Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 361Question →

A logistics company is integrating its on-premises inventory server with AWS. The server must automatically upload daily reports to an Amazon S3 bucket. To comply with strict security standards, the company prohibits storing long-term AWS access keys on the physical on-premises server. Which configuration represents the most secure AWS-recommended best practice to grant this access?

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.

Answer

Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.
The configuration utilizing AWS IAM Roles Anywhere is correct because it allows on-premises physical hardware to authenticate using local digital certificates (X.509) and assume an IAM role. This process returns temporary, short-lived security credentials (access key, secret key, and session token), successfully eliminating the need to store long-term keys on the server.

Step-by-Step Solution

1
Analyze the security constraints.
The solution must allow the on-premises server to write to Amazon S3 without storing long-term credentials (like IAM access keys) on the physical hardware.
This filters out any options that rely on permanent IAM user access keys or root user access keys.
2
Identify the AWS mechanism for extending roles to non-AWS hardware.
AWS IAM Roles Anywhere is identified as the service designed to grant secure, temporary AWS credentials to on-premises servers using public key infrastructure (PKI) certificates.
IAM Roles allow applications to obtain temporary security credentials dynamically, removing the need for long-term keys.
3
Evaluate alternative methods to ensure they meet security best practices.
Using public S3 buckets with IP filters is rejected as insecure and an abuse of bucket policies.
AWS access should always be authenticated and authorized via IAM policies and temporary credentials where possible.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to securely access AWS resources using temporary IAM credentials derived from local X.509 digital certificates, eliminating long-term credentials.

Alternative Method

An alternative method is to register the on-premises server as an AWS Systems Manager (SSM) managed instance using Systems Manager Hybrid Activations, allowing it to assume IAM roles through the SSM Agent.
Estimated Time:2m 0s
Question 362Question →

A satellite imagery analytics company processes massive volumes of earth observation data. The processing workload is highly variable, spiking dramatically after major weather events when customers request urgent assessments, while remaining idle during normal operations. Historically, the company maintained a large on-premises server cluster to handle peak demands, resulting in low average resource utilization. Which of the following AWS Cloud benefits directly address this organization's challenges? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Stop spending money running and maintaining data centers

Answer

The correct benefits are stopping guessing capacity and stopping spending money running and maintaining data centers.
The correct answers are the benefits of stopping guessing capacity and stopping spending money running and maintaining data centers. The satellite imagery company's workload is highly variable, meaning that scaling resources dynamically (stopping guessing capacity) prevents low utilization. Additionally, eliminating physical server clusters removes the financial and operational burden of managing their own data center facility.

Step-by-Step Solution

1
Analyze the organization's business and technical challenge.
The company has highly variable workloads (spiking after weather events, idle during normal operations) and historically paid high costs to maintain physical on-premises servers that had low average utilization.
This establishes that the challenges relate to capacity management, resource utilization, and physical data center overhead.
2
Evaluate the option regarding capacity management.
The benefit of 'stopping guessing capacity' allows them to dynamically scale up during spikes and down during idle times, directly solving the utilization issue.
It eliminates the need to pre-provision infrastructure for maximum potential load.
3
Evaluate the option regarding physical infrastructure maintenance.
The benefit of 'stopping spending money running and maintaining data centers' allows the company to eliminate the overhead of managing physical server clusters.
This shifts the focus and budget from keeping physical hardware running to analyzing satellite data.
4
Confirm the remaining options are incorrect.
The options proposing trading variable costs for capital costs, using monolithic architectures, or using static provisioning represent common cloud misconceptions.
AWS encourages trading capital expenses for variable expenses, using loosely coupled designs, and leveraging dynamic elasticity.

Key Concept

Benefits of the AWS Cloud
Question 363Question →

A company stores its financial documents in an Amazon Simple Storage Service (Amazon S3) bucket. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling server-side encryption on the bucket to protect data at rest; Configuring Amazon S3 bucket policies to restrict access to authorized identities

Answer

The customer is responsible for enabling server-side encryption on the bucket and configuring S3 bucket policies to restrict access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For Amazon S3, this includes managing data encryption configurations (such as enabling server-side encryption) and controlling access to buckets and objects (such as setting up bucket policies and IAM controls).

Step-by-Step Solution

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (Platform-as-a-Service/Object storage), meaning AWS manages the infrastructure, operating system, and hardware, while the customer manages data classification, encryption, and access permissions.
Understanding the boundary between infrastructure management and data configuration helps isolate customer-managed tasks.
2
Analyze each option to determine whether it involves configuring customer data/access or managing physical infrastructure/compliance documents.
Configuring access policies and enabling data encryption are customer configurations (security 'in' the cloud). Managing server hardware, patching physical operating systems, and retrieving physical logs are AWS infrastructure responsibilities.
This isolates the correct options from the distractors based on the security 'in' the cloud versus security 'of' the cloud principle.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon S3, AWS manages the security 'of' the cloud (physical infrastructure, virtualization layer, operating system), while the customer manages security 'in' the cloud (data encryption, access control policies).
Estimated Time:1m 0s
Question 364Question →

A global pharmaceutical firm is validating its drug development systems on Amazon EC2 for GxP (Good Practice) regulatory compliance. The auditors require the firm to provide official documentation of AWS's physical security certifications and verify who is responsible for patching the virtualization hypervisor host operating system. Which combination of actions correctly addresses these requirements?

Show answer & explanation

Answer: Retrieve the compliance reports from AWS Artifact; AWS is responsible for patching the host operating system of the hypervisor.

Answer

Retrieve the compliance reports from AWS Artifact; AWS is responsible for patching the host operating system of the hypervisor.
The correct action is retrieving the compliance reports from AWS Artifact, with AWS being responsible for patching the host operating system of the hypervisor. AWS Artifact is the central portal for accessing AWS's security and compliance documents on-demand. Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud (such as the guest OS on EC2), whereas AWS is responsible for security 'of' the cloud, which includes the physical servers, virtualization hypervisors, and host operating systems.

Step-by-Step Solution

1
Identify the service for obtaining official AWS compliance certifications and reports.
AWS Artifact is the dedicated self-service portal that provides on-demand access to AWS security and compliance reports (such as ISO certifications and SOC reports).
Auditors require third-party validated reports proving that the physical infrastructure hosting EC2 meets GxP security standards.
2
Determine the boundary of responsibility for patching the host operating system of the hypervisor.
Under the AWS Shared Responsibility Model, AWS is responsible for the infrastructure components, which include physical security, virtualization hypervisors, and the host operating system.
Since customers do not have access to the physical servers or hypervisor layer, AWS must manage and patch the host operating system.

Key Concept

Retrieving AWS compliance documents using AWS Artifact and distinguishing patching responsibilities for host operating systems under the Shared Responsibility Model.
Estimated Time:2m 0s
Question 365Question →

A pharmaceutical company deploys an AWS Outpost in its on-premises data center to comply with local data residency regulations. The IT team is establishing the operational security procedures for this hybrid deployment. Under the AWS Shared Responsibility Model, which two duties remain the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Providing physical security, power, and cooling for the Outpost hardware rack; Configuring security groups and network access control lists (NACLs) to regulate traffic within the virtual private cloud (VPC) on the Outpost

Answer

The customer is responsible for providing physical security, power, and cooling for the Outpost hardware rack, as well as configuring security groups and network access control lists (NACLs) to regulate traffic within the virtual private cloud (VPC) on the Outpost.
For AWS Outposts, because the physical rack is situated inside the customer's premises, the customer is responsible for physical security, power, and cooling. Additionally, the customer retains control over logical security controls in the cloud, such as security groups and network access control lists (NACLs) for virtual network resources.

Step-by-Step Solution

1
Analyze the service deployment model for AWS Outposts.
AWS Outposts is a hybrid service where AWS-managed hardware is installed in a customer-owned physical facility.
Understanding the hybrid nature of AWS Outposts is necessary to identify how the boundary of physical responsibility shifts compared to standard AWS region deployments.
2
Differentiate the physical security responsibilities.
Since the hardware resides in the customer's facility, the customer must manage physical security, power, and cooling, while AWS remains responsible for hardware replacement and maintenance.
This establishes the physical security boundary under the Shared Responsibility Model for AWS Outposts.
3
Differentiate the logical network and infrastructure responsibilities.
AWS manages the hypervisor and Outpost firmware, while the customer manages virtual private cloud (VPC) configurations, including security groups and network ACLs.
This determines which network configurations are handled by the customer.

Key Concept

Shared Responsibility Model for Hybrid Cloud (AWS Outposts)
Question 366Question →

A startup is designing a collaborative document editing platform on AWS. The development team wants to minimize the operational effort required to manage database infrastructure. They also want to ensure that testing environments can be spun up quickly for developers and completely destroyed when no longer needed to optimize costs.

Which of the following architectural decisions align with the AWS Cloud design principles of 'services not servers' and 'disposable resources'? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Using AWS CloudFormation to define infrastructure as code, enabling testing environments to be deployed programmatically and terminated when testing is complete; Storing application metadata and user session state in Amazon DynamoDB instead of running a self-managed database cluster on virtual servers

Answer

The correct architectural decisions are using AWS CloudFormation to define infrastructure as code for dynamic environment creation and termination, and using Amazon DynamoDB for metadata storage to replace self-managed servers.
The correct options are using AWS CloudFormation for automated environment provisioning and destruction, and storing metadata in Amazon DynamoDB. AWS CloudFormation enables infrastructure as code, which directly implements the 'disposable resources' principle by allowing environments to be created and destroyed dynamically. Storing data in Amazon DynamoDB implements the 'services not servers' principle by leveraging a fully managed, serverless database service that eliminates the need to provision, patch, or maintain virtual servers.

Step-by-Step Solution

1
Identify the requirements of the scenario.
The startup wants to minimize database infrastructure management effort (suggesting 'services not servers') and dynamically create and destroy testing environments (suggesting 'disposable resources').
To narrow down the options that align with these specific target principles.
2
Evaluate the option regarding database management.
Choosing Amazon DynamoDB instead of self-hosted database clusters on EC2 aligns with 'services not servers' by utilizing a managed service.
DynamoDB is fully managed, eliminating the need to manage database servers.
3
Evaluate the option regarding testing environments.
Using AWS CloudFormation to programmatically spin up and tear down environments aligns with 'disposable resources'.
CloudFormation allows resources to be treated as temporary assets that are easily provisioned and terminated.

Key Concept

AWS Cloud design principles focus on scalability, elasticity, loose coupling, disposable resources, and using managed services to reduce operational overhead.
Question 367Question →

A developer needs to configure a script running on their local workstation to upload log files to an Amazon S3 bucket. Which of the following is the AWS-recommended method to securely authenticate this script?

Show answer & explanation

Answer: Create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket.

Answer

Create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket.
The correct answer is to create an IAM user for the developer, generate programmatic access keys, and assign only the necessary permissions to write to the S3 bucket. This ensures the script uses programmatic credentials with the minimum required privileges, securing the account.

Step-by-Step Solution

1
Identify the authentication requirement
A local script running outside of AWS requires programmatic credentials to interact with AWS APIs.
Before the script can interact with Amazon S3, it must authenticate with AWS to verify its identity and permissions.
2
Apply the principle of least privilege and root user best practices
Avoid using the AWS account root user, and instead create a dedicated IAM user with only the specific S3 write permissions required.
This limits the potential damage if the credentials are compromised, which aligns with AWS security best practices.

Key Concept

AWS IAM Programmatic Access and Least Privilege
Question 368Question →

A retail company wants to continuously monitor its AWS accounts, Amazon EC2 instances, and container workloads for potential security threats, such as instances communicating with known malicious IP addresses or performing unauthorized API calls. The solution must use threat intelligence and machine learning to identify these anomalies. Which AWS service should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a dedicated threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as cryptocurrency mining, credential compromise, or communications with known malicious command-and-control servers.

Step-by-Step Solution

1
Identify the primary security requirement.
The requirement is to continuously monitor AWS workloads and accounts for active threats, such as communication with malicious IPs, using threat intelligence and machine intelligence.
This helps distinguish between active threat detection (analyzing behaviors/logs) and vulnerability scanning (identifying static security flaws).
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty uses machine learning and threat intelligence to analyze data sources like VPC Flow Logs, DNS logs, and CloudTrail logs to detect active threats. Amazon Inspector scans for software vulnerabilities. AWS CloudTrail records API calls. AWS Artifact provides compliance reports.
Matching the requirements to the correct service definition ensures the most appropriate service is chosen.

Key Concept

Continuous threat detection using machine learning and threat intelligence in AWS.
Question 369Question →

A financial company is preparing for an external audit of its application running on Amazon EC2 instances. The company needs to restrict network access to the servers and collect compliance reports showing that the underlying AWS physical infrastructure meets industry security standards. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring the security group rules to restrict inbound network traffic to the EC2 instances.

Answer

Configuring the security group rules to restrict inbound network traffic to the EC2 instances.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring security groups (which operate as a firewall at the instance level) to control inbound and outbound traffic to their resources. This is classified as security 'in' the cloud.

Step-by-Step Solution

1
Analyze the customer's requirements in the scenario.
The customer needs to restrict network access to EC2 instances and obtain compliance reports for the physical infrastructure.
Understanding the required tasks is necessary to map them to the correct side of the Shared Responsibility Model.
2
Determine the boundary of responsibility for each task.
Configuring security groups is a customer responsibility (security in the cloud), while physical data center security and hypervisor maintenance are AWS responsibilities (security of the cloud). Compliance reports for the physical infrastructure are retrieved by the customer using AWS Artifact.
This identifies the specific action that falls under the customer's operational duties.

Key Concept

AWS Shared Responsibility Model boundaries for Infrastructure as a Service (IaaS) resources
Estimated Time:1m 30s
Question 370Question →

A company is migrating its legacy customer booking application to the AWS Cloud. During this process, the development team wants to ensure that a failure in the email notification service does not halt the entire booking system. In addition, the developers want to automatically build temporary staging environments for testing and terminate them as soon as testing is complete. Which of the following AWS Cloud design principles are demonstrated in this scenario? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Loose coupling; Disposable resources

Answer

Loose coupling and Disposable resources
Loose coupling decouples system components to isolate failures and maintain system availability even when one component fails. Disposable resources enable the use of automation to dynamically instantiate and terminate infrastructure components on demand, minimizing waste.

Step-by-Step Solution

1
Analyze the first requirement: ensuring that a failure in the email notification service does not stop the booking system.
This requires decoupling the components so they operate independently, which aligns with the design principle of Loose coupling.
By reducing dependencies between services, the application gains higher fault tolerance.
2
Analyze the second requirement: automatically creating temporary environments for testing and terminating them when done.
This involves using automation to treat environments as temporary, which aligns with the design principle of Disposable resources.
Treating servers as temporary assets rather than permanent hardware optimizes costs and operations.

Key Concept

AWS Cloud design principles recommend decoupling systems (loose coupling) and utilizing automated, temporary infrastructure (disposable resources) to build reliable, cost-effective applications.
Estimated Time:45s
Question 371Question →

A mobile game studio based in London is launching a new multiplayer game. The studio needs to deploy its game backend servers in multiple locations worldwide, specifically near players in North America, Europe, and Asia, to ensure low-latency gameplay. Which AWS Cloud benefit is this studio utilizing by deploying their application across multiple AWS Regions with just a few clicks?

Show answer & explanation

Answer: Go global in minutes

Answer

Go global in minutes
The correct option is 'Go global in minutes'. This benefit represents the ability to deploy applications in multiple AWS Regions around the world with just a few clicks. In this scenario, the game studio is using this capability to place its servers close to players in North America, Europe, and Asia to minimize latency and improve the gaming experience.

Step-by-Step Solution

1
Analyze the scenario requirements
The scenario describes a game studio that needs to deploy backend servers globally (North America, Europe, Asia) to provide low-latency gameplay to users in those regions.
Identifying the core goal (reducing latency globally by deploying across multiple geographic locations) helps map it to the correct AWS Cloud benefit.
2
Match the requirement to the six AWS Cloud benefits
The ability to deploy applications globally across multiple AWS Regions with minimal effort matches the 'Go global in minutes' benefit.
AWS allows quick deployment in multiple Regions globally, which reduces latency for end-users, aligning perfectly with the studio's objective.

Key Concept

Go global in minutes
Question 372Question →

NovaPeak Manufacturing is planning to migrate two of its IT workloads to the AWS Cloud. First, they want to migrate a legacy inventory database to Amazon EC2 without making any architectural or code changes. Second, they plan to replace their on-premises customer relationship management (CRM) software with a cloud-based Software-as-a-Service (SaaS) subscription. Which two cloud migration strategies should NovaPeak Manufacturing select for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehosting (Lift-and-Shift); Repurchasing (Drop-and-Shop)

Answer

The correct strategies are Rehosting (Lift-and-Shift) and Repurchasing (Drop-and-Shop).
The correct strategies are Rehosting (Lift-and-Shift) and Repurchasing (Drop-and-Shop). Rehosting is correct because moving the legacy database to Amazon EC2 without any changes is a classic lift-and-shift approach. Repurchasing is correct because moving from self-hosted software to a SaaS subscription represents purchasing a new product.

Step-by-Step Solution

1
Analyze the first workload requirement: migrating the legacy database to Amazon EC2 without making any architectural or code changes.
Identify that moving a workload 'as-is' corresponds to the Rehosting (Lift-and-Shift) migration strategy.
This strategy allows organizations to quickly migrate workloads without redesigning the application.
2
Analyze the second workload requirement: replacing the on-premises CRM software with a cloud-based SaaS subscription.
Identify that discarding an existing application to purchase a new product or utility service (like SaaS) corresponds to the Repurchasing (Drop-and-Shop) strategy.
This strategy shifts the business to a different product or platform, often managed by a third-party vendor.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Question 373Question →

An online gaming company hosting its multiplayer game servers on Amazon EC2 wants to continuously monitor its AWS accounts for security threats like cryptocurrency mining, unauthorized API calls, and unusual data access patterns. The security team needs an intelligent service that automatically analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS query logs to detect these anomalies. Which AWS service should the company use to meet this objective?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides continuous, intelligent threat detection. It analyzes data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning and anomaly detection to identify threats like cryptocurrency mining, credential compromise, and communication with malicious servers.

Step-by-Step Solution

1
Analyze the requirements in the scenario
The requirement is to choose an intelligent threat detection service that continuously analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS query logs for active threats (like cryptocurrency mining and unauthorized API activity).
This helps identify which AWS security services are designed for runtime behavioral analysis and log-based threat detection.
2
Evaluate the options against their core functionality
Amazon GuardDuty is the specific AWS service that uses machine learning and threat intelligence to analyze AWS CloudTrail, VPC Flow Logs, and DNS logs. Amazon Inspector focuses on scanning resources for software vulnerabilities, AWS CloudTrail provides only logging without analysis, and AWS Shield Standard provides managed infrastructure-level DDoS protection.
This isolates the correct tool based on service definitions.

Key Concept

Continuous threat detection using Amazon GuardDuty
Estimated Time:1m 15s
Question 374Question →

SwiftCargo Logistics is planning to migrate its application portfolio to the AWS Cloud. During the analysis, the migration team identifies an old, duplicate database application that is no longer used by any business unit. The team decides to shut down and decommission this application completely before the migration begins. Which migration strategy is the company applying to this specific application?

Show answer & explanation

Answer: Retiring

Answer

Retiring
The correct strategy is Retiring. In the context of AWS migration strategies (the 6 Rs), Retiring involves identifying applications that are no longer useful or redundant and turning them off completely. This reduces the migration scope, security footprint, and ongoing maintenance costs.

Step-by-Step Solution

1
Analyze the business scenario described in the question.
The scenario describes an application that is no longer used and is being shut down and decommissioned completely.
Understanding the lifecycle status of the application is necessary to map it to the correct AWS migration strategy.
2
Map the action of decommissioning an unneeded application to the 6 Rs migration strategies.
Decommissioning or turning off applications that are no longer needed corresponds to the 'Retire' (or Retiring) migration strategy.
The 'Retire' strategy focuses on identifying redundant or obsolete assets and shutting them down to reduce costs and narrow the migration scope.

Key Concept

AWS Cloud Migration Strategies (6 Rs) - Retiring
Estimated Time:45s
Question 375Question →

An organization hosts a web application on Amazon EC2 instances in a public subnet. The security team wants to allow web clients to access the instances over HTTP (port 80) and HTTPS (port 443). However, to prevent data exfiltration, the EC2 instances must be restricted from initiating any outbound connections to the internet, while still allowing them to return responses to client requests. Which of the following configurations are required to achieve this goal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic.; Configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.

Answer

Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic. Additionally, configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.
The correct combination involves understanding the stateful nature of Security Groups and the stateless nature of Network ACLs. The Security Group configuration allows inbound HTTP/HTTPS traffic, which automatically permits outbound responses due to state tracking, while removing outbound rules prevents the instances from initiating outbound connections. The Network ACL configuration requires inbound rules for ports 80/443 and outbound rules for the ephemeral ports (1024-65535) to allow return packets, because Network ACLs do not track connection states.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups.
Since Security Groups operate at the instance level and are stateful, any inbound traffic allowed is automatically permitted to return outbound. Therefore, to allow incoming web traffic while blocking instances from initiating outbound traffic, we must allow inbound ports 80 and 443, and remove the outbound rule that allows all traffic.
This meets the requirement of allowing inbound HTTP/HTTPS requests and return traffic, while preventing the instances from initiating outbound requests.
2
Analyze the stateless nature of Network ACLs.
Network ACLs operate at the subnet boundary and are stateless. This means we must explicitly define rules for both inbound and outbound directions. To allow inbound client traffic, we permit ports 80 and 443. To allow the return traffic back to those clients, we must add an outbound rule permitting traffic to ephemeral ports (1024-65535).
Since Network ACLs do not track connection states, omitting the outbound ephemeral port rule would block the return traffic.

Key Concept

Stateful vs. Stateless network filtering in AWS (Security Groups vs. Network ACLs)
Question 376Question →

A retail company is migrating its e-commerce platform to AWS. The finance department wants to eliminate high upfront capital expenditures for data centers and instead pay for resources only as they are consumed. Simultaneously, the IT operations team wants to avoid the risk of either underprovisioning servers during peak sales events or paying for idle capacity during low-traffic periods. Which of the following benefits of the AWS Cloud directly address these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Trade fixed expense for variable expense; Stop guessing capacity

Answer

The correct benefits are trading fixed expense for variable expense and stopping guessing capacity.
The correct benefits demonstrated in this scenario are trading fixed expense for variable expense and stopping guessing capacity. Trading fixed expense for variable expense allows the company to convert costly upfront hardware investments (capital expenses) into variable operating expenses that match actual usage. Stopping guessing capacity ensures that resources dynamically scale to meet traffic demand, eliminating both service downtime from underprovisioning and financial waste from idle overprovisioned servers.

Step-by-Step Solution

1
Analyze the finance team's need to eliminate upfront capital expenditures for data centers and move to a consumption-based payment model.
This requirement aligns with trading fixed expense for variable expense.
AWS cloud computing turns upfront capital expenses (CapEx) into variable operating expenses (OpEx) where you pay only for what you use.
2
Analyze the IT operations team's need to avoid underprovisioning during peak traffic and overprovisioning during low traffic.
This requirement aligns with stopping guessing capacity.
By using elastic resources on AWS, capacity automatically adjusts to meet demand, removing the need to predict or guess system capacity requirements beforehand.

Key Concept

Define the benefits of the AWS Cloud
Estimated Time:1m 30s
Question 377Question →

A company is migrating its monolithic on-premises order-processing application to AWS. To handle unpredictable traffic spikes, they need to ensure the system is highly resilient to failures, can scale dynamically without human intervention, and prevents database performance bottlenecks from crashing the web frontend. Which of the following architectural strategies on AWS best implements these requirements while avoiding common cloud design anti-patterns?

Show answer & explanation

Answer: Deploy the frontend web servers across multiple Availability Zones within an Auto Scaling group, and use Amazon Simple Queue Service (SQS) to buffer writes to the database.

Answer

Deploy the frontend web servers across multiple Availability Zones within an Auto Scaling group, and use Amazon Simple Queue Service (SQS) to buffer writes to the database.
The correct strategy implements loose coupling by using Amazon SQS to decouple the database writes from the web frontend, designs for failure by deploying the web servers across multiple Availability Zones, and implements elasticity by using an Auto Scaling group to handle dynamic traffic spikes automatically.

Step-by-Step Solution

1
Analyze the resiliency requirement.
To ensure high resilience against failures, the application must be deployed across multiple Availability Zones (AZs) so that if one AZ fails, the others can continue operating.
This implements the 'design for failure' principle.
2
Analyze the scaling requirement.
To scale dynamically without human intervention, an Auto Scaling group should be used to automatically add or remove EC2 instances based on demand.
This implements the 'elasticity' principle, avoiding the anti-pattern of manual scaling.
3
Analyze the database bottleneck and decoupling requirement.
To prevent database bottlenecks from crashing the web frontend, a message queue like Amazon SQS must be introduced to buffer incoming requests and decouple the layers.
This implements the 'loose coupling' principle, ensuring that components are not tightly bound to each other's immediate performance.

Key Concept

AWS Cloud design principles (loose coupling, elasticity, and design for failure)
Question 378Question →

A company is building an online food delivery application on AWS. They want to ensure that if the payment service fails, the restaurant browsing and ordering service remains fully operational. Which AWS Cloud design principle is best demonstrated by this architectural choice?

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling
Loose coupling reduces dependencies between systems, ensuring that if one service fails, others continue to function. In this scenario, isolating the payment system from the browsing and ordering services allows customers to continue using the application even if payment processing is temporarily unavailable.

Step-by-Step Solution

1
Analyze the scenario
The scenario describes a system where one component (payment service) can fail without causing other components (restaurant browsing and ordering) to fail.
This is a key requirement of high availability and fault isolation.
2
Map the system behavior to AWS design principles
Separating components so they interact with minimal dependency is the definition of loose coupling.
Loose coupling prevents cascading failures and allows individual services to be updated or scale independently.

Key Concept

Loose coupling is a core design principle of the AWS Cloud that reduces dependencies between components, preventing single points of failure from disabling the entire system.
Question 379Question →

A digital publishing company is planning to migrate its content archive and seasonal traffic analytics systems from an on-premises data center to the AWS Cloud. The systems experience predictable, low baseline activity throughout the month, except for a 4848-hour window at the end of each month when monthly reports are generated and traffic spikes by 400%400\%. The company's goal is to minimize total cost of ownership (TCO) while ensuring performance during peak periods.

Which of the following strategies represent direct applications of AWS cloud economics to achieve these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implementing auto-scaling policies that dynamically provision compute capacity for the 4848-hour reporting spike and terminate the extra resources immediately afterward.; Converting upfront physical server acquisition costs into variable operating expenses, paying only for the compute runtime actually consumed.

Answer

The correct strategies are implementing auto-scaling policies to dynamically provision capacity during peak spikes, and converting upfront capital expenditures into variable operating expenses.
Implementing auto-scaling policies to dynamically provision capacity during peak spikes allows the company to pay only for the resource runtime they actually use, which leverages cloud elasticity. Converting upfront physical server acquisition costs into variable operating expenses shifts the financial risk from a capital expense model to an operational expense model, aligning costs directly with business demand.

Step-by-Step Solution

1
Analyze the workload characteristics and financial goals described in the scenario.
The workload has a low baseline with a predictable 4848-hour spike (400%400\% increase), and the goal is to optimize costs and minimize TCO.
Understanding the workload pattern is necessary to match it with the correct economic and operational strategies in AWS.
2
Evaluate the financial shifts associated with cloud migration.
Transitioning from purchasing physical hardware (CapEx) to paying for runtime hourly/secondly (OpEx) matches the goal of variable cost optimization.
Cloud economics favors trading capital expenses for variable operating expenses to increase financial agility.
3
Evaluate the technical scaling strategies for transient spikes.
Applying elasticity (scaling up and down dynamically) fits the 4848-hour spike, whereas permanent provisioning or long-term Reserved Instances for peak capacity are financially inefficient.
Elasticity prevents paying for idle resources, which directly reduces TCO compared to on-premises over-provisioning.

Key Concept

AWS Cloud Economics: CapEx to OpEx shift and the financial benefit of elasticity
Question 380Question →

A financial company hosts a transaction processing application on Amazon EC2 instances and stores historical data archives in Amazon S3. The security team must implement a security strategy that achieves two goals: first, automatically identifying software package vulnerabilities and unintended network accessibility on the EC2 instances; second, continuously monitoring the AWS accounts and network traffic for active malicious activity, such as brute-force attacks or communication with known malicious command-and-control servers. Which of the following AWS services should be implemented to address these specific security requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector to scan the EC2 instances for software vulnerabilities and unintended network exposure.; Amazon GuardDuty to continuously monitor account activity and network logs for signatures of malicious behavior.

Answer

The correct services are Amazon Inspector and Amazon GuardDuty.
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector satisfies the first requirement by continuously scanning EC2 instances for software vulnerability packages and mapping network reachability. Amazon GuardDuty satisfies the second requirement by analyzing VPC Flow Logs, DNS logs, and CloudTrail events to identify active threats like brute-force attacks or communication with malicious IP addresses.

Step-by-Step Solution

1
Analyze the requirement for host-level software vulnerability and network reachability scanning on EC2 instances.
Identify Amazon Inspector as the service that automates software package vulnerability scanning and checks for unintended external network paths.
Vulnerability scanning of EC2 operating system packages and network path analysis is the core function of Amazon Inspector.
2
Analyze the requirement for active, intelligent threat detection and anomaly monitoring at the AWS account level.
Identify Amazon GuardDuty as the service that monitors log metadata (VPC Flow Logs, DNS, CloudTrail) to flag malicious communications and brute-force attempts.
Amazon GuardDuty uses machine learning and threat intelligence feeds to actively identify compromised hosts and unauthorized account activity.

Key Concept

AWS threat detection and vulnerability management services function at different layers of the infrastructure, with Amazon Inspector performing software and reachability assessments, while Amazon GuardDuty performs active log-based threat monitoring.
PreviousPage 19 / 74Next