Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 401Question →

Zenith Retail is planning the migration of its application portfolio to the AWS Cloud. During the discovery phase, the team identifies a legacy mainframe application that is highly customized and runs critical accounting processes. Due to its complexity and the lack of an immediate business case for migration, the company decides to keep this application running in their on-premises data center for now. Which cloud migration strategy is Zenith Retail using for this mainframe application?

Show answer & explanation

Answer: Retaining

Answer

Retaining
The correct answer is Retaining. This strategy involves keeping applications in their current on-premises environment instead of migrating them to the cloud. This is typically chosen for legacy workloads that are highly customized, complex, or lack a business case for immediate migration.

Step-by-Step Solution

1
Analyze the scenario to determine the fate of the legacy mainframe application.
The application is highly customized, runs critical processes, and Zenith Retail decides to keep it running in their on-premises data center for now.
Understanding the target action (keeping the application on-premises) is key to selecting the correct migration strategy.
2
Match the decision of keeping the application on-premises to the correct AWS 6 Rs migration strategy.
This corresponds to the Retaining strategy.
Retaining is defined as keeping applications in their source environment, often due to complexity or pending deprecation/migration plans.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Estimated Time:45s
Question 402Question →

A university is migrating its legacy student registration database to AWS. The database runs on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The security team has established two strict requirements:

1. Automatically deny all network traffic originating from a specific list of blacklisted external IP ranges at the subnet boundary.
2. Allow inbound database connections to the database instances on port 1521, while relying on the firewall's stateful behavior to automatically permit the returning outbound database traffic without requiring any explicit outbound rules.

Which of the following security configurations should the university implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Network Access Control List (Network ACL) at the subnet level with a rule to deny traffic from the blacklisted external IP ranges.; Configure a Security Group at the instance level to allow inbound connections on port 1521.

Answer

To meet the requirements, the university should configure a Network Access Control List at the subnet level with a rule to deny traffic from the blacklisted external IP ranges, and configure a Security Group at the instance level to allow inbound connections on port 1521.
The requirement to deny blacklisted IP ranges at the subnet boundary is met by configuring a Network Access Control List with a deny rule, as Network ACLs operate at the subnet level and support explicit deny rules. The requirement to allow database connections statefully is met by configuring a Security Group, which operates at the instance level and automatically permits return traffic once inbound traffic is allowed.

Step-by-Step Solution

1
Evaluate the requirement to block specific external IP ranges at the subnet boundary.
Network Access Control Lists operate at the subnet boundary and support explicit deny rules, which makes them suitable for blocking the blacklisted IP ranges before traffic enters the subnet. Security groups operate at the instance level and only support allow rules.
This establishes that a Network ACL must be used for the IP blacklisting requirement.
2
Evaluate the requirement to allow database traffic on port 1521 statefully without explicit outbound rules.
Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on a port, the return outbound traffic is automatically allowed. Network ACLs are stateless, so they do not automatically allow return traffic.
This establishes that a Security Group must be configured for the database instances' inbound rules.

Key Concept

Stateful vs. Stateless Network Firewalls in AWS
Question 403Question →

A retail business operates an e-commerce application on AWS. During peak shopping hours, the application requires 20 Amazon EC2 instances to handle the traffic, but during off-peak hours, only 4 instances are needed. The infrastructure team uses Amazon EC2 Auto Scaling to dynamically launch and terminate instances in response to the real-time load. Which AWS Cloud design principle is best illustrated by this scenario?

Show answer & explanation

Answer: Elasticity

Answer

Elasticity
The design principle of elasticity focuses on matching resource allocation with actual demand. In this scenario, dynamically provisioning 20 instances during peak hours and scaling down to 4 instances during off-peak hours ensures the system is cost-effective and performs well without over-provisioning.

Step-by-Step Solution

1
Analyze the scenario details.
The scenario describes a system that automatically adds resources (scaling up to 20 instances) when demand is high and removes them (scaling down to 4 instances) when demand is low.
To identify the specific cloud behavior described.
2
Match the behavior to AWS cloud design principles.
The ability to dynamically scale resources both up and down to match demand is the definition of elasticity.
To select the correct design principle from the options.

Key Concept

Elasticity versus Scalability in cloud design principles
Question 404Question →

A financial services company is hosting a payment processing application on Amazon EC2 instances inside a private subnet. The instances must initiate outbound HTTPS connections (port 443) to an external payment gateway API and receive the responses. The security team requires that network access controls be configured at both the subnet boundary and the instance level. Which two configuration steps must the cloud practitioner take to allow this traffic while maintaining a secure architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add an outbound rule to the Security Group allowing TCP port 443 traffic to the destination IP range.; Add an outbound rule to the Network ACL allowing TCP port 443 traffic, and an inbound rule allowing TCP traffic on ephemeral ports 1024-65535 from the destination IP range.

Answer

Configure the Security Group with an outbound rule allowing TCP port 443 to the destination IP range, and configure the Network ACL with both an outbound rule for TCP port 443 and an inbound rule allowing response traffic on ephemeral ports (1024-65535).
Security Groups operate at the instance level and are stateful. This means that if an outbound rule is created to allow traffic to a destination (such as TCP port 443 to the payment gateway), the return traffic is automatically allowed back in without requiring a corresponding inbound rule. Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that rules must be explicitly created for both outbound and inbound traffic. For outbound connections initiated by the EC2 instances, the outbound rule must allow TCP port 443 to the destination, and the inbound rule must allow the response traffic coming back on ephemeral ports (typically 1024-65535) from the destination.

Step-by-Step Solution

1
Analyze the security controls at the instance level (Security Group).
Since Security Groups are stateful, allowing outbound TCP port 443 traffic to the API gateway is sufficient to also allow the return traffic. No inbound rule is required.
To grant outbound-initiated communication at the instance level while leveraging Security Group's stateful tracking.
2
Analyze the security controls at the subnet boundary (Network ACL).
Since Network ACLs are stateless, traffic must be allowed explicitly in both directions. Outbound traffic needs a rule for TCP port 443, and inbound return traffic needs a rule for ephemeral ports (1024-65535) because client connections use a random source port in that range.
To ensure both request and response packets can cross the subnet boundary.

Key Concept

The difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level) in managing outbound traffic and its inbound responses.
Question 405Question →

A hospitality booking portal hosts its application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (ECR). The security team wants to continuously monitor their AWS accounts for malicious activity and unauthorized behavior, while also automatically scanning the EC2 instances and container images for software vulnerabilities.

Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector to scan the Amazon EC2 instances and Amazon ECR container images for software vulnerabilities; Amazon GuardDuty to perform intelligent threat detection and continuous monitoring for malicious activity

Answer

Amazon Inspector and Amazon GuardDuty
The service that scans Amazon EC2 instances and Amazon ECR container images for software vulnerabilities is Amazon Inspector. The service that provides intelligent threat detection and continuous monitoring for malicious activity is Amazon GuardDuty.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on Amazon EC2 instances and ECR container images.
Amazon Inspector is identified as the appropriate AWS service designed for automated vulnerability management and scanning of EC2 instances and ECR images.
It identifies software vulnerabilities and unintended network exposure.
2
Identify the requirement for intelligent threat detection and continuous monitoring for malicious activity across AWS accounts.
Amazon GuardDuty is identified as the appropriate AWS service for intelligent threat detection.
It analyzes data sources like VPC Flow Logs, CloudTrail logs, and DNS logs using machine learning to detect unauthorized or malicious behavior.

Key Concept

Differentiating AWS threat detection and vulnerability management services under the Shared Responsibility Model.
Question 406Question →

GlowCare Cosmetics plans to migrate its on-premises relational database to Amazon Relational Database Service (Amazon RDS) to reduce database administration tasks. The company wants to complete this transition quickly without changing its core application architecture or rewriting its code. Which cloud migration strategy is the company using?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
The correct strategy is Replatforming. Replatforming involves making minor optimizations, such as migrating a self-managed database to a fully managed service like Amazon RDS, to reduce administrative tasks without changing the core application code or architecture.

Step-by-Step Solution

1
Analyze the migration target in the scenario.
The target is migrating an on-premises database to Amazon RDS, a managed service.
This establishes that an optimization (moving to a managed service) is being made to reduce administrative work.
2
Identify constraints on the code and architecture.
The company does not plan to change its core application architecture or rewrite any code.
This rules out refactoring or re-architecting, which requires code modifications.
3
Match the scenario to the correct migration strategy.
Migrating to a managed service without changing core application code is known as Replatforming.
Replatforming is the strategy that involves minimal modifications ('tinkering') to achieve cloud benefits, such as moving to a managed database.

Key Concept

AWS Cloud Migration Strategies (6 Rs) - Replatforming vs. Rehosting vs. Refactoring
Estimated Time:1m 0s
Question 407Question →

A technology company wants to delegate administrative capabilities by allowing department leads to create and manage IAM roles for their developers. To maintain strict security, the central security team must ensure that these department leads cannot grant permissions that exceed a predefined set of allowed services, even if they create policies with administrator access. Which AWS Identity and Access Management (IAM) feature should the security team implement to enforce this maximum permission limit?

Show answer & explanation

Answer: Permissions boundaries

Answer

Permissions boundaries
Permissions boundaries are specifically designed to set the maximum permissions that an identity-based policy can grant to an IAM entity. This allows senior administrators to delegate the creation of IAM roles to department leads, while ensuring that the leads cannot create roles with permissions that exceed the boundary.

Step-by-Step Solution

1
Analyze the requirement to delegate IAM role management while preventing permission escalation.
Identify that the department leads need to create IAM roles, but must be restricted from granting administrative access to those roles.
This establishes the need for a mechanism that defines the maximum possible permissions that can be delegated.
2
Compare the capabilities of IAM features designed to limit maximum permissions.
Determine that permissions boundaries specifically set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role) within an account.
This aligns with the security best practice of delegation with boundaries.

Key Concept

Permissions boundaries are used to restrict the maximum permissions that an identity-based policy can grant to an IAM user or role.
Estimated Time:2m 0s
Question 408Question →

A non-profit organization is setting up its donation portal on AWS and wants to continuously monitor its AWS accounts and workloads for malicious activity, such as unauthorized API calls or potential cryptocurrency mining. Which AWS service should the organization use to detect these threats?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is correct because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data.

Step-by-Step Solution

1
Identify the need for continuous threat detection and monitoring of AWS accounts and workloads for malicious activities like cryptocurrency mining.
Determine that a service utilizing machine learning and threat intelligence to analyze log sources is required.
Generic logging or vulnerability scanning will not actively identify ongoing threat patterns.
2
Evaluate the correct AWS security service designed for intelligent threat detection.
Amazon GuardDuty is selected because it continuously monitors CloudTrail, VPC Flow Logs, and DNS logs to identify threat patterns.
Amazon GuardDuty is specifically built for active threat detection across AWS accounts.

Key Concept

Intelligent threat detection using Amazon GuardDuty
Question 409Question →

A global travel booking company is preparing for a security audit. The company needs to retrieve AWS compliance documentation, such as SOC reports, and also ensure that their stored customer databases are encrypted. Which of the following actions should the company perform to satisfy these compliance needs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the compliance reports directly using the AWS Artifact console; Enable and configure encryption for customer data stored in AWS databases

Answer

Retrieve the compliance reports directly using the AWS Artifact console, and enable and configure encryption for customer data stored in AWS databases
To retrieve AWS compliance documents like SOC reports, users must access AWS Artifact. To secure customer database contents, the customer must enable and manage encryption themselves, as data protection is a customer responsibility under the Shared Responsibility Model.

Step-by-Step Solution

1
Identify the AWS service dedicated to providing compliance reports.
AWS Artifact is identified as the portal to download SOC and ISO reports.
This satisfies the requirement to retrieve AWS compliance documentation.
2
Determine the party responsible for data encryption under the AWS Shared Responsibility Model.
Encrypting customer data is a customer responsibility ('security in the cloud').
This satisfies the requirement to ensure the customer databases are encrypted.

Key Concept

AWS Compliance and Shared Responsibility Model
Question 410Question →

A smart grid utility operator runs complex grid-reliability simulations once a week. This process requires a large amount of compute capacity for a 6-hour window, but the infrastructure remains completely idle for the rest of the week. Currently, the company maintains an on-premises data center sized to handle this peak load, incurring high upfront costs, virtualization licensing, power, and cooling fees. Which of the following best describes the primary economic driver and financial shift of migrating this simulation workload to AWS?

Show answer & explanation

Answer: Transitioning from capital expenses (CapEx) to operating expenses (OpEx), allowing the company to leverage AWS elasticity and pay only for compute resources during the active simulation window.

Answer

Transitioning from capital expenses (CapEx) to operating expenses (OpEx), allowing the company to leverage AWS elasticity and pay only for compute resources during the active simulation window.
Transitioning from capital expenses (CapEx) to operating expenses (OpEx) is a core benefit of AWS. By leveraging AWS elasticity, the utility only incurs costs when the simulations run, eliminating the overhead of idle infrastructure.

Step-by-Step Solution

1
Analyze the workload's resource usage pattern.
The workload requires high compute capacity for 6 hours once a week, remaining idle for the other 162 hours of the week.
Identifying the pattern helps determine the appropriate cloud architecture and pricing model.
2
Evaluate the financial shift of cloud migration.
Moving away from owning and maintaining physical data centers shifts expenses from Capital Expenses (CapEx) to Operating Expenses (OpEx).
This is a fundamental concept of cloud economics where fixed upfront costs are replaced by variable expenses.
3
Apply the principle of cloud elasticity to the workload.
By scaling down resources to zero during the idle hours, the company only pays for the active 6 hours of simulation runtime.
Elasticity ensures cost optimization by aligning resource provisioning directly with real-time demand.

Key Concept

Concepts of Cloud Economics (CapEx vs OpEx and Elasticity)
Question 411Question →

A company is onboarding a new team of data analysts who require read-only access to Amazon S3 buckets. Which of the following actions should the company take to configure access in accordance with AWS Identity and Access Management (IAM) best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each analyst to ensure unique credentials and individual accountability.; Create an IAM group, attach the ReadOnlyS3 access policy to the group, and add the analyst users to the group.

Answer

Create individual IAM users for each analyst, and create an IAM group with read-only permissions to which the analysts are added.
The correct options are to create individual IAM users and to manage permissions via an IAM group. Creating individual users ensures auditability and security accountability. Using an IAM group allows you to define permissions (such as read-only access to S3) once and apply them to all members of the group, which aligns with AWS best practices for managing permissions at scale.

Step-by-Step Solution

1
Ensure individual accountability for all users.
Identify the need to create unique IAM users rather than sharing accounts.
Individual IAM users allow tracking of actions and secure authentication.
2
Group users by their common access needs.
Create an IAM group with a read-only S3 permission policy and assign the users to it.
Grouping simplifies policy management and ensures the principle of least privilege is applied consistently.

Key Concept

Identity and Access Management (IAM) Best Practices
Question 412Question →

A technology startup runs its backend API on AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks is the responsibility of the startup?

Show answer & explanation

Answer: Configuring Identity and Access Management (IAM) execution roles for the Lambda functions

Answer

Configuring Identity and Access Management (IAM) execution roles for the Lambda functions
Configuring IAM execution roles for Lambda functions is the customer's responsibility. Under the AWS Shared Responsibility Model, identity and access management (IAM) remains a customer responsibility across all service types, ensuring that only authorized users or processes can access the resource.

Step-by-Step Solution

1
Identify the service model of AWS Lambda.
AWS Lambda is a serverless, abstracted service.
The level of customer responsibility depends on whether the service is categorized as infrastructure (IaaS), container/platform (PaaS), or abstract/serverless.
2
Evaluate the customer's responsibility boundary for a serverless service.
AWS manages the infrastructure layer (hardware, virtualization, operating system, and runtime). The customer retains responsibility for configuring access controls, writing code, and protecting their data.
Under the Shared Responsibility Model, even when infrastructure management is offloaded to AWS, IAM configuration remains the customer's responsibility.

Key Concept

AWS Shared Responsibility Model for serverless/abstracted services
Question 413Question →

A media company is migrating its backend processing workloads to serverless architectures using AWS Lambda. The company wants to ensure that all aspects of this environment conform to their security policies. Under the AWS Shared Responsibility Model, which responsibility falls solely on the customer when deploying these serverless functions?

Show answer & explanation

Answer: Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can access

Answer

Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can access
Under the AWS Shared Responsibility Model, AWS Lambda represents a serverless service where AWS manages the entire infrastructure stack, including physical security, hardware, virtualization, the guest operating system, and the application runtime. The customer's responsibility is focused on the security of their code and access management. This includes creating and configuring the Identity and Access Management (IAM) execution roles that specify the exact permissions the function has when interacting with other AWS services.

Step-by-Step Solution

1
Identify the AWS service type and its deployment model
AWS Lambda is a serverless (managed) compute service.
Managed services shift more infrastructure-level responsibilities (such as OS patching and runtime maintenance) to AWS.
2
Define the boundaries of the Shared Responsibility Model for serverless compute
AWS is responsible for physical security, hardware, virtualization, operating systems, and runtimes. The customer is responsible for application code, data, and access configurations.
This establishes which operational tasks belong to the customer.
3
Evaluate the operational tasks in the options against the boundary
Configuring the IAM execution role is a customer access management configuration, while patching the guest OS, maintaining language runtimes, and managing subnet hosts are AWS responsibilities.
This identifies the correct customer responsibility.

Key Concept

Shared Responsibility Model for Serverless Services
Estimated Time:1m 15s
Question 414Question →

A company has hired an external security auditing firm to inspect their AWS resource configurations. The auditors require read-only access to the AWS account for a limited period of two weeks. Which of the following options represents the AWS-recommended best practice to grant the external auditors access?

Show answer & explanation

Answer: Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.

Answer

Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.
The correct answer is to create an IAM role that the external auditors can assume. This is the AWS-recommended best practice because IAM roles generate temporary security credentials, minimizing the risk of credential exposure and avoiding the need to manage long-term credentials for external parties.

Step-by-Step Solution

1
Identify the access requirements for the external auditor.
The auditor requires read-only access for a limited time (two weeks).
This establishes that the access is temporary and delegated to an external entity.
2
Select the correct IAM entity type for temporary third-party access.
An IAM role is the appropriate entity because it grants temporary security credentials via role assumption.
IAM roles prevent the creation of permanent credentials and do not require sharing account credentials.

Key Concept

Delegating temporary access to third parties using IAM roles
Question 415Question →

A regional hospital network is planning to migrate its patient medical imaging archive and processing system to AWS. The network currently maintains physical storage arrays and server hardware on-premises, requiring significant upfront capital investments and ongoing facility maintenance. The imaging archive grows steadily, but the processing demand peaks predictably during daytime clinic hours and drops significantly at night. The network wants to align its infrastructure costs with actual usage and minimize capital expenditures (CapEx).

Which two strategies should the network implement to achieve these cloud economics goals?

Select all that apply

Show answer & explanation

Answer: Replacing upfront physical server purchases with a pay-as-you-go pricing model for compute and storage resources.; Deploying elastic resources that automatically scale down during night hours to match the reduced demand.

Answer

The correct strategies are replacing upfront physical server purchases with a pay-as-you-go pricing model, and deploying elastic resources that automatically scale down during night hours.
Replacing upfront physical server purchases with a pay-as-you-go model shifts capital expenses to operating expenses. Furthermore, deploying elastic resources that scale down at night aligns capacity with actual usage, minimizing waste and reducing the Total Cost of Ownership (TCO).

Step-by-Step Solution

1
Analyze the financial objective of minimizing capital expenditures (CapEx).
Determine that shifting from physical hardware acquisition (CapEx) to a pay-as-you-go consumption model (OpEx) fulfills this goal.
On-premises infrastructure requires large upfront investments, whereas AWS allows paying for resources as they are consumed, eliminating upfront CapEx.
2
Analyze the operational objective of aligning costs with actual usage.
Determine that resources should dynamically scale down when demand drops at night rather than running at peak levels constantly.
By using elasticity to match capacity with variable demand, the organization avoids paying for idle resources during off-peak hours.

Key Concept

Cloud economics benefits, specifically the shift from CapEx to OpEx and the utilization of elasticity to reduce TCO.
Question 416Question →

A startup is designing a secure multi-tier environment in an Amazon VPC. They require a network security control at the subnet boundary that does not track connection state, meaning inbound and outbound traffic must be allowed via explicit, separate rules. For individual Amazon EC2 instances, they require a firewall that automatically allows outbound return traffic if the inbound request is permitted. Which combination of AWS network security features should the startup implement to meet these requirements?

Show answer & explanation

Answer: Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.

Answer

Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.
The correct option is correct because Network Access Control Lists (NACLs) are stateless and applied at the subnet boundary, fulfilling the requirement for separate inbound/outbound evaluation. Security Groups are stateful and applied at the instance level, fulfilling the requirement for automatic return traffic permission.

Step-by-Step Solution

1
Identify the service that operates at the subnet boundary and is stateless.
Network Access Control Lists (NACLs) are stateless firewalls that control traffic at the subnet boundary, requiring explicit rules for both inbound and outbound traffic.
NACLs do not track connection state, meaning return traffic must be explicitly permitted by a corresponding rule in the opposite direction.
2
Identify the service that operates at the instance level and is stateful.
Security Groups are stateful firewalls that secure individual instances (virtual interfaces), automatically allowing return traffic.
Security Groups track the state of connections, allowing response traffic to flow back to the requester automatically without requiring an explicit rule.
3
Select the option combining NACLs at the subnet level and Security Groups at the instance level.
The correct combination aligns NACLs at the subnet layer and Security Groups at the instance layer.
This configuration satisfies both the stateless subnet boundary requirement and the stateful instance firewall requirement.

Key Concept

Stateful vs. Stateless AWS Network Security Features
Question 417Question →

A digital marketing firm is moving its media processing application to the AWS Cloud. The application currently processes video uploads in a sequential manner, where a failure in the rendering module causes the upload module to stop responding. To address this, the firm wants to modernize the architecture using AWS Cloud design principles to improve resilience and cost efficiency.

Which design decisions should the firm implement to achieve these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement an Amazon Simple Queue Service (Amazon SQS) queue to decouple the front-end upload interface from the back-end rendering service; Use Amazon EC2 Auto Scaling to dynamically provision and terminate rendering instances based on the volume of videos in the queue

Answer

Implementing an Amazon Simple Queue Service (Amazon SQS) queue to decouple the front-end upload interface from the back-end rendering service, and using Amazon EC2 Auto Scaling to dynamically provision and terminate rendering instances based on the volume of videos in the queue.
Implementing an Amazon SQS queue ensures the front-end upload interface and the rendering backend are decoupled, allowing them to scale and fail independently (loose coupling). Integrating Amazon EC2 Auto Scaling based on queue size allows capacity to automatically adjust to demand, ensuring both performance and cost-efficiency (elasticity).

Step-by-Step Solution

1
Analyze the architectural requirements for resilience and cost efficiency.
Identified that the application has a tight dependency between upload and rendering modules (needs loose coupling to improve resilience) and variable workload peaks (needs elasticity to optimize costs).
This establishes which design principles must be targeted to solve the issues described in the scenario.
2
Select options that match the required design principles.
Using Amazon SQS decouples the modules (loose coupling), and using Amazon EC2 Auto Scaling dynamically adjusts rendering instances (elasticity).
These choices implement cloud-native architectures that replace tightly coupled infrastructure with scalable, decoupled systems.

Key Concept

AWS Cloud Design Principles: Loose Coupling and Elasticity
Question 418Question →

An automobile manufacturer is migrating its web applications to AWS and wants to establish automated security checks. The manufacturer needs to implement software vulnerability assessments on its application hosts and monitor AWS account activity for potential security threats. Which AWS services should be selected to fulfill these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty should be selected to meet the requirements.
Amazon Inspector is the correct choice for host and software vulnerability scanning on instances and containers. Amazon GuardDuty is the correct choice for continuous threat detection and monitoring of malicious activity across AWS accounts.

Step-by-Step Solution

1
Identify the requirement for software vulnerability assessment on application hosts.
Determine that Amazon Inspector is the AWS service designed to automatically scan EC2 instances and containers for known software vulnerabilities.
Host security scanning is a core feature of Amazon Inspector.
2
Identify the requirement to monitor AWS account activity for active security threats.
Determine that Amazon GuardDuty is the AWS service that uses intelligent threat detection to identify unauthorized or malicious activity across AWS accounts.
Threat detection based on account activity and network logs is a core feature of Amazon GuardDuty.

Key Concept

AWS threat detection and vulnerability management services
Question 419Question →

A company is migrating its web application to AWS. To handle unpredictable changes in user demand, the company configures the application to automatically scale its compute resources up and down. Additionally, the company decides to use Amazon DynamoDB, a fully managed database service, instead of installing and maintaining database software on EC2 instances. Which of the following design principles of the AWS Cloud is the company implementing? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Elasticity; Services, not servers

Answer

The company is implementing the principles of Elasticity and Services, not servers.
The startup implements elasticity by configuring the application to automatically scale its compute resources in response to real-time demand. It also implements the 'services, not servers' principle by leveraging Amazon DynamoDB, a fully managed service, which eliminates the administrative burden of provisioning and managing virtual servers.

Step-by-Step Solution

1
Analyze the automatic scaling behaviour.
The application automatically scales resources up and down to match demand. This maps directly to the principle of Elasticity.
Elasticity is the ability to acquire resources as you need them and release them when you don't.
2
Analyze the choice of database service.
The company chose a managed database service (Amazon DynamoDB) instead of running the database software on EC2 instances. This maps to the principle of Services, not servers.
Using managed services allows organizations to focus on application development rather than server maintenance.

Key Concept

AWS Cloud Design Principles: Elasticity and Services, not servers
Question 420Question →

AeroTemp Solutions, a weather forecasting startup, wants to migrate its legacy monolithic weather prediction application to the AWS Cloud. The startup's primary goal is to fully leverage cloud-native features, such as serverless computing and auto-scaling, to handle sudden spikes in weather data processing. To achieve this, the IT team decides to completely redesign the application architecture, breaking the monolith into independent microservices using AWS Lambda and Amazon DynamoDB. Which cloud migration strategy is AeroTemp Solutions employing?

Show answer & explanation

Answer: Refactoring

Answer

Refactoring
Refactoring (also known as re-architecting) is the migration strategy where an application is reimagined and rewritten to run on a cloud-native architecture. In this scenario, breaking the monolith into serverless microservices using AWS Lambda and Amazon DynamoDB represents a complete architectural redesign, which is characteristic of Refactoring.

Step-by-Step Solution

1
Analyze the organization's requirements and migration plans.
The startup wants to break their monolithic application into microservices using serverless technologies (AWS Lambda and Amazon DynamoDB).
Identifying the planned actions helps determine which migration strategy is being used.
2
Map the migration actions to the 6 Rs migration strategies.
Completely redesigning and rewriting the application to use cloud-native services aligns with Refactoring (Re-architecting).
Comparing the actions against the definitions of the migration strategies leads to the correct classification.

Key Concept

Cloud migration strategies (6 Rs)
Estimated Time:1m 0s
PreviousPage 21 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin