Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 681Question →

A ridesharing service processes real-time driver and passenger location data on AWS. The security department wants to establish automated threat detection that monitors their AWS accounts for anomalous behavior, such as API activity from unrecognized IP addresses, compromised credentials, or EC2 instances communicating with malicious IP addresses. The service must analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs. Which AWS service meets these needs?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify issues like compromised credentials or EC2 instances communicating with known malicious hosts.

Step-by-Step Solution

1
Identify the key security objective in the scenario.
The goal is active threat detection, credential monitoring, and detecting malicious command-and-control communication from EC2 instances.
Determining the primary security goal helps narrow down the appropriate AWS security services.
2
Analyze the log data sources requested for analysis.
The required sources are AWS CloudTrail events, VPC Flow Logs, and DNS logs.
Specific security tools ingest different log sources; only Amazon GuardDuty automatically parses these three specific sources for threat intelligence.
3
Eliminate inappropriate options.
Amazon Inspector is ruled out as it focuses on vulnerability scanning rather than live threat monitoring. AWS CloudTrail is ruled out as it logs actions but does not perform analysis. AWS Shield is ruled out as it handles external DDoS protection.
This confirms that only one service fulfills all threat detection and source analysis requirements.

Key Concept

Amazon GuardDuty is an intelligent threat detection service that analyzes multiple AWS log sources (CloudTrail, VPC Flow Logs, DNS logs) to identify malicious activity and unauthorized behavior.
Question 682Question →

A company is developing a mobile application and needs a fully managed database service to store user session data. The application requires a key-value NoSQL database that can deliver single-digit millisecond response times at any scale. Which AWS service should the company select for this workload?

Show answer & explanation

Answer: Amazon DynamoDB

Answer

Amazon DynamoDB
Amazon DynamoDB is a fully managed, serverless NoSQL database service that provides fast, predictable, single-digit millisecond performance at any scale, aligning perfectly with the key-value store and performance requirements.

Step-by-Step Solution

1
Analyze the application requirements.
The workload requires a fully managed database, key-value NoSQL storage, and single-digit millisecond latency at any scale.
This helps filter out services that are relational, self-managed, or designed for analytical workloads.
2
Evaluate the database services against the requirements.
Amazon DynamoDB is the only fully managed NoSQL key-value database that natively offers single-digit millisecond latencies.
Amazon RDS and Amazon Redshift are relational/analytical, and hosting on Amazon EC2 is self-managed rather than fully managed.

Key Concept

AWS managed NoSQL database services
Question 683Question →

A media streaming company is preparing for a security compliance review. The audit team needs to verify which IAM identity made the API calls to modify the configuration of an Amazon S3 bucket containing sensitive customer billing data. At the same time, the security team wants to set up automated threat detection to identify potential unauthorized activity or compromised credentials in their AWS environment. Which combination of AWS services should the company use to meet these requirements?

Show answer & explanation

Answer: AWS CloudTrail to audit the API calls, and Amazon GuardDuty for threat detection

Answer

AWS CloudTrail to audit the API calls, and Amazon GuardDuty for threat detection
AWS CloudTrail logs, continuously monitors, and retains account activity related to actions taken across your AWS infrastructure, satisfying the requirement to audit IAM identity actions on S3 buckets. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, satisfying the requirement to identify potential threat vectors like compromised credentials.

Step-by-Step Solution

1
Identify the service required to track and audit configuration modifications and API actions.
AWS CloudTrail is chosen because it specifically logs, continuously monitors, and retains account activity related to actions taken across your AWS infrastructure.
Auditing access records and verifying which IAM identity performed an operation requires API auditing capabilities.
2
Identify the service required for active, automated threat detection and identifying compromised credentials.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to detect malicious behavior and unauthorized activities in AWS accounts.
Vulnerability scanners do not monitor live account activity for anomalies like compromised credentials; dedicated threat detection is required.

Key Concept

Differentiating security monitoring, API logging, and threat detection services in AWS
Question 684Question →

A game development studio is deploying dedicated multiplayer game servers on Amazon Elastic Compute Cloud (Amazon EC2). According to the AWS Shared Responsibility Model, which two operational security tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Patching the guest operating system of the game server instances; Configuring the guest operating system firewalls on the EC2 instances

Answer

The customer is responsible for patching the guest operating system of the game server instances and configuring the guest operating system firewalls on the EC2 instances.
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS) model. In this setup, the customer maintains control of the guest operating system, which includes the responsibility to apply OS patches and configure software firewalls within the instances. AWS handles the physical infrastructure and the virtualization layer.

Step-by-Step Solution

1
Identify the service type and model boundary in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer maintains full control over the guest operating system, network configurations, and data.
Determining whether the service is IaaS, PaaS, or SaaS helps establish where the boundary between customer and AWS responsibility lies.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS secures the global infrastructure, physical hardware, and virtualization layers. The customer secures their data, operating systems, and network access controls.
Categorizing tasks using this distinction helps identify which responsibilities belong to the customer.

Key Concept

Shared Responsibility Model for IaaS Services
Question 685Question →

A global logistics firm is migrating its package tracking system to the AWS Cloud. In the current on-premises architecture, a single database server and a single application server are tightly coupled. During peak shipping periods, database write bottlenecks cause the front-end portal to become completely unresponsive, resulting in lost transaction details. To improve system resilience and ensure messages are not lost, which of the following strategies align with the AWS Cloud design principles of loose coupling and designing for failure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Introduce Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates before writing them to the database.; Deploy application instances across multiple Availability Zones behind an Elastic Load Balancer.

Answer

Introducing Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates before writing them to the database, and deploying application instances across multiple Availability Zones behind an Elastic Load Balancer.
The correct strategies are introducing Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates, which implements loose coupling, and deploying application instances across multiple Availability Zones behind an Elastic Load Balancer, which implements designing for failure.

Step-by-Step Solution

1
Analyze the current architectural bottlenecks and issues.
The current application is tightly coupled and lacks fault tolerance, meaning database overload crashes the entire system and causes data loss.
Identifying these failures points to the need for design principles that decouple services and create redundancy.
2
Select a solution that provides loose coupling to prevent database writes from directly impacting the frontend.
Using Amazon SQS allows message buffering, ensuring that frontend tracking updates are stored reliably even if the database database write speed lags.
Message queuing isolates components, allowing them to fail or scale independently.
3
Select a solution that designs for failure to ensure high availability.
Using Multi-AZ deployments with an Elastic Load Balancer ensures that if an instance or an entire zone fails, the system automatically redirects traffic to healthy resources.
Distributing resources across isolated infrastructure zones mitigates single points of failure.

Key Concept

AWS Cloud design principles state that loose coupling reduces interdependencies so that a failure in one component does not cascade, while designing for failure ensures system components have redundancy to survive infrastructure outages.
Estimated Time:1m 30s
Question 686Question →

A municipal public transit authority is migrating its ticketing database and web applications to the AWS Cloud. During an audit, the compliance officer asks who is responsible for configuring firewall rules (such as security groups) to protect the applications, and how the authority can verify AWS's physical infrastructure compliance. Which of the following statements correctly identifies the responsibility mapping and the service needed to retrieve the necessary AWS compliance reports?

Show answer & explanation

Answer: The customer is responsible for configuring security groups; AWS compliance documents are retrieved using AWS Artifact.

Answer

The customer is responsible for configuring security groups, and AWS compliance documents are retrieved using AWS Artifact.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes defining firewall rules via security groups. To download AWS's official compliance documentation (like ISO and PCI certifications), the customer must use AWS Artifact, which is the central portal for these agreements and reports.

Step-by-Step Solution

1
Identify the security group configuration responsibility within the Shared Responsibility Model.
Customers are responsible for security 'in' the cloud, which includes configuring guest operating systems, network access control lists, and security groups.
AWS manages the global infrastructure, while the customer controls their resources and access configurations.
2
Identify the AWS service dedicated to providing compliance reports and agreements.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports) and online agreements.
Other services like CloudTrail or Trusted Advisor serve different auditing or optimization functions.

Key Concept

Understanding compliance reports retrieval and the Shared Responsibility Model boundaries.
Estimated Time:1m 0s
Question 687Question →

Aegis Insurance Group is preparing to migrate its legacy on-premises IT portfolio to the AWS Cloud. During the portfolio discovery phase, the migration team identifies two distinct systems:

- System 1: A core underwriting application that will be completely rewritten to utilize a cloud-native, serverless architecture with AWS Lambda and Amazon DynamoDB.
- System 2: An old, redundant testing environment that is no longer used by any business unit and has no regulatory data retention requirements.

Which of the following migration strategies represent the correct approach for these systems? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Refactoring System 1 to transition to a serverless architecture; Retiring System 2 since it is no longer required

Answer

The correct strategies are Refactoring for System 1 and Retiring for System 2.
Refactoring (or Re-architecting) is chosen when an application needs to be rebuilt from scratch to utilize cloud-native features, such as serverless compute and managed databases, which aligns with System 1. Retiring involves decommissioning applications and assets that are no longer useful or needed, which applies to the redundant test environment in System 2.

Step-by-Step Solution

1
Analyze the requirement for System 1.
System 1 is a core application being completely rewritten to use serverless services (AWS Lambda and Amazon DynamoDB) to achieve cloud-native scale. This architectural modification represents the Refactoring/Re-architecting strategy.
Identifying the correct strategy requires evaluating how much of the application architecture and code will be modified during migration.
2
Analyze the requirement for System 2.
System 2 is a redundant, unused testing environment with no compliance or data retention requirements. Decommissioning these assets represents the Retiring strategy.
Identifying assets that are no longer needed prevents unnecessary migration costs and efforts.
3
Select the correct combination of strategies.
The correct strategies are Refactoring for System 1 and Retiring for System 2.
These choices align with the 6 Rs framework definitions.

Key Concept

AWS Cloud Migration Strategies (6 Rs)
Estimated Time:1m 35s
Question 688Question →

A smart agriculture startup processes high-resolution satellite imagery to predict crop yields. The company runs massive image-processing workloads for just one week at the end of each harvest season, requiring thousands of virtual compute instances. Throughout the rest of the year, they only run a small, low-traffic web dashboard. Additionally, because they do not have to buy, install, or maintain physical servers in a local facility, their engineering team focuses solely on developing machine learning models. Which two advantages of the AWS Cloud are directly demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Stop spending money running and maintaining data centers

Answer

The advantages are stopping guessing capacity and stopping spending money running and maintaining data centers.
The correct answers are the benefits of stopping guessing capacity and stopping spending money running and maintaining data centers. The company avoids guessing capacity by dynamically scaling virtual instances to handle peak workload during the harvest season and scaling down afterward. They also avoid data center maintenance costs by not owning or maintaining physical servers, which lets them focus on development.

Step-by-Step Solution

1
Analyze the workload characteristics mentioned in the scenario.
The workload requires massive computing power (thousands of cores) for only one week per quarter, and very little power for the rest of the year.
Understanding the dynamic nature of the workload helps identify the capacity benefit.
2
Identify the AWS benefit related to these workload characteristics.
This aligns with 'Stop guessing capacity', as the company does not need to pre-purchase hardware for peak times.
Matching the scenario's workload flexibility with the AWS Cloud benefit of elastic capacity.
3
Analyze the operational characteristics regarding physical hardware.
The company does not have to buy, install, or maintain physical servers in a local facility.
Understanding the lack of physical server management requirements.
4
Identify the AWS benefit related to physical hardware management.
This aligns with 'Stop spending money running and maintaining data centers', allowing engineering teams to focus on core product delivery.
Matching the lack of physical facility management with the AWS Cloud benefit of offloading data center maintenance.

Key Concept

Define the benefits of the AWS Cloud
Question 689Question →

A company wants to deploy a legacy server application on AWS that requires full administrative (root) access to the guest operating system to perform custom software configurations. Which AWS compute service meets this requirement?

Show answer & explanation

Answer: Amazon Elastic Compute Cloud (Amazon EC2)

Answer

Amazon Elastic Compute Cloud (Amazon EC2)
Amazon Elastic Compute Cloud (Amazon EC2) provides resizable virtual servers (instances) in the cloud. As an Infrastructure as a Service (IaaS) offering, it gives the customer full administrative control (root or Administrator access) over the guest operating system, which is required to install custom configurations, drivers, or proprietary software packages.

Step-by-Step Solution

1
Analyze the workload requirements
The application is a legacy server application that requires complete control (root/administrative access) over the guest operating system to configure custom software.
Identifying the constraints and level of access needed helps filter out serverless or fully managed services where OS access is restricted.
2
Compare AWS compute options based on the shared responsibility model and control level
Amazon EC2 is an Infrastructure as a Service (IaaS) offering that provides virtual machines with complete administrative control of the operating system. Serverless options like AWS Lambda and AWS Fargate do not allow OS-level access.
Matching the control requirement to the correct AWS service level of responsibility determines that Amazon EC2 is the correct choice.

Key Concept

AWS compute services offer different levels of management and control. Amazon EC2 provides full access and administrative control over the virtual server's operating system, whereas serverless compute options like AWS Lambda and AWS Fargate abstract the operating system layer from the user.
Estimated Time:45s
Question 690Question →

An organization runs automated database backup scripts on its on-premises servers. These scripts need to upload backups to an Amazon S3 bucket. To comply with security best practices, the organization wants to avoid storing long-term access keys on the physical servers. Which IAM solution should the organization implement to grant these scripts secure, temporary access?

Show answer & explanation

Answer: AWS IAM Roles Anywhere

Answer

AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is the correct solution because it allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to authenticate and obtain temporary AWS credentials by assuming an IAM role. This eliminates the security risk of storing long-term AWS access keys on physical infrastructure.

Step-by-Step Solution

1
Identify the requirements: the workload runs on-premises, needs access to Amazon S3, and must not store long-term access keys.
Conclude that standard IAM roles cannot be directly assumed by on-premises servers without a secure mechanism to authenticate them.
On-premises servers do not have access to the AWS Instance Metadata Service, which automatically distributes credentials to AWS-native resources.
2
Evaluate AWS services designed for hybrid security integration.
Determine that AWS IAM Roles Anywhere is the designated feature that allows external workloads to exchange X.509 digital certificates for temporary AWS credentials.
This establishes trust between the on-premises environment and AWS to provision short-term security credentials dynamically without storing long-term access keys.

Key Concept

AWS IAM Roles Anywhere provides temporary security credentials for workloads outside of AWS.
Question 691Question →

A boutique video production agency needs to expand its storage capacity for raw footage. Instead of purchasing expensive new physical storage hardware that requires upfront funding, the agency decides to use Amazon S3, allowing them to pay only for the storage they use on a monthly basis. Which concept of cloud economics does this spending shift demonstrate?

Show answer & explanation

Answer: Trading capital expenses (CapEx) for variable operating expenses (OpEx)

Answer

Trading capital expenses (CapEx) for variable operating expenses (OpEx)
The correct answer is trading capital expenses (CapEx) for variable operating expenses (OpEx). Capital expenses refer to upfront investments in physical assets like servers and storage arrays. By migrating to Amazon S3, the boutique video production agency avoids these upfront costs and instead pays a variable operating expense based on their actual monthly consumption.

Step-by-Step Solution

1
Analyze the business decision made by the boutique video production agency.
The agency is choosing not to purchase physical hardware upfront and instead paying monthly for storage resources actually used.
To classify the change in the company's financial model.
2
Map the spending models to cloud economic concepts.
Buying physical hardware represents a capital expense (CapEx), whereas paying monthly for consumption represents an operating expense (OpEx).
To determine which cloud economics concept describes shifting from upfront physical purchases to consumption-based pricing.

Key Concept

Trading Capital Expenses for Variable Expenses (CapEx vs OpEx)
Estimated Time:45s
Question 692Question →

A startup is designing a web application. The application requires a fully managed relational database to run complex SQL queries and transactional updates. Additionally, the startup wants to deploy an in-memory database to cache frequent query results and reduce database latency. Which TWO AWS services should the startup select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Relational Database Service (Amazon RDS); Amazon ElastiCache

Answer

Amazon Relational Database Service (Amazon RDS) and Amazon ElastiCache
Amazon Relational Database Service (Amazon RDS) provides a managed relational database service suitable for SQL transactional workloads. Amazon ElastiCache provides an in-memory caching layer that helps reduce application latency by caching frequent query results.

Step-by-Step Solution

1
Analyze the first requirement: a fully managed database for relational queries and SQL transactions.
Amazon Relational Database Service (Amazon RDS) matches this requirement as it is a relational database engine supporting SQL.
Relational databases are designed for SQL transactions.
2
Analyze the second requirement: an in-memory database to cache queries and reduce latency.
Amazon ElastiCache matches this requirement because it acts as an in-memory database/caching layer.
ElastiCache provides low-latency caching capabilities.

Key Concept

AWS database services selection based on transaction and cache requirements
Question 693Question →

A newly hired cloud administrator needs to perform daily operational tasks in the AWS Management Console, such as configuring network settings and managing Amazon S3 buckets. Which AWS security best practice should be followed to grant these permissions?

Show answer & explanation

Answer: Create an individual IAM user with the necessary permissions for the administrator's daily tasks.

Answer

Create an individual IAM user with the necessary permissions for the administrator's daily tasks.
Creating an individual IAM user for daily tasks aligns with the AWS best practice of maintaining separate identities for auditing and applying the principle of least privilege, while avoiding the use of the root user.

Step-by-Step Solution

1
Analyze the operational requirements.
A new internal administrator needs persistent access to the AWS Management Console to perform everyday administrative tasks such as configuring networks and S3.
Understanding the identity type and access frequency helps determine the correct IAM entity to use.
2
Apply AWS security best practices for identity management.
The AWS account root user should not be used for daily tasks. Instead, an individual IAM user should be created with standard administrator permissions mapped to their specific identity.
This establishes individual accountability, supports the principle of least privilege, and protects the root account.

Key Concept

AWS IAM Best Practices - Avoiding Root User and Using Individual IAM Users
Estimated Time:45s
Question 694Question →

A company is refactoring a monolithic application into a microservices architecture on AWS. They need to select database solutions for two new microservices: a product inventory service that requires complex table joins, strict schema enforcement, and automatic storage scaling up to 128 TiB; and a gaming leaderboard service that requires sub-millisecond response times for retrieving simple key-value player scores. Which of the following AWS database services should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora to support the product inventory service; Amazon ElastiCache to support the gaming leaderboard service

Answer

Amazon Aurora should be selected to support the product inventory service, and Amazon ElastiCache should be selected to support the gaming leaderboard service.
The correct services are Amazon Aurora and Amazon ElastiCache. Amazon Aurora is a cloud-native relational database service that supports complex joins, schema enforcement, and automatically scales its storage up to 128 TiB. Amazon ElastiCache is an in-memory key-value data store that provides the sub-millisecond latency required for high-throughput gaming leaderboards.

Step-by-Step Solution

1
Analyze the requirements for the first microservice (product inventory).
The microservice requires a relational database (complex joins, schema enforcement) with automated storage scaling up to 128 TiB.
This points directly to Amazon Aurora, which automatically provisions storage in increments up to 128 TiB and supports relational database engines.
2
Analyze the requirements for the second microservice (gaming leaderboard).
The microservice requires an in-memory database capable of delivering sub-millisecond response times for simple key-value store operations.
This matches Amazon ElastiCache, which is designed for sub-millisecond in-memory caching and session/leaderboard store workloads.
3
Evaluate the design architecture principles.
The system must remain decoupled to align with microservices best practices, meaning separate databases are preferred over a single monolithic database.
Choosing separate managed databases ensures fault tolerance and operational efficiency.

Key Concept

Selecting the appropriate AWS database service based on workload characteristics (relational vs. non-relational vs. in-memory) and adhering to cloud architecture design principles (loose coupling, managed services).
Question 695Question →

A company has two new requirements for its cloud workloads. First, they need to host a legacy database application that requires custom operating system kernel modifications and administrative root access. Second, they need to quickly deploy a simple web application using a pre-configured LAMP stack with a predictable, flat-rate monthly pricing structure. Which two AWS compute services should the company select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon EC2; Amazon Lightsail

Answer

Amazon EC2 and Amazon Lightsail
Amazon Elastic Compute Cloud (Amazon EC2) provides full virtual machine control, allowing users to modify OS configurations and install custom kernels. Amazon Lightsail provides pre-configured application packages (such as LAMP) under a simple, predictable monthly pricing model.

Step-by-Step Solution

1
Analyze the first requirement: host a legacy database requiring custom operating system kernel modifications and root access.
This requires Infrastructure as a Service (IaaS) where the user has full administrative control over the virtual machine's OS. Amazon EC2 meets this requirement.
Managed or serverless services (such as AWS Fargate or AWS Lambda) abstract the operating system and do not allow custom kernel modifications.
2
Analyze the second requirement: deploy a simple web application using a pre-configured LAMP stack with predictable, flat-rate monthly pricing.
Amazon Lightsail is designed specifically for simple, low-cost application hosting with bundled resources (compute, storage, databases) and predictable monthly plans. It supports one-click pre-configured stacks like LAMP.
While Amazon EC2 could host this, it does not offer flat-rate pricing out-of-the-box, and other options like AWS Lambda require refactoring the application to fit a serverless model.

Key Concept

Selecting appropriate AWS compute services based on OS access, management overhead, and pricing models.
Question 696Question →

A SaaS provider hosts its web application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement automated tools to accomplish two tasks:
1. Continually scan the EC2 instances and container images for software vulnerabilities and unintended network exposure.
2. Monitor AWS account activity and network traffic to detect anomalous behavior, potential unauthorized access, and malicious threats.

Which two AWS services should the company use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty should be used to scan for software vulnerabilities and detect malicious threats, respectively.
Amazon Inspector automatically and continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides continuous threat detection by monitoring AWS account activity and network traffic to identify potential malicious activity.

Step-by-Step Solution

1
Identify the service responsible for scanning EC2 instances and ECR container images for software vulnerabilities and network exposure.
Amazon Inspector performs vulnerability scanning on Amazon EC2 instances and Amazon ECR images.
This meets the first requirement of detecting software vulnerabilities and unintended network exposure.
2
Identify the service responsible for monitoring AWS account activity and network traffic to detect anomalous or malicious behavior.
Amazon GuardDuty provides continuous threat detection by analyzing events and log data.
This meets the second requirement of detecting threats, unauthorized access, and malicious activity.

Key Concept

AWS threat detection and vulnerability management services
Estimated Time:1m 30s
Question 697Question →

A media broadcasting company is preparing for an annual governance review of its cloud-based video archiving system. The governance team needs to acquire official AWS ISO 27001 certification documents and clarify how the security of AWS's physical infrastructure is validated. Which two of the following options represent correct actions or concepts that meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Retrieve the AWS ISO 27001 certification report directly from AWS Artifact.; Rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.

Answer

To meet the governance requirements, the company should retrieve the AWS ISO 27001 certification report directly from AWS Artifact, and rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.
Retrieving the AWS ISO 27001 certification report directly from AWS Artifact is correct because AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports. Relying on AWS compliance reports for physical infrastructure security is correct because, under the Shared Responsibility Model, AWS is responsible for security of the cloud (the physical infrastructure), and customers verify this inheritance through these reports.

Step-by-Step Solution

1
Identify where to retrieve official AWS compliance documents.
AWS Artifact is identified as the portal providing on-demand access to AWS security and compliance reports (such as SOC and ISO certifications).
This resolves the requirement of acquiring the official AWS ISO 27001 certification.
2
Determine the boundary of security responsibility for physical infrastructure under the Shared Responsibility Model.
Under the model, AWS is responsible for security 'of' the cloud, which includes the physical infrastructure of data centers.
This clarifies how physical security is validated without needing custom audits.

Key Concept

AWS compliance reports retrieval via AWS Artifact and boundaries of physical security under the Shared Responsibility Model.
Question 698Question →

A company needs to host a legacy database application on AWS. The application requires administrative (root) access to the underlying operating system and custom kernel configuration changes. Which AWS compute service should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon EC2

Answer

Amazon EC2
Amazon EC2 (Elastic Compute Cloud) provides virtual servers in the cloud where customers have full control over the guest operating system. This allows customers to log in with administrative (root) privileges, install custom software, and perform kernel modifications.

Step-by-Step Solution

1
Analyze the workload requirements
The application requires root/administrative access to the operating system and custom kernel configuration changes.
This determines the level of control and responsibility the customer needs over the compute infrastructure.
2
Evaluate AWS compute services based on control level
Amazon EC2 provides complete control over the guest operating system, whereas serverless options like AWS Lambda and AWS Fargate abstract the OS. Elastic Beanstalk is a platform for deployment rather than a low-level compute resource provider.
Matching the administrative control requirements to the appropriate AWS Shared Responsibility model tier identifies the correct service.

Key Concept

AWS Compute Services
Estimated Time:45s
Question 699Question →

A system administrator needs to run a quick command from a local terminal to list all active Amazon EC2 instances in an AWS account. Which of the following is the most appropriate tool to use for this task?

Show answer & explanation

Answer: AWS Command Line Interface (AWS CLI)

Answer

AWS Command Line Interface (AWS CLI)
The AWS Command Line Interface (AWS CLI) is the tool designed to enable direct interaction with AWS services using commands in a command-line shell (such as bash or zsh), making it the most suitable tool for executing quick commands from a local terminal.

Step-by-Step Solution

1
Identify that the requirement is to run a command directly from a local terminal shell.
Limits the tool selection to command-line interfaces rather than graphical web interfaces or coding libraries.
Terminal execution requires a command-line interface tool.
2
Select the tool designed for quick, direct command execution and administrative scripting in a terminal.
The AWS Command Line Interface (AWS CLI) is selected.
The AWS CLI is explicitly built to control AWS services from the terminal using simple commands.

Key Concept

AWS Command Line Interface (AWS CLI)
Question 700Question →

Vanguard Logistics plans to migrate its legacy on-premises route optimization application to the AWS Cloud. The application currently runs on an outdated, unsupported Linux distribution. To minimize migration time while improving operational support, the company decides to migrate the application to Amazon EC2 instances running a modern, supported Amazon Linux operating system without modifying the core application code. Which cloud migration strategy is Vanguard Logistics using?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
Replatforming (also known as lift-tinker-and-shift) is correct because the company is making a minor optimization—upgrading the underlying operating system to a supported version—without changing the core architecture or code of the application.

Step-by-Step Solution

1
Analyze the migration scenario details
The application code remains unchanged, but the underlying operating system is upgraded to a supported version during the migration.
This establishes that the migration involves some modification at the platform level (operating system upgrade) but no modification to the core application code.
2
Map the observed changes to the 6 Rs migration strategies
Upgrading the operating system without changing the core application code is classified as Replatforming (lift-tinker-and-shift).
Rehosting preserves the operating system environment as-is, whereas Replatforming allows small changes (like OS or runtime upgrades) to meet platform compatibility and support requirements without full re-architecting.

Key Concept

Identifying AWS migration strategies (6 Rs), specifically distinguishing between Rehosting and Replatforming
PreviousPage 35 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin