Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 461Question →

A health-tech company hosts its patient management portal on Amazon EC2 instances. The security team needs a service that can continuously monitor the AWS environment for potential security threats, such as command-and-control (C2) activity, unauthorized API calls, and brute-force attacks on the instances. Which AWS service is designed to perform this type of intelligent threat detection?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection by continuously monitoring logs (such as VPC Flow Logs, AWS CloudTrail management events, and DNS logs) using machine learning and threat intelligence to identify suspicious activities like brute-force attacks and command-and-control communication.

Step-by-Step Solution

1
Analyze the business and security requirements in the scenario.
The company needs continuous, intelligent threat detection to identify malicious activities like command-and-control activity, brute-force attacks, and unauthorized API calls within their AWS environment.
Identifying the target behavior (active threat detection) helps narrow down the appropriate AWS security service category.
2
Evaluate the capabilities of the proposed AWS security services.
Amazon GuardDuty uses threat intelligence feeds and machine learning to detect anomalies and unauthorized activities across AWS accounts and workloads, matching all specified requirements.
This step distinguishes active log-based threat detection (GuardDuty) from package vulnerability scanning (Inspector) or API logging (CloudTrail).

Key Concept

Active threat detection and monitoring on AWS
Estimated Time:1m 0s
Question 462Question →

A media streaming company is preparing to share its compliance posture with new business partners. The company needs to retrieve official AWS security compliance documents, such as Service Organization Control (SOC) reports, to demonstrate the security of the AWS infrastructure. Which AWS service or portal provides on-demand access to these reports?

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact
AWS Artifact provides on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) and Payment Card Industry (PCI) reports.

Step-by-Step Solution

1
Identify the core business requirement.
The requirement is to retrieve official AWS security compliance documents (such as SOC reports) to share with partners.
This establishes the scope of the search to AWS compliance and governance tools.
2
Determine the AWS service designed for compliance reports.
AWS Artifact is the dedicated, self-service portal for on-demand access to AWS security and compliance reports and agreements.
This matches the requirement for downloading SOC reports directly.

Key Concept

AWS Compliance and Governance
Question 463Question →

A retail company deploys its online storefront using AWS Elastic Beanstalk. Under the AWS Shared Responsibility Model, which two of the following security-related tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Securing the application code and data uploaded to the environment; Configuring Identity and Access Management (IAM) user permissions for accessing the environment

Answer

Securing the application code and data uploaded to the environment, and configuring Identity and Access Management (IAM) user permissions for accessing the environment.
In the Platform as a Service (PaaS) model represented by AWS Elastic Beanstalk, the customer is responsible for configuring access policies (IAM) and securing the application code and data they upload. AWS manages and maintains the infrastructure, virtualization layer, guest operating system, and the application runtime platform.

Step-by-Step Solution

1
Identify the service model of the AWS service described.
AWS Elastic Beanstalk is identified as a Platform as a Service (PaaS) model.
The shared responsibility boundary shifts depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
2
Differentiate between the customer's responsibility and AWS's responsibility for a PaaS service.
AWS manages the guest operating system, platform patching (such as Java or Node.js runtimes), virtualization layer, and physical infrastructure. The customer remains responsible for application code, configuration settings, data security, and identity/access control.
This step determines which tasks fall under customer ownership ('security in the cloud') versus AWS ownership ('security of the cloud') for managed services.
3
Select the two customer responsibilities from the options provided.
The tasks of securing the application code and data, as well as configuring IAM permissions, are selected.
These match the customer's operational responsibilities in a Platform as a Service (PaaS) deployment.

Key Concept

Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Platform as a Service (PaaS) offerings like AWS Elastic Beanstalk, AWS takes on more responsibility by managing the guest OS, runtime software, and physical security. The customer remains responsible for securing their code, protecting their data, and controlling user access via IAM.
Question 464Question →

A healthcare provider must ensure that all administrative actions performed in their AWS Cloud environment are recorded for regulatory compliance. They need to track when a user logs in, which resources were modified, and the source IP address of the request. Which AWS service is designed to record and log these API transactions?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is designed specifically to track, log, and audit user activity and API calls across the AWS infrastructure. It provides detailed records of who made the request, when, and from what IP address, which meets compliance requirements.

Step-by-Step Solution

1
Identify the key requirement in the scenario.
The healthcare provider needs to record all administrative actions, track user logins, resource modifications, and log the source IP addresses of the requests for regulatory compliance.
This establishes the core need for API logging and activity auditing.
2
Evaluate the capabilities of the AWS services listed in the options.
AWS CloudTrail records and logs AWS API transactions and user actions. Amazon CloudWatch focuses on operational metrics and system logs. Amazon GuardDuty focuses on threat detection. AWS Trusted Advisor provides optimization recommendations.
Matching the requirements to the correct service's primary function ensures the correct selection.
3
Verify which service provides the necessary activity history.
AWS CloudTrail is the specific service designed to log API transactions and user activity for auditing and compliance.
This confirms the correct option based on AWS services documentation.

Key Concept

AWS CloudTrail is the primary service used to log, monitor, and retain account activity related to actions across your AWS infrastructure, enabling operational auditing and compliance verification.
Question 465Question →

A software-as-a-service (SaaS) company providing human resources platform services is undergoing an external SOC 2 Type II audit. The audit team requires documentation verifying the security and compliance of the AWS physical infrastructure, and confirmation of how the SaaS company manages encryption keys for its application data. Which of the following actions should the company take to meet these audit requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS SOC 2 report directly from AWS Artifact to provide to the auditors; Manage customer-managed encryption keys for application data using AWS Key Management Service (AWS KMS)

Answer

To meet these requirements, the company should download the AWS SOC 2 report directly from AWS Artifact to verify AWS infrastructure compliance, and manage application data encryption keys using AWS Key Management Service (AWS KMS) to fulfill their responsibility under the Shared Responsibility Model.
The correct options are downloading the AWS SOC 2 report from AWS Artifact and managing encryption keys using AWS Key Management Service (AWS KMS). AWS Artifact provides on-demand access to security and compliance reports (such as SOC and PCI reports) which verify the compliance of AWS physical infrastructure. Additionally, under the Shared Responsibility Model, the customer is responsible for data protection, which includes configuring encryption and managing keys using AWS KMS.

Step-by-Step Solution

1
Identify the service for retrieving AWS compliance reports
Determine that AWS Artifact is the self-service portal to download reports like SOC 2 to prove AWS physical infrastructure compliance.
Auditors require third-party verification of the infrastructure managed by AWS.
2
Determine the tool and responsibility for data encryption key management
Identify that managing keys for data encryption is a customer responsibility under the Shared Responsibility Model, which is implemented using AWS Key Management Service (AWS KMS).
The customer is responsible for data protection and encryption in the cloud.

Key Concept

AWS Compliance and Governance and the Shared Responsibility Model
Estimated Time:1m 30s
Question 466Question →

A financial services firm wants to audit user activity in its AWS account to ensure compliance. They need to keep a complete record of all API transactions, and they also want to receive real-time notifications if anyone attempts to modify security group rules. Which combination of AWS services should the company implement to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to log and track API calls across the account.; Amazon CloudWatch Alarms to monitor log events and send alerts for security group changes.

Answer

To audit all API transactions and receive real-time notifications for security group changes, the company should configure AWS CloudTrail to log API activity and use Amazon CloudWatch Alarms to monitor the logs and trigger alerts.
Deploying AWS CloudTrail allows the company to log, continuously monitor, and retain account activity related to actions across their AWS infrastructure. To receive real-time notifications for modifications to security group rules, the company can deliver CloudTrail logs to Amazon CloudWatch Logs and configure Amazon CloudWatch Alarms to trigger alerts based on specific log patterns.

Step-by-Step Solution

1
Identify the service responsible for auditing and logging AWS API actions.
AWS CloudTrail is identified as the service that records API calls, user activity, and resource changes across the AWS infrastructure.
Tracking user activity and API transaction history is a core capability of AWS CloudTrail.
2
Determine how to monitor logs and trigger notifications for specific events like security group modifications.
Amazon CloudWatch Logs can receive CloudTrail logs, and CloudWatch Alarms can trigger alerts (such as via Amazon SNS) based on metric filters for security group modification events.
Amazon CloudWatch is designed for real-time monitoring and alerting based on log patterns and resource metrics.

Key Concept

AWS CloudTrail is used for auditing and tracking API activity, while Amazon CloudWatch is used for monitoring resource performance, logs, and setting up alarms.
Question 467Question →

A company is designing a new web application in the AWS Cloud and wants to ensure that the architecture is modular and resilient to component outages. Which two of the following are design principles of the AWS Cloud that support this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Design for failure; Loose coupling

Answer

The correct principles are designing for failure and loose coupling.
The correct options are designing for failure and loose coupling. Designing for failure ensures that systems remain functional even if individual components experience outages. Loose coupling minimizes dependencies between components, which prevents failures in one component from causing cascading failures across the entire system.

Step-by-Step Solution

1
Identify the goal of the scenario
The company wants to build an application that is modular (loosely integrated) and resilient (can survive component failures).
Understanding requirements helps select the relevant cloud design principles.
2
Evaluate the design principles of the AWS Cloud against the requirements
Designing for failure ensures resiliency by planning for component outages. Loose coupling ensures modularity by minimizing dependencies between components.
This step directly maps the business objectives to AWS Cloud architectural best practices.

Key Concept

AWS Cloud Design Principles (Loose Coupling and Design for Failure)
Question 468Question →

An online travel agency wants to improve its security posture on AWS. The company needs to implement a solution that continuously monitors its AWS accounts for malicious activity or unauthorized access, and it also needs to automate security assessments of its Amazon EC2 instances to identify software vulnerabilities. Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services because Amazon GuardDuty provides intelligent threat detection through continuous log analysis, while Amazon Inspector automates vulnerability scanning for host systems and software dependencies.
Amazon GuardDuty and Amazon Inspector are correct. Amazon GuardDuty continuously monitors AWS accounts and workloads for threats and malicious activity using machine learning. Amazon Inspector automatically assesses Amazon EC2 instances for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the requirement for continuous threat detection and unauthorized behavior monitoring.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to analyze logs and detect malicious activity.
GuardDuty is the primary AWS service for active threat detection across accounts.
2
Identify the requirement for automated security assessments and software vulnerability scanning of Amazon EC2 instances.
Amazon Inspector is selected as it scans workloads (such as EC2 instances) for software packages vulnerabilities and network reachability issues.
Inspector is the primary AWS service for host-level vulnerability scanning.

Key Concept

AWS Threat Detection and Vulnerability Management Services
Question 469Question →

A genomic research institute stores patient DNA sequencing data in Amazon S3 and runs analysis workloads on Amazon EC2. The institute's compliance guidelines state that:
1. The cryptographic keys used for encrypting the data at rest must be managed on dedicated, single-tenant hardware security modules (HSMs) where the customer has sole control over cryptographic web users and key policies.
2. All data in transit between the EC2 instances and the S3 buckets must be encrypted using Transport Layer Security (TLS).

Which of the following implementation details are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement.; The customer is responsible for configuring bucket policies that enforce HTTPS (TLS) connections to secure data in transit to Amazon S3.

Answer

The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement, and the customer is responsible for configuring S3 bucket policies that enforce HTTPS (TLS) connections to secure data in transit.
The correct implementation requires AWS CloudHSM because it is a dedicated, single-tenant HSM service that gives the customer exclusive cryptographic control over keys and users. Additionally, under the Shared Responsibility Model, configuring bucket policies to enforce TLS for data in transit is a customer-side responsibility.

Step-by-Step Solution

1
Analyze the at-rest encryption requirements for single-tenant, dedicated HSM hardware.
Determine that AWS Key Management Service (AWS KMS) is a shared, multi-tenant service and does not meet this requirement, whereas AWS CloudHSM provides dedicated single-tenant HSM instances.
This isolates the correct key management service required for compliance.
2
Analyze the in-transit encryption requirement under the Shared Responsibility Model.
Recognize that while AWS provides the network infrastructure and endpoints, the customer must configure their applications and S3 bucket policies to require HTTPS/TLS.
This establishes correct ownership of configurations for data in transit.

Key Concept

Understanding the difference between multi-tenant AWS KMS and single-tenant AWS CloudHSM, and mapping the customer's responsibility for configuring encryption in transit under the AWS Shared Responsibility Model.
Question 470Question →

A security analyst needs to determine which IAM user made a specific API call to delete an Amazon S3 bucket last week. Which AWS service should the analyst use to retrieve this API history?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail is the AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user actions, allowing security teams to pinpoint who made a call, when it occurred, and from which IP address.

Step-by-Step Solution

1
Identify the core requirement of the scenario.
The requirement is to trace user identity and API actions (specifically the deletion of an S3 bucket).
This is an auditing and compliance task that requires access to API transaction logs.
2
Evaluate the capabilities of the primary logging and monitoring services in AWS.
AWS CloudTrail is the dedicated service that records API activity, whereas Amazon CloudWatch monitors metrics/operational logs, Amazon GuardDuty performs threat analysis, and OS-level logging is a customer responsibility.
Matching the requirement with the correct service leads to AWS CloudTrail as the correct tool.

Key Concept

API Auditing and User Activity Tracking
Estimated Time:45s
Question 471Question →

A financial technology company must comply with a strict regulatory standard requiring that cryptographic keys used to encrypt transactional data at rest be stored in dedicated, single-tenant hardware security modules (HSMs) where the customer retains exclusive administrative control over the HSM partitions. Which of the following options represents the correct service selection and distribution of responsibility under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: AWS CloudHSM; the customer is responsible for managing the HSM users, keys, and cryptographic partitions, while AWS manages the physical hardware maintenance and network availability of the HSM appliance.

Answer

AWS CloudHSM is the correct service selection because it provides dedicated, single-tenant HSMs with customer administrative control over the partition. Under this model, the customer is responsible for managing HSM users, keys, and cryptographic configurations, while AWS handles the physical hardware maintenance, network provisioning, and appliance availability.
The correct option correctly identifies AWS CloudHSM as the service that provides dedicated, single-tenant HSM appliances under the customer's exclusive control. It also correctly defines the shared responsibility boundaries where the customer manages the logical aspects (HSM users, keys, partitions) and AWS manages the physical and infrastructure aspects (hardware maintenance and network availability of the appliance).

Step-by-Step Solution

1
Analyze the compliance requirement for encryption key storage
The requirement specifies dedicated, single-tenant hardware security modules (HSMs) with exclusive customer control over the cryptographic partitions.
To choose between AWS Key Management Service (KMS) and AWS CloudHSM.
2
Evaluate AWS KMS against the requirement
AWS KMS is a managed, multi-tenant service. Even with customer managed keys, the underlying HSMs are shared across multiple tenants. Thus, KMS does not meet the dedicated, single-tenant requirement.
To eliminate KMS-based options.
3
Evaluate AWS CloudHSM against the requirement
AWS CloudHSM provides dedicated, single-tenant HSM instances within the customer's VPC, meeting the compliance requirement.
To confirm AWS CloudHSM as the correct service selection.
4
Determine the distribution of responsibility for AWS CloudHSM
AWS manages physical security, hardware maintenance, network connectivity, and the appliance OS/firmware. The customer manages HSM users, key generation, and partition administration.
To select the correct option that accurately represents the Shared Responsibility Model for AWS CloudHSM.

Key Concept

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for cryptographic key storage
Question 472Question →

A regional food delivery platform wants to focus its engineering resources on developing its proprietary dispatch algorithm rather than managing physical server racks, power supplies, and cooling systems. Additionally, the platform experiences massive, brief spikes in order volume during lunch and dinner hours, and wants to dynamically scale its infrastructure to avoid paying for idle resources during off-peak times. Which two of the following AWS Cloud benefits directly align with this company's goals?

Select all that apply

Show answer & explanation

Answer: Stop spending money running and maintaining data centers; Stop guessing capacity

Answer

The correct options are stopping the expenditure of money on running and maintaining data centers, and stopping the guessing of capacity.
The correct options are stopping the expenditure of money on running and maintaining data centers, and stopping the guessing of capacity. The platform's desire to focus on its dispatch algorithm instead of managing physical racks, power, and cooling matches the benefit of letting AWS handle data center maintenance. Its need to scale dynamically during meal-time spikes without paying for idle resources matches the benefit of not having to guess capacity limits.

Step-by-Step Solution

1
Analyze the company's requirement to focus on development instead of physical hardware management.
This maps directly to the AWS benefit of stopping the expenditure of money on running and maintaining data centers, as AWS takes care of the physical infrastructure.
To identify which cloud benefit eliminates the need for managing physical hardware assets.
2
Analyze the company's requirement to handle brief spikes in order volume without paying for idle resources.
This maps directly to the AWS benefit of stopping the guessing of capacity, since resources can scale elastically according to real-time demand.
To identify which cloud benefit prevents under-provisioning or over-provisioning during peak traffic intervals.

Key Concept

Identifying the six core benefits of the AWS Cloud based on specific business scenarios.
Question 473Question →

A renewable energy company operates a fleet of Amazon EC2 instances to monitor wind turbine telemetry and stores its deployment packages in Amazon Elastic Container Registry (Amazon ECR). The company needs to implement a solution that continuously scans its container images and virtual machines for software vulnerabilities, while also monitoring its AWS accounts for potential unauthorized behavior and DNS data exfiltration attempts.

Which of the following AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector is designed for vulnerability management, scanning EC2 instances and container images for software vulnerabilities. Amazon GuardDuty is an intelligent threat detection service that monitors logs to identify malicious activity such as DNS data exfiltration.

Step-by-Step Solution

1
Analyze the requirement for scanning EC2 virtual machines and ECR container images for software vulnerabilities.
Identify Amazon Inspector as the service that automates software vulnerability management for these resources.
Amazon Inspector specifically performs package and software vulnerability scanning on host instances and registry containers.
2
Analyze the requirement for continuous threat detection and monitoring for unauthorized behavior and DNS exfiltration.
Identify Amazon GuardDuty as the service providing intelligent threat detection.
Amazon GuardDuty analyzes VPC Flow Logs, DNS logs, and other sources to detect malicious operations and exfiltration attempts.
3
Evaluate the remaining options to ensure they do not meet the primary goals.
Eliminate Amazon Macie, AWS CloudTrail, and Amazon CloudWatch as they do not scan hosts for software vulnerabilities or perform active threat detection.
These services focus on sensitive data discovery in S3, API call logging, and performance monitoring respectively.

Key Concept

Differentiating vulnerability management (Amazon Inspector) from threat detection (Amazon GuardDuty) and other AWS security and logging services.
Question 474Question →

An organization needs to grant a new database administrator the necessary permissions to manage Amazon RDS resources on a daily basis. Which of the following actions aligns with the AWS-recommended best practice for securing this access?

Show answer & explanation

Answer: Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.

Answer

Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.
The correct action is to create an individual IAM user with the minimum required permissions. This aligns with the principle of least privilege by ensuring the database administrator only has access to Amazon RDS, and ensures accountability by using a unique identity rather than sharing credentials.

Step-by-Step Solution

1
Identify the entity requiring access.
A human database administrator requires daily access to the AWS Management Console.
Understanding the type of identity helps determine the appropriate access mechanism.
2
Apply the principle of least privilege and root account safety best practices.
Create an individual IAM user and assign only the permissions needed to manage RDS, while avoiding the use or sharing of the root account.
Ensures administrative accountability and limits access to only the necessary services.

Key Concept

AWS IAM Best Practices for User Access Control
Estimated Time:45s
Question 475Question →

A telehealth startup is launching a patient consultation portal. Instead of purchasing physical servers and securing dedicated data center space upfront, the company decides to host the application on AWS and pay only for the virtual resources it uses each month. Which of the following benefits of the AWS Cloud is directly demonstrated by this business decision?

Show answer & explanation

Answer: Trading fixed expense for variable expense

Answer

Trading fixed expense for variable expense is the core economic benefit demonstrated because the company avoids upfront infrastructure investment and pays only for what they consume monthly.
Trading fixed expense for variable expense is correct because AWS allows customers to pay only for the computing resources they actually consume, eliminating the need to invest in physical servers and data centers before knowing how they will be used.

Step-by-Step Solution

1
Analyze the financial requirements of the startup in the scenario.
The startup wants to avoid upfront costs for physical servers and data centers, choosing instead to pay monthly based on resource usage.
Identifying the shift from fixed upfront hardware costs to flexible recurring costs defines the financial transition.
2
Match the transition to the defined benefits of the AWS Cloud.
Paying for resources as they are consumed on-demand aligns with the cloud benefit of trading fixed expense for variable expense.
Connecting the business decision directly to official AWS Cloud benefits guarantees a correct conceptual match.

Key Concept

Trading fixed expense for variable expense
Estimated Time:45s
Question 476Question →

A financial services company uses Amazon Simple Storage Service (Amazon S3) to store sensitive customer transaction records. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for performing?

Show answer & explanation

Answer: Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records

Answer

Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records
The task of configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, represents security 'in' the cloud. Because the customer owns the data stored in the S3 bucket, they are solely responsible for determining who can access that data and configuring the permissions accordingly.

Step-by-Step Solution

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (PaaS/storage service) where AWS manages the underlying infrastructure, operating systems, and physical security.
Understanding the service type determines where the boundary between customer and AWS responsibility lies.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
Security 'of' the cloud includes hardware, virtualization, and physical facilities, which AWS manages. Security 'in' the cloud includes customer data, access management, and resource configuration, which the customer manages.
This distinction allows mapping of operational tasks to the correct owner.
3
Evaluate the choices based on the determined boundaries.
Upgrading host OS, physical security, and obtaining infrastructure compliance certifications belong to AWS. Configuring bucket policies and IAM permissions is a customer configuration task to protect their own data.
Applying the model boundaries helps isolate the correct customer responsibility.

Key Concept

AWS Shared Responsibility Model for Managed Services (Amazon S3)
Question 477Question →

An AWS cloud practitioner is configuring network security within a Virtual Private Cloud (VPC). To ensure proper network isolation, they need to identify the operational differences between Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.; Network Access Control Lists (Network ACLs) are stateless, meaning that return traffic must be explicitly allowed by rules in both directions.

Answer

Security groups are stateful, meaning return traffic is automatically allowed; and Network Access Control Lists (Network ACLs) are stateless, meaning return traffic must be explicitly allowed in both directions.
The correct options are the statements indicating that Security Groups are stateful and Network Access Control Lists (Network ACLs) are stateless. In AWS, Security Groups automatically allow return traffic for any established connection, while Network ACLs require explicit inbound and outbound rules to permit traffic in both directions.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Confirm that Security Groups automatically track connection state and allow return traffic without needing explicit outbound rules.
This is a fundamental concept of Security Groups operating as an instance-level firewall.
2
Analyze the stateless behavior of Network ACLs.
Confirm that Network ACLs do not track connection state, meaning inbound and outbound rules must be configured separately to allow round-trip communication.
This is a fundamental concept of Network ACLs operating as a subnet-level firewall.
3
Evaluate the remaining options for layer of operation and responsibility mappings.
Identify that Security Groups operate at the instance level (not subnet level), Network ACLs operate at the subnet level (not instance level), and physical security is the responsibility of AWS (not the customer).
This helps rule out incorrect options based on common AWS CCP security misconceptions.

Key Concept

The operational differences between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Estimated Time:45s
Question 478Question →

A global logistics firm currently hosts its fleet-management application in an on-premises data center. The application experiences massive, unpredictable traffic spikes during holiday shopping seasons, but remains largely idle during the rest of the year. The company plans to migrate this application to AWS. Which two of the following options describe how the economics of the AWS Cloud will help the company optimize its infrastructure costs?

Select all that apply

Show answer & explanation

Answer: Shifting from a capital expense (CapEx) model with high upfront hardware costs to a variable operating expense (OpEx) model.; Leveraging cloud elasticity to automatically scale resources down during off-peak times, thereby eliminating expenses for idle capacity.

Answer

The logistics company optimizes its costs on AWS by shifting from upfront capital expenses to variable operating expenses, and by using elasticity to scale down resources during periods of low activity to avoid paying for idle infrastructure.
Shifting from capital expenses to variable operating expenses allows the company to pay only for the resources they consume rather than making large upfront investments. Additionally, leveraging cloud elasticity allows resources to scale down during low-activity periods, which eliminates costs associated with idle on-premises hardware.

Step-by-Step Solution

1
Analyze the financial impact of the cloud migration model.
Identify that AWS allows companies to trade capital expenses (upfront hardware investments) for variable operating expenses (paying for what is used).
This matches the AWS Cloud value proposition of shifting from CapEx to OpEx.
2
Evaluate how the company handles variable traffic and peak capacity.
Identify that AWS elasticity allows the application to dynamically scale down when traffic is low, avoiding costs for idle resources.
Elasticity aligns infrastructure supply with real-time demand, minimizing cost waste.

Key Concept

Cloud economics benefits such as the shift from CapEx to OpEx and the cost optimization enabled by resource elasticity.
Question 479Question →

A healthcare provider is designing a patient registration portal on AWS. To prevent patient registrations from failing when the backend database is offline for scheduled maintenance, the architect decides to insert a message queue between the front-end registration portal and the database. Which AWS Cloud design principle is best illustrated by this architectural decision?

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling
Loose coupling is the design principle demonstrated by placing a buffer, like a message queue, between components. This ensures that the front-end registration portal remains responsive to users even if the backend database is temporarily offline, as the queue stores the messages until the database is ready to process them.

Step-by-Step Solution

1
Analyze the requirement to keep the front-end intake operational during database downtime.
The front-end must not have a direct, synchronous dependency on the database service.
A synchronous dependency causes the entire system to fail if one component is down.
2
Evaluate the role of the message queue in the architecture.
The queue acts as an asynchronous buffer, allowing the portal to save registrations to the queue and proceed without waiting for a database write.
This isolates the two layers from each other's operational status.
3
Identify the corresponding AWS Cloud design principle.
Designing components to interact with minimal dependencies is known as loose coupling.
Loose coupling ensures fault isolation and independent scalability.

Key Concept

Loose coupling reduces interdependencies between components, so that a failure or maintenance event in one service does not cascade to others.
Estimated Time:1m 0s
Question 480Question →

A developer deploys a web application on an Amazon EC2 instance and updates its security group to permit inbound traffic on port 80. Although no outbound rules are modified, the instance can successfully return response traffic to the clients. Which characteristic of security groups explains why this outbound traffic is allowed?

Show answer & explanation

Answer: Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.

Answer

Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.
Security groups are stateful, which means that any rule permitting inbound traffic automatically permits the corresponding outbound response traffic, regardless of the outbound rules configured.

Step-by-Step Solution

1
Analyze the resource and rules configuration.
The application runs on an Amazon EC2 instance with an inbound security group rule allowing port 80 traffic.
This establishes that inbound traffic is authorized.
2
Determine the stateful nature of the security firewall.
Since security groups operate at the instance level and are stateful, allowing inbound traffic automatically permits the corresponding outbound response traffic.
Stateful firewalls track the connection state and allow return traffic without requiring matching outbound rules.

Key Concept

Security groups are stateful firewalls that control inbound and outbound traffic at the Amazon EC2 instance level, automatically allowing return traffic.
PreviousPage 24 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin