies of scale
The correct option is the one stating 'Benefit from massive economies of scale'. In AWS, the collective usage of millions of customers allows the cloud provider to achieve higher economies of scale. These savings are passed on to customers in the form of lower pay-as-you-go pricing.

Step-by-Step Solution

1
Analyze the business scenario described in the stem.
The scenario highlights a reduction in service pricing resulting from the aggregate usage of millions of customers on the AWS platform.
To identify which of the six AWS Cloud benefits corresponds to price reductions driven by high customer volume.
2
Match the scenario results with the official AWS Cloud benefits.
The benefit defined as achieving lower pay-as-you-go prices due to the aggregate usage of hundreds of thousands of customers is 'Benefit from massive economies of scale'.
To select the correct benefit that matches the mechanism of volume-based price reductions.

Key Concept

Massive economies of scale allow AWS to lower prices for customers due to high aggregate usage.
Question 315Question →

CloudySparks, a media blogging platform, needs to migrate its legacy content management system to AWS. The company has a tight deadline and wants to move the application to the cloud as quickly as possible without making any changes to its underlying architecture, code, or configuration. Which AWS migration strategy meets these requirements?

Show answer & explanation

Answer: Rehosting

Answer

Rehosting
Rehosting, commonly referred to as 'lift-and-shift', is the strategy that involves moving applications to the cloud exactly as they are, without making any modifications to the code, database, or architecture. This makes it the most suitable and fastest option for companies with tight timelines and zero tolerance for changes.

Step-by-Step Solution

1
Analyze the company's migration requirements and constraints.
The company requires a rapid migration with absolutely zero modifications to code, configuration, or architecture.
Understanding the constraints is necessary to narrow down the correct strategy among the 6 Rs.
2
Identify the migration strategy that moves workloads as-is to the cloud.
Rehosting (lift-and-shift) allows transferring the workload without any modifications.
Matching the requirements to the migration strategy definition reveals the correct choice.

Key Concept

AWS Cloud Migration Strategies (specifically Rehosting)
Question 316Question →

A financial analytics firm is deploying a containerized API using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team must define the security controls for which they are solely responsible. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the customer for this deployment?

Show answer & explanation

Answer: Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM roles

Answer

Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM roles
Under the AWS Shared Responsibility Model for AWS Fargate, the customer does not manage or access the underlying EC2 instances or host operating system. The customer is responsible for configuring application-level security, which includes security groups applied directly to the container tasks, and managing task-related access policies using IAM roles.

Step-by-Step Solution

1
Analyze the service type in the scenario
The deployment uses Amazon ECS with the AWS Fargate launch type, which is an abstraction layer (managed serverless container service).
Identifying Fargate as a managed/serverless service shifts the underlying host and infrastructure responsibilities from the customer to AWS.
2
Determine the boundary of customer responsibilities for AWS Fargate
The customer is responsible for container definitions, task execution IAM roles, application security groups, application code, data encryption, and identity management.
Since the customer does not have access to the underlying EC2 instances in Fargate, host-level management, host patching, and virtualization security are managed by AWS.
3
Evaluate the options against this boundary
The option to configure task-level security groups and IAM roles is a customer responsibility, while patching host operating systems, managing physical infrastructure isolation, and securing physical networks are AWS responsibilities.
Allows selecting the correct customer task and discarding AWS-managed tasks.

Key Concept

AWS Shared Responsibility Model for Container/Serverless Services (AWS Fargate)
Question 317Question →

A software development team is deploying a serverless API using AWS Lambda to process incoming customer orders. Under the AWS Shared Responsibility Model, which operational task is the responsibility of the customer?

Show answer & explanation

Answer: Writing and securing the application code deployed within the Lambda function

Answer

Writing and securing the application code deployed within the Lambda function
In the Shared Responsibility Model, AWS Lambda is a serverless service where AWS manages the underlying physical infrastructure, virtualization layer, operating system, and runtime. The customer remains responsible for writing, maintaining, and securing the actual application code that is executed within the function.

Step-by-Step Solution

1
Identify the AWS service type being used in the scenario.
AWS Lambda is a serverless (Function-as-a-Service) compute service.
The service type determines the boundary of responsibility under the Shared Responsibility Model.
2
Determine the customer's responsibility boundary for serverless services.
For serverless services, the customer's operational burden is reduced. The customer is responsible for data, IAM configurations, and the application code itself.
AWS manages the operating system, hardware, virtualization layer, and runtime environments for serverless offerings.
3
Evaluate the options against the customer's responsibility boundary.
Writing and securing the application code is a customer responsibility. Managing the OS, physical security, and runtimes are AWS responsibilities.
This identifies the correct option based on the defined shared responsibility boundaries.

Key Concept

Shared Responsibility Model for Serverless Services
Question 318Question →

A municipal utility provider is migrating its operations to AWS and must review the security compliance reports of the AWS physical data centers to satisfy local government auditing requirements. How can the provider obtain these official AWS compliance documents?

Show answer & explanation

Answer: Access the AWS Artifact portal to retrieve and download the AWS SOC and ISO reports.

Answer

Access the AWS Artifact portal to retrieve and download the AWS SOC and ISO reports.
AWS Artifact is a free, self-service portal that provides AWS customers with on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports and International Organization for Standardization (ISO) certificates.

Step-by-Step Solution

1
Identify the entity responsible for the physical security of the data centers.
Under the AWS Shared Responsibility Model, AWS is solely responsible for physical security and compliance of the cloud infrastructure.
This narrows the search to AWS-provided compliance reports rather than customer-driven scanning or logging.
2
Determine the appropriate AWS tool for downloading official compliance documents.
AWS Artifact is the self-service portal where customers can access and download security reports (like SOC and ISO certifications) and accept agreements.
This matches the requirement to obtain official compliance documents for third-party or governmental audits.

Key Concept

AWS Artifact provides on-demand access to AWS security and compliance reports.
Estimated Time:1m 0s
Question 319Question →

A genomic research institution is evaluating the migration of its DNA sequencing pipeline to the AWS Cloud. The pipeline runs highly resource-intensive, batch-processing jobs that vary wildly in demand, operating heavily for a few days a month and remaining idle otherwise. On-premises, the institution maintains a cluster of high-performance servers that are underutilized 80%80\% of the time. Which of the following represent the primary economic advantages of moving this workload to AWS? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The transition from a capital expense (CapEx) model of purchasing physical hardware to an operating expense (OpEx) model where costs align with actual analysis runtimes.; The capability to leverage elasticity by dynamically provisioning compute resources during active sequencing runs and terminating them when processing is complete, avoiding idle capacity costs.

Answer

The primary economic advantages are the transition from a capital expense model to an operating expense model, and the capability to leverage elasticity by dynamically provisioning and terminating compute resources based on active workloads.
Migrating the genomic sequencing workload to AWS allows the institution to transition from a capital expense model (purchasing physical servers) to an operating expense model (paying only for active runs). By leveraging cloud elasticity, they can dynamically provision compute instances for the short duration of active sequencing and terminate them immediately afterward, completely avoiding costs during the period when resources would otherwise sit idle on-premises.

Step-by-Step Solution

1
Analyze the workload demand pattern in the scenario.
The genomic pipeline has highly variable, batch-processing demand, running for only a few days a month and remaining idle the rest of the time.
Identifying the workload profile is necessary to determine which cloud economics concepts, such as elasticity, are applicable.
2
Evaluate the economic impact of shifting infrastructure acquisition models.
Eliminating the need to purchase physical hardware shifts costs from capital expenses (CapEx) to variable operating expenses (OpEx) that occur only during active analysis.
This maps directly to the cloud economic concept of trading capital expense for variable operating expense.
3
Evaluate how dynamic resource provisioning affects idle hardware costs.
By using elastic scaling, compute instances can be provisioned when sequencing begins and terminated when it ends, avoiding costs during the idle period.
This demonstrates the direct cost benefit of elasticity compared to provisioning fixed on-premises capacity.

Key Concept

Cloud economics benefits including CapEx to OpEx shift and elasticity.
Question 320Question →

A healthcare provider, Sanitas Health, is planning the migration of its IT systems to the AWS Cloud. The organization has decided to migrate its patient portal database from a self-managed database to Amazon RDS for PostgreSQL to reduce administrative tasks, without making any modifications to the application code. Additionally, they will decommission their on-premises archival application and replace it with a new Software-as-a-Service (SaaS) document management solution available on the AWS Marketplace. Which two AWS Cloud Migration strategies are being implemented in this scenario? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Replatforming, for the patient portal database migration; Repurchasing, for the archival application migration

Answer

Replatforming for the patient portal database and Repurchasing for the archival application.
The correct options are Replatforming (for the patient portal database) and Repurchasing (for the archival application). Replatforming involves modifying the platform on which the application runs—such as using Amazon RDS instead of a self-managed database—to optimize operation without rewriting application code. Repurchasing involves moving to a different product or service model, such as purchasing a SaaS solution from the AWS Marketplace to replace an on-premises system.

Step-by-Step Solution

1
Analyze the database migration strategy
The patient portal database is moved from a self-managed infrastructure to a managed database service (Amazon RDS) without modifying the application code.
This lift-tinker-and-shift pattern matches Replatforming, where database management tasks are offloaded to AWS while keeping the core application the same.
2
Analyze the archival application migration strategy
The on-premises archival application is decommissioned and replaced with a Software-as-a-Service (SaaS) solution from the AWS Marketplace.
This drop-and-shop pattern matches Repurchasing, which involves changing the software licensing model or vendor for a cloud-managed SaaS offering.

Key Concept

Identifying AWS cloud migration strategies (Replatforming and Repurchasing) based on organizational migration requirements.
Estimated Time:1m 30s
PreviousPage 16 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin