Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 441Question →

An agricultural technology company is migrating its crop monitoring analysis platform from an on-premises data center to the AWS Cloud. The company wants to focus its engineering resources on developing predictive soil algorithms rather than managing physical server racks and hardware cabling. Additionally, they want to pay only for the compute resources used during the active growing seasons, rather than purchasing physical servers that sit idle during winter. Which of the following AWS Cloud benefits directly align with this company's goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trade fixed expense for variable expense; Stop spending money running and maintaining data centers

Answer

The correct benefits are trading fixed expense for variable expense, and stopping spending money running and maintaining data centers.
The correct options are the ones stating we should trade fixed expense for variable expense and stop spending money running and maintaining data centers. The company's goal of paying only for active seasons maps to variable pricing, and their desire to avoid hardware management maps to leaving data center maintenance to AWS.

Step-by-Step Solution

1
Analyze the company's requirement to pay only for resources used during active growing seasons instead of owning idle hardware.
This aligns with the cloud benefit of trading fixed expense (capital expenses for hardware) for variable expense (operational expenses based on usage).
By using the cloud, businesses only pay for the IT resources they consume, optimizing costs for seasonal workloads.
2
Analyze the company's requirement to focus on development of soil algorithms rather than managing server racks and hardware cabling.
This aligns with the cloud benefit of stopping spending money running and maintaining data centers.
AWS manages the physical infrastructure, power, cooling, and hardware maintenance, allowing customers to focus on business-differentiating activities.

Key Concept

AWS Cloud Benefits (Value Proposition)
Question 442Question →

A financial technology startup has deployed application microservices across multiple AWS accounts. To protect their workloads, the startup's security team needs to implement a solution that continuously scans their container images and virtual machines for software vulnerabilities, while also analyzing log sources (such as VPC Flow Logs and DNS query logs) to detect active threats and potential data exfiltration. Which of the following AWS services should the startup configure to address both of these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty to continuously monitor and analyze log sources for active security threats and anomalous behaviors.; Amazon Inspector to automatically scan container images and virtual machine instances for known software vulnerabilities.

Answer

Amazon GuardDuty for active threat detection and Amazon Inspector for vulnerability scanning
Amazon GuardDuty and Amazon Inspector are the correct choices. Amazon GuardDuty is the managed intelligent threat detection service that monitors VPC Flow Logs, DNS logs, and CloudTrail event logs to identify threats like command-and-control communication or data exfiltration. Amazon Inspector is the automated vulnerability management service that scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Analyze the requirement for active threat detection based on log monitoring.
Identify that the startup needs to detect anomalies and unauthorized activities by analyzing DNS logs and VPC Flow Logs.
Amazon GuardDuty uses machine learning and threat intelligence to analyze AWS logs (CloudTrail, VPC Flow Logs, DNS query logs) to detect active threats.
2
Analyze the requirement for host and container vulnerability management.
Identify that the startup needs to scan virtual machines and container images for software vulnerabilities.
Amazon Inspector is designed specifically to automate vulnerability assessment for Amazon EC2 workloads and Amazon Elastic Container Registry (ECR) images.
3
Evaluate and eliminate incorrect services based on their functions.
Exclude AWS CloudTrail, Amazon Macie, and AWS Shield as they perform auditing, sensitive data discovery, and DDoS protection respectively, rather than host vulnerability scanning or broad log-based threat detection.
Correctly identifying the primary purpose of each AWS security service ensures compliance with the AWS Shared Responsibility Model and architectural best practices.

Key Concept

AWS Threat Detection and Vulnerability Management using Amazon GuardDuty and Amazon Inspector
Estimated Time:2m 0s
Question 443Question →

A biotech startup is developing a genomic sequencing platform. To launch the product quickly, the startup wants its small team of software developers to focus on refining their proprietary analysis algorithms and user interface rather than managing server hardware, networking cables, and cooling systems.

Which benefit of the AWS Cloud is this startup demonstrating by choosing to deploy their platform on AWS?

Show answer & explanation

Answer: Stop spending money running and maintaining data centers

Answer

Stop spending money running and maintaining data centers
The correct answer is 'Stop spending money running and maintaining data centers'. By deploying on AWS, the startup delegates physical infrastructure tasks like hardware procurement, cabling, and cooling to AWS, allowing their development team to focus on core business tasks like writing algorithms.

Step-by-Step Solution

1
Identify what physical and operational tasks the startup wants to avoid.
The startup wants to avoid tasks related to physical hardware procurement, cabling, cooling, and power management.
These tasks represent the overhead of running a physical data center.
2
Match this avoidance of infrastructure management with the corresponding AWS Cloud benefit.
AWS takes care of racking, stacking, and powering servers, allowing the startup to focus on their core business differentiator.
This directly maps to the AWS benefit of 'Stop spending money running and maintaining data centers'.

Key Concept

Benefits of the AWS Cloud
Estimated Time:1m 0s
Question 444Question →

A logistics company is migrating its package tracking application to AWS. To ensure the application remains operational even during a physical infrastructure outage, the architects configure the application to run on Amazon EC2 instances spread across three Availability Zones behind an Application Load Balancer. They also deploy a Multi-AZ Amazon RDS database instance that automatically replicates data and handles failover. Which AWS Cloud design principle is directly implemented by this architecture?

Show answer & explanation

Answer: Design for failure

Answer

Design for failure
Designing for failure is a core AWS principle that assumes systems will eventually experience outages. By distributing EC2 instances across multiple Availability Zones and using a Multi-AZ RDS deployment, the system is designed to automatically detect failure, fail over, and continue operating without downtime.

Step-by-Step Solution

1
Identify the primary objective of the architecture described in the scenario.
The architecture is designed to prevent application downtime and ensure continuous operation during a physical infrastructure outage.
Understanding the problem being solved helps determine which cloud design principle applies.
2
Analyze the mechanisms used to achieve this objective.
The system utilizes EC2 instances distributed across three Availability Zones and a Multi-AZ database with automatic replication and failover.
Identifying the technical components helps link them to specific AWS principles.
3
Map the mechanism of distributing resources and automating failover to an AWS Cloud design principle.
This matches the 'design for failure' principle, which advises building systems that assume components will fail and automates the recovery path.
This confirms the correct principle that explains this high-availability configuration.

Key Concept

Design for failure
Estimated Time:1m 0s
Question 445Question →

A software development firm manages a multi-account AWS environment. A developer in the development account needs temporary administrative access to perform emergency troubleshooting on resources in the production account. Which of the following options represents the most secure, AWS-recommended method to achieve this?

Show answer & explanation

Answer: Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.

Answer

Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.
The correct method is to create an IAM role in the production account that trusts the development account, and then allow the developer to assume this role. This approach follows the security best practice of using temporary credentials (via AWS STS) for cross-account delegation, eliminating the need to create static credentials or duplicate users across multiple accounts.

Step-by-Step Solution

1
Evaluate the need for cross-account access and identify the appropriate IAM entity.
Determine that IAM roles are designed to delegate access to resources across different AWS accounts using temporary credentials.
IAM roles allow users in one account to assume permissions in another account securely without creating duplicate IAM users or sharing static keys.
2
Configure the trust policy of the target IAM role in the production account.
Define a trust policy that specifies the development account ID as a trusted principal.
This establishes a cryptographic trust relationship, allowing users in the trusted development account to assume the role.
3
Grant the developer permission to assume the cross-account role.
Attach an IAM policy to the developer's IAM user or group in the development account that allows the sts:AssumeRole action on the production role's ARN.
The developer must have explicit permission to request the temporary credentials from AWS STS.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials.
Estimated Time:1m 30s
Question 446Question →

A logistics company is preparing for an external audit to verify that its cloud infrastructure meets international compliance standards. The company needs to retrieve AWS security reports and determine which security tasks are managed directly by AWS. Which two of the following actions should the company take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Download AWS compliance documents, such as SOC and PCI reports, using AWS Artifact; Identify that physical security and infrastructure virtualization controls are managed by AWS

Answer

Downloading AWS compliance documents from AWS Artifact and identifying that physical security and infrastructure virtualization controls are managed by AWS.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports). Additionally, under the Shared Responsibility Model, AWS is responsible for 'security of the cloud,' which includes physical security of the data centers and the virtualization layer.

Step-by-Step Solution

1
Locate the tool to retrieve AWS compliance reports.
Identify AWS Artifact as the on-demand service for downloading SOC, PCI, and ISO compliance documents.
The company needs to obtain official AWS compliance documents for its auditors.
2
Determine the physical and infrastructure security boundaries.
Identify that AWS manages physical security of the data centers and the virtualization layer under the Shared Responsibility Model.
The company needs to establish which security controls are handled directly by AWS.

Key Concept

Retrieving AWS compliance reports and mapping shared responsibility boundaries.
Question 447Question →

A systems administrator is troubleshooting a connectivity issue for a web application deployed on Amazon EC2 instances within a custom VPC subnet. The instances are associated with a stateful Security Group that allows inbound HTTP (port 80) traffic from any source, and allows all outbound traffic. At the subnet level, the custom Network Access Control List (Network ACL) is configured with an inbound rule allowing HTTP (port 80) traffic from any source, but its outbound rule set only contains the default deny rule. Users report that they receive connection timeouts when trying to access the web application. Which of the following explains why the connection attempts are timing out?

Show answer & explanation

Answer: The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.

Answer

The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.
The correct answer is correct because Network Access Control Lists (Network ACLs) are stateless. Even though the inbound HTTP traffic is allowed and the instance's Security Group is stateful (allowing return traffic automatically at the instance level), the stateless Network ACL blocks the return traffic because it does not track connection states. Therefore, an outbound rule must be explicitly added to the Network ACL to allow the web server's responses to reach the clients' ephemeral ports (typically 1024-65535).

Step-by-Step Solution

1
Analyze the stateful nature of the Security Group associated with the EC2 instances.
The Security Group is stateful, so inbound HTTP traffic on port 80 is allowed, and its response traffic is automatically allowed outbound at the instance level.
To determine if the traffic is blocked at the instance boundary.
2
Analyze the stateless nature of the Network ACL associated with the subnet.
The Network ACL is stateless, which means outbound return traffic is not tracked or automatically allowed, even if the corresponding inbound traffic was permitted.
To check if the subnet boundary is blocking the return traffic.
3
Identify the missing configuration in the Network ACL outbound rules.
The outbound rule set only contains the default deny rule, blocking response packets sent to client ephemeral ports (typically 1024-65535). An explicit outbound rule is required.
To resolve the connection timeout by allowing the server to respond to the client.

Key Concept

Stateful vs. Stateless network security controls in AWS VPC
Estimated Time:2m 0s
Question 448Question →

A regional energy utility company is hosting its customer portal on AWS. In preparation for an upcoming regulatory audit, the company's compliance officer needs to retrieve the AWS Service Organization Control (SOC) reports to verify the security controls of the AWS physical infrastructure. Which AWS resource provides on-demand access to these compliance documents?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact is the primary, self-service portal for downloading AWS compliance documents, such as SOC and PCI reports, which are required for demonstrating compliance.

Step-by-Step Solution

1
Identify the requirement to retrieve third-party audit reports (such as SOC reports) for AWS infrastructure.
Recognized that the auditor needs AWS-owned compliance documentation rather than customer-generated logs.
This establishes the scope of the search to AWS infrastructure compliance.
2
Evaluate AWS services that provide self-service access to security and compliance reports.
Identified AWS Artifact as the dedicated portal for compliance documentation.
This matches the requirements of obtaining audit-ready reports on-demand.

Key Concept

AWS Artifact is the central resource for downloading AWS security and compliance reports.
Estimated Time:1m 0s
Question 449Question →

A media streaming company wants to improve its security posture on AWS. The company needs to implement continuous monitoring of its AWS accounts for malicious activity or unauthorized behavior. Additionally, it needs to automatically scan its Amazon EC2 instances for software vulnerabilities.

Which of the following AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection across AWS accounts, while Amazon Inspector automatically scans EC2 instances for software vulnerabilities.
Amazon GuardDuty is correct because it provides continuous, intelligent threat detection by monitoring network logs and account activity. Amazon Inspector is correct because it is the dedicated tool for scanning EC2 instances and container images for software vulnerabilities and network exposure.

Step-by-Step Solution

1
Identify the service needed for continuous monitoring of AWS accounts for malicious or unauthorized activity.
Amazon GuardDuty is designed for intelligent threat detection and continuous monitoring of AWS workloads and accounts.
GuardDuty uses machine learning and threat intelligence to detect anomalies and unauthorized activities.
2
Identify the service needed to scan Amazon EC2 instances for software vulnerabilities.
Amazon Inspector is the service that automatically scans EC2 instances, containers, and serverless functions for known vulnerabilities.
Inspector compares system configurations and software packages against databases of known security vulnerabilities.

Key Concept

Identifying the distinct roles of AWS threat detection and vulnerability management services.
Question 450Question →

A smart-agriculture IoT company runs containerized data processing applications on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team wants to implement continuous, automated scans to identify software vulnerabilities in both the EC2 operating system packages and the ECR container images. According to the AWS Shared Responsibility Model, which AWS service performs these scans, and who is responsible for configuring the tool and remediating the findings?

Show answer & explanation

Answer: Amazon Inspector is used to perform the vulnerability scans, and the customer is responsible for configuring the scans and patching the identified vulnerabilities.

Answer

Amazon Inspector is used to perform the vulnerability scans, and the customer is responsible for configuring the scans and patching the identified vulnerabilities.
Amazon Inspector is a vulnerability management service that continuously scans AWS workloads, including Amazon EC2 instances and Amazon ECR container images, for software vulnerabilities and unintended network exposure. Under the AWS Shared Responsibility Model, the customer is responsible for configuring the service, analyzing the findings, and performing remediation (such as patching operating systems and updating container images), while AWS is responsible for the security OF the cloud (the underlying infrastructure).

Step-by-Step Solution

1
Identify the security requirement from the scenario.
The platform needs continuous, automated scanning of Amazon EC2 operating system packages and Amazon ECR container images for known software vulnerabilities.
This establishes that the necessary capability is host and package vulnerability scanning rather than network threat detection or API activity logging.
2
Select the correct AWS service that corresponds to vulnerability scanning.
Amazon Inspector is identified as the AWS service that provides automated vulnerability management for EC2 and ECR.
This eliminates services like Amazon GuardDuty (used for threat detection) and AWS CloudTrail (used for API logging).
3
Apply the AWS Shared Responsibility Model to the scenario's operations.
Determine that while AWS provides the Amazon Inspector service, the customer is responsible for enabling it, configuring the scan scopes, analyzing the reports, and executing remediation actions such as patching the EC2 guest OS and updating container files.
This rules out the misconception that AWS automatically remediates or patches customer-managed software resources.

Key Concept

Vulnerability management and the division of security duties under the AWS Shared Responsibility Model
Estimated Time:2m 0s
Question 451Question →

A startup is establishing its cloud presence and needs to set up administrative access for its system administrator. The administrator will be responsible for creating resources, managing network settings, and monitoring logs on a daily basis. What is the AWS-recommended best practice to configure this administrative access?

Show answer & explanation

Answer: Create an individual IAM user for the administrator, grant the necessary administrative permissions, and enforce multi-factor authentication (MFA)

Answer

Create an individual IAM user for the administrator, grant the necessary administrative permissions, and enforce multi-factor authentication (MFA)
Creating an individual IAM user for the administrator, granting the necessary permissions, and enabling MFA aligns with AWS security best practices. This ensures accountability, limits the exposure of the root account, and adds an extra layer of security via MFA.

Step-by-Step Solution

1
Identify the security requirements for daily administrative access, recognizing that the root user should not be used.
Discard the option suggesting the use of the AWS account root user.
AWS security best practices dictate that the root user credentials should be locked away and used only for a few specific tasks.
2
Evaluate the customer's versus AWS's responsibilities in managing access credentials under the AWS Shared Responsibility Model.
Discard the option proposing that AWS support manages user daily permissions.
Identity and Access Management (IAM) configurations are strictly the responsibility of the customer.
3
Determine the correct IAM entity and authentication setup for a human user requiring administrative access.
Identify that an individual IAM user with MFA is the recommended secure configuration, whereas roles are for temporary access and are not shared with static credentials.
An individual IAM user ensures accountability, enables MFA for security, and avoids sharing credentials or using temporary role configurations incorrectly.

Key Concept

AWS IAM Best Practices and Root User Security
Estimated Time:1m 30s
Question 452Question →

Veridian Financial Services is conducting a comprehensive audit of its on-premises application portfolio in preparation for migrating to the AWS Cloud. During this discovery phase, the IT team identifies a legacy transactional logging tool. The team discovers that this tool's functionality has been fully replaced by a newer business intelligence platform, and no users or systems have accessed it for over 18 months. Which migration strategy should Veridian Financial Services apply to this legacy transactional logging tool?

Show answer & explanation

Answer: Retiring

Answer

Retiring
Retiring is the migration strategy used when an application is no longer needed or its functionality has been replaced. Decommissioning these applications reduces the scope, cost, and complexity of the migration.

Step-by-Step Solution

1
Analyze the usage and business necessity of the identified legacy tool.
The tool has not been accessed for 18 months and its functionality is already replaced by another platform.
To determine if the application is still required by the business.
2
Match the scenario characteristics to the 6 Rs migration strategies.
Since the application is no longer useful, it should be decommissioned or shut down, which corresponds to the Retiring strategy.
Identifying the correct migration strategy reduces migration scope and saves costs by avoiding the migration of obsolete systems.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Question 453Question →

A startup wants to establish operational visibility and security auditing. They need to log all API calls made by users and services across their AWS account, and they also need to collect and monitor performance metrics, such as CPU utilization, from their Amazon EC2 instances.

Which of the following AWS services should the startup use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch are the correct services. AWS CloudTrail is used to audit user activity and API calls, while Amazon CloudWatch monitors resource metrics and performance.
AWS CloudTrail is designed to capture and log API calls and user activity, satisfying the audit requirement. Amazon CloudWatch collects and monitors operational performance metrics such as CPU utilization, satisfying the resource monitoring requirement.

Step-by-Step Solution

1
Identify the service that records API activity and user actions for auditing.
AWS CloudTrail records API calls made within the AWS account, which satisfies the auditing requirement.
CloudTrail is the primary service dedicated to governance, compliance, and auditing of actions in an AWS account.
2
Identify the service that collects and monitors resource metrics like CPU utilization.
Amazon CloudWatch tracks and monitors performance metrics and logs from AWS resources.
CloudWatch is the core monitoring and observability service designed to track resource health and application performance.

Key Concept

AWS CloudTrail provides API auditing and user activity tracking, whereas Amazon CloudWatch provides resource performance monitoring and metrics collection.
Question 454Question →

A software development company is setting up its testing environments on AWS. The team wants to deploy identical environments temporarily using templates, delete them when testing is complete to minimize costs, and ensure the system can recover automatically if a virtual server stops working. Which two AWS Cloud design principles should the team follow to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Design for failure; Disposable resources instead of fixed servers

Answer

The correct principles are designing for failure and using disposable resources instead of fixed servers.
The correct design principles are designing for failure and using disposable resources instead of fixed servers. Designing for failure ensures that the application is built to handle infrastructure outages and recover automatically, such as when a virtual server stops working. Using disposable resources instead of fixed servers allows the company to deploy identical environments using templates and easily terminate them when testing is finished, reducing costs.

Step-by-Step Solution

1
Analyze the requirement to temporarily deploy identical environments and delete them to minimize costs.
Identify that this matches the principle of using disposable resources instead of fixed servers, where resources are treated as temporary and can be easily created and destroyed using automation.
To understand how the company can avoid long-running, costly servers for temporary testing.
2
Analyze the requirement to ensure the system can recover automatically if a virtual server stops working.
Identify that this aligns with the principle of designing for failure, which advocates for building systems that can automatically detect and recover from component outages.
To ensure high availability and self-healing capabilities in the cloud.
3
Compare the identified principles with the options and eliminate anti-patterns.
Confirm that designing for failure and using disposable resources instead of fixed servers are the correct principles, while eliminating options that promote static, tightly coupled, or pre-provisioned infrastructure.
To select the correct options representing official AWS design principles.

Key Concept

AWS Cloud design principles promote system resilience through designing for failure and flexibility through disposable resources.
Question 455Question →

A digital real estate platform runs its database and web servers on Amazon Elastic Compute Cloud (Amazon EC2) instances. The platform's security team needs to implement a solution that automatically scans these EC2 instances for software vulnerabilities, package issues, and unintended network path exposures. Which AWS service should the real estate platform use to meet these requirements?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it is specifically designed to perform automated vulnerability scans on Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions, detecting known software vulnerabilities and unintended network paths.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is scanning Amazon EC2 instances for software vulnerabilities, package issues, and unintended network path exposures.
The target task is vulnerability management and host-level security assessment.
This narrows down the potential AWS services to those focused on scanning workloads for known CVEs and exposure.
2
Evaluate the available AWS security services against this requirement and select the one designed specifically for automated vulnerability scanning.
Amazon Inspector is the designated service for automated vulnerability management on EC2 and container images.
It matches the scanning requirement, whereas other security services focus on threat detection, logging, or operational management.

Key Concept

Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure.
Question 456Question →

A startup is setting up its initial AWS environment and wants to secure the account. Which of the following are AWS Identity and Access Management (IAM) best practices that the startup should implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) for the AWS account root user.; Create individual IAM users for each team member who requires access.

Answer

The correct practices are to enable multi-factor authentication (MFA) for the AWS account root user and to create individual IAM users for each team member who requires access.
Securing the root user with multi-factor authentication (MFA) protects the root account from credential theft. Creating individual IAM users ensures distinct identities, which supports traceability and facilitates implementing specific permissions for each team member.

Step-by-Step Solution

1
Review account-level security best practices.
Identify that securing the root account with multi-factor authentication (MFA) is the highest priority first step.
The root user has complete administrative control over the entire AWS account, so securing it prevents full-scale compromises.
2
Evaluate user-level credential provisioning policies.
Determine that individual team members must be assigned their own distinct IAM users rather than sharing root or general user credentials.
This establishes accountability and enables administrators to grant permissions using the principle of least privilege.

Key Concept

Applying core IAM best practices to protect account resources by isolating root privileges and utilizing individual user identities.
Question 457Question →

A non-profit organization stores its public files in Amazon S3 and runs a web application on Amazon EC2 instances. Which two of the following tasks are the responsibility of AWS under the AWS Shared Responsibility Model?

Select all that apply

Show answer & explanation

Answer: Maintaining physical security of the data centers hosting the infrastructure; Disposing of decommissioned physical storage devices

Answer

AWS is responsible for maintaining the physical security of the data centers and securely disposing of decommissioned physical storage devices.
Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud. This includes physical data center security and hardware lifecycle tasks, such as destroying decommissioned physical storage drives.

Step-by-Step Solution

1
Identify the service models described in the scenario.
Amazon S3 (a managed object storage service) and Amazon EC2 (an Infrastructure as a Service, or IaaS, compute service) are used.
This establishes where the boundary of responsibility is drawn for each service.
2
Distinguish between responsibilities for security 'of' the cloud and security 'in' the cloud.
AWS handles the security 'of' the cloud (physical infrastructure, hardware, and the virtualization layer). The customer handles the security 'in' the cloud (guest operating systems, application configurations, firewall rules, and data access policies).
This division is the foundational logic of the AWS Shared Responsibility Model.
3
Evaluate the choices to see which are managed by AWS.
Physical data center security and physical storage device disposal belong to AWS. Configuring S3 bucket permissions, patching the EC2 guest operating system, and managing security groups are operational tasks managed by the customer.
This identifies the two correct responsibilities assigned to AWS.

Key Concept

AWS Shared Responsibility Model
Estimated Time:1m 0s
Question 458Question →

A company wants to automate vulnerability assessments for its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which AWS service should the company use?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads (such as Amazon EC2 instances, AWS Lambda functions, and container images) for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the goal
The company wants to automatically scan Amazon EC2 instances to check for software vulnerabilities and unintended network exposure.
This establishes the requirements of vulnerability scanning at the host/software level.
2
Select the appropriate AWS service
Amazon Inspector is selected as the correct service.
Amazon Inspector is specifically designed to automate security assessments and vulnerability scanning on EC2 instances and container images.

Key Concept

Vulnerability management on AWS hosts and packages
Estimated Time:45s
Question 459Question →

A company is migrating its legacy application to the AWS Cloud. Currently, the application's user interface and database reside on the same server, meaning a database issue will crash the entire user interface. The team decides to split these components into independent tiers that communicate through well-defined APIs. Which design principle of the AWS Cloud does this separation directly demonstrate?

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling
The correct answer is loose coupling. By separating the user interface and the database into independent tiers that interact through APIs, the application becomes more resilient. If one component fails, the other can continue to function or handle the error gracefully, avoiding a complete system crash.

Step-by-Step Solution

1
Analyze the scenario details.
The scenario describes separating the user interface and database into independent tiers that communicate through APIs.
Identifying the core change helps determine which cloud design principle is being applied.
2
Match the architectural change to AWS cloud design principles.
Decoupling components so that they interact via interfaces and do not cause cascading failures is the definition of loose coupling.
This confirms that separating the components corresponds to the design principle of loose coupling.

Key Concept

Loose coupling reduces dependencies between components, preventing a failure in one tier from cascading to other tiers.
Estimated Time:45s
Question 460Question →

An IoT organization is designing a telemetry processing system on AWS to collect data from smart-home devices. The volume of incoming data fluctuates significantly throughout the day. To ensure high availability and efficiency, the architecture decouples the ingestion component from the database processing component so that ingestion is not disrupted if the database fails. Additionally, the backend compute resources adjust automatically to match the real-time rate of incoming sensor messages. Which two AWS Cloud design principles are directly applied in this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Loose coupling; Elasticity

Answer

The architecture applies loose coupling by separating the ingestion and database processing components, and elasticity by automatically scaling compute resources to match changing demand.
The correct principles are loose coupling and elasticity. The architecture decouples the ingestion layer from the database processor, ensuring they can fail and operate independently (loose coupling). The compute capacity is scaled automatically to match incoming data surges (elasticity).

Step-by-Step Solution

1
Analyze the relationship between the ingestion and database processing components.
The components are designed to operate independently so that a failure in the database does not cause a failure in ingestion.
This shows the application of loose coupling, which reduces interdependencies to prevent cascading failures.
2
Analyze how compute resources respond to incoming traffic changes.
Compute resources adjust automatically in real-time based on the volume of incoming sensor messages.
This shows the application of elasticity, which allows a system to dynamically scale out or in to match the current demand.

Key Concept

AWS Cloud Design Principles: Loose Coupling and Elasticity
PreviousPage 23 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin