Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 321Question →

A healthcare organization hires a new compliance officer who needs permanent, individual access to log into the AWS Management Console to review compliance reports. Which AWS Identity and Access Management (IAM) entity should be created to grant this access?

Show answer & explanation

Answer: An IAM user

Answer

An IAM user
An IAM user is the correct entity to create because it represents a specific person or service that requires permanent credentials to interact with AWS, such as logging into the AWS Management Console.

Step-by-Step Solution

1
Identify the access requirement, which is a new permanent employee (compliance officer) needing individual login credentials to the AWS Management Console.
The scenario requires permanent, individual credentials rather than temporary or shared access.
Understanding the nature of the worker's access requirement determines whether an IAM user or IAM role is appropriate.
2
Evaluate the AWS security best practices for daily operational access.
Individual IAM users should be created for daily tasks, and root user usage should be restricted.
Applying the principle of least privilege and administrative isolation secures the account.

Key Concept

AWS Identity and Access Management (IAM) Entities
Estimated Time:45s
Question 322Question →

A financial services firm wants to modernize its transaction auditing system. The technical lead recommends using separate microservices that communicate asynchronously and ensuring that test environments can be easily created and destroyed using automated scripts.

Which of the following AWS Cloud design principles do these recommendations demonstrate? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Loose coupling; Disposable resources

Answer

The correct design principles demonstrated are loose coupling and disposable resources.
The correct answers are loose coupling and disposable resources. Loose coupling is shown by using separate microservices communicating asynchronously, which prevents failures in one service from bringing down others. Disposable resources is shown by using automated scripts to easily create and destroy test environments, which simplifies environment replication.

Step-by-Step Solution

1
Analyze the first recommendation to use separate microservices that communicate asynchronously.
This matches loose coupling, as asynchronous communication decouples the components so they do not depend directly on each other's immediate availability.
Loose coupling is a fundamental AWS design principle to prevent single points of failure from impacting the entire system.
2
Analyze the second recommendation to easily create and destroy test environments using automated scripts.
This matches disposable resources, which encourages treating infrastructure as temporary and automated rather than static and manual.
Using disposable resources allows teams to rapidly iterate, test, and maintain consistency across environments without configuration drift.

Key Concept

AWS Cloud design principles promote system flexibility, scalability, and resiliency through practices like loose coupling (decoupling components) and utilizing disposable resources (using automation to spin up and tear down environments).
Question 323Question →

An organization is configuring a secure network architecture on AWS with public-facing web servers and a private database tier. To meet strict compliance guidelines, the security team must implement a layered defense-in-depth strategy. They need to understand how Security Groups and Network Access Control Lists (Network ACLs) behave when filtering traffic across these tiers.

Which of the following statements accurately describe the behavior and configuration of Security Groups and Network ACLs in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning that if an inbound HTTP request is allowed on port 80, the outbound response traffic is automatically allowed regardless of outbound security group rules.; Network ACLs are stateless, requiring explicit rules in both directions (inbound and outbound) to allow traffic to flow between subnets.

Answer

Security groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit inbound and outbound rules).
Security groups operate at the instance level and are stateful. When inbound traffic is allowed, corresponding outbound traffic is permitted automatically. Conversely, Network ACLs operate at the subnet level and are stateless, meaning return traffic must be explicitly permitted by a rule in the opposite direction.

Step-by-Step Solution

1
Examine the operational boundary and stateful tracking of Security Groups.
Security groups operate at the instance level (Elastic Network Interface) and automatically track connection states, allowing return traffic regardless of outbound rules.
This identifies the stateful traffic rule for Security Groups.
2
Examine the operational boundary and stateless behavior of Network ACLs.
Network ACLs operate at the subnet boundary and do not track connection states, requiring separate rules for inbound and outbound traffic.
This identifies the stateless traffic rule for Network ACLs.
3
Verify responsibility boundaries for security configurations.
Defining rules in Security Groups and Network ACLs falls under the customer's responsibility (Security in the Cloud).
This eliminates the choice regarding AWS configuring customer Network ACLs.
4
Evaluate the role of monitoring and vulnerability detection tools.
Amazon Inspector checks hosts/images for vulnerabilities and does not act as an automated network traffic filter.
This rules out using Amazon Inspector for active Network ACL block automation.

Key Concept

Statefulness versus statelessness and subnet-level versus instance-level enforcement of AWS network security controls.
Question 324Question →

A healthcare startup needs to verify its compliance posture by reviewing official security documentation and accepting a Business Associate Addendum (BAA) with AWS. Which of the following actions can the startup perform using AWS Artifact to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download AWS compliance reports, such as ISO certifications and SOC reports.; Review and accept agreements with AWS, such as the Business Associate Addendum (BAA).

Answer

The correct options are downloading AWS compliance reports (such as ISO certifications and SOC reports) and reviewing and accepting agreements with AWS (such as the Business Associate Addendum).
AWS Artifact is a self-service compliance portal. It allows customers to download AWS security and compliance documents (such as ISO certifications and SOC reports) and to review and accept agreements with AWS (such as the Business Associate Addendum needed for HIPAA compliance).

Step-by-Step Solution

1
Identify the AWS service that provides on-demand access to compliance documents and agreements.
AWS Artifact is the central portal for AWS compliance reports and agreements.
AWS Artifact is specifically designed to provide access to security documents and to allow accepting agreements like the Business Associate Addendum (BAA).
2
Determine which options correspond to the capabilities of AWS Artifact.
Downloading ISO/SOC reports and accepting agreements (like HIPAA BAA) are core features of AWS Artifact, whereas vulnerability scanning, API auditing, and physical security management are handled by Amazon Inspector, AWS CloudTrail, and AWS respectively.
This isolates the correct AWS Artifact features from other security services and shared responsibility boundaries.

Key Concept

AWS Artifact capabilities and compliance reporting
Question 325Question →

An organization hosts a multi-tier web application where Amazon EC2 instances in a private subnet receive traffic from a public-facing Application Load Balancer (ALB). The security team configures the EC2 instances' Security Group to allow inbound HTTP traffic on port 80 only from the ALB's Security Group, and allowed all outbound traffic. At the subnet level, the Network ACL (NACL) is modified to allow inbound HTTP traffic on port 80 from the ALB's private IP range, and allow outbound HTTP traffic on port 80 to the ALB's private IP range, with all other traffic blocked by default rules. Users report receiving 502 Bad Gateway errors from the ALB. Which configuration change is required to resolve this issue and allow successful traffic flow?

Show answer & explanation

Answer: Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).

Answer

Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).
The correct option is to modify the subnet's outbound Network ACL to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535). Because Network ACLs are stateless, return traffic from the EC2 instances back to the ALB must be explicitly allowed. A client connection (from the ALB) uses a random ephemeral port to initiate the request, meaning the EC2 instance must reply to a destination port in the 1024-65535 range rather than port 80.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups.
Since the security group allows inbound traffic on port 80, return traffic is automatically tracked and allowed outbound at the instance layer without additional outbound rules.
Security Groups operate at the instance level and are stateful.
2
Analyze the stateless nature of Network ACLs.
Subnet-level Network ACLs do not track connection states. For any allowed inbound request, the corresponding return traffic must be explicitly permitted in the outbound rules.
Network ACLs operate at the subnet level and are stateless.
3
Determine the destination port of the return traffic.
When a client (the ALB) establishes a TCP connection to a server (the EC2 instance on port 80), the client uses a temporary, high-numbered port known as an ephemeral port (typically 1024-65535) to receive the response.
TCP return connections are directed to the client's ephemeral port, not the service port.
4
Identify the misconfiguration and correct it.
The current outbound Network ACL only allows outbound traffic on port 80, causing the return packets destined for the ALB's ephemeral ports to be blocked by the default deny rule. Allowing outbound traffic to the ALB's IP range on ports 1024-65535 resolves the issue.
Explicitly permitting ephemeral port traffic in the outbound Network ACL is mandatory for stateless return path communications.

Key Concept

The stateful behavior of Security Groups versus the stateless behavior of Network ACLs, and the requirement of ephemeral ports for return traffic in stateless configurations.
Estimated Time:2m 0s
Question 326Question →

A retail company runs its e-commerce website on several Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of AWS?

Show answer & explanation

Answer: Decommissioning and physically destroying retired storage hardware

Answer

Decommissioning and physically destroying retired storage hardware
Decommissioning and physically destroying retired storage hardware is the correct answer because physical security, infrastructure maintenance, and hardware disposal are part of security 'of' the cloud, which is the sole responsibility of AWS.

Step-by-Step Solution

1
Analyze the service type in the scenario
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, where the customer manages the operating system, applications, and data, while AWS manages the physical infrastructure, virtualization hypervisor, and hardware.
Identifying the service type determines the boundary of responsibilities between the customer and AWS.
2
Evaluate the operational tasks against the Shared Responsibility Model
Physical hardware disposal and destruction belong to the security 'of' the cloud (managed by AWS). Configuring firewalls (security groups), patching the guest OS, and application compliance belong to security 'in' the cloud (managed by the customer).
Differentiating between security of the cloud and security in the cloud allows us to select the task owned by AWS.

Key Concept

Shared Responsibility Model
Estimated Time:45s
Question 327Question →

A smart-vehicle manufacturer is launching an autonomous fleet management platform on AWS. To meet regional regulatory requirements, the manufacturer's legal department must execute a Business Associate Addendum (BAA) with AWS, and the risk assessment team must download the ISO/IEC 27001 certification report for the AWS physical infrastructure. Which AWS resource should the manufacturer use to accept this online agreement and retrieve the required certification?

Show answer & explanation

Answer: AWS Artifact, which provides on-demand access to AWS security and compliance reports and allows customers to accept online agreements.

Answer

AWS Artifact, which provides on-demand access to AWS security and compliance reports and allows customers to accept online agreements.
AWS Artifact is the primary portal for retrieving AWS's independent compliance reports (such as ISO/IEC 27001 and SOC reports) and formally accepting online agreements (such as the Business Associate Addendum) on behalf of AWS accounts.

Step-by-Step Solution

1
Identify the service that acts as a central repository for AWS's third-party compliance reports.
AWS Artifact is the correct portal to download AWS's independent security audits, such as ISO/IEC 27001 certifications.
AWS Artifact is designed specifically to share AWS compliance documents with customers on demand.
2
Determine the portal where customers can review and accept online agreements like the Business Associate Addendum (BAA).
AWS Artifact Agreements allows customers to accept and manage agreements for single accounts or across AWS Organizations.
AWS Artifact serves both compliance report retrieval and agreement management needs.

Key Concept

AWS compliance reports and agreements portal
Question 328Question →

A startup in the hospitality sector is launching a vacation rental booking application. The company wants to eliminate the need for upfront capital investments in physical servers and instead pay only for the compute resources they consume on a pay-as-you-go basis. Which AWS Cloud benefit is this startup leveraging, and what is its financial impact?

Show answer & explanation

Answer: Trading fixed expense for variable expense, which shifts costs from capital expenses (CapEx) to operating expenses (OpEx).

Answer

Trading fixed expense for variable expense, which shifts costs from capital expenses (CapEx) to operating expenses (OpEx).
The correct answer is trading fixed expense for variable expense, which shifts costs from capital expenses (CapEx) to operating expenses (OpEx). By using AWS, the company avoids the upfront capital investments associated with purchasing and maintaining physical servers (CapEx) and instead pays only for resources consumed as an ongoing operational cost (OpEx).

Step-by-Step Solution

1
Analyze the financial requirements of the hospitality startup in the scenario.
The startup wants to eliminate upfront capital costs for physical hardware and pay only for actual compute resource usage on a pay-as-you-go basis.
This identifies the transition from high upfront costs to dynamic, usage-based pricing.
2
Map the financial transition to the standard AWS Cloud benefits and accounting models.
Avoiding upfront server purchases corresponds to reducing Capital Expenditures (CapEx), while paying as you go maps to Operating Expenditures (OpEx). This matches the AWS Cloud benefit of 'trading fixed expense for variable expense'.
This differentiates the correct financial mechanism from other benefits like scalability or global deployment.

Key Concept

Trading fixed expense for variable expense (CapEx vs. OpEx)
Estimated Time:1m 30s
Question 329Question →

A financial services company is setting up its application environment on AWS. The environment will consist of developers who need to configure resources and applications running on Amazon EC2 instances that need to retrieve data from Amazon S3. Which two of the following actions align with AWS-recommended security best practices for managing identity and access in this scenario?

Select all that apply

Show answer & explanation

Answer: Configure an IAM role with the required Amazon S3 access permissions and attach it to the Amazon EC2 instances.; Enable Multi-Factor Authentication (MFA) on the AWS account root user and restrict its use to only essential account management tasks.

Answer

The correct practices are configuring an IAM role with S3 permissions for the EC2 instances, and enabling MFA on the root user while restricting its daily usage.
Configuring an IAM role for EC2 instances allows applications to securely access Amazon S3 using temporary, auto-rotated credentials. Additionally, securing the root user with Multi-Factor Authentication (MFA) and restricting its use to essential tasks protects the account from unauthorized administrative actions.

Step-by-Step Solution

1
Evaluate application-to-service access requirements.
Identify that applications running on Amazon EC2 need to access Amazon S3. AWS best practice is to assign roles with temporary credentials rather than hardcoding static access keys.
This limits the risk of credential leakage and simplifies secret rotation.
2
Evaluate root account management policies.
Identify that the AWS account root user must be secured with Multi-Factor Authentication (MFA) and restricted from daily operations.
This protects the account from unauthorized administrative actions since root privileges cannot be limited.
3
Evaluate shared responsibility boundaries.
Understand that customer operating system user permissions inside EC2 instances are managed by the customer, not AWS.
This ensures the security configuration matches the company's internal compliance requirements.

Key Concept

AWS IAM security best practices, including temporary credentials via roles and root user protection.
Question 330Question →

A multiplayer gaming startup is redesigning its matchmaking and live tournament leaderboard system. The system experiences high, unpredictable spikes in traffic during weekend tournaments, but remains mostly idle during weekdays. The company wants to redesign the system to align with the AWS Cloud design principles of 'loose coupling' and 'services, not servers' to minimize operational overhead and handle failures gracefully. Which of the following architectural decisions best implement these design principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Buffer incoming matchmaking requests using Amazon Simple Queue Service (Amazon SQS) and process them asynchronously using AWS Lambda.; Store real-time tournament leaderboard data in Amazon DynamoDB and use DynamoDB Streams to automatically trigger downstream notification functions.

Answer

The correct choices are the option to buffer requests using Amazon SQS and process them using AWS Lambda, and the option to store data in Amazon DynamoDB and use DynamoDB Streams to trigger notifications.
The option to buffer matchmaking requests with Amazon SQS and process them with AWS Lambda aligns with 'loose coupling' by inserting a message queue between request submission and processing, and with 'services, not servers' by utilizing serverless computing. Similarly, using Amazon DynamoDB and DynamoDB Streams to trigger Lambda functions uses fully managed services ('services, not servers') and integrates them asynchronously ('loose coupling').

Step-by-Step Solution

1
Identify the target design principles ('services, not servers' and 'loose coupling') and the operational goals (minimizing operational overhead, handling spikes, and graceful failure).
Recognized that the solution must use serverless managed services and asynchronous, event-driven components.
This establishes criteria to evaluate which architectures avoid managing virtual servers and reduce tight runtime dependencies.
2
Analyze each option to determine if it uses serverless managed services (services, not servers) and minimizes direct inter-component dependencies (loose coupling).
Identified that Amazon SQS, AWS Lambda, and Amazon DynamoDB are managed serverless offerings that can integrate asynchronously.
This helps filter out traditional, server-based, or tightly coupled monolithic architectures.
3
Verify that the selected options (asynchronous processing via Amazon SQS and AWS Lambda, and event-driven updates via Amazon DynamoDB Streams) implement these principles.
Confirmed both options decouple components and shift infrastructure management to AWS.
Ensures that the final selection directly addresses all constraints in the scenario.
4
Confirm that the distractors rely on self-managed EC2 servers, monolithic synchronous architectures, or over-provisioning, which violate the target cloud design principles.
Validated that options using fixed EC2 capacity, monolithic single-instance deployment, or synchronous APIs are anti-patterns.
Guarantees that the wrong options are incorrect for reasons aligned with the AWS Cloud design principles.

Key Concept

Loose coupling and services, not servers are fundamental AWS design principles. Loose coupling reduces inter-dependencies between components, preventing cascading failures and allowing independent scaling. Services, not servers helps customers focus on application logic rather than managing infrastructure.
Question 331Question →

A financial technology company wants to continuously monitor its AWS accounts for malicious activity and unauthorized behavior. The company needs a service that can analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to detect issues like compromised EC2 instances or unauthorized API calls. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
The correct service is Amazon GuardDuty because it is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes metadata from AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify threats like compromised credentials, communication with known malicious IPs, or anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to continuously monitor AWS accounts for malicious activity, unauthorized behavior, and potential threats by analyzing CloudTrail event logs, VPC Flow Logs, and DNS logs.
Understanding the source data (logs) and the desired outcome (threat detection) allows for the selection of the correct specialized security service.
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty is the specific service designed for intelligent threat detection via log analysis, whereas Amazon Inspector is for vulnerability scanning, AWS CloudTrail is for logging API calls, and AWS Shield is for DDoS protection.
Differentiating between vulnerability management, logging, protection, and threat detection determines the correct tool.

Key Concept

Intelligent threat detection using log analysis
Question 332Question →

A logistics software provider is explaining the financial advantages of cloud migration to its stakeholders. The provider highlights that because AWS aggregates usage from hundreds of thousands of customers, it can achieve higher purchasing power and pass these savings back to customers in the form of lower pay-as-you-go prices. Which benefit of the AWS Cloud is the provider describing?

Show answer & explanation

Answer: Benefit from massive economies of scale

Answer

Benefit from massive economies of scale
The correct answer is the option describing 'Benefit from massive economies of scale'. AWS can build and operate data centers more efficiently and purchase hardware in larger volumes due to the aggregated demand of hundreds of thousands of customers, passing these operational savings back to customers through regular price cuts.

Step-by-Step Solution

1
Analyze the financial savings mechanism presented in the scenario.
The scenario describes AWS aggregating customer usage to achieve higher purchasing power, which results in lower pay-as-you-go pricing for customers.
Understanding the core economic driver in the scenario allows matching it to one of the six benefits of cloud computing.
2
Evaluate the choices against official AWS Cloud benefits.
The benefit of achieving lower unit costs through aggregated customer volume matches the definition of 'Benefit from massive economies of scale'.
This identifies the correct conceptual benefit and distinguishes it from other concepts like trading capital expenses or capacity planning.

Key Concept

Define the benefits of the AWS Cloud
Question 333Question →

A financial services startup is planning to launch a new mobile application. The company wants to avoid purchasing physical servers and wants to focus its engineering resources on writing application code rather than managing data center infrastructure. Which of the following benefits of the AWS Cloud directly support this strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trade fixed expense for variable expense; Stop spending money running and maintaining data centers

Answer

Trading fixed expense for variable expense, and stopping spending money running and maintaining data centers
The correct benefits are trading fixed expense for variable expense, which allows the startup to avoid upfront hardware investments, and stopping spending money running and maintaining data centers, which lets the engineering team focus on writing code rather than racking servers and managing infrastructure.

Step-by-Step Solution

1
Identify the startup's requirements
The startup wants to avoid upfront costs for physical servers (which represents trading fixed expense for variable expense) and wants to focus on coding rather than managing data center infrastructure (which represents stopping spending money running and maintaining data centers).
Understanding the key business constraints helps map them to the 6 benefits of cloud computing.
2
Evaluate the choices against the 6 benefits of the AWS Cloud
Trading fixed expense for variable expense and stopping spending money running and maintaining data centers are direct benefits that map to the startup's goals. Confusing CapEx/OpEx, avoiding scalability, and building monolithic designs are incorrect patterns.
Matches the scenario's goals directly to AWS cloud benefits.

Key Concept

Benefits of the AWS Cloud
Estimated Time:1m 0s
Question 334Question →

A company is migrating its relational database to Amazon RDS (Relational Database Service) to reduce operational overhead. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring database-level user access and permissions; Enabling encryption at rest for the database instances

Answer

Configuring database-level user access and permissions AND Enabling encryption at rest for the database instances
Under the AWS Shared Responsibility Model for Amazon RDS, the customer is responsible for security 'in' the cloud. This includes configuring database-level user access and permissions to control access to the data, and enabling data encryption features (such as encryption at rest). AWS, on the other hand, is responsible for security 'of' the cloud, which includes managing the underlying physical infrastructure, virtualization layer, and OS-level patching.

Step-by-Step Solution

1
Identify the AWS service and its type in the Shared Responsibility Model.
Amazon RDS is a managed service (PaaS-like database service), which offloads operating system and database engine maintenance to AWS.
Understanding the service type helps determine the boundary of responsibilities between AWS and the customer.
2
Evaluate the proposed tasks against customer-side responsibilities (security 'in' the cloud) for Amazon RDS.
Configuring database-level user permissions and enabling encryption at rest are customer responsibilities. Tasks like OS patching, hardware replacement, and hypervisor updates are handled by AWS.
To select the correct options, we must classify each task as either the customer's or AWS's responsibility.

Key Concept

Shared Responsibility Model for Managed Services (PaaS)
Estimated Time:1m 0s
Question 335Question →

A logistics company is onboarding a new shipping partner that requires proof of AWS's ISO 9001 compliance. Which AWS service should the company use to download the required audit reports and certifications?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the correct service because it serves as the central, self-service portal for downloading AWS compliance reports, including SOC reports, PCI DSS agreements, and ISO certifications.

Step-by-Step Solution

1
Identify the business requirement for obtaining AWS's third-party audit reports and compliance certificates.
The requirement is to retrieve official certifications (such as ISO 9001) for AWS infrastructure.
This determines which type of service or portal is needed to retrieve official security documentation.
2
Select the specific AWS tool designed as a central repository for compliance documentation.
AWS Artifact is the designated portal providing on-demand access to AWS compliance reports.
AWS Artifact allows customers to download compliance documents to share with auditors or business partners.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports and agreements.
Estimated Time:45s
Question 336Question →

A smart-home IoT device manufacturer is preparing for a security audit of its database systems. The compliance team must review AWS physical infrastructure security controls via a SOC 2 report and verify who is responsible for patching the guest operating systems on their Amazon EC2 instances. Which of the following actions should the company take to meet these compliance and operational requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS SOC 2 report from AWS Artifact.; Apply security patches to the guest operating systems of the Amazon EC2 instances.

Answer

Downloading the AWS SOC 2 report from AWS Artifact and patching the guest operating systems on the Amazon EC2 instances.
The correct actions are downloading the compliance reports directly from AWS Artifact and taking responsibility for patching the guest operating system on EC2 instances. AWS Artifact is the self-service portal for AWS compliance reports, and under the Shared Responsibility Model, patching the guest operating system of EC2 instances is the customer's responsibility.

Step-by-Step Solution

1
Identify where third-party compliance reports are stored and retrieved in AWS.
Determine that AWS Artifact is the central portal for downloading reports like SOC 2.
AWS Artifact provides on-demand, self-service access to AWS compliance documentation.
2
Analyze the division of patching responsibilities for Amazon EC2 instances under the Shared Responsibility Model.
Identify that AWS patches the physical host and hypervisor, while the customer patches the guest operating system.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, giving the customer full control and responsibility over the operating system.

Key Concept

AWS compliance reports retrieval via AWS Artifact and the division of patching responsibilities under the Shared Responsibility Model.
Question 337Question →

A logistics company wants to secure its cloud infrastructure. The development team needs a service to automatically scan their container images in Amazon Elastic Container Registry (ECR) for known software vulnerabilities. At the same time, the security team needs a service to continuously monitor their AWS accounts for malicious activity and unauthorized behavior. Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty are the correct services for vulnerability scanning of container images and intelligent threat detection, respectively.
Amazon Inspector is correct because it is the AWS service that automatically discovers and scans workloads, including Amazon ECR container images, for software vulnerabilities. Amazon GuardDuty is correct because it continuously monitors AWS accounts, workloads, and data for malicious activity and anomalies, such as credential compromise or data exfiltration.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning in Amazon ECR.
Amazon Inspector is identified as the AWS service designed to automatically scan container images in Amazon ECR for known vulnerabilities.
This matches the development team's need to check their software packages and dependencies.
2
Identify the requirement for continuous threat detection and monitoring for malicious activity.
Amazon GuardDuty is identified as the intelligent threat detection service that monitors AWS accounts and workloads for anomalous behavior.
This matches the security team's need to identify potential threats and unauthorized actions.

Key Concept

AWS threat detection and vulnerability management services
Question 338Question →

BookHaven Networks, a public library system, plans to migrate its legacy catalog database to the AWS Cloud. The migration team wants to move the database as quickly as possible with minimal effort, without modifying the database code or its operational characteristics. Which of the following represents the correct migration strategy and a key benefit for this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The migration team should use the Rehosting strategy.; A benefit of this strategy is the minimization of migration time and effort.

Answer

The migration team should use the Rehosting strategy, and a benefit of this strategy is the minimization of migration time and effort.
The correct choices are using the Rehosting strategy and minimizing migration time and effort as a benefit. Rehosting (lift-and-shift) allows an organization to migrate workloads to the cloud as-is, without code or architecture alterations, making it the fastest and least effort-intensive strategy. This aligns perfectly with the requirements to migrate the library database quickly with no modifications.

Step-by-Step Solution

1
Analyze the scenario constraints: the library wants to migrate a database quickly, with minimal effort, and without modifying any code.
This points to a migration strategy that does not alter the application architecture or code.
Identifying the constraints narrows down the 6 Rs migration strategies.
2
Evaluate the migration strategies: Rehosting (lift-and-shift) fits this because it transfers the database as-is, whereas Replatforming and Refactoring require changes.
The correct strategy is Rehosting.
Rehosting is the only strategy that requires no modifications to the code or architecture.
3
Determine the primary benefit of Rehosting and assess cost models.
The benefit is minimizing time and effort. Shifting to the cloud changes costs from CapEx to OpEx, not OpEx to CapEx.
This identifies the correct benefit and rules out the incorrect economic benefit description.

Key Concept

AWS Cloud Migration Strategies (Rehosting) and Cost Benefits
Question 339Question →

A financial technology company is launching a new international remittance application. The company must deploy its services in multiple geographic regions to provide a low-latency experience for users worldwide. Furthermore, transaction traffic is highly unpredictable, with extreme surges during holidays and minimal traffic during off-peak hours. The company wants to avoid both over-provisioning infrastructure and managing physical data centers. Which of the following benefits of the AWS Cloud directly align with the company's requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes, allowing the deployment of the application in multiple AWS Regions worldwide to minimize latency for users.; Stop guessing capacity, enabling the application to automatically scale resources in or out based on real-time transaction volume.

Answer

The correct answers are the benefits to go global in minutes and to stop guessing capacity.
Deploying application endpoints globally to reduce latency for international users is the core definition of the AWS benefit 'Go global in minutes'. Automatically adjusting resource levels in response to variable transaction volume instead of over-provisioning infrastructure corresponds to the AWS benefit of 'Stop guessing capacity'. Together, these two benefits directly address the startup's requirements.

Step-by-Step Solution

1
Analyze the requirement to deploy services globally with low latency.
Deploying the application in multiple geographic regions to reduce latency for international users aligns with the benefit 'Go global in minutes'.
AWS infrastructure allows deployment across multiple global regions in minutes.
2
Analyze the requirement to handle highly unpredictable, fluctuating traffic without over-provisioning.
Scaling resources dynamically to match actual demand rather than provisioning for maximum expected peak capacity aligns with the benefit 'Stop guessing capacity'.
Elasticity allows resources to adjust automatically to match workload variations.
3
Identify the incorrect options based on cloud concepts and economics.
Trading variable expenses for capital expenses is the reverse of AWS economics. Monolithic architectures are contrary to AWS design best practices. Static peak capacity planning is inefficient and directly opposes stopping guessing capacity.
This leaves the correct options as going global in minutes and stopping guessing capacity.

Key Concept

Benefits of the AWS Cloud
Question 340Question →

A logistics company is deploying a Redis cluster using Amazon ElastiCache to cache high-frequency tracking data. Under the AWS Shared Responsibility Model, which two of the following operational tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring Amazon VPC security groups to restrict network access to the cache nodes; Managing database user authentication and access control policies within the Redis application

Answer

Configuring Amazon VPC security groups to restrict network access to the cache nodes, and managing database user authentication and access control policies within the Redis application.
The correct responsibilities of the customer are configuring Amazon VPC security groups to restrict network access to the cache nodes, and managing database user authentication and access control policies within the Redis application. These actions allow the customer to secure access to the service and its data, which falls under security 'in' the cloud.

Step-by-Step Solution

1
Identify the service deployment model used in the scenario.
Amazon ElastiCache is a managed service (Platform as a Service / PaaS model).
The shared responsibility model boundaries vary depending on whether the service is Infrastructure as a Service (IaaS) like Amazon EC2, or a managed service like Amazon ElastiCache.
2
Determine customer responsibilities for managed caching services.
The customer is responsible for firewall configuration (VPC security groups) and identity and access management within the application (Redis authentication).
In a managed service, AWS manages the operating system, database patching, and physical infrastructure, while the customer retains control over network access rules and application data security.

Key Concept

In the AWS Shared Responsibility Model, the division of tasks depends on the type of service deployed. For managed services (PaaS) like Amazon ElastiCache, AWS takes on responsibility for the guest operating system, patching, and hardware, while the customer remains responsible for network access controls (security groups) and data access management (user authentication).
Estimated Time:2m 0s
PreviousPage 17 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin