Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 521Question →

A renewable energy firm is developing a smart grid monitoring application. They want to avoid buying expensive physical servers upfront and want the ability to deploy their application to wind farms located in multiple geographic regions around the world. Which two benefits of the AWS Cloud are they directly utilizing? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes; Trade capital expense for variable expense

Answer

The two benefits of the AWS Cloud are 'Go global in minutes' and 'Trade capital expense for variable expense'.
The renewable energy firm benefits from 'Trade capital expense for variable expense' by avoiding upfront hardware costs and instead paying only for the resources they use. They also benefit from 'Go global in minutes' because AWS allows them to deploy applications across multiple global regions with just a few clicks, reducing latency for wind farms around the world.

Step-by-Step Solution

1
Analyze the firm's requirement to deploy applications to wind farms in multiple geographic regions.
This maps to 'Go global in minutes', which allows deploying applications globally with minimal latency.
AWS infrastructure spans multiple geographic regions, allowing applications to be deployed globally in minutes.
2
Analyze the requirement to avoid purchasing expensive physical servers upfront.
This maps to 'Trade capital expense for variable expense', where upfront capital expenses are replaced by variable operational expenses.
AWS charges only for the resources consumed, avoiding upfront hardware investments.

Key Concept

Benefits of AWS Cloud Computing
Question 522Question →

Altus Manufacturing is planning to migrate its legacy on-premises inventory management application to AWS. To reduce operational overhead, the IT department decides to migrate the self-managed database to Amazon Relational Database Service (Amazon RDS) for PostgreSQL, while keeping the application server's configuration and code unchanged. Which migration strategy is Altus Manufacturing using for this database migration?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming is the correct migration strategy because the company is migrating its self-managed database to a fully managed database service (Amazon RDS) to reduce administrative overhead, without making changes to the core application code.
The correct answer is Replatforming. In a replatforming strategy, also known as 'lift-tinker-and-shift,' minor optimizations are made to the application during migration to take advantage of cloud capabilities (such as shifting from a self-managed database to a fully managed AWS service like Amazon RDS) without changing the core architecture or code of the application itself.

Step-by-Step Solution

1
Analyze the migration scenario details and identify that the database is migrating from a self-managed setup on-premises to a fully managed AWS service (Amazon RDS).
This shows a platform optimization (shifting operational tasks to AWS) while leaving the core application code unchanged.
Identifying optimizations help differentiate between Rehosting and Replatforming.
2
Evaluate the architectural modifications to see if the core code or application layout is being restructured.
The core application code and server configuration remain unchanged, ruling out Refactoring.
Refactoring requires rewriting code to adapt to cloud-native paradigms.
3
Select the migration strategy that aligns with making optimizations without altering core code.
The strategy is classified as Replatforming (lift-tinker-and-shift).
Replatforming matches the scenario of substituting a self-managed database with a managed database service (RDS) without changing the core code.

Key Concept

Cloud migration strategies (6 Rs), specifically Replatforming (lift-tinker-and-shift)
Estimated Time:1m 0s
Question 523Question →

A financial services firm runs compliance monitoring agents on Amazon EC2 instances within a dedicated subnet. These agents must establish outbound connections to an external regulatory API on port 443443 to upload audit logs. The security team implements a strict Network Access Control List (Network ACL) for the subnet, adding an outbound rule that permits traffic to the API's IP range on TCP port 443443. No inbound rules are added to the Network ACL. The associated Security Groups are left at their default settings (allowing all outbound traffic and no inbound traffic). During testing, the agents fail to establish a connection with the API.

Which modification is required to allow this communication while maintaining the principle of least privilege?

Show answer & explanation

Answer: Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.

Answer

Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
Since Network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic. When the EC2 instances initiate connections to the external API on port 443443, the return traffic is sent to ephemeral ports (10241024-6553565535) on the EC2 instances. Therefore, an inbound Network ACL rule must be added to allow traffic from the API's IP address range on ports 10241024-6553565535. Default Security Groups are stateful, meaning they track connection state and automatically allow the return traffic at the instance level without requiring any inbound Security Group rule changes.

Step-by-Step Solution

1
Analyze the stateful behavior of the Security Group.
The default Security Group settings allow all outbound traffic. Because Security Groups are stateful, any outbound request's return traffic is automatically allowed back in. No Security Group modifications are needed.
To determine if the blockage is occurring at the instance firewall level.
2
Analyze the stateless behavior of the Network ACL.
The Network ACL is stateless, meaning outbound and inbound traffic must be explicitly permitted by separate rules. The current setup only allows outbound traffic on port 443443.
To locate the point of failure in the network path.
3
Identify the destination port of the returning traffic.
When an EC2 instance initiates a connection to port 443443 of the external API, it sends requests from a random ephemeral port (TCP range 10241024-6553565535). The API's response is sent back to this ephemeral port on the EC2 instance.
To determine the correct port range for the inbound Network ACL rule.
4
Formulate the required Network ACL rule modification.
Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
To allow the stateless firewall to permit the returning response traffic back to the subnet.

Key Concept

Stateful vs. Stateless Firewalls (Security Groups vs. Network ACLs) and Ephemeral Ports
Estimated Time:2m 0s
Question 524Question →

A company is setting up its security guidelines for access management in AWS. The IT manager wants to enforce Multi-Factor Authentication (MFA) to protect the account's resources. According to AWS security best practices, which of the following identities should have MFA enabled? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The AWS account root user; Individual IAM users who perform administrative tasks

Answer

The AWS account root user and individual IAM users who perform administrative tasks should have Multi-Factor Authentication (MFA) enabled.
The correct options are the AWS account root user and individual IAM users who perform administrative tasks. According to AWS security best practices, multi-factor authentication (MFA) should be enabled on the root account to prevent unauthorized access to the most privileged user in the account. Similarly, IAM users, particularly those with administrative privileges, should have MFA enabled to protect daily operational access.

Step-by-Step Solution

1
Identify the entities within the AWS environment that represent human users or credentials requiring protection via Multi-Factor Authentication (MFA).
MFA is applicable to user accounts that log in via the console or CLI, such as the root user and IAM users.
MFA adds an extra layer of security on top of user passwords to verify human identity.
2
Evaluate the non-human or machine-based entities and identify why they do not use MFA.
IAM roles use temporary security credentials and are assumed programmatically, while Security Groups are network firewalls, and physical security is managed by AWS.
These entities do not involve human interactive logins and thus do not support or require MFA configuration by the customer.

Key Concept

Multi-Factor Authentication (MFA) best practices for securing human identities in IAM.
Question 525Question →

An agricultural technology company runs a crop monitoring system. The system requires massive compute resources for two weeks during the bi-annual harvesting season to process telemetry data. For the remaining 11 months of the year, the compute demand is near zero. The company is evaluating the financial impact of migrating this workload from its on-premises data center to AWS. Which of the following represents the primary economic advantage of this migration?

Show answer & explanation

Answer: Leveraging elasticity to dynamically provision resources during the peak harvest weeks and terminate them afterward, shifting from a fixed capital expense (CapEx) to a variable operating expense (OpEx).

Answer

Leveraging elasticity to dynamically provision resources during the peak harvest weeks and terminate them afterward, shifting from a fixed capital expense (CapEx) to a variable operating expense (OpEx).
The correct answer correctly identifies that the primary economic benefit comes from elasticity and the CapEx-to-OpEx shift. Since the telemetry processing workload is highly seasonal (active for only 4 weeks out of 52), paying for resources dynamically as an operating expense (OpEx) when they are actually running prevents the company from wasting money on idle physical infrastructure (CapEx) during the rest of the year.

Step-by-Step Solution

1
Analyze the demand pattern of the workload.
The workload has a highly variable demand pattern, requiring massive compute capacity for only 4 weeks a year (two weeks twice a year) and minimal capacity otherwise.
Understanding the demand curve helps identify which cloud economic benefits (like elasticity) apply.
2
Evaluate the financial shift between on-premises and cloud models.
On-premises requires capital expenses (CapEx) to buy hardware for peak capacity. AWS allows paying for resources as variable operating expenses (OpEx) based on consumption.
This contrasts the fixed-cost model of physical hardware with the pay-as-you-go model of the cloud.
3
Determine the optimal cloud mechanism for cost reduction.
Elasticity allows the company to scale resources up during the peak harvest weeks and scale them back down when not in use, avoiding paying for idle capacity.
Elasticity directly matches resource supply with demand to optimize cloud spending.

Key Concept

The primary economic benefit of the cloud is the shift from capital expenses (CapEx) to variable operating expenses (OpEx), enabled by elasticity, allowing customers to pay only for the resources they consume.
Estimated Time:1m 30s
Question 526Question →

A security team needs to monitor and audit IP traffic routing through network interfaces in a Virtual Private Cloud (VPC) to investigate network connectivity issues. Which AWS feature should the team enable to collect this network traffic information?

Show answer & explanation

Answer: VPC Flow Logs

Answer

VPC Flow Logs
VPC Flow Logs is the feature that allows you to capture and log IP traffic details for network interfaces in a VPC. It is widely used to troubleshoot connection issues and audit traffic rules.

Step-by-Step Solution

1
Determine the security requirement, which is to capture and audit IP traffic going to and from network interfaces in a VPC.
The target resource must be a network monitoring or auditing feature.
This helps rule out services focused on API auditing or threat detection.
2
Evaluate the features of VPC Flow Logs against the other options.
VPC Flow Logs is specifically designed to log IP traffic at the network interface level, satisfying the requirements.
VPC Flow Logs provides the exact raw network traffic information needed for troubleshooting connectivity issues.

Key Concept

VPC Flow Logs enables you to capture information about the IP traffic going to and from network interfaces in your VPC.
Estimated Time:40s
Question 527Question →

A financial research firm needs to run a complex risk analysis simulation once a week. The simulation requires a large cluster of compute instances for six hours. The firm uses infrastructure as code to automatically provision the instances, run the simulation, and then immediately terminate the entire cluster. Which AWS Cloud design principle is directly demonstrated by this operational workflow?

Show answer & explanation

Answer: Disposable resources instead of fixed servers

Answer

Disposable resources instead of fixed servers
The principle of using disposable resources instead of fixed servers dictates that infrastructure should be treated as temporary and easily replaceable. By programmatically launching a compute cluster for a weekly simulation and terminating it immediately after completion, the firm optimizes cost and resource utilization, avoiding the expense of maintaining idle, permanent servers.

Step-by-Step Solution

1
Analyze the operational workflow described in the scenario.
The firm spins up resources on demand for a short-lived task (six hours) and completely tears them down afterward.
This establishes that the infrastructure is temporary and not a permanent fixture.
2
Identify the AWS design principle that relates to treating infrastructure as temporary, programmatically defined assets.
The principle is 'Disposable resources instead of fixed servers'.
This principle leverages cloud automation to provision and terminate environments dynamically, eliminating the need for fixed, continuous infrastructure.

Key Concept

Disposable resources instead of fixed servers
Question 528Question →

A retail company is migrating its customer database and product catalogs to Amazon S3. The company's security policy requires that all data stored in the cloud must be encrypted at rest. Under the AWS Shared Responsibility Model, which of the following is a customer responsibility regarding this encryption requirement?

Show answer & explanation

Answer: Configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS)

Answer

Configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS)
The correct answer is configuring server-side encryption on the Amazon S3 buckets using AWS Key Management Service (AWS KMS). Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption of data at rest (security 'in' the cloud). This includes selecting and enabling the appropriate encryption settings on their S3 buckets.

Step-by-Step Solution

1
Determine which security controls are managed by the customer under the Shared Responsibility Model.
The customer is responsible for configuring security options 'in' the cloud, such as enabling server-side encryption on their Amazon S3 buckets.
AWS is responsible for security 'of' the cloud, which includes the physical security of data centers and the underlying infrastructure.
2
Differentiate between customer responsibilities and AWS operational tasks for managed security services.
Tasks like maintaining the physical security of hardware security modules (HSMs) and patching host operating systems of storage servers are handled entirely by AWS.
Managed services like Amazon S3 and AWS KMS offload infrastructure and physical maintenance to AWS.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for data protection and encryption configuration (security 'in' the cloud), while AWS is responsible for physical and infrastructure security (security 'of' the cloud).
Question 529Question →

Stellaris Hospitality is preparing to migrate its legacy application portfolio to the AWS Cloud. During the discovery phase, the IT team evaluates two applications:
- A proprietary, custom-built property management system that must be redesigned to leverage serverless databases and auto-scaling.
- An on-premises commercial billing software that will be retired in favor of a web-based Software-as-a-Service (SaaS) solution.

Which of the following migration strategies represent the correct approach for these two systems? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Refactoring (Re-architecting) for the custom property management system to enable cloud-native features.; Repurchasing for the billing software to transition to a SaaS subscription model.

Answer

Refactoring (Re-architecting) for the custom property management system to enable cloud-native features, and Repurchasing for the billing software to transition to a SaaS subscription model.
The custom property management system requires a redesign to implement cloud-native features (like serverless databases and auto-scaling), which is the definition of Refactoring (Re-architecting). The billing software is being retired and replaced with a Software-as-a-Service (SaaS) model, which is the definition of Repurchasing.

Step-by-Step Solution

1
Analyze the migration requirements for the custom property management system.
The application needs to be redesigned for serverless databases and auto-scaling, requiring code and architecture modifications.
This corresponds to the Refactoring (Re-architecting) migration strategy.
2
Analyze the migration plan for the commercial billing software.
The application will be retired in favor of a third-party, web-based SaaS platform.
This corresponds to the Repurchasing migration strategy.
3
Combine findings to identify the two correct strategies.
Refactoring and Repurchasing are the chosen strategies.
Matching the correct definition of the 6 Rs migration strategies is required to answer the question.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Question 530Question →

An automotive telemetry platform processes vehicle sensor data using a fleet of Amazon EC2 instances. The security team needs to implement a solution to scan these EC2 instances for known software vulnerabilities and continuously monitor the AWS accounts for malicious activity or unauthorized behavior. Which two AWS services should the platform use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector performs vulnerability management by scanning EC2 instances for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides intelligent threat detection by continuously monitoring AWS accounts and workloads for malicious activity.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on Amazon EC2 instances.
Amazon Inspector is selected as it is specifically designed to scan EC2 instances and container images for software vulnerabilities and network exposure.
Vulnerability scanning is a core function of Amazon Inspector.
2
Identify the requirement for continuous threat detection and monitoring of malicious activity across the AWS account.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to detect unauthorized behavior and malicious activity.
Intelligent threat detection across AWS accounts and workloads is the primary use case for Amazon GuardDuty.

Key Concept

Identifying AWS services for threat detection and vulnerability management
Question 531Question →

A logistics company uses Amazon Simple Queue Service (SQS) to decouple its order processing systems. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring IAM policies to restrict access to the queue; Enabling server-side encryption (SSE) on the queue using encryption keys

Answer

Configuring IAM policies to restrict access to the queue, and enabling server-side encryption (SSE) on the queue using encryption keys.
For fully managed services like Amazon SQS, the customer is responsible for security 'in' the cloud, which includes configuring IAM policies to restrict queue access and enabling server-side encryption to protect data. AWS is responsible for security 'of' the cloud, including the underlying infrastructure, operating systems, and physical security.

Step-by-Step Solution

1
Identify the AWS service model type for Amazon SQS.
Amazon SQS is a fully managed service, meaning AWS handles all underlying infrastructure, servers, physical hardware, and operating systems.
Understanding the service type helps determine where the boundary of responsibility lies.
2
Determine customer responsibilities (security 'in' the cloud) for SQS.
The customer is responsible for data classification, encryption settings, and configuring identity and access management (IAM) policies to secure access to the queue.
Customer responsibilities for managed services focus on data protection and access configuration.
3
Identify AWS responsibilities (security 'of' the cloud) for SQS and eliminate matching options.
AWS handles OS patching, physical storage decommissioning, and infrastructure replication. Options describing these tasks are eliminated.
Infrastructure, physical security, and foundational service operations belong to AWS.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like SQS, AWS manages the infrastructure layer (such as operating system updates, hardware maintenance, and physical security), while the customer remains responsible for data configuration, encryption settings, and access control policies.
Question 532Question →

An enterprise client is designing a security monitoring architecture for their AWS environment. The client must satisfy two requirements:
1. Detect and alert in real-time when administrative actions, such as the deletion of an Amazon S3 bucket, are initiated by any user or role.
2. Continuously monitor the network activity of Amazon EC2 instances to identify active threat behaviors, such as outbound port scanning or communication with known malicious command-and-control servers.

Which combination of AWS services should the client implement to meet these requirements?

Show answer & explanation

Answer: AWS CloudTrail to capture the administrative API activity for S3 bucket deletions, and Amazon GuardDuty to analyze network logs and detect threat behaviors from EC2 instances.

Answer

The configuration using AWS CloudTrail to log S3 bucket deletions and Amazon GuardDuty to analyze network logs for EC2 threat behaviors is the correct choice.
The correct solution uses AWS CloudTrail to record administrative API calls, such as deleting S3 buckets, and Amazon GuardDuty to analyze network logs for malicious EC2 behavior. GuardDuty uses threat intelligence to detect active threats like port scanning or command-and-control communication, which satisfies the network monitoring requirement.

Step-by-Step Solution

1
Determine which service is required for logging administrative API activity.
AWS CloudTrail is selected because it is designed to audit and record API calls made across AWS resources, including S3 bucket deletion.
This isolates the administrative auditing requirement from application performance monitoring.
2
Determine which service detects active network-level threat behaviors like port scanning.
Amazon GuardDuty is selected because it continuously monitors logs (such as VPC Flow Logs) using threat intelligence to detect malicious activity.
This distinguishes active threat detection from static vulnerability assessments.
3
Apply the AWS Shared Responsibility Model to identify customer operational duties.
The customer is responsible for configuring GuardDuty to protect their EC2 instances and OS-level traffic.
This confirms that managing threats within EC2 instances falls on the customer rather than AWS teams.

Key Concept

Auditing API calls with AWS CloudTrail, executing threat detection with Amazon GuardDuty, and understanding customer responsibilities under the Shared Responsibility Model.
Question 533Question →

A company is migrating its database to Amazon RDS. Under the AWS Shared Responsibility Model, which task is the responsibility of the customer?

Show answer & explanation

Answer: Managing database user accounts and access permissions

Answer

Managing database user accounts and access permissions
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed database service like Amazon RDS, this includes managing database user accounts, credentials, permissions, and network access rules (security groups).

Step-by-Step Solution

1
Identify the service type and model boundaries.
Amazon RDS is a managed database service (PaaS), where AWS manages the underlying infrastructure, operating system, and hardware.
This determines which layers are managed by AWS versus the customer.
2
Evaluate the customer's operational responsibility for data and access.
The customer retains ownership of their data and must configure who has access to the database itself.
Security 'in' the cloud includes managing access credentials and user privileges.

Key Concept

Shared Responsibility Model for managed services
Question 534Question →

A company wants to secure its Virtual Private Cloud (VPC) by controlling traffic entering and leaving its subnets. The security team needs a solution that evaluates traffic using stateless rules at the subnet boundary. Which AWS resource or feature should the company configure to achieve this?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) act as a firewall for controlling traffic in and out of one or more subnets. They are stateless, meaning that inbound and outbound rules must be defined separately to allow traffic in both directions.

Step-by-Step Solution

1
Determine the required evaluation level for the network traffic.
The scenario requires traffic evaluation at the subnet boundary level.
This rules out instance-level security controls.
2
Identify the required rule evaluation type (stateful vs. stateless).
The scenario explicitly requests stateless rules.
Stateless rules require separate configuration for inbound and outbound traffic.
3
Select the AWS VPC feature matching both subnet-level and stateless requirements.
Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless.
This matches all criteria described in the scenario.

Key Concept

Understanding the difference between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Estimated Time:45s
Question 535Question →

A healthcare technology company runs its patient portal on a fleet of Amazon EC2 instances. The security compliance officer needs to ensure that the operating systems of these instances are regularly checked for software vulnerabilities and unintended network exposure. According to the AWS Shared Responsibility Model, which customer-managed action should the company take to meet this requirement?

Show answer & explanation

Answer: Configure Amazon Inspector to automatically scan the EC2 instances.

Answer

Configure Amazon Inspector to automatically scan the EC2 instances.
Configuring Amazon Inspector is the correct action because it is AWS's automated vulnerability management service. It continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network reachability.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to regularly check the EC2 instance operating systems for software vulnerabilities and network exposure.
Understanding whether the task involves active threat detection (log analysis) or software vulnerability/configuration scanning determines the correct AWS security tool.
2
Determine the boundary of responsibility under the Shared Responsibility Model.
The guest operating system and applications running on Amazon EC2 instances fall under the customer's responsibility (Security 'in' the Cloud).
AWS does not manage or scan guest operating systems automatically; the customer must select and configure a service like Amazon Inspector to perform these tasks.
3
Select the appropriate AWS service for vulnerability scanning.
Amazon Inspector is chosen because it specifically scans EC2 instances and ECR images for software vulnerabilities and unintended exposure.
Other services like Amazon GuardDuty (threat detection) and AWS CloudTrail (API logging) do not scan for OS-level software vulnerabilities.

Key Concept

Amazon Inspector is the native AWS service for automated vulnerability management, scanning EC2 instances and container images for software vulnerabilities and network path exposure. Under the Shared Responsibility Model, securing the guest operating system is the customer's responsibility.
Estimated Time:1m 0s
Question 536Question →

A pharmaceutical research firm must encrypt clinical trial data stored in Amazon S3. The firm's compliance policy mandates that encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm's security team. However, the firm still wants to leverage the automated, seamless server-side encryption features of Amazon S3 without custom application-side coding. Which of the following approaches meets these requirements?

Show answer & explanation

Answer: Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).

Answer

Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).
The correct approach is to configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS). This allows the customer to maintain sole ownership and control of the keys in a dedicated, single-tenant HSM cluster (AWS CloudHSM) while still allowing Amazon S3 to perform transparent server-side encryption via KMS integrations.

Step-by-Step Solution

1
Identify the primary compliance requirement for key control.
Encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm.
This requirement identifies AWS CloudHSM as the necessary hardware boundary, rather than standard AWS KMS multi-tenant key storage.
2
Identify the operational integration requirement.
The firm wants to use S3's automated server-side encryption without custom application-side coding.
This rules out client-side encryption and requires a solution that integrates natively with S3 server-side encryption (SSE).
3
Determine the integration path between AWS CloudHSM and Amazon S3.
S3 cannot directly interact with AWS CloudHSM. AWS KMS must act as the intermediary using a Custom Key Store backed by the AWS CloudHSM cluster.
Using a KMS Custom Key Store allows S3 to request encryption via SSE-KMS, while KMS offloads the cryptographic operations and key storage to the user-controlled CloudHSM cluster.

Key Concept

AWS KMS Custom Key Stores
Question 537Question →

A digital marketing agency runs website analytics reports for its clients. The reports are generated only during the first three days of each month, leaving their on-premises servers underutilized for the rest of the month. The agency is planning to migrate these workloads to AWS.

Which TWO of the following describe the primary cloud economic benefits of this migration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Shifting from capital expenses (CapEx) for physical hardware to variable operating expenses (OpEx) based on actual usage; Benefiting from elasticity by provisioning compute resources dynamically for the three-day reporting period and terminating them afterward

Answer

The primary economic benefits are shifting from capital expenses (CapEx) to variable operating expenses (OpEx), and leveraging elasticity to run compute resources only during the three-day reporting window.
The correct options identify that migrating to AWS allows the agency to transition from upfront physical hardware investments (CapEx) to variable utility-style billing (OpEx), and allows them to utilize elasticity to provision compute instances only for the three days they are needed, reducing overall infrastructure costs.

Step-by-Step Solution

1
Analyze the agency's workload pattern and current resource allocation.
The agency runs a workload for only three days per month, causing physical on-premises servers to remain idle and waste capital investment for the remaining 27 days.
Understanding the customer's usage pattern highlights the financial inefficiency of static on-premises sizing.
2
Apply AWS cloud economics principles to optimize the cost of the workload.
By shifting to a variable expense model (OpEx) and utilizing elasticity, the agency pays only for the server capacity used during the active three days, avoiding upfront hardware investments (CapEx).
Matching resource capacity to actual demand is the primary driver of cloud cost savings.

Key Concept

Cloud economics benefits, specifically the shift from CapEx to OpEx and the cost-saving power of elasticity.
Question 538Question →

An online retail company is designing a security and operational monitoring strategy. The company needs to audit administrative API activities (such as who created a resource or modified access policies) and track EC2 instance CPU utilization to trigger alerts if performance degrades. Which AWS services should the company use to meet these two requirements?

Show answer & explanation

Answer: AWS CloudTrail to audit administrative API activities, and Amazon CloudWatch to monitor resource performance metrics

Answer

AWS CloudTrail to audit administrative API activities, and Amazon CloudWatch to monitor resource performance metrics
AWS CloudTrail is designed to record API calls and user activity across your AWS infrastructure, enabling auditing and governance. Amazon CloudWatch is designed to collect performance metrics, monitor resources, and trigger alarms based on thresholds like CPU utilization.

Step-by-Step Solution

1
Analyze the requirement for auditing administrative API activities.
Identify that AWS CloudTrail records AWS API calls, user actions, and change history for auditing purposes.
CloudTrail is the designated service for governance, compliance, operational auditing, and risk auditing of your AWS account.
2
Analyze the requirement for tracking EC2 instance CPU utilization and triggering alerts.
Identify that Amazon CloudWatch monitors operational metrics, collects log files, and sets alarms on performance thresholds.
CloudWatch is the primary monitoring service for AWS cloud resources and applications, providing real-time data and automated actions.
3
Combine the two services to form the complete solution.
The correct combination is AWS CloudTrail for API logging and Amazon CloudWatch for resource metric monitoring.
This combination satisfies both the auditing and operational alerting requirements without introducing unrelated services.

Key Concept

Distinguishing the distinct purposes of AWS CloudTrail and Amazon CloudWatch for security and operational monitoring.
Estimated Time:1m 0s
Question 539Question →

An enterprise is migrating its legacy web application to AWS and decides to run it inside Docker containers using AWS Fargate. Under the AWS Shared Responsibility Model, which two of the following operational tasks are the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring the task security groups to control inbound and outbound network traffic to the container.; Managing and applying security updates to the application code and libraries within the container image.

Answer

Configuring the task security groups to control inbound and outbound network traffic, and managing and applying security updates to the application code and libraries within the container image.
Under the AWS Shared Responsibility Model for AWS Fargate, the customer is responsible for security 'in' the cloud. This includes configuring task security groups to govern network access to the containerized application and managing the application code, dependencies, and libraries within the Docker image itself.

Step-by-Step Solution

1
Analyze the service model used in the scenario.
AWS Fargate is a serverless container execution engine where AWS manages the underlying hosts, operating systems, and container runtimes, while the customer retains control over the containers and network configuration.
Identifying the service type helps determine where the boundary of responsibility lies between AWS and the customer.
2
Evaluate the customer's responsibilities for container-based workloads.
The customer is responsible for everything they package inside the container (application code, dependencies, libraries) and how the container interacts with the network (security groups).
This isolates the correct options containing customer responsibilities.
3
Evaluate the AWS responsibilities for serverless container workloads.
AWS is responsible for physical security, host OS patching, and virtualization infrastructure.
This allows for the elimination of options representing AWS-managed responsibilities.

Key Concept

Under the AWS Shared Responsibility Model for container services like AWS Fargate, the customer is responsible for the configuration of security groups and the security of their containerized application code and libraries, while AWS handles physical security, host OS patching, and runtime environment updates.
Question 540Question →

A company needs to grant an external auditor temporary access to view the configuration of their AWS resources. The auditor does not have an AWS account but has a corporate identity provider (IdP). Which of the following is the most secure AWS-recommended method to grant this access?

Show answer & explanation

Answer: Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.

Answer

Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.
The correct option is to configure identity federation to allow the auditor to assume an IAM role. This mechanism enables secure single sign-on (SSO) using the auditor's existing corporate credentials and assigns temporary permissions via an IAM role. This removes the security risks associated with managing and storing permanent IAM credentials for external users.

Step-by-Step Solution

1
Identify the access requirement and the external user's identity source.
An external auditor needs temporary read-only access and has a corporate identity provider (IdP).
This establishes that the user is external and possesses an existing credential repository that can be integrated.
2
Apply the principle of least privilege and secure credential management.
Avoid creating static, long-term AWS credentials or sharing root access.
Creating permanent IAM users for temporary external audits or sharing root access violates fundamental AWS security principles.
3
Select the mechanism that maps the external identity provider to temporary AWS permissions.
Implement identity federation to assume an IAM role with read-only access.
Federation delegates authentication to the external IdP and provides temporary security credentials through an IAM role.

Key Concept

Identity Federation and IAM Roles for External Access
Estimated Time:1m 0s
PreviousPage 27 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin