Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 501Question →

A food delivery startup wants to continuously monitor its AWS accounts and workloads for malicious activity and unauthorized behavior, such as potential data exfiltration or unusual API calls. Which AWS service should the startup use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it is an intelligent, managed threat detection service that continuously monitors AWS accounts, workloads, and S3 data for malicious activities, unauthorized access, and anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is the need for continuous threat detection and monitoring of AWS accounts for malicious activity.
The solution must actively monitor and analyze account-level behavior for indicators of compromise or security anomalies.
This establishes that the correct service must have active threat detection capabilities rather than static vulnerability scanning or passive logging.
2
Compare the capabilities of the options to find the service that matches this threat monitoring requirement.
Amazon GuardDuty is identified as the service built to ingest data sources like CloudTrail events and VPC flow logs to identify suspicious activity.
Amazon GuardDuty uses machine learning and threat intelligence feeds to discover activities such as credential exfiltration and unauthorized API calls, which directly satisfies the startup's requirements.

Key Concept

Continuous threat detection with Amazon GuardDuty
Estimated Time:45s
Question 502Question →

A logistics provider wants to identify potential security threats and malicious activity across their AWS accounts by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. Which AWS service should they use for this continuous threat monitoring?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data. It uses machine learning and threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is continuous monitoring of AWS accounts for security threats and malicious activity by analyzing VPC Flow Logs, DNS logs, and CloudTrail events.
The requirement points to an intelligent threat detection service.
Understanding the core need helps narrow down the choices to security services designed for continuous log analysis and threat monitoring.
2
Evaluate the choices based on their core functionality.
AWS CloudTrail logs API activity; Amazon CloudWatch monitors system performance and application logs; Amazon Inspector scans for host vulnerabilities; Amazon GuardDuty performs intelligent threat detection using log analysis.
Differentiating these logging, monitoring, and security scanning services ensures the correct tool is selected for threat monitoring.

Key Concept

Continuous threat monitoring and intelligent log analysis on AWS
Estimated Time:45s
Question 503Question →

An educational technology (EdTech) company is launching a new virtual learning platform. The platform experiences highly unpredictable user traffic, peaking during daytime school hours and dropping significantly overnight. Additionally, the company wants its IT team to focus on developing new learning features rather than managing physical hardware and infrastructure.

Which of the following benefits of the AWS Cloud directly address this company's challenges? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Stop spending money running and maintaining data centers

Answer

The correct answers are the benefits to stop guessing capacity and to stop spending money running and maintaining data centers.
The platform's unpredictable traffic patterns mean that resource demand varies significantly. The benefit of 'Stop guessing capacity' allows the platform to use elasticity to scale resources up or down dynamically, avoiding under-provisioning or over-paying. Additionally, because the company wants its IT team to focus on writing code and developing features rather than racking servers, power, and cooling, the benefit of 'Stop spending money running and maintaining data centers' applies directly.

Step-by-Step Solution

1
Analyze the company's first challenge: unpredictable traffic that peaks during school hours and drops at night.
Identify that the cloud benefit of 'Stop guessing capacity' allows the company to dynamically scale resources to meet demand without over-provisioning.
This matches the traffic pattern requirement by utilizing elasticity.
2
Analyze the company's second challenge: wanting the IT team to focus on developing learning features instead of managing physical hardware.
Identify that 'Stop spending money running and maintaining data centers' allows the company to delegate infrastructure management to AWS and focus on business value.
This matches the desire to offload physical server maintenance.

Key Concept

Benefits of the AWS Cloud
Question 504Question →

A financial analytics startup is planning to launch a new forecasting application. Instead of purchasing physical servers and networking hardware upfront, the startup decides to host the application on AWS and pay only for the resources they use each month. Which cloud economics concept does this decision represent?

Show answer & explanation

Answer: Replacing upfront capital expenditures with variable operational costs

Answer

Replacing upfront capital expenditures with variable operational costs
Replacing upfront capital expenditures with variable operational costs is correct because the AWS Cloud allows customers to avoid high upfront hardware investments (CapEx) and instead pay for resource consumption on a pay-as-you-go basis as ongoing operational expenses (OpEx).

Step-by-Step Solution

1
Analyze the financial transition in the scenario
The startup is choosing not to purchase physical hardware upfront (avoiding Capital Expenditures) and is instead paying a monthly fee based on actual usage (paying Operating Expenditures).
This is a key differentiator of cloud computing economics compared to traditional on-premises data centers.
2
Match this financial model to the correct AWS Cloud economics benefit
This shift represents trading capital expenditures for variable operating costs.
By using AWS, organizations replace the fixed overhead of physical assets with flexible, consumption-based operating costs.

Key Concept

Shifting from Capital Expenditures (CapEx) to Operating Expenditures (OpEx)
Estimated Time:1m 0s
Question 505Question →

A utility company is deploying an IoT smart-grid application on AWS. The application ingests telemetry data from millions of smart meters over the public internet and stores the processed records in an Amazon S3 bucket. The company's compliance policy requires all data to be encrypted both in transit and at rest.

According to the AWS Shared Responsibility Model, which of the following actions are the responsibility of the customer to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring SSL/TLS for data ingestion to protect telemetry data in transit.; Enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.

Answer

Configuring SSL/TLS for data ingestion to protect telemetry data in transit, and enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.
The customer is responsible for configuring encryption of data in transit (such as enforcing SSL/TLS protocols for data ingestion) and implementing encryption at rest for stored data (such as enabling Amazon S3 server-side encryption using KMS keys). Under the Shared Responsibility Model, AWS manages the security 'of' the cloud, including physical security of data centers, host infrastructure, and underlying managed encryption hardware, while the customer manages security 'in' the cloud, including data configuration and access policies.

Step-by-Step Solution

1
Analyze the Shared Responsibility Model for encryption in transit.
Identify that configuring secure ingestion protocols (like SSL/TLS) over the public internet to AWS endpoints is the customer's responsibility to protect data in transit.
AWS secures the ingestion endpoints, but configuring the client devices and setting up SSL/TLS connections to those endpoints is managed by the customer.
2
Analyze the Shared Responsibility Model for encryption at rest.
Identify that enabling encryption on storage services like Amazon S3 and configuring the KMS keys used for that encryption is the customer's responsibility.
AWS provides the encryption features and tools, but the customer must choose to enable them and define the key policies.
3
Evaluate the infrastructure-related options to eliminate AWS-managed tasks.
Exclude physical HSM upkeep, dedicated HSM deployment for KMS, and intra-AZ network infrastructure management, as these are managed by AWS.
AWS is responsible for the physical security, hardware maintenance, and global networking infrastructure.

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for data security configurations, which include configuring SSL/TLS protocols for data in transit and enabling server-side encryption at rest (such as in Amazon S3) using KMS keys. AWS is responsible for the security of the underlying infrastructure, including physical networking, hosting hosts, and the physical HSMs utilized by managed services.
Question 506Question →

A logistics and package delivery company runs its route optimization software on a fleet of Amazon EC2 instances. The cybersecurity team wants to implement a security solution to achieve two goals: automatically scan the EC2 instances for known software vulnerabilities, and continuously monitor the AWS account for threat patterns such as credential theft or anomalous API activity. Which AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector is the dedicated service for scanning EC2 instances for software vulnerabilities and network reachability issues. Amazon GuardDuty is the correct service for active threat detection, leveraging machine learning and threat intelligence to identify anomalous account behavior, credential compromises, and malicious activity.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on the virtual hosts.
Amazon Inspector is identified as the AWS service designed for automated package and software vulnerability assessment of Amazon EC2 instances.
Inspector runs automated assessments to find vulnerabilities and unintended network exposure on virtual machine instances.
2
Identify the requirement for continuous account-level threat detection.
Amazon GuardDuty is identified as the intelligent threat detection service that monitors logs (like CloudTrail and VPC Flow Logs) to identify malicious actions, compromised credentials, or anomalous behavior.
GuardDuty uses machine learning and threat intelligence to analyze account activity and identify threats in real time.

Key Concept

Vulnerability scanning versus threat detection in AWS security services
Estimated Time:1m 30s
Question 507Question →

An online education startup wants to avoid paying heavy upfront costs for physical servers and data centers. Instead, they want to pay only for the computing resources they consume on a monthly basis. Which benefit of the AWS Cloud is best described by this approach?

Show answer & explanation

Answer: Trade capital expense for variable expense

Answer

Trading capital expense for variable expense allows the startup to pay only for the resources they consume instead of investing heavily in data centers and servers beforehand.
Trading capital expense for variable expense allows organizations to pay only for the resources they consume rather than investing heavily in physical data centers and servers before using them. This provides cost flexibility and reduces upfront financial risk.

Step-by-Step Solution

1
Analyze the startup's requirements of avoiding upfront capital costs and paying only for consumed resources.
Identify that the startup wants to transition from large upfront investments (capital expenses) to usage-based fees (variable expenses).
To map the business requirement to the correct AWS Cloud benefit.
2
Compare the identified financial need against the 6 benefits of AWS Cloud.
The benefit 'Trade capital expense for variable expense' directly describes shifting from upfront infrastructure costs to paying on the go.
To select the option that matches the identified benefit.

Key Concept

Trading capital expense for variable expense (CapEx to OpEx shift)
Estimated Time:45s
Question 508Question →

A media company is redesigning its video transcoding pipeline on AWS. Currently, a monolithic system receives uploaded videos, transcodes them, and stores the results. When multiple large files are uploaded at the same time, the system runs out of resources and fails, halting the entire pipeline. Which of the following architectural changes should the company implement to align with the AWS Cloud design principles of 'loose coupling' and 'services not servers'? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use Amazon Simple Queue Service (Amazon SQS) to buffer incoming transcoding requests, allowing the upload and transcoding components to operate independently.; Utilize AWS Lambda functions to execute the transcoding code automatically in response to upload events without provisioning or managing virtual servers.

Answer

The correct architecture uses Amazon Simple Queue Service (Amazon SQS) to decouple the upload and transcoding components, and AWS Lambda to process transcoding tasks without managing underlying servers.
The correct selections are using Amazon Simple Queue Service (Amazon SQS) to buffer incoming transcoding requests and utilizing AWS Lambda to execute transcoding code. Amazon SQS decouples the upload and transcoding components so they do not depend on each other's immediate availability (implementing loose coupling). AWS Lambda runs code serverlessly in response to upload events, which removes the operational burden of managing, patching, and scaling physical or virtual servers (implementing services not servers).

Step-by-Step Solution

1
Analyze the problem in the scenario: a monolithic transcoding system runs out of resources and fails when handling simultaneous uploads, causing the entire pipeline to fail.
Identified the need for decoupled, resilient components (loose coupling) and serverless computing to avoid managing virtual servers (services not servers).
This establishes which design principles are needed to solve the problem.
2
Evaluate the option regarding Amazon Simple Queue Service (Amazon SQS).
Amazon SQS acts as a message broker that decouples components, allowing them to scale independently and preventing failures in one component from taking down the other.
This implements the 'loose coupling' design principle.
3
Evaluate the option regarding AWS Lambda.
AWS Lambda is a serverless compute service that runs code in response to events (like file uploads) without requiring EC2 instance provisioning or management.
This implements the 'services not servers' design principle.
4
Verify that other options represent design anti-patterns (such as tight coupling, monolithic setups, or static provisioning).
The option suggesting a single EC2 instance and the option suggesting synchronous API calls represent tight coupling/monolithic designs, while the option suggesting pre-provisioning a static fleet ignores elasticity.
This confirms that the distractors are incorrect based on the design principles.

Key Concept

AWS Cloud Design Principles: Loose Coupling and Services Not Servers
Question 509Question →

An e-commerce startup is designing a secure network environment within a Virtual Private Cloud (VPC). To protect their resources, they plan to use both Security Groups and Network Access Control Lists (Network ACLs). Which two of the following statements correctly describe the characteristics or behavior of these network security features?

Select all that apply

Show answer & explanation

Answer: Security Groups are stateful, meaning allowed inbound traffic automatically permits return outbound traffic.; Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed by rules.

Answer

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules in both directions).
Security Groups are stateful firewalls that automatically allow return traffic for established connections. Conversely, Network ACLs are stateless firewalls operating at the subnet boundary, requiring explicit configuration for both inbound and outbound traffic paths.

Step-by-Step Solution

1
Analyze the state characteristics of both network security layers.
Identify that Security Groups automatically track connection state (stateful), while Network ACLs inspect every packet individually and do not track state (stateless).
This establishes the correct behavior of return traffic rules for both tools.
2
Evaluate the operational scope and management boundaries of the remaining choices.
Confirm that Security Groups apply to instances (not subnets), rules must be set by the customer (not AWS), and scanning is done by Amazon Inspector (not Network ACLs).
This eliminates incorrect answers by mapping them to known errors in boundaries, scope, and service functionality.

Key Concept

The primary distinction between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) within an AWS VPC.
Question 510Question →

AeroWing Logistics is planning a migration of its on-premises infrastructure to AWS. During the discovery phase, the migration team identifies two specific systems:

1. A legacy package-tracking utility that has been completely replaced by a newer system and is no longer used by any business unit.
2. A critical customer portal running on an on-premises web server. The team wants to move the portal to AWS while reducing database management overhead. They plan to migrate the self-managed database to Amazon Relational Database Service (Amazon RDS) without modifying the core application code.

Which two migration strategies should the company apply to these systems? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replatforming; Retiring

Answer

Replatforming and Retiring are the correct migration strategies.
The correct strategy for the unused package-tracking utility is Retiring, as it is no longer required and should be turned off. The correct strategy for the customer portal is Replatforming because it replaces the on-premises database server with a managed service (Amazon RDS) without altering the application's core code.

Step-by-Step Solution

1
Analyze the first system: A legacy utility that is no longer used by any business unit.
Since it is obsolete and provides no business value, it should be decommissioned. This corresponds to the Retiring strategy.
Identifying and shutting down unnecessary resources reduces costs and migration scope.
2
Analyze the second system: A portal whose database is being moved to Amazon RDS to reduce management overhead without changing the core code.
This matches Replatforming, which involves making small optimizations (like adopting a managed database service) without changing the core architecture or code.
This strategy allows the organization to benefit from cloud-native automation (backups, patching) with minimal migration effort.

Key Concept

Cloud migration strategies (6 Rs) classify workloads during planning to optimize migration paths.
Question 511Question →

A university website experiences a predictable spike in user traffic during registration week, followed by a significant drop. The IT department wants the website to automatically provision more servers during peak times and terminate them when traffic decreases to avoid paying for idle resources. Which AWS Cloud design principle is the university applying?

Show answer & explanation

Answer: Elasticity

Answer

Elasticity
Elasticity is the ability to acquire resources as they are needed and release them when they are no longer required. In this scenario, automatically provisioning servers during peak enrollment times and terminating them when traffic drops matches resources directly to demand, optimizing costs and availability.

Step-by-Step Solution

1
Analyze the university's technical requirements and traffic pattern.
The application experiences high-traffic spikes followed by low-traffic periods, requiring resources to scale up and scale down automatically.
To match capacity with demand without manual intervention or paying for unused resources.
2
Match this requirement with AWS Cloud design principles.
The principle of matching supply with demand dynamically is defined as elasticity.
To identify the correct design principle that supports automatic scaling of resources.

Key Concept

Elasticity is the AWS design principle of matching supply with demand by dynamically provisioning and deprovisioning resources.
Question 512Question →

An independent game studio is preparing to launch a new multiplayer online game. They are uncertain about the initial player adoption rate, which could range from a few thousand to millions of players within the first week. Additionally, they want to focus their limited engineering resources on game design and player features rather than building and managing physical server facilities.

Which two of the following AWS Cloud benefits directly address this game studio's business requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity, allowing the studio to scale resources dynamically to meet player demand without under-provisioning or paying for idle servers; Stop spending money running and maintaining data centers, allowing the studio to focus engineering resources on game features instead of physical infrastructure management

Answer

The two benefits that address the requirements are stopping guessing capacity and stopping spending money running and maintaining data centers.
The option to stop guessing capacity helps the studio scale resources dynamically in response to actual player numbers, solving the challenge of unpredictable demand. The option to stop spending money running and maintaining data centers allows the studio to avoid the heavy burden of physical infrastructure management, enabling developers to focus on game features.

Step-by-Step Solution

1
Analyze the business requirements from the scenario.
The studio has two main challenges: highly unpredictable player traffic (requiring dynamic capacity planning) and a desire to focus engineering time on game features rather than server management.
Identifying the specific business problems allows us to map them directly to AWS Cloud benefits.
2
Map the first challenge (unpredictable player traffic) to the 6 AWS Cloud benefits.
Stopping guessing capacity directly addresses this by allowing dynamic scaling to meet demand rather than pre-provisioning for a fixed peak.
This matches the requirement to handle traffic ranging from thousands to millions without over-provisioning.
3
Map the second challenge (avoiding building and managing physical server facilities) to the 6 AWS Cloud benefits.
Stop spending money running and maintaining data centers addresses this by offloading physical infrastructure tasks to AWS, letting engineers focus on game development.
This aligns with the goal of minimizing time and money spent on non-differentiating infrastructure tasks.

Key Concept

Identifying how the six advantages of cloud computing (specifically stopping guessing capacity and stopping spending money running and maintaining data centers) apply to specific business scenarios.
Estimated Time:1m 30s
Question 513Question →

A government contractor is building a secure document storage platform on AWS for a federal agency. To satisfy the agency's security requirements, the contractor must verify that the underlying AWS infrastructure complies with the Federal Risk and Authorization Management Program (FedRAMP) standards. Which action should the contractor take to obtain the official AWS FedRAMP authorization documents?

Show answer & explanation

Answer: Download the FedRAMP authorization letters and reports directly from AWS Artifact.

Answer

Download the FedRAMP authorization letters and reports directly from AWS Artifact.
The correct action is to download the FedRAMP authorization letters and reports directly from AWS Artifact. AWS Artifact is the dedicated, self-service portal in the AWS Management Console that provides customers with free, on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from various global accreditation bodies including FedRAMP.

Step-by-Step Solution

1
Identify the compliance requirement, which is to obtain official third-party compliance reports and authorizations (FedRAMP) for the AWS infrastructure.
Recognized that these documents are standard AWS compliance artifacts.
Before using any service, the customer must locate where AWS shares its official compliance documentation.
2
Select the specific AWS service designed to deliver self-service compliance reports and agreements to customers.
Identified AWS Artifact as the primary portal for retrieving these compliance reports.
AWS Artifact provides on-demand, free access to security and compliance reports from AWS third-party auditors.

Key Concept

AWS Artifact is the primary portal for retrieving AWS security and compliance reports.
Estimated Time:1m 0s
Question 514Question →

A startup is deploying a new serverless application using AWS Lambda to process user uploads. In accordance with the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the startup?

Show answer & explanation

Answer: Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.

Answer

Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.
Defining IAM execution roles and resource-based policies is a customer responsibility. Under the Shared Responsibility Model, even for fully managed and serverless services like AWS Lambda, the customer retains control over identity and access management (IAM). This ensures that only authorized entities can invoke the functions and that the functions themselves have the minimum necessary privileges to access other AWS services.

Step-by-Step Solution

1
Analyze the service model type for the resource mentioned in the scenario.
AWS Lambda is a serverless (Function-as-a-Service / PaaS) offering where the underlying physical servers, virtualization hypervisors, operating systems, and runtimes are fully managed by AWS.
Determining the service type helps establish the boundary of responsibility between AWS and the customer.
2
Evaluate the customer's security responsibilities for serverless services.
The customer remains responsible for application code, data, and access management (IAM configuration, function execution roles, and resource policies).
This identifies the specific tasks the startup must perform to secure the application.
3
Select the option that represents a customer responsibility under IAM and access control.
Defining the IAM execution roles and resource-based policies falls directly under customer security configuration.
It aligns with the identity and access management requirements of the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model, serverless services like AWS Lambda shift infrastructure management responsibilities (like operating system patching and runtime maintenance) to AWS. The customer remains responsible for application code, data classification, and access management (Identity and Access Management, policies, and roles).
Question 515Question →

A disaster relief organization needs to deploy a localized emergency coordination portal to serve volunteers and citizens in multiple countries across South America and East Asia. By using AWS, they deploy their application stack to several geographic locations globally within minutes, ensuring low latency for all users. Which benefit of the AWS Cloud is best demonstrated by this deployment?

Show answer & explanation

Answer: Go global in minutes

Answer

Go global in minutes
The correct answer is the benefit of deploying globally in minutes. This benefit allows applications to be replicated in multiple AWS Regions around the world quickly, providing lower latency and a better user experience for international users without the complexity of managing physical infrastructure abroad.

Step-by-Step Solution

1
Analyze the business scenario's key requirement.
The organization needs to deploy its application stack to multiple geographic locations around the world (South America and East Asia) quickly to ensure low-latency access.
Understanding the core requirement helps filter out irrelevant benefits.
2
Map the requirement to the six AWS Cloud benefits.
Deploying globally within minutes to reduce latency directly maps to the 'Go global in minutes' benefit.
This identifies the specific AWS Cloud benefit designed for global reach and latency reduction.

Key Concept

Go global in minutes
Estimated Time:1m 0s
Question 516Question →

A mobile gaming studio hosts its backend matchmaking services on a fleet of Amazon EC2 instances. Before releasing a major update, the development team wants to scan these virtual servers for known software vulnerabilities, unintended network accessibility, and packages that do not comply with security best practices. Which AWS service is designed to automatically perform these vulnerability assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
The correct answer is Amazon Inspector. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It automatically scans Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The studio needs to scan Amazon EC2 instances for software vulnerabilities, unintended network exposure, and security best practice deviations.
This establishes the scope of the tool needed (vulnerability management at the host/software level).
2
Evaluate the AWS security services that match the requirement.
Amazon Inspector is designed specifically for automated vulnerability management and scanning of EC2 instances and container images.
Amazon Inspector analyzes the software package vulnerabilities and network reachability of EC2 instances, making it the correct choice.

Key Concept

Vulnerability management and host-level security assessments in AWS.
Estimated Time:1m 0s
Question 517Question →

A global financial technology (FinTech) company is preparing to launch a payment processing application on AWS. To meet regulatory compliance, the company needs to verify the physical security standards of the AWS data centers and retrieve the latest AWS System and Organization Controls (SOC) 1 report. Which of the following actions should the company take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the AWS SOC 1 report directly from the AWS Artifact console.; Rely on AWS to manage the physical security of the data centers under the Shared Responsibility Model.

Answer

Retrieve the AWS SOC 1 report directly from the AWS Artifact console, and rely on AWS to manage the physical security of the data centers under the Shared Responsibility Model.
AWS compliance reports, including SOC reports, are retrieved on-demand from the AWS Artifact portal. Additionally, the Shared Responsibility Model outlines that AWS is solely responsible for physical security of its data centers, so the customer relies on AWS's compliance posture for physical infrastructure.

Step-by-Step Solution

1
Determine the resource to retrieve compliance documentation.
AWS Artifact is the central agreement and compliance portal that allows customers to download SOC reports.
This meets the requirement of obtaining the SOC 1 report.
2
Determine who controls the physical security of the AWS cloud infrastructure.
Under the Shared Responsibility Model, AWS is responsible for 'Security of the Cloud,' which covers physical security.
This clarifies the customer's role regarding data center physical controls.

Key Concept

AWS Artifact is the primary portal for retrieving AWS compliance reports, and physical infrastructure security is managed by AWS under the Shared Responsibility Model.
Question 518Question →

A company is setting up AWS access for a team of developers who need to manage cloud resources through the AWS Management Console and execute command-line scripts locally. The company wants to integrate access with their existing corporate identity provider and ensure that developers do not store long-term credentials on their local workstations. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access from the existing corporate identity provider.; Configure developers to use short-lived temporary credentials for local command-line access.

Answer

Configure AWS IAM Identity Center to federate access from the corporate identity provider and configure developers to use short-lived temporary credentials for local command-line access.
Configuring identity federation via AWS IAM Identity Center integrates access with the corporate identity provider. Enforcing short-lived temporary credentials for local CLI access prevents the risk of storing long-term credentials on developer workstations.

Step-by-Step Solution

1
Address console access integration by implementing identity federation.
AWS IAM Identity Center is configured to allow developers to log in to the console using their corporate identity provider credentials.
This satisfies the requirement to integrate access with the existing corporate identity provider without creating duplicate IAM users.
2
Address programmatic workstation security by enforcing short-lived temporary credentials.
Developers use short-lived credentials (such as those generated via AWS STS or IAM Identity Center CLI integration) on their local machines.
This satisfies the requirement to avoid storing long-term credentials like permanent IAM access keys on local workstations.

Key Concept

Identity federation and short-lived credentials management in AWS IAM.
Question 519Question →

A startup is deploying a web application on Amazon EC2 instances. The security team needs to continuously scan these EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they need to monitor their AWS accounts for malicious activity and unauthorized behavior.

Which of the following AWS services should the startup use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector is correct because it automates vulnerability management by scanning EC2 instances for software vulnerabilities and network exposure. Amazon GuardDuty is correct because it provides intelligent threat detection by continuously monitoring AWS accounts and workloads for malicious activity.

Step-by-Step Solution

1
Identify the requirement for scanning hosts (Amazon EC2 instances) for software vulnerabilities and network exposure.
Amazon Inspector is identified as the service designed to automate host-level vulnerability assessments and network reachability scans.
This matches the AWS service definition for host and container vulnerability scanning.
2
Identify the requirement for continuously monitoring the AWS account for malicious activity and unauthorized access.
Amazon GuardDuty is identified as the service that analyzes logs (such as CloudTrail and VPC Flow Logs) to detect active threats and anomalies.
This matches the AWS service definition for intelligent threat detection.

Key Concept

Identifying the distinct purposes of Amazon Inspector for vulnerability scanning and Amazon GuardDuty for threat detection.
Question 520Question →

A company wants to establish baseline visibility for its new AWS account. The company has two requirements: first, it must record a history of all API calls and user activity for security compliance auditing; second, it must track infrastructure performance metrics (such as CPU utilization) and send alerts when resource limits are exceeded. Which of the following AWS services should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

The company should use AWS CloudTrail and Amazon CloudWatch.
AWS CloudTrail tracks and logs all API calls and user changes in the AWS account, which satisfies auditing needs. Amazon CloudWatch gathers performance data and can trigger notifications when metrics go past set thresholds, satisfying the performance monitoring needs.

Step-by-Step Solution

1
Determine which service records and logs AWS API events and user actions.
AWS CloudTrail is identified as the service that logs all account management actions.
This meets the compliance requirement of recording all user API activity.
2
Determine which service collects operational metrics and sends alerts on threshold violations.
Amazon CloudWatch is identified as the monitoring and alerting service.
This satisfies the requirement to track CPU utilization and set up alerts.

Key Concept

Distinguishing between CloudTrail (API history and auditing) and CloudWatch (metrics, performance monitoring, and alerting).
PreviousPage 26 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin