Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 481Question →

A media company is looking for a way to continuously monitor its AWS accounts and workloads for malicious activities, such as cryptocurrency mining, unauthorized data access, or compromised credentials. The solution must automatically analyze data from AWS CloudTrail logs, VPC Flow Logs, and DNS query logs to identify threats. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it continuously monitors AWS accounts and workloads for malicious activity by analyzing data from sources like AWS CloudTrail, VPC Flow Logs, and DNS logs.

Step-by-Step Solution

1
Identify the primary goal of the scenario: continuously monitoring AWS workloads for malicious activities, unauthorized access, and compromised credentials.
Threat detection requirement.
Enables selection of security services rather than operational or compliance services.
2
Analyze the data sources specified: AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.
Identify the service that natively ingests and analyzes these three specific log sources.
Differentiates from vulnerability scanners that inspect instances directly.
3
Select the service that performs intelligent threat detection using machine learning and anomaly detection.
Amazon GuardDuty is selected as the correct answer.
It is the only service designed to actively process these logs to find threats.

Key Concept

Intelligent threat detection and security monitoring using Amazon GuardDuty
Question 482Question →

A retail company is migrating its inventory management system to AWS. The system runs on Amazon EC2 instances and requires permission to write to an Amazon DynamoDB table. Additionally, a team of developers requires access to perform administrative tasks. Which of the following actions represent AWS-recommended security practices for managing access in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM role with permissions to access DynamoDB and associate it with the EC2 instances.; Organize the developers into an IAM user group and attach policies directly to the group rather than to individual users.

Answer

The correct practices are configuring an IAM role for the EC2 instances to access the database, and organizing developers into an IAM user group with attached policies.
The correct practices are configuring an IAM role with the appropriate permissions and associating it with the EC2 instances, which allows the application to securely access DynamoDB using temporary credentials. Additionally, organizing developers into an IAM user group and attaching policies directly to the group ensures consistency and simplifies administration, aligning with IAM best practices.

Step-by-Step Solution

1
Analyze the requirement for the application on EC2 to access DynamoDB.
Determine that assigning an IAM role to the EC2 instances is the AWS-recommended method, avoiding hardcoded credentials.
This uses temporary security credentials, aligning with the principle of least privilege and credential rotation.
2
Analyze the requirement for developers to perform administrative tasks.
Determine that placing developers into an IAM user group and attaching policies to the group is the recommended practice.
This simplifies permission management and prevents configuration drift among individual user accounts.
3
Evaluate and eliminate incorrect practices.
Reject options recommending root user sharing, long-term embedded credentials, or delegating credential configuration to AWS Support.
These violate root user safety, credential management best practices, and the Shared Responsibility Model boundaries respectively.

Key Concept

AWS IAM best practices including IAM roles for EC2, IAM groups for user management, and the Shared Responsibility Model.
Question 483Question →

A mobile game studio wants to launch a new multiplayer game. Instead of purchasing physical servers and hardware upfront in a traditional data center, the studio decides to host the game on AWS and pay for compute resources as they are consumed. Which of the following describes this financial shift?

Show answer & explanation

Answer: Trading capital expenses (CapEx) for operating expenses (OpEx)

Answer

Trading capital expenses (CapEx) for operating expenses (OpEx)
Trading capital expenses (CapEx) for operating expenses (OpEx) is correct because using AWS allows organizations to avoid physical hardware acquisition costs (CapEx) and instead pay for cloud resource usage as an operational expense (OpEx) based on consumption.

Step-by-Step Solution

1
Identify the initial investment model of the mobile game studio.
The studio is avoiding purchasing physical servers upfront (Capital Expenses/CapEx).
Understanding what type of expense is being eliminated is the first step in cloud economics.
2
Identify the new payment model after moving to AWS.
The studio pays for compute resources as they are consumed (Operating Expenses/OpEx).
Recognizing the nature of pay-as-you-go pricing as an ongoing operational cost.
3
Match this transition to the correct cloud economics concept.
The shift represents trading capital expenses (CapEx) for operating expenses (OpEx).
This is one of the core financial benefits of AWS cloud adoption.

Key Concept

Understanding the financial shift from Capital Expenses (CapEx) to Operating Expenses (OpEx) in cloud computing.
Estimated Time:45s
Question 484Question →

A gaming studio is deploying a multiplayer matchmaking backend on AWS using Amazon DynamoDB to store player session states. Under the AWS Shared Responsibility Model, which two security-related tasks are the sole responsibility of the gaming studio?

Select all that apply

Show answer & explanation

Answer: Implementing client-side encryption for sensitive player data before sending it to the database; Configuring Identity and Access Management (IAM) policies to restrict access to the database tables

Answer

Implementing client-side encryption for sensitive player data before sending it to the database and configuring Identity and Access Management (IAM) policies to restrict access to the database tables are customer responsibilities.
In the Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon DynamoDB, this includes managing user access via Identity and Access Management (IAM) policies and encrypting sensitive player data on the client side before writing it to the database. AWS maintains the security 'of' the cloud, which includes the physical hardware, operating systems, and database engine software.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon DynamoDB is identified as a fully managed database service (NoSQL).
Managed services shift operational tasks (like patching and physical security) to AWS, meaning the customer is responsible primarily for data configuration and access control.
2
Evaluate the customer's responsibilities for a managed database service.
The customer controls identity and access management (IAM) and how they secure the data itself (client-side encryption).
In the Shared Responsibility Model, data security 'in the cloud' (including encryption and access control) remains the customer's responsibility, regardless of the service type.
3
Identify AWS's responsibilities for DynamoDB.
AWS is responsible for managing the physical data centers, host operating systems, and the DynamoDB database engine software.
AWS manages the infrastructure layer, hardware, and system software for managed services, making guest OS patching, database software updates, and physical audits part of the AWS responsibility ('of the cloud').

Key Concept

Shared Responsibility Model for Managed Services
Question 485Question →

An enterprise wants to simplify permission management for its finance department. Currently, the IT team manually attaches permissions to each new financial analyst's AWS account, which has led to inconsistent access rights and administrative overhead. Which of the following is the AWS-recommended method to resolve this issue?

Show answer & explanation

Answer: Create an IAM group for the finance department, attach the necessary permissions policy to the group, and add the financial analysts to this group.

Answer

Create an IAM group for the finance department, attach the necessary permissions policy to the group, and add the financial analysts to this group.
Creating an IAM group and attaching the required policy to it allows the administrator to manage permissions for all group members at once. New users automatically inherit the group's permissions when added, eliminating administrative overhead and ensuring consistency.

Step-by-Step Solution

1
Analyze the administrative challenge of managing permissions individually for multiple users with identical job functions.
Identify that individual assignment is prone to errors, leads to inconsistent access rights, and increases administrative overhead.
Permissions should be managed centrally and consistently for users sharing the same functional role.
2
Evaluate the AWS IAM constructs that allow collective permission management.
Determine that IAM groups are designed to associate policies with collections of users, while IAM roles are for temporary access and the root user must not be shared.
Using the appropriate IAM construct ensures secure, scalable, and compliant access control.

Key Concept

Managing user permissions collectively using IAM Groups
Question 486Question →

A company is setting up a new application on AWS and wants to establish baseline security logging and operational monitoring. They need to track user activity and API calls for auditing purposes, as well as collect and track performance metrics for their Amazon EC2 instances. Which of the following AWS services should the company use to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch are the services needed to track API activity and monitor EC2 performance metrics respectively.
AWS CloudTrail and Amazon CloudWatch are the appropriate services because CloudTrail records and audits all AWS API calls and user interactions, while CloudWatch tracks operational metrics such as CPU utilization and network traffic for resources like EC2 instances.

Step-by-Step Solution

1
Identify the service needed for tracking user activity and API operations.
AWS CloudTrail logs API calls, providing details on who made a call, when, and from what IP address.
This satisfies the requirement for security auditing and tracking user actions.
2
Identify the service needed for collecting and tracking performance metrics.
Amazon CloudWatch collects metric data such as CPU utilization, disk read/writes, and network traffic.
This satisfies the requirement for operational monitoring of Amazon EC2 instances.

Key Concept

Identifying the distinct use cases of AWS auditing and monitoring tools, specifically AWS CloudTrail for API logging and Amazon CloudWatch for resource metrics.
Question 487Question →

A financial technology (FinTech) startup wants to accelerate its software development cycle by allowing developers to quickly provision test environments with various configurations. On-premises, obtaining these resources required a formal approval process and took several weeks. On AWS, developers can provision these environments within minutes using the AWS Management Console or AWS CLI. Which AWS Cloud benefit is directly illustrated by this scenario?

Show answer & explanation

Answer: Increase speed and agility

Answer

Increase speed and agility
The correct answer is the option stating 'Increase speed and agility'. In cloud computing, the ability to provision new IT resources within minutes instead of weeks significantly reduces developer friction, allowing organizations to experiment and iterate faster.

Step-by-Step Solution

1
Analyze the scenario requirements
The scenario focuses on the speed of provisioning resources (weeks on-premises vs. minutes on AWS) to accelerate the development cycle.
Identifying the core business need helps match it to the correct AWS Cloud benefit.
2
Match the scenario with the official AWS Cloud benefits
The ability to access resources in minutes to reduce development time directly matches 'Increase speed and agility'.
AWS defines speed and agility as the reduction in time required to make resources available to developers, moving from weeks to minutes.

Key Concept

AWS Cloud Benefit: Increase speed and agility
Estimated Time:1m 0s
Question 488Question →

An organization is securing a proprietary database tier hosted on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The database must receive SQL traffic on TCP port 33063306 from the application servers located in a public subnet, while ensuring strict network isolation at both the subnet and instance levels. Which two configuration steps are required to establish this network security architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the database security group with an inbound rule allowing TCP port 33063306 from the application security group, and rely on its stateful nature to automatically permit outbound response traffic.; Configure the private subnet Network ACL with an inbound rule allowing TCP port 33063306 from the public subnet CIDR, and an outbound rule allowing TCP ports 10241024-6553565535 to the public subnet CIDR.

Answer

Configuring the database security group with an inbound rule allowing TCP port 33063306 from the application security group (leveraging its stateful tracking), and configuring the private subnet Network ACL with an inbound rule allowing TCP port 33063306 and an outbound rule allowing TCP ephemeral ports 10241024-6553565535.
Security groups operate at the instance level and are stateful. When you add an inbound rule allowing TCP port 33063306 from the application security group, the return traffic is automatically permitted outbound, regardless of outbound rules. Network ACLs operate at the subnet level and are stateless. This means that both inbound traffic (port 33063306) and outbound response traffic (ephemeral ports 10241024-6553565535) must be explicitly allowed.

Step-by-Step Solution

1
Determine instance-level security requirements using Security Groups.
A Security Group rule must allow inbound database traffic on port 33063306 from the source application tier. Because Security Groups are stateful, no outbound rule is needed for return traffic.
Security Groups provide stateful firewall protection at the resource/instance level.
2
Determine subnet-level security requirements using Network ACLs.
The Network ACL must allow inbound TCP traffic on port 33063306 from the public subnet. Additionally, an outbound rule must allow TCP traffic to ephemeral ports 10241024-6553565535 back to the public subnet.
Network ACLs are stateless firewalls at the subnet boundary, meaning outbound return path rules are required.

Key Concept

The key concept is the distinction between stateful Security Groups (operating at the instance level) and stateless Network Access Control Lists (operating at the subnet level) in AWS VPC security.
Question 489Question →

A security team needs to monitor an AWS environment for active threats and unauthorized behavior. They require a solution that automatically analyzes AWS CloudTrail events, VPC Flow Logs, and DNS logs to identify activities like an Amazon EC2 instance communicating with a known malicious command-and-control server. The solution must be agentless and operate at the account level. Which AWS service should the security team use to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection. It analyzes data from AWS CloudTrail, VPC Flow Logs, and DNS logs without requiring agents, allowing it to identify suspicious activities like communication with known malicious command-and-control servers.

Step-by-Step Solution

1
Analyze the requirements of the scenario.
The scenario requires identifying active threats (like command-and-control traffic), analyzing logs (VPC Flow Logs, CloudTrail, DNS logs), and operating agentlessly at the AWS account level.
Understanding these parameters helps narrow down the correct security service that operates without host-based agents.
2
Differentiate between the candidate services.
Amazon GuardDuty is a threat detection service that matches the log analysis and agentless requirements. Amazon Inspector scans for vulnerabilities rather than active threats. Amazon CloudWatch collects logs and metrics but lacks built-in threat intelligence.
Distinguishing services based on their primary functions (vulnerability scanning vs. threat detection vs. log collection) points to the correct solution.
3
Select the correct service.
Amazon GuardDuty is selected as the correct answer.
It fulfills all criteria, including log source analysis and agentless detection.

Key Concept

AWS Threat Detection and Logging
Question 490Question →

A company wants to set up access for a new employee who needs to manage Amazon EC2 instances on a daily basis. The manager wants to follow AWS security best practices. Which of the following actions should the administrator take to grant the employee this access?

Show answer & explanation

Answer: Create an IAM user for the employee and attach an IAM policy with EC2 management permissions.

Answer

Create an IAM user for the employee and attach an IAM policy with EC2 management permissions.
Creating a dedicated IAM user for the employee and attaching an IAM policy with the necessary EC2 management permissions is the standard AWS best practice. This ensures accountability, follows the principle of least privilege, and aligns with secure identity management recommendations.

Step-by-Step Solution

1
Identify the type of identity required for a new employee's daily operations.
An IAM user is appropriate for an individual human needing long-term credentials for AWS console or CLI access.
AWS best practices dictate that individuals should have unique IAM users rather than sharing root credentials or using temporary roles as permanent logins.
2
Determine how to grant the minimum required permissions to the IAM user.
Attach an IAM policy specifying permissions to manage EC2 instances.
Following the principle of least privilege ensures the employee only has access to the resources required for their job role.

Key Concept

Identity and Access Management (IAM) Identity Types and Best Practices
Estimated Time:45s
Question 491Question →

A digital marketing agency is launching a series of promotional campaigns that require temporary computing infrastructure. The agency wants to avoid making large upfront hardware payments and does not want to manage physical server infrastructure. Which of the following are official benefits of the AWS Cloud that directly align with these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Trade fixed expense for variable expense; Stop spending money running and maintaining data centers

Answer

The correct benefits are trading fixed expense for variable expense and stopping spending money running and maintaining data centers.
The scenario highlights two distinct needs: avoiding upfront hardware investments (which corresponds to trading fixed expense for variable expense) and avoiding the upkeep of physical servers (which corresponds to stopping spending money running and maintaining data centers).

Step-by-Step Solution

1
Analyze the agency's requirement to avoid large upfront hardware payments.
This requirement aligns with the AWS Cloud benefit of trading fixed expense for variable expense, where organizations only pay for resources consumed.
It addresses the capital expense vs. operating expense model shift.
2
Analyze the agency's requirement to avoid managing physical server infrastructure.
This requirement aligns with the AWS Cloud benefit of stopping spending money running and maintaining data centers, which offloads physical infrastructure management to AWS.
It eliminates the need for power, cooling, cabling, and physical space management.

Key Concept

Benefits of the AWS Cloud (specifically Trading Fixed Expense for Variable Expense, and Stop Spending Money Running and Maintaining Data Centers)
Question 492Question →

A company is hosting a secure web application on Amazon EC2 instances within a VPC. The security team wants to allow incoming traffic on port 443443 (HTTPS) while blocking a specific range of known malicious IP addresses at the boundary before the traffic reaches any EC2 instance. They also need to ensure that the EC2 instances can send outbound response traffic back to clients. Which of the following network security configurations meets these requirements?

Show answer & explanation

Answer: Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.

Answer

Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.
The correct configuration combines stateful Security Groups at the instance level with stateless Network ACLs at the subnet level. Because Security Groups are stateful, allowing inbound HTTPS traffic on port 443443 automatically permits the return outbound traffic. Because Network ACLs are stateless, they require both inbound and outbound rules to allow the connection to succeed, which includes allowing outbound ephemeral port traffic (1024−655351024-65535). Additionally, Network ACLs support explicit deny rules, which makes them the correct choice for blocking a specific malicious IP range at the subnet boundary.

Step-by-Step Solution

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, whereas Security Groups operate at the instance level and only support allow rules.
This establishes that the IP block must be implemented at the Network ACL level.
2
Evaluate the stateful behavior of Security Groups.
Security Groups are stateful. Allowing inbound traffic on port 443443 automatically allows the outbound response traffic.
This simplifies instance-level configurations since return traffic does not require an explicit outbound rule.
3
Evaluate the stateless behavior of Network ACLs.
Network ACLs are stateless. Inbound traffic allowed on port 443443 requires a corresponding outbound rule to allow ephemeral port traffic (1024−655351024-65535) back to the client.
Stateless firewalls do not track connection states, so both ingress and egress paths must be explicitly configured.
4
Verify shared responsibility boundaries.
Configuring firewalls (Security Groups and Network ACLs) in a customer's VPC is the customer's responsibility under the Shared Responsibility Model.
AWS manages physical and infrastructure security, while the customer secures their resources in the cloud.

Key Concept

Stateful Security Groups vs Stateless Network ACLs
Question 493Question →

An enterprise is deploying an application on Amazon EC2 instances that needs to retrieve files from an Amazon S3 bucket. Which of the following configurations represent AWS Identity and Access Management (IAM) best practices for this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances.; Configure a least-privilege IAM policy and attach it to the IAM role.

Answer

Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances, and configure a least-privilege IAM policy and attach it to the IAM role.
The correct configuration is to associate an IAM role with the Amazon EC2 instance and attach a least-privilege policy to that role. This follows AWS best practices by granting only the necessary permissions and using temporary credentials for programmatic access.

Step-by-Step Solution

1
Determine the authentication mechanism for applications running on AWS compute resources.
Identified that IAM roles should be used to assign permissions to AWS resources like EC2 instances.
This eliminates the need to manage and secure long-term credentials in code.
2
Define the specific resource access requirements.
The application only needs to read files from a specific Amazon S3 bucket.
Enables the design of a highly restrictive permission policy.
3
Apply the IAM policy to the role using the principle of least privilege.
Created a customer-managed policy with read-only access to the S3 bucket and attached it to the EC2 role.
Ensures that the application has only the access necessary to perform its job.

Key Concept

AWS Identity and Access Management (IAM) roles and policy configurations for applications on Amazon EC2 instances
Estimated Time:1m 0s
Question 494Question →

A logistics company coordinates delivery routes using an application hosted on Amazon EC2 instances. The security team needs to implement a solution that continuously monitors the environment for active threats, such as instances communicating with known malicious command-and-control servers or performing unauthorized API actions. This monitoring must be performed without installing software agents or affecting application performance. Which AWS service should be used to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is correct because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes foundation data sources such as VPC Flow Logs, DNS logs, and AWS CloudTrail management events without requiring agent installation, ensuring zero impact on application performance.

Step-by-Step Solution

1
Identify the primary requirement: continuous monitoring for active threats (such as communication with command-and-control servers) without installing agents.
Determine that the required capability is intelligent threat detection rather than host vulnerability scanning.
Vulnerability scanning (like Amazon Inspector) checks for security weaknesses, while threat detection identifies active malicious activity.
2
Analyze the constraint: no software agents must be installed and there must be no performance impact on workloads.
Identify AWS services that analyze logs at the account and network infrastructure level rather than running on the OS.
Amazon GuardDuty operates completely out-of-band by analyzing logs like VPC Flow Logs and DNS logs directly from the AWS infrastructure.
3
Evaluate the choices to find the service that matches intelligent, agentless threat detection.
Select Amazon GuardDuty as the correct service.
Amazon GuardDuty uses threat intelligence and machine learning to detect anomalies and malicious behavior without agents.

Key Concept

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS accounts and workloads by analyzing data sources like CloudTrail, VPC Flow Logs, and DNS logs.
Estimated Time:1m 30s
Question 495Question →

Aegis Health is migrating its patient scheduling database to AWS. The database currently runs on an on-premises Microsoft SQL Server. The IT team wants to reduce database administration overhead, such as patching and backups, but does not want to change the database schema or write new application code. Which migration strategy should Aegis Health select to meet these requirements?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
Replatforming (sometimes called lift-tinker-and-shift) is correct because it involves making minor optimizations to achieve tangible benefits—such as migrating an on-premises database to a managed database service like Amazon RDS—without altering the core application architecture or changing the database schema.

Step-by-Step Solution

1
Analyze the business and technical constraints of the migration scenario.
The target workload is an on-premises Microsoft SQL Server database. The goal is to migrate to AWS, reduce administrative tasks (patching/backups), and avoid code or schema changes.
Understanding these constraints is necessary to differentiate between simple migration (Rehosting), managed platform optimization (Replatforming), and deep architectural changes (Refactoring).
2
Evaluate which migration strategy aligns with shifting to a managed service without code modifications.
Moving an on-premises database to a managed database service like Amazon RDS without modifying the application code is a classic example of Replatforming.
This strategy allows the organization to optimize the platform (leveraging AWS automation for backups and patching) while leaving the core application architecture untouched.

Key Concept

Identifying AWS migration strategies (the 6 Rs), specifically distinguishing Replatforming from Rehosting and Refactoring.
Question 496Question →

A local bakery chain plans to migrate its legacy inventory management application from on-premises servers to the AWS Cloud. By doing so, the company expects to eliminate the need to purchase physical hardware upfront.

Which two of the following represent the primary cloud economics benefits of this migration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trading capital expenses (CapEx) for variable operating expenses (OpEx); Benefiting from lower variable costs due to AWS's massive economies of scale

Answer

Trading capital expenses (CapEx) for variable operating expenses (OpEx) and benefiting from lower variable costs due to AWS's massive economies of scale
The correct choices explain that cloud economics allows a business to trade capital expenses (CapEx) for variable operating expenses (OpEx), reducing upfront costs. Furthermore, customers benefit from lower variable costs because AWS passes on savings achieved through its massive economies of scale.

Step-by-Step Solution

1
Analyze the financial impact of moving from purchasing physical servers upfront to paying for resources dynamically.
Identify that this shift represents moving from Capital Expenses (CapEx) to Operating Expenses (OpEx).
Understanding CapEx vs OpEx is a fundamental principle of cloud economics.
2
Evaluate how AWS aggregates resource usage across millions of customers to lower costs.
Identify that AWS passes these savings to customers as lower variable costs due to economies of scale.
Recognizing the cost advantage of AWS's massive scale helps explain the pricing benefit.

Key Concept

Cloud Economics and Cost Optimization Pillars
Estimated Time:1m 0s
Question 497Question →

A media streaming company uses Amazon CloudFront to distribute video content to users worldwide. Under the AWS Shared Responsibility Model, which two of the following security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Geo Restriction to prevent access from specific geographic locations; Restricting access to content using signed URLs or signed cookies

Answer

Configuring Geo Restriction to prevent access from specific geographic locations, and restricting access to content using signed URLs or signed cookies are the responsibilities of the customer.
Configuring Geo Restriction and restricting access using signed URLs or signed cookies are both customer tasks. Under the Shared Responsibility Model, the customer is responsible for configuring access controls and protecting their data/content (Security in the Cloud).

Step-by-Step Solution

1
Analyze the service model type for Amazon CloudFront.
Amazon CloudFront is a managed global content delivery network (CDN) service.
Managed services shift physical and server-level infrastructure management to AWS, while the customer retains control over configuration, data access, and content protection.
2
Distinguish between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud) for CloudFront.
AWS manages physical security of edge locations, hardware maintenance, and edge server patching. The customer manages content access settings (Geo Restriction, signed URLs/cookies) and viewer encryption certificates.
This allows identifying the tasks that the customer must perform to secure their content delivery.

Key Concept

AWS Shared Responsibility Model for managed services, specifically distinguishing customer-side configuration responsibilities from AWS-side infrastructure management.
Question 498Question →

A startup is deploying a microservices application using AWS Lambda to process user registration data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of AWS?

Show answer & explanation

Answer: Patching the underlying operating system and runtime environment of the Lambda function

Answer

Patching the underlying operating system and runtime environment of the Lambda function is the responsibility of AWS.
Under the AWS Shared Responsibility Model, for serverless and managed services like AWS Lambda, AWS manages the guest operating system, runtime environment, physical infrastructure, and virtualization layer. Therefore, patching the underlying OS and runtime environment is a responsibility of AWS.

Step-by-Step Solution

1
Analyze the service type mentioned in the scenario.
AWS Lambda is a serverless, fully managed compute service.
Different AWS services (IaaS vs. PaaS/Serverless) have different boundaries of responsibility under the Shared Responsibility Model.
2
Determine the division of responsibilities for serverless compute.
AWS manages the physical infrastructure, virtualization layer, operating system, and execution runtime. The customer is responsible for configuring access policies, writing secure application code, and protecting their data.
Since the customer does not have access to or control over the underlying OS or runtime in Lambda, AWS must maintain and patch them.

Key Concept

Shared Responsibility Model for Serverless Compute (AWS Lambda)
Estimated Time:45s
Question 499Question →

An online retailer wants to ensure that its billing application and its shipping notification application can operate independently. By inserting an Amazon Simple Queue Service (Amazon SQS) queue between the two applications, a delay in shipping notifications will not prevent billing transactions from completing. Which AWS Cloud design principle does this architecture demonstrate?

Show answer & explanation

Answer: Loose coupling

Answer

Loose coupling
Loose coupling is the design principle of reducing dependencies between components. In this scenario, placing Amazon SQS between the billing and shipping applications decouples them. If the shipping application slows down or fails, the billing application can still successfully process transactions and add messages to the queue, preventing a cascading failure.

Step-by-Step Solution

1
Analyze the scenario details.
The scenario describes a system where the billing application and the shipping notification application are separated by an Amazon SQS queue, allowing them to function independently even when one experiences a delay.
Understanding the interaction between components is key to identifying the architectural pattern being used.
2
Map the observed behavior to AWS Cloud design principles.
Separating components so they do not directly depend on each other's immediate availability is the definition of loose coupling.
This matches the principle of loose coupling, which reduces interdependencies to improve system resilience.

Key Concept

Loose coupling is an AWS Cloud design principle that reduces interdependencies between components, ensuring that a change or failure in one does not affect the others.
Question 500Question →

An automotive manufacturer is auditing its connected-vehicle telemetry platform hosted on AWS to verify compliance with ISO/IEC 27001 standards. Under the AWS Shared Responsibility Model, which compliance-related activity is the sole responsibility of the customer?

Show answer & explanation

Answer: Managing access permissions and user roles within the AWS Identity and Access Management (IAM) service

Answer

Managing access permissions and user roles within the AWS Identity and Access Management (IAM) service
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. This includes configuring identity and access management (IAM) to control access to AWS resources. Managing access permissions and user roles is a customer task, while AWS is responsible for physical security of data centers, hypervisor patching, and hardware disposal.

Step-by-Step Solution

1
Analyze the compliance requirements and identify the operational boundaries defined by the AWS Shared Responsibility Model.
Establish that security 'of' the cloud (infrastructure, hardware, virtualization) belongs to AWS, while security 'in' the cloud (customer data, operating systems, access management) belongs to the customer.
This sets the foundation for distinguishing between AWS and customer responsibilities under compliance frameworks.
2
Evaluate each option against the responsibility boundaries.
Determine that physical security, hypervisor patching, and hardware disposal are security 'of' the cloud (AWS responsibilities). Managing access permissions and user roles via IAM is security 'in' the cloud (customer responsibility).
This allows the selection of the correct option that is the customer's sole responsibility.

Key Concept

AWS Shared Responsibility Model for Compliance
PreviousPage 25 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin