Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 381Question →

A food delivery platform is preparing for an audit and needs to download official AWS compliance documents, such as SOC and PCI DSS reports, while also verifying its security responsibilities. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the required AWS compliance reports directly using AWS Artifact.; Rely on AWS to manage the physical security and environmental compliance of the data center facilities.

Answer

The correct options are the one to download compliance reports using AWS Artifact and the one relying on AWS to manage physical security and environmental compliance.
To meet compliance auditing needs, a customer uses the self-service AWS Artifact portal to download compliance documents (such as SOC and PCI DSS reports). Additionally, under the Shared Responsibility Model, AWS is responsible for security 'of' the cloud, which includes maintaining physical data center security and environmental compliance.

Step-by-Step Solution

1
Identify the service for compliance documentation
AWS Artifact is identified as the correct service to retrieve compliance reports.
AWS Artifact provides on-demand download of AWS compliance documents such as SOC and PCI reports.
2
Determine the shared responsibility boundary for physical data centers
Physical and environmental security is identified as the responsibility of AWS.
AWS is responsible for the security 'of' the cloud, which includes data center physical security.

Key Concept

AWS compliance reports retrieval via AWS Artifact and boundary of physical security in the Shared Responsibility Model.
Question 382Question →

A media streaming company wants to enhance its security posture. The security team needs a solution to achieve two goals: first, they want to continuously monitor their AWS accounts for malicious activity and unauthorized behavior; second, they want to perform automated security assessments on their Amazon EC2 instances to identify software vulnerabilities. Which of the following AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides active threat detection across AWS accounts, while Amazon Inspector performs vulnerability scanning on Amazon EC2 instances.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. Amazon Inspector provides automated vulnerability scanning for Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Together, they satisfy the requirements for threat detection and vulnerability management.

Step-by-Step Solution

1
Identify the service required for active threat detection and continuous monitoring of malicious behavior across AWS accounts.
Amazon GuardDuty is identified as the service that monitors account activity using machine learning and threat intelligence.
To satisfy the requirement of detecting unauthorized or malicious activity at the account level.
2
Identify the service required for scanning Amazon EC2 instances for software vulnerabilities.
Amazon Inspector is identified as the service that automatically scans EC2 instances and ECR container images for software vulnerabilities.
To satisfy the requirement of detecting host-level software vulnerabilities.

Key Concept

AWS threat detection and vulnerability management services
Question 383Question →

A financial institution deploying a payment processing application on AWS wants to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Under the AWS Shared Responsibility Model, which compliance-related task is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring data encryption at rest and in transit within the payment application.

Answer

Configuring data encryption at rest and in transit within the payment application.
Under the AWS Shared Responsibility Model, AWS is responsible for 'security of the cloud,' which includes the physical infrastructure, hardware, and hypervisor virtualization layer. The customer is responsible for 'security in the cloud,' which includes customer data encryption, firewall configuration, and application-level security settings. Therefore, configuring encryption for cardholder data within the application is the customer's sole responsibility.

Step-by-Step Solution

1
Analyze the Shared Responsibility Model boundaries for a PCI-DSS compliance scenario.
Identify that physical security (data centers) and infrastructure maintenance (hypervisor patching) belong to AWS ('security of the cloud').
This isolates the options that are managed by AWS rather than the customer.
2
Determine the customer's responsibility for protecting data ('security in the cloud').
Recognize that managing encryption settings, keys, and application-level configurations for PCI data is the customer's responsibility.
This confirms the correct compliance task under customer ownership.

Key Concept

AWS Shared Responsibility Model for Compliance
Question 384Question →

A quality assurance team at a financial software company currently maintains a permanent, always-on staging environment for testing weekly application updates. Because this environment is idle for most of the week, the team decides to use AWS CloudFormation to automatically spin up a brand new, identical staging environment at the start of a test run and completely destroy it once testing is complete. Which design principle of the AWS Cloud is directly demonstrated by this approach?

Show answer & explanation

Answer: Disposable resources

Answer

Disposable resources
The correct answer is the principle of disposable resources. In the AWS Cloud, infrastructure is treated as temporary and programmatically managed. Using tools like AWS CloudFormation to automatically spin up a staging environment for a test run and then terminating it immediately after completion directly applies the principle of disposable resources, helping to reduce costs and maintain clean test states.

Step-by-Step Solution

1
Analyze the scenario's operational goal.
The company wants to move away from a permanent, always-on staging environment to an on-demand, temporary environment that is programmatically created and destroyed using infrastructure as code (AWS CloudFormation).
Understanding the operational shift helps identify which architectural principle governs the lifecycle of these environments.
2
Map the team's approach to AWS Cloud design principles.
The practice of treating infrastructure as temporary and interchangeable assets that can be programmatically launched and terminated matches the principle of 'disposable resources' rather than maintaining static hardware.
This matches the definition of treating resources as disposable rather than fixed assets.

Key Concept

Disposable resources instead of fixed servers
Estimated Time:1m 0s
Question 385Question →

A health-tech organization needs to secure its AWS environment to meet compliance standards. The compliance team requires the organization to implement a mechanism that records all historical API activities to identify who made specific configuration changes to security groups, and also run automated scans on their Amazon EC2 instances to check for known software vulnerabilities and package exposures. Which combination of AWS services or responsibility frameworks will meet these requirements?

Show answer & explanation

Answer: AWS CloudTrail to record API activity, and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.

Answer

The combination of AWS CloudTrail to record API activity and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.
The correct answer combines AWS CloudTrail and Amazon Inspector. AWS CloudTrail records and logs AWS API calls, enabling auditing of modifications to security configurations such as security groups. Amazon Inspector is the service that automatically assesses EC2 instances for software vulnerabilities (CVEs) and unintended network exposure.

Step-by-Step Solution

1
Identify the requirement for tracking and auditing API configuration history.
Determine that AWS CloudTrail is the service responsible for auditing and logging AWS API calls and user activities.
AWS CloudTrail tracks actions taken by a user, role, or an AWS service, which allows the security team to audit who modified the security groups.
2
Identify the requirement for automated vulnerability scanning on Amazon EC2 instances.
Determine that Amazon Inspector is designed to automatically scan EC2 instances for software vulnerabilities (CVEs) and network reachability.
Amazon Inspector continuously scans workloads for software vulnerabilities, whereas GuardDuty focuses on active threat detection, and guest OS security is the customer's responsibility.

Key Concept

Auditing API activity using AWS CloudTrail and managing EC2 software vulnerabilities using Amazon Inspector under the AWS Shared Responsibility Model.
Question 386Question →

A startup has just created its first AWS account and wants to secure the account root user. Which of the following actions represent AWS security best practices for protecting the account root user? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the root user.; Avoid using the root user for daily administrative tasks.

Answer

Enabling multi-factor authentication (MFA) for the root user and avoiding using the root user for daily administrative tasks.
Securing the AWS account root user requires enabling multi-factor authentication (MFA) to prevent unauthorized access and using IAM users or roles for daily administration rather than using the root user directly.

Step-by-Step Solution

1
Identify the options that follow the principle of least privilege and root user protection rules.
Enabling multi-factor authentication (MFA) adds an essential security layer, and avoiding root usage for everyday tasks prevents accidental or unauthorized administrative actions.
AWS strongly recommends securing the root user immediately after account creation and using IAM entities instead.

Key Concept

Root user security best practices, including enabling MFA and delegating administrative tasks to IAM users or roles.
Question 387Question →

A logistics company, SwiftRoute Logistics, plans to migrate its on-premises package tracking application to the AWS Cloud. The migration team will move the application's web servers directly to Amazon EC2 instances without modification, but will transition its self-managed relational database to Amazon Relational Database Service (Amazon RDS) to eliminate database administration tasks. Which migration strategy is SwiftRoute Logistics using?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming is the correct migration strategy because the company is migrating its application to the cloud while making minor optimizations—specifically moving the database to a managed service (Amazon RDS) to reduce management overhead—without altering the core application architecture or code.
The strategy described is replatforming (also known as lift-tinker-and-shift). In this scenario, the core application code is migrated to Amazon EC2 without changes, but the database is moved to a managed database service (Amazon RDS) to reduce administrative overhead. This optimization of a component without changing the core application structure is the defining characteristic of replatforming.

Step-by-Step Solution

1
Analyze the migration details for the application servers.
The web servers are moved directly to Amazon EC2 without modification (lift-and-shift).
To understand which parts of the application are migrated as-is.
2
Analyze the migration details for the database component.
The database is converted from a on-premises self-managed server to a managed database service (Amazon RDS) to reduce administrative efforts.
To identify any optimization or platform-level modifications.
3
Match the overall strategy to the AWS migration framework (6 Rs).
Combining lift-and-shift for servers with optimization of the database using a managed service represents Replatforming (lift-tinker-and-shift).
To select the migration strategy that aligns with these activities.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Question 388Question →

A software-as-a-service (SaaS) provider wants to implement Amazon Inspector to enhance the security posture of its application hosting environment. Which of the following tasks can Amazon Inspector perform to assist the provider with vulnerability management? (Select two.)

Select all that apply

Show answer & explanation

Answer: Scanning software packages on running Amazon EC2 instances for known vulnerabilities; Scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilities

Answer

The correct tasks are scanning software packages on running Amazon EC2 instances for known vulnerabilities, and scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilities.
Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It supports automated scanning of software packages installed on running Amazon EC2 instances and container images pushed to Amazon Elastic Container Registry (Amazon ECR).

Step-by-Step Solution

1
Identify the primary capability of Amazon Inspector.
Amazon Inspector is an automated vulnerability management service designed to scan workloads for software vulnerabilities and unintended network exposure.
This helps determine which options align with vulnerability scanning vs other security activities.
2
Evaluate the workload scanning targets supported by Amazon Inspector.
Amazon Inspector supports scanning Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions.
This matches the options for EC2 package scanning and ECR container image scanning as the correct tasks.
3
Differentiate Amazon Inspector from other security services and user responsibilities.
Anomalous API activity log analysis is performed by Amazon GuardDuty. Applying OS patches is a customer responsibility under the Shared Responsibility Model. Metric monitoring is done by Amazon CloudWatch.
This eliminates the distractors based on the correct division of services and responsibilities.

Key Concept

Amazon Inspector automated vulnerability scanning for EC2 workloads and container images
Estimated Time:1m 30s
Question 389Question →

A company is developing a new mobile application and decides to store customer profile data in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for?

Show answer & explanation

Answer: Configuring identity and access management (IAM) policies to control access to the tables.

Answer

Configuring identity and access management (IAM) policies to control access to the tables.
In the AWS Shared Responsibility Model, Amazon DynamoDB is a fully managed service. For managed services, AWS takes care of the infrastructure, OS patching, and database software maintenance. The customer remains responsible for securing access to the data, which includes configuring IAM policies to control who can read or write to the database tables.

Step-by-Step Solution

1
Identify the AWS service model type for Amazon DynamoDB.
Amazon DynamoDB is a fully managed NoSQL database service.
Understanding the service type determines where the line of responsibility is drawn. In managed services, AWS takes over more operational responsibilities.
2
Determine the customer's responsibility boundary for managed database services.
For Amazon DynamoDB, AWS manages the hardware, operating system, and database software. The customer is responsible for data classification, encryption settings, and access control (IAM).
This allows us to identify that configuring access permissions is the customer's duty, while patching and physical maintenance are AWS's duty.

Key Concept

Shared Responsibility Model
Estimated Time:45s
Question 390Question →

An enterprise wants to allow its employees to log in to the AWS Management Console using their existing corporate credentials managed by an on-premises identity provider. The security team mandates that employees must not have permanent AWS IAM user credentials. Which of the following IAM features or mechanisms should the enterprise use to implement this configuration?

Show answer & explanation

Answer: Federate identities using an IAM role that trusts the external corporate identity provider

Answer

Federate identities using an IAM role that trusts the external corporate identity provider
Federating identities with an IAM role that trusts the external corporate identity provider allows employees to obtain temporary credentials to access the AWS Management Console. This avoids the administrative overhead and security risks associated with creating and managing permanent IAM users for each employee.

Step-by-Step Solution

1
Analyze the business and security requirements
The solution must integrate an on-premises identity provider with AWS to allow console access without creating permanent AWS IAM users.
This establishes the constraints: federation/temporary credentials must be used, and IAM users must be avoided.
2
Evaluate the IAM capabilities for external identity integration
AWS IAM supports identity federation using OpenID Connect (OIDC) or SAML 2.0. By establishing a trust relationship, external users are mapped to temporary security credentials via IAM roles.
This matches the requirement for no permanent credentials while enabling single sign-on.
3
Identify and eliminate incorrect options
Creating individual IAM users creates permanent credentials. Sharing root user credentials violates root security practices. Assuming AWS manages on-premises identity systems is a misunderstanding of the Shared Responsibility Model.
This leaves the role-based identity federation option as the only secure and compliant answer.

Key Concept

IAM Identity Federation and Temporary Access
Estimated Time:1m 0s
Question 391Question →

A government transit agency runs a fleet of on-premises database servers and also hosts application servers on Amazon EC2. The agency needs to configure a nightly backup process that uploads database logs to a secured Amazon S3 bucket, while strictly adhering to the principle of least privilege and avoiding the use of long-term credentials on any server. Which TWO of the following configurations represent AWS-recommended security practices for this architecture?

Select all that apply

Show answer & explanation

Answer: Attach an IAM role to the Amazon EC2 instances hosting the application servers to grant temporary security credentials for Amazon S3 bucket access.; Use AWS IAM Roles Anywhere to allow the on-premises database servers to assume an IAM role and obtain temporary security credentials using X.509 digital certificates.

Answer

The correct configurations are attaching an IAM role to the EC2 instances for application server access, and using AWS IAM Roles Anywhere to allow the on-premises database servers to obtain temporary credentials using X.509 digital certificates.
AWS-recommended security practices mandate the use of temporary credentials instead of long-term access keys whenever possible. Attaching an IAM role to EC2 instances allows applications running on them to access AWS resources using temporary, rotated credentials without storing secrets. For resources outside of AWS, such as the on-premises database servers, AWS IAM Roles Anywhere provides a secure way to exchange X.509 digital certificates for temporary AWS credentials, eliminating the need for long-term IAM user access keys on physical hardware.

Step-by-Step Solution

1
Analyze the organization's requirements for nightly database backups to Amazon S3.
Identify that the solution must support EC2 application servers and on-premises database servers while avoiding the use of long-term credentials on any system.
To determine which IAM features can provide temporary credentials for both AWS-native and non-AWS environments.
2
Evaluate options for providing credentials to the EC2 application servers.
Confirm that attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials without hardcoding secrets.
To securely grant access to AWS resources from EC2 instances in accordance with the principle of least privilege.
3
Evaluate options for providing credentials to the on-premises database servers.
Identify AWS IAM Roles Anywhere as the mechanism to obtain temporary AWS security credentials using X.509 certificates.
To extend the use of temporary IAM roles to workloads running outside of AWS, avoiding static keys on on-premises hardware.
4
Rule out options recommending root user access keys, static shared IAM users, or public access policies.
Exclude root user credential generation, static IAM user key distribution, and public bucket policies as they violate the principle of least privilege and root user best practices.
To avoid severe security risks and adhere to the customer's responsibility under the AWS Shared Responsibility Model.

Key Concept

Identity and Access Management (IAM)
Question 392Question →

A retail company has a web application hosted on an Amazon EC2 instance that needs to read and write images to an Amazon S3 bucket. According to AWS security best practices, which of the following is the most secure method to grant the EC2 instance access to the S3 bucket?

Show answer & explanation

Answer: Attach an IAM role with the required S3 permissions to the EC2 instance.

Answer

Attach an IAM role with the required S3 permissions to the EC2 instance.
Attaching an IAM role to the EC2 instance is the recommended best practice. AWS automatically provides temporary, short-lived security credentials to the EC2 instance through the Instance Metadata Service (IMDS). This eliminates the need to hardcode or store permanent AWS access keys on the instance, reducing the risk of credential exposure.

Step-by-Step Solution

1
Identify the AWS resource (EC2 instance) that requires permission to access another service (S3).
An application on EC2 needs to communicate with S3.
AWS services requiring access to other AWS services should use temporary credentials instead of long-lived access keys.
2
Determine the AWS-recommended mechanism for granting permissions to applications running on EC2 instances.
IAM roles are designed to grant applications on EC2 temporary access to other AWS resources.
This removes the need to store and manage static AWS credentials on the server, enhancing overall security.

Key Concept

Using IAM Roles for AWS Services
Estimated Time:45s
Question 393Question →

A financial services company is setting up AWS access for its newly hired database administrators. The company wants to enforce the principle of least privilege, simplify permissions management as the team grows, and secure individual console access. Which two of the following actions represent recommended AWS Identity and Access Management (IAM) best practices to achieve this?

Select all that apply

Show answer & explanation

Answer: Assign the database administrators to an IAM group and attach the necessary permissions policy to that group.; Configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.

Answer

Assign the database administrators to an IAM group and attach the necessary permissions policy to that group, and configure multi-factor authentication (MFA) on the database administrators' individual IAM user accounts.
The correct practices are to assign the administrators to an IAM group and attach policies to that group, and to enforce multi-factor authentication (MFA) on the individual IAM user accounts. Using IAM groups simplifies permissions management as the team grows, and enabling MFA ensures that console access is secured with an additional authentication layer.

Step-by-Step Solution

1
Evaluate the requirement for managing permissions easily as the team grows.
Using IAM groups allows policies to be attached once and automatically applied to any user added to the group, satisfying the scalability requirement.
Managing permissions at the group level reduces administrative overhead and potential configuration errors.
2
Evaluate the requirement for securing individual console access.
Enabling Multi-Factor Authentication (MFA) on individual IAM user accounts enforces an extra security layer beyond password authentication.
MFA is the standard AWS recommendation for securing console access.
3
Analyze and eliminate incorrect alternatives.
Discard sharing the root user due to security risks; discard attaching roles with permanent access keys since roles only use temporary credentials; discard AWS patching workstations since client-side device security belongs to the customer.
This aligns with the AWS Shared Responsibility Model and core IAM security boundaries.

Key Concept

AWS IAM best practices including group-based permissions and multi-factor authentication (MFA).
Question 394Question →

A media company is migrating its video transcoding pipeline to AWS. The solution architect designs the system to use Amazon S3 to store raw uploads, which triggers an AWS Lambda function to process the video. The processed videos are then stored in a different S3 bucket. Additionally, the Lambda functions automatically scale out to handle thousands of concurrent uploads during peak hours and scale down to zero when there is no activity.

Which two design principles of the AWS Cloud does this architecture represent? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Services, not servers; Elasticity

Answer

The correct design principles are 'Services, not servers' and 'Elasticity'.
The architecture demonstrates 'services, not servers' by utilizing fully managed services like Amazon S3 and AWS Lambda, which eliminates the need to provision or manage servers. It also demonstrates 'elasticity' because AWS Lambda automatically scales out to match the incoming demand of video uploads and scales back down when demand decreases.

Step-by-Step Solution

1
Identify the compute and storage resources used in the scenario and how they are managed.
The architecture uses Amazon S3 and AWS Lambda, which are fully managed services requiring no server provisioning or maintenance.
This identifies the 'services, not servers' design principle.
2
Analyze how the system handles changes in demand and workload.
The system automatically scales up to handle thousands of uploads and scales down to zero when idle.
This identifies the 'elasticity' design principle, which is the ability to scale dynamically based on demand.

Key Concept

AWS Cloud Design Principles focus on loose coupling, elasticity, and utilizing managed services to reduce operational overhead.
Estimated Time:1m 30s
Question 395Question →

An independent software vendor (ISV) is transitioning its application from a traditional on-premises hosting model to AWS. Under the old model, the ISV had to invest heavily in purchasing physical servers and storage arrays before launch to ensure the application could support its projected user base. On AWS, the ISV plans to deploy resources on-demand and scale them dynamically. Which option correctly identifies the primary AWS Cloud benefit demonstrated by this shift, along with the correct financial or operational rationale?

Show answer & explanation

Answer: Trading capital expense for variable expense, which allows the ISV to pay only for the resources they consume rather than investing heavily in physical data centers and servers before using them.

Answer

Trading capital expense for variable expense, which allows the ISV to pay only for the resources they consume rather than investing heavily in physical data centers and servers before using them.
The correct option is correct because the ISV is shifting from upfront investments in physical infrastructure (capital expenses) to a model where they pay for resources on-demand (variable expenses). This directly matches the AWS Cloud benefit of trading capital expense for variable expense.

Step-by-Step Solution

1
Analyze the resource procurement shift in the scenario.
The ISV moves from upfront purchasing of physical hardware (servers and storage arrays) to on-demand provisioning on AWS.
Understanding the transition from fixed upfront physical assets to pay-as-you-go computing is necessary to determine the financial shift.
2
Map the transition to the defined benefits of the AWS Cloud.
Shifting from upfront hardware investments to paying only for actual resource consumption aligns with the benefit of trading capital expense for variable expense.
This identifies the specific core benefit that addresses the financial optimization described.
3
Verify each option against the official definitions of AWS benefits and design principles.
The correct option outlines this exact trade-off. The incorrect options misidentify economies of scale, reverse the cost trade-off direction, or misapply design principles like loose coupling.
Ensures the selected option is factually accurate and that all distractors are based on distinct misconceptions.

Key Concept

Trading capital expense for variable expense allows organizations to avoid heavy upfront hardware costs and instead pay only for what they consume, shifting costs from CapEx to OpEx.
Estimated Time:2m 0s
Question 396Question →

A real estate platform is preparing for an external security audit and needs to download official compliance reports, such as ISO certifications and Service Organization Control (SOC) reports, to prove the security of the AWS infrastructure. Which AWS service should the platform use to access these documents?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the central resource for secure, on-demand compliance reports and agreements. It allows customers to download AWS security and compliance documents, such as SOC and ISO reports, to share with their auditors.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is to retrieve third-party compliance reports and certificates (such as ISO and SOC) for the AWS infrastructure.
The platform needs a service that provides secure, on-demand download capabilities for AWS's compliance documents.
AWS manages physical security and infrastructure compliance, and shares these audit reports with customers to help them meet their compliance requirements.
2
Compare the available AWS services and select the correct repository for these compliance documents.
AWS Artifact is identified as the portal designed specifically for retrieving these documents.
AWS Artifact provides on-demand access to AWS's security and compliance reports, whereas services like Amazon Inspector, AWS CloudTrail, and Amazon GuardDuty perform runtime vulnerability scans, API auditing, and threat detection respectively.

Key Concept

AWS Artifact is the primary portal for secure, on-demand compliance reports and agreements.
Estimated Time:45s
Question 397Question →

A startup is developing a mobile application backend. The company wants to focus on writing application code and delivering features without spending time on provisioning, patching, or managing operating systems. To achieve this, they select AWS Lambda for compute and Amazon DynamoDB for database storage. Which AWS Cloud design principle is best demonstrated by this architectural decision?

Show answer & explanation

Answer: Services, not servers

Answer

Services, not servers
The correct answer is the principle of using managed services rather than managing servers. By selecting serverless and fully managed services like AWS Lambda and Amazon DynamoDB, the startup avoids the complexity and effort of operating system maintenance, patching, and server provisioning, allowing them to focus strictly on code.

Step-by-Step Solution

1
Analyze the requirement of the startup.
The startup wants to avoid the operational overhead of provisioning, patching, and maintaining servers.
This points to offloading infrastructure management tasks.
2
Evaluate the selected AWS services (AWS Lambda and Amazon DynamoDB).
Both AWS Lambda and Amazon DynamoDB are fully managed, serverless services that do not require server administration.
This aligns with using managed offerings rather than running virtual machines.
3
Match the architectural choice with the corresponding AWS Cloud design principle.
The selection matches the principle of using services rather than servers.
The 'Services, not servers' principle advises leveraging managed services to reduce operational complexity.

Key Concept

Services, not servers design principle
Question 398Question →

A digital healthcare startup plans to host a patient telemetry application on AWS. To meet regulatory requirements, the startup needs to obtain the AWS ISO 27001 certification, accept the HIPAA Business Associate Addendum (BAA), and ensure that database records are encrypted. Which of the following actions should the startup take to meet these compliance and governance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the ISO 27001 certification and accept the HIPAA Business Associate Addendum (BAA) through AWS Artifact.; Enable encryption for data at rest and in transit within the application's database layer.

Answer

To meet compliance requirements, the startup must download the ISO 27001 certification and accept the HIPAA BAA via AWS Artifact, and they must enable encryption for data at rest and in transit in their database layer.
The correct actions are downloading compliance documents using AWS Artifact and implementing database encryption. AWS Artifact is the central portal for on-demand access to AWS compliance reports and agreements, such as ISO certificates and the HIPAA Business Associate Addendum (BAA). Under the Shared Responsibility Model, AWS secures the underlying infrastructure, while the customer is responsible for encrypting their data at rest and in transit.

Step-by-Step Solution

1
Identify the AWS service dedicated to retrieving compliance reports and signing agreements.
AWS Artifact is identified as the portal for downloading official certifications (like ISO 27001) and accepting legal agreements (like the HIPAA BAA).
AWS Artifact provides on-demand access to AWS security and compliance reports.
2
Determine customer security responsibilities under the Shared Responsibility Model.
Encrypting data at rest and in transit is identified as a customer responsibility ('security in the cloud').
AWS manages physical and hypervisor security, while customers must protect their own data and configure encryption keys.

Key Concept

Retrieving compliance documents through AWS Artifact and understanding customer responsibilities under the Shared Responsibility Model.
Question 399Question →

A media streaming company uses Amazon CloudFront to distribute video files to global users. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of AWS?

Select all that apply

Show answer & explanation

Answer: Maintaining the physical security of the edge locations; Patching the virtualization software and operating systems of the edge servers

Answer

The correct answers are the options stating that AWS is responsible for maintaining the physical security of the edge locations, and patching the virtualization software and operating systems of the edge servers.
Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud. This includes protecting the global infrastructure (Regions, Availability Zones, and Edge locations) that runs all of the services offered in the AWS Cloud. Therefore, maintaining the physical security of edge locations and patching the virtualization software and operating systems of the edge servers are both AWS responsibilities.

Step-by-Step Solution

1
Identify the service type and the specific resources being managed in the scenario.
The scenario involves Amazon CloudFront, which is a managed content delivery network (CDN) service deployed at AWS edge locations.
Understanding the service type helps determine where the boundary lies between customer configuration and AWS-managed infrastructure.
2
Distinguish between infrastructure-level security (security of the cloud) and configuration-level security (security in the cloud).
AWS is responsible for the physical security and infrastructure maintenance of edge locations. The customer is responsible for configuring access rules, geographic restrictions, and certificates.
This allows separation of the responsibilities to select the tasks handled by AWS.

Key Concept

AWS Shared Responsibility Model for managed Edge services
Question 400Question →

A gaming studio wants to automatically identify software vulnerabilities and unintended network exposure on its Amazon EC2 instances. Which AWS service should the studio use to perform these security assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it automatically and continually scans workloads, including Amazon EC2 instances, for software vulnerabilities and unintended network exposure. It identifies package-level issues (CVEs) and provides actionable remediation recommendations.

Step-by-Step Solution

1
Analyze the requirement to scan EC2 instances for software vulnerabilities and network exposure.
Identify that the task requires a vulnerability assessment tool for host operating systems and software packages.
This narrows down the choice to AWS security services that perform package-level and configuration-level vulnerability scanning.
2
Evaluate the capabilities of the available AWS services.
Determine that Amazon Inspector is designed for scanning software vulnerabilities, whereas GuardDuty is for active threat detection, CloudTrail is for API logging, and Artifact is for compliance documents.
Correctly matching the service definition guarantees selecting the proper tool for vulnerability management.

Key Concept

Vulnerability scanning for EC2 instances and workloads using Amazon Inspector
Estimated Time:45s
PreviousPage 20 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin