Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 701Question →

A logistics company is struggling with the high costs of maintaining its physical server rooms, including electricity, cooling, and security staff. The company decides to migrate its package-tracking applications to AWS so that its IT team can focus on developing new route-optimization algorithms rather than managing infrastructure. Which benefit of the AWS Cloud is this company realizing?

Show answer & explanation

Answer: Stop spending money running and maintaining data centers

Answer

Stop spending money running and maintaining data centers
The correct answer is the option that states 'Stop spending money running and maintaining data centers'. By migrating to AWS, the logistics company no longer needs to manage the physical infrastructure, power, cooling, and security of on-premises server rooms. This allows the IT department to redirect its efforts toward activities that add direct business value, such as developing route-optimization algorithms.

Step-by-Step Solution

1
Analyze the company's problem in the scenario.
The company is spending resources on physical infrastructure operations, including cooling, power, and security staff for its server rooms.
Identifying the primary operational bottleneck helps map it to the correct AWS Cloud benefit.
2
Analyze the company's objective after migrating to AWS.
The company wants its IT team to focus on developing route-optimization algorithms instead of managing physical servers.
This shows the company is shifting effort from infrastructure management to core business value.
3
Match the scenario's outcome to the official AWS Cloud benefits.
By outsourcing the physical hosting environment to AWS, the company is realizing the benefit of stopping data center maintenance.
This matches the official AWS benefit: 'Stop spending money running and maintaining data centers' (which lets companies focus on projects rather than infrastructure heavy lifting).

Key Concept

AWS Cloud Benefit: Stop spending money running and maintaining data centers
Question 702Question →

A logistics company is building a package tracking system on AWS. The company's security policy requires that all package destination logs must be encrypted at rest. Which of the following are customer responsibilities for protecting this data? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling encryption on the AWS storage services where the logs are stored; Managing access permissions for the keys used to encrypt the logs

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for enabling encryption on the storage services where their logs reside, and managing the access permissions for the keys used to encrypt those logs.
Under the AWS Shared Responsibility Model, customers are responsible for data protection settings within the services they use ('security in the cloud'). This includes configuring encryption at rest for storage resources (such as Amazon S3 buckets or Amazon EBS volumes) and managing access permissions for the cryptographic keys used to encrypt that data. AWS, on the other hand, is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud ('security of the cloud').

Step-by-Step Solution

1
Identify the boundary between customer responsibility and AWS responsibility regarding data protection.
Recognize that 'security in the cloud' (such as configuring encryption on storage services and managing key access) is the customer's responsibility, while 'security of the cloud' (physical security and hardware maintenance) is AWS's responsibility.
This helps eliminate options that involve physical data center security or hardware replacements.
2
Evaluate the remaining options to identify correct key management and encryption practices.
Confirm that configuring encryption on storage services and managing key permissions are correct customer duties, whereas AWS CloudHSM is a dedicated service requiring manual key administration rather than automatic global service integration.
This isolates the two correct actions.

Key Concept

AWS Shared Responsibility Model for Data Encryption
Estimated Time:45s
Question 703Question →

A gaming developer needs a database that can store and retrieve simple player profile attributes with single-digit millisecond latency at any scale. The schema of the profile data varies frequently between players. Which AWS database service is best suited for this NoSQL key-value workload?

Show answer & explanation

Answer: Amazon DynamoDB

Answer

Amazon DynamoDB
Amazon DynamoDB is a serverless, NoSQL database service that provides consistent, single-digit millisecond latency at any scale. It supports both key-value and document data structures, and its schema-less design allows the profile attributes to vary across players.

Step-by-Step Solution

1
Analyze the workload requirements: key-value data structure, flexible schema (varying player attributes), and single-digit millisecond latency at scale.
Identify that the workload requires a NoSQL database system.
NoSQL databases are designed for schema flexibility and high-throughput key-value access.
2
Match the NoSQL requirement with the appropriate AWS database service.
Amazon DynamoDB is the primary AWS NoSQL service offering managed key-value storage.
Amazon DynamoDB is specifically built to deliver single-digit millisecond response times for key-value and document data at any scale.

Key Concept

Distinguishing between relational (RDS) and NoSQL (DynamoDB) databases based on access patterns, latency requirements, and schema flexibility.
Question 704Question →

An enterprise is planning to deploy a regulatory-compliant application on AWS that requires high availability, resilience against localized physical disasters, and optimal resource distribution. Which TWO statements accurately describe the physical, logical, or networking isolation characteristics of AWS Regions and Availability Zones?

Select all that apply

Show answer & explanation

Answer: The mapping of Availability Zone names to physical locations is randomized independently for each AWS account to ensure even resource distribution.; Availability Zones within a single Region are physically isolated on separate floodplains and power grids, yet are connected by low-latency, redundant private fiber-optic networks.

Answer

The mapping of Availability Zone names to physical locations is randomized independently for each AWS account, and Availability Zones within a single Region are physically isolated on separate floodplains and power grids, yet connected by private fiber-optic networks.
The correct statements identify that AWS virtualizes and randomizes logical Availability Zone names to physical infrastructure independently per account to balance resource utilization, and that Availability Zones are physically isolated to prevent disaster correlation while being connected via high-speed, private networks for latency-sensitive operations.

Step-by-Step Solution

1
Analyze the physical separation and networking mechanisms between Availability Zones.
Identify that Availability Zones are engineered with physical isolation (separate power, cooling, floodplains) to prevent cascading failures, but are linked by low-latency private networks for synchronous replication.
This establishes the physical resilience characteristics of Availability Zones.
2
Examine how AWS maps logical Availability Zone names to physical structures across accounts.
Recognize that logical names like us-east-1a map to different physical infrastructures for different accounts to distribute resource loading.
This details the logical virtualization layer of AWS infrastructure.
3
Differentiate between the regulatory boundaries of Regions and the physical boundaries of Availability Zones.
Confirm that data sovereignty is managed at the Region level, and traffic within a Region is kept on private AWS transit networks.
This isolates the compliance and networking scope of Regions from Availability Zones.

Key Concept

AWS Global Infrastructure physical and logical separation
Question 705Question →

A retail company wants to deploy a new container-based inventory microservice. The development team wants to focus solely on packaging and running their application containers, and they want to eliminate the operational overhead of provisioning, patching, and scaling the underlying virtual servers. Which AWS compute service should the company select to meet these requirements?

Show answer & explanation

Answer: AWS Fargate

Answer

AWS Fargate is the most appropriate service because it is a serverless compute engine that runs containers without requiring the user to provision, patch, or manage the underlying virtual machines.
AWS Fargate is a serverless compute engine for containers that integrates with Amazon ECS. It runs containers directly without requiring the customer to provision, configure, patch, or manage the underlying virtual machines, fulfilling the requirement to eliminate server management overhead.

Step-by-Step Solution

1
Analyze the requirements of the workload
The workload is a container-based microservice that requires a compute environment where the user does not have to manage, patch, or scale the virtual servers (virtual machines).
This helps filter out compute services that require server administration or are not designed for containers.
2
Evaluate the AWS compute options against these requirements
Amazon EC2 and Amazon Lightsail require virtual machine management and patching. AWS Lambda is serverless but is designed for short-lived, event-driven functions rather than persistent containerized microservices. AWS Fargate is serverless, container-native, and eliminates the overhead of managing underlying virtual machines.
This identifies AWS Fargate as the only service that satisfies all the criteria.

Key Concept

AWS serverless container computing with AWS Fargate
Estimated Time:1m 0s
Question 706Question →

A global retail corporation is migrating its inventory management and analytics platform to AWS. The inventory system requires a database that supports rigid schema enforcement and complex SQL join queries across multiple tables for real-time stock reconciliation. Concurrently, the data science team needs to run complex, long-running analytical queries across terabytes of historical sales data to predict future inventory demands. To minimize operational overhead, the company wants fully managed services where AWS handles database patching, backups, and setup. Which combination of AWS services should the company select?

Show answer & explanation

Answer: Amazon Aurora for the inventory system, and Amazon Redshift for historical sales analytics

Answer

Amazon Aurora for the inventory system, and Amazon Redshift for historical sales analytics
The correct answer combines Amazon Aurora and Amazon Redshift. Amazon Aurora is a fully managed relational database that provides the high performance, ACID compliance, and complex join capabilities required for the inventory system. Amazon Redshift is a fully managed data warehouse designed specifically for high-performance analysis of large-scale historical datasets, offloading analytical processing from the transactional database to prevent performance degradation.

Step-by-Step Solution

1
Analyze the requirements for the inventory system.
The inventory system needs rigid schema enforcement, complex multi-table SQL joins, and minimal operational overhead. This requires a fully managed relational database service.
Amazon Aurora and Amazon RDS both meet these criteria as managed relational database services, whereas Amazon DynamoDB is NoSQL.
2
Analyze the requirements for the historical sales analytics system.
The analytics system requires running complex, long-running queries over large volumes of historical data, pointing to a fully managed data warehouse service.
Amazon Redshift is AWS's managed data warehousing service, optimized for running complex analytical queries on massive datasets.
3
Evaluate the management overhead requirement.
Self-managed options like database software on Amazon EC2 do not meet the requirement of minimizing operational overhead.
Deploying databases on Amazon EC2 puts the burden of OS patching, backups, and high availability on the customer under the shared responsibility model.
4
Combine the matching services to find the correct architecture.
The combination of Amazon Aurora for OLTP (online transaction processing) and Amazon Redshift for OLAP (online analytical processing) meets all requirements with minimal operational overhead.
Both services are fully managed by AWS and specifically designed for these distinct workloads.

Key Concept

Selecting the appropriate AWS database or analytics service based on application requirements (relational vs. non-relational, transaction processing vs. analytical warehousing, and managed vs. self-managed services).
Question 707Question →

A financial institution is planning to migrate a legacy data processing application to AWS. The company's compliance policy mandates that the internal operations team must maintain complete administrative control over the guest operating system, including the ability to install custom kernel modules and manage OS-level patches. Which AWS compute service should the company select to meet these requirements?

Show answer & explanation

Answer: Amazon Elastic Compute Cloud (Amazon EC2)

Answer

Amazon Elastic Compute Cloud (Amazon EC2)
Amazon Elastic Compute Cloud (Amazon EC2) operates as an Infrastructure as a Service (IaaS) model. This design grants the customer full root-level administrative access to the guest operating system. Consequently, the operations team has the necessary permissions to configure the OS, install proprietary kernel-level drivers, and manage updates, fulfilling the compliance requirements.

Step-by-Step Solution

1
Analyze the organization's requirement for administrative control.
The legacy application requires direct access to the guest operating system to install custom kernel modules and perform OS-level patching.
This requirement determines the level of shared responsibility and administrative access needed from the AWS compute service.
2
Evaluate the management boundaries of the available AWS compute options.
Serverless options (AWS Lambda and AWS Fargate) manage the operating system layer automatically, denying direct OS access to the customer. Platform as a Service (AWS Elastic Beanstalk) abstracts infrastructure management to simplify deployments, whereas Amazon EC2 provides full root-level control over the virtual machine's operating system.
To identify which service permits the specific configuration of custom kernel modules at the operating system level.

Key Concept

The customer's administrative control and patching responsibilities under the AWS Shared Responsibility Model vary across IaaS, PaaS, and serverless compute offerings.
Estimated Time:1m 30s
Question 708Question →

A financial consulting firm is preparing to migrate its client portal to the AWS Cloud. The firm wants to understand how the migration will impact its spending and operational model.

Which of the following statements regarding the cloud economics of this migration are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The migration allows the firm to trade upfront capital expenses (CapEx) for variable operating expenses (OpEx).; The total cost of ownership (TCO) is reduced by eliminating the cost of purchasing, powering, and maintaining physical servers.

Answer

Migrating to AWS allows the firm to trade upfront capital expenses (CapEx) for variable operating expenses (OpEx), and reduces the total cost of ownership (TCO) by eliminating the cost of purchasing, powering, and maintaining physical servers.
Migrating to AWS allows organizations to convert their financial model from capital expenditures (CapEx) to operating expenditures (OpEx), as they pay only for resources consumed rather than investing upfront in physical hardware. Furthermore, total cost of ownership (TCO) is reduced because the firm no longer needs to pay for the purchase, power, cooling, or maintenance of physical servers and data centers.

Step-by-Step Solution

1
Analyze how cloud migration shifts financial models.
Identify that cloud services convert capital expenses (CapEx) for hardware into variable operating expenses (OpEx).
This is a fundamental concept of cloud economics where businesses pay-as-they-go.
2
Analyze the impact on physical infrastructure costs.
Identify that total cost of ownership (TCO) decreases because physical servers and data centers are managed by AWS.
Eliminating physical hardware maintenance, power, and cooling directly lowers overall costs.

Key Concept

Shifting from CapEx to OpEx and reducing TCO through the elimination of physical infrastructure management.
Estimated Time:1m 0s
Question 709Question →

A retail company is expanding its AWS footprint and needs to deploy two new systems:

1. A microservice that processes payment notifications as they arrive, executing code that typically completes within a few seconds.
2. A containerized order processing application that runs continuously on a managed container orchestration platform without the need to provision or manage underlying virtual servers.

Which two AWS compute services should the company select to run these workloads?

Select all that apply

Show answer & explanation

Answer: AWS Lambda; AWS Fargate

Answer

AWS Lambda and AWS Fargate are the correct compute services to meet the requirements.
AWS Lambda satisfies the first workload because it is a serverless, event-driven compute service that runs code only when triggered by payment events. AWS Fargate satisfies the second workload because it provides a serverless compute engine for containers, executing them without the operational overhead of provisioning or managing virtual servers.

Step-by-Step Solution

1
Analyze the first requirement: a microservice that processes payment notifications and completes execution in seconds.
Identify AWS Lambda as the best fit, as it is a serverless service designed for running short-lived, event-driven code without provisioning servers.
AWS Lambda runs code in response to events and charges only for compute time consumed, making it ideal for event-driven payment notifications.
2
Analyze the second requirement: a containerized application running continuously without provisioning or managing virtual servers.
Identify AWS Fargate as the best fit, as it is a serverless compute engine for containers that removes the need to manage EC2 instances.
AWS Fargate manages the underlying server infrastructure automatically, allowing containers to run in a serverless environment.

Key Concept

Selecting appropriate AWS compute services based on operational overhead, execution duration, and containerization requirements.
Question 710Question →

An online education platform is deploying a new serverless application using AWS Lambda functions. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.

Answer

Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.
Configuring the IAM execution role and access policies is a customer responsibility under security 'in' the cloud. The customer must define permissions to ensure the function only accesses the resources it requires (least privilege rule).

Step-by-Step Solution

1
Analyze the service classification specified in the scenario.
The application runs on AWS Lambda, which is classified as a serverless/managed service.
Different service categories (IaaS vs. PaaS/Serverless) shift the boundaries of the Shared Responsibility Model, with AWS taking on more administrative responsibilities for managed services.
2
Determine the boundary between AWS and customer responsibilities for managed serverless resources.
AWS manages physical security, virtualization, container OS, and execution runtimes. The customer manages application code, data classification, and Identity and Access Management (IAM) permissions.
This division isolates infrastructure maintenance from application-level configurations and security settings.
3
Evaluate the choices to locate the one that describes a customer configuration task.
Configuring IAM execution roles is an access management task performed by the customer inside the console or API.
IAM settings are always managed by the customer to maintain control over authorization and resource access.

Key Concept

Shared Responsibility Model for Serverless Services
Estimated Time:1m 30s
Question 711Question →

A company is setting up a new AWS account and needs to organize access permissions for several system administrators and developers. According to AWS Identity and Access Management (IAM) best practices, which TWO statements correctly describe the characteristics and usage of IAM groups? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: They allow administrators to assign permissions to multiple IAM users simultaneously by attaching a policy to the group.; They are collections of IAM users and do not possess their own login credentials or access keys.

Answer

The correct statements are that IAM groups allow administrators to assign permissions to multiple users at once by attaching a policy, and that they are collections of users without their own security credentials.
IAM groups are designed to simplify permission management by allowing administrators to apply policies to multiple users at once. Because they are administrative collections rather than entities that take action, they do not have login credentials or access keys of their own.

Step-by-Step Solution

1
Analyze the role and capabilities of IAM groups in AWS.
Identify that IAM groups are collections of IAM users used to simplify permission management. Policies attached to a group are inherited by all member users.
This helps determine which options correctly state how groups function.
2
Examine the credentials and structure of IAM groups.
Confirm that IAM groups do not have their own password or access keys, and cannot be nested or assumed by AWS services.
This allows us to identify the second correct statement and rule out the incorrect statements.

Key Concept

IAM groups simplify access management by applying policies to multiple users at once, and they do not have credentials or support nesting.
Question 712Question →

A genomics research institute runs high-performance DNA sequencing data analysis that requires 128 compute nodes for exactly 6 hours every Friday. For the rest of the week, the institute only needs 2 compute nodes to allow researchers to access historical data. Which of the following best describes the cloud economics benefit of running this workload on AWS rather than on-premises?

Show answer & explanation

Answer: The institute can leverage elasticity to pay for the 128 compute nodes only during the 6 hours of active analysis, avoiding the costs of idle on-premises infrastructure.

Answer

The institute can leverage elasticity to pay for the 128 compute nodes only during the 6 hours of active analysis, avoiding the costs of idle on-premises infrastructure.
The correct answer correctly identifies elasticity and the pay-as-you-go billing model. In an on-premises deployment, the institute would have to purchase and maintain 128 servers to handle the Friday workload, meaning 126 servers would sit idle and waste resources for the rest of the week. With AWS, the institute can scale up to 128 nodes for the 6 hours of processing and then scale back down to 2 nodes, paying only for the resources they consume.

Step-by-Step Solution

1
Analyze the workload demand pattern.
The workload has a highly variable demand pattern: 128 nodes for 6 hours a week (peak demand) and 2 nodes for the remaining 162 hours (baseline demand).
Understanding the ratio of peak-to-baseline usage helps identify whether elasticity and variable pricing will provide cost benefits.
2
Compare on-premises provisioning with AWS cloud economics.
On-premises requires purchasing and maintaining 128 nodes (CapEx) to support the peak workload, leaving 126 nodes idle for 96% of the week. AWS allows dynamic scaling and pay-as-you-go pricing (OpEx).
This shows the contrast between fixed capital expenditure for idle capacity versus variable operating expenditure for actual consumption.
3
Identify the key cloud concept that matches this scenario.
Elasticity is the ability to scale computing resources up and down easily to meet demand. Using elasticity ensures the institute only pays for peak capacity when it is actively used.
This links the workload requirements directly to the economic benefit of elasticity.

Key Concept

Cloud elasticity and pay-as-you-go pricing model vs. on-premises over-provisioning
Estimated Time:1m 30s
Question 713Question →

A digital publishing company requires a solution to track changes made to its AWS infrastructure resources, specifically recording who made a configuration change and when. At the same time, the company needs to monitor application log files for specific error patterns and trigger automated alerts. Which AWS services are designed to address these requirements?

Show answer & explanation

Answer: AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.

Answer

AWS CloudTrail for tracking user and API activity, and Amazon CloudWatch for monitoring log files and sending alerts.
AWS CloudTrail records user activity and API calls, allowing the company to track changes and audit who performed specific actions. Amazon CloudWatch is used to collect logs, monitor application performance, and configure alarms when specific log patterns or thresholds are met.

Step-by-Step Solution

1
Identify the service responsible for auditing API actions and user modifications to resources.
AWS CloudTrail records AWS Management Console actions and API calls.
CloudTrail provides operational and risk auditing of AWS account activity.
2
Identify the service responsible for collecting application logs, monitoring metrics, and triggering alerts.
Amazon CloudWatch monitors resource performance and collects logs to trigger alarms.
CloudWatch provides real-time monitoring and alerting for application metrics and log patterns.

Key Concept

AWS CloudTrail provides compliance auditing of API calls, while Amazon CloudWatch provides performance monitoring and log alerting.
Estimated Time:1m 5s
Question 714Question →

A multi-department enterprise is setting up its AWS environment. The security team must define access controls for two distinct groups: a finance audit team that requires read-only access to AWS billing information, and an operations team that needs to start, stop, and reboot Amazon EC2 instances. Which TWO of the following configurations represent AWS-recommended IAM best practices to implement this access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group.; Create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.

Answer

Create an IAM user group for the audit team, attach the AWS-managed Billing policy to it, and assign individual audit users to this group; and create an IAM user group for the operations team, attach a customer-managed policy that permits the necessary EC2 actions to it, and assign individual operations users to this group.
The correct configurations involve creating separate IAM user groups for the audit and operations teams, attaching targeted permission policies, and placing individual users into those groups. This aligns with AWS security best practices by avoiding direct policy assignment to users and applying the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements for the audit and operations teams.
The audit team needs read-only billing access. The operations team needs partial EC2 access (start, stop, reboot).
This establishes the minimum permissions needed for each team to apply the principle of least privilege.
2
Identify the AWS identity best practices for organizing access.
Instead of assigning policies to individual users or sharing credentials, users should be placed in IAM user groups with specific permission policies attached.
Grouping users simplifies permission management and ensures consistency across roles.
3
Evaluate the option configurations against security standards.
Creating separate groups for audit and operations with specific policies is correct. Using root accounts, sharing users, or requesting AWS to manage OS access are incorrect configurations.
This rules out distractors based on security anti-patterns and the Shared Responsibility Model.

Key Concept

Principle of least privilege and IAM user groups management
Estimated Time:1m 30s
Question 715Question →

An organization is deploying a web application on Amazon EC2 instances. The security team must ensure that inbound HTTP traffic to port 80 is permitted, and that the corresponding outbound response traffic is automatically allowed back to the client without needing a corresponding outbound rule. Which AWS security feature should be configured to meet this requirement?

Show answer & explanation

Answer: Security Groups

Answer

Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on port 80, the return traffic is automatically allowed regardless of outbound rules. Network Access Control Lists (NACLs) are stateless and would require an explicit outbound rule. Amazon Inspector is a vulnerability scanner, and AWS Shield is for DDoS protection.
Security Groups are stateful firewalls operating at the instance level. Any permitted inbound traffic automatically allows the outbound response traffic to flow back, bypassing outbound rules. This aligns perfectly with the requirement to allow inbound HTTP traffic on port 80 and have the response traffic automatically permitted.

Step-by-Step Solution

1
Analyze the requirement for automatic return traffic.
The requirement specifies that outbound response traffic must be automatically permitted without an explicit outbound rule, indicating a stateful firewall behavior.
Identifying the stateful nature narrows the choices down to Security Groups, since they are stateful at the EC2 instance level.
2
Compare Security Groups and Network ACLs.
Security Groups are stateful (allowing return traffic automatically), while Network ACLs are stateless (requiring explicit rules in both directions).
This confirms that Security Groups are the correct configuration option to meet the organization's requirements.

Key Concept

Stateful vs. stateless network security controls in AWS VPC (Security Groups vs. Network ACLs)
Estimated Time:1m 0s
Question 716Question →

An online university hosting global certification exams experiences a massive surge in website traffic for exactly four hours during a monthly testing event. The university uses AWS Auto Scaling to automatically launch hundreds of Amazon EC2 instances to handle the exam traffic and subsequently terminates those instances when the testing window closes. Which AWS Cloud design principle is directly demonstrated by this dynamic adjustment of resources to match fluctuating demand?

Show answer & explanation

Answer: Elasticity

Answer

Elasticity
The correct answer is elasticity because the scenario highlights a system that dynamically expands capacity during traffic spikes and contracts capacity when demand decreases. Elasticity allows organizations to match supply with demand automatically, ensuring high availability while minimizing costs by only paying for the resources used.

Step-by-Step Solution

1
Analyze the scenario details.
The scenario describes a system that automatically adds instances to handle a temporary demand spike and then removes them (terminates them) when demand drops.
This establishes that we are looking for a cloud design principle focused on dynamic resource adjustment in both directions (scaling out and scaling in).
2
Differentiate between elasticity and scalability.
Scalability is the capability to handle growth, while elasticity is the capability to dynamically scale resources to match short-term fluctuations in demand, including reducing capacity when not needed.
Since the key cost-saving action is terminating instances when the event ends, elasticity is the most specific and correct principle.

Key Concept

AWS Cloud design principles: Elasticity
Question 717Question →

A company is planning to deploy four different workloads on AWS, each with unique hosting, administration, and pricing requirements. Which AWS compute service is the most appropriate for each workload? Match the application workload requirements to their corresponding AWS compute services.

Click a left item, then click its matching right item

Items

A simple web application that needs pre-configured storage, databases, and networking at a flat, predictable monthly price.
An event-driven script that automatically processes and resizes images uploaded to Amazon S3, paying only for the execution time.
A legacy corporate application that requires direct administrative (root) access to the underlying operating system kernel.
Containerized microservices that need to run and scale without provisioning or managing any underlying virtual machines.

Matches

Show answer & explanation

Answer

AWS Lightsail matches the simple flat-rate web application; AWS Lambda matches the event-driven image processing script; Amazon EC2 matches the legacy application needing OS administrative access; AWS Fargate matches the containerized microservices without managing virtual machines.
AWS Lightsail matches simple web hosting with flat-rate pricing. AWS Lambda matches event-driven, short-running functions. Amazon EC2 matches workloads requiring root access and control over the operating system. AWS Fargate matches serverless container execution where VM management is handled by AWS.

Step-by-Step Solution

1
Analyze the first workload requiring flat, predictable pricing and bundled services.
Identify AWS Lightsail as the service designed for easy, predictable-cost hosting.
AWS Lightsail bundles virtual private servers, storage, and databases into a single monthly flat rate, ideal for simple applications.
2
Analyze the second workload requiring event-driven execution for processing S3 uploads.
Identify AWS Lambda as the service that executes code in response to events without running continuous servers.
AWS Lambda is an event-driven serverless service that executes code in response to events (like S3 uploads) and bills only for active runtime.
3
Analyze the third workload requiring full administrative/root access to the OS kernel.
Identify Amazon EC2 as the service offering raw virtual machines with full administrative control.
Amazon EC2 offers complete root access and kernel customization, which serverless or fully managed services do not allow.
4
Analyze the fourth workload requiring container hosting without VM provisioning.
Identify AWS Fargate as the serverless container execution environment.
AWS Fargate runs containers directly without requiring the customer to manage, patch, or scale the underlying EC2 instances.

Key Concept

Selecting AWS compute services based on application architecture, administrative requirements, and cost models.
Question 718Question →

A company is designing a new container-based e-commerce platform on AWS. The platform consists of two main workloads:

1. A front-end web service that runs continuously, handles unpredictable traffic spikes, and requires full control over the underlying operating system and Docker daemon configuration to install third-party security agents.
2. A short-lived, event-driven image processing task that runs automatically whenever a new product image is uploaded, taking between 1010 and 3030 seconds to complete.

Which combination of AWS compute services should the company select to meet these requirements with the minimum operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon EC2 to host the front-end web service; AWS Lambda to run the image processing task

Answer

The correct combination is Amazon EC2 to host the front-end web service and AWS Lambda to run the image processing task.
The correct combination requires using Amazon EC2 for the web service and AWS Lambda for the processing task. Amazon EC2 gives the user full root-level control over the virtual machine's operating system, allowing installation of custom software and Docker daemon modifications. AWS Lambda is a serverless, event-driven service that automatically scales to execute code for short durations, which perfectly matches the brief image-processing task with zero host management.

Step-by-Step Solution

1
Analyze the requirements for the front-end web service.
The web service requires full control over the underlying operating system and Docker daemon configuration to install third-party security agents.
This requirement rules out serverless container environments like AWS Fargate, where the host OS is managed by AWS, making Amazon EC2 the necessary choice.
2
Analyze the requirements for the image processing task.
The task is short-lived (1010 to 3030 seconds), event-driven (triggered by image uploads), and needs minimal operational overhead.
AWS Lambda is the most suitable service for this pattern because it runs code in response to events, scales automatically, and charges only for the compute time consumed, eliminating server management.

Key Concept

Selecting appropriate AWS compute services based on operational control, scaling needs, and workload characteristics.
Estimated Time:2m 0s
Question 719Question →

A marketing company launches promotional websites that are only active for a few weeks at a time. Instead of purchasing physical servers to host these websites, the company hosts them on AWS and pays only for the resources consumed during the campaigns. Which of the following cloud economics benefits is demonstrated in this scenario?

Show answer & explanation

Answer: Trading upfront capital expenses for variable operating expenses

Answer

Trading upfront capital expenses for variable operating expenses
The correct answer is correct because purchasing physical servers requires upfront investment, which is a capital expense (CapEx). Moving to AWS allows the company to pay only for resources consumed on an ongoing basis, shifting these costs to variable operating expenses (OpEx). This directly represents the benefit of trading capital expenses for variable expenses.

Step-by-Step Solution

1
Analyze the financial model of purchasing physical servers.
Purchasing physical servers requires significant upfront investment, which represents a Capital Expense (CapEx).
To understand the baseline on-premises cost model.
2
Analyze the financial model of paying for AWS resources on demand.
Paying only for virtual resources while they are active represents a variable Operating Expense (OpEx).
To identify how cloud services are billed.
3
Compare the transition between the two models.
The company trades the high upfront CapEx of buying servers for the flexible, variable OpEx of cloud resources.
To determine the cloud economics concept demonstrated.

Key Concept

Trading capital expenses for variable expenses
Estimated Time:45s
Question 720Question →

A retail company wants to store its weekly sales reports in Amazon Simple Storage Service (Amazon S3). To protect this data, they want to enable encryption at rest using cryptographic keys that are fully managed by AWS. Which AWS service is designed to easily create and manage these encryption keys?

Show answer & explanation

Answer: AWS Key Management Service (AWS KMS)

Answer

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that integrates with many AWS services (such as Amazon S3) to easily create, manage, and rotate cryptographic keys used to secure data at rest.

Step-by-Step Solution

1
Identify the core requirement from the scenario.
The requirement is to encrypt data at rest in Amazon S3 using a fully managed key management service.
This narrows down the choice to services that deal with encryption and key management.
2
Evaluate the managed services offered by AWS for cryptographic key management.
AWS Key Management Service (AWS KMS) is the standard multi-tenant managed service for creating and managing keys. AWS CloudHSM offers dedicated hardware security modules but requires manual management by the customer.
Since the scenario specifies a fully managed service that easily creates and manages keys, AWS KMS is the correct fit.

Key Concept

AWS Key Management Service (AWS KMS) provides a fully managed, secure solution for creating and controlling cryptographic keys to encrypt data at rest across AWS services.
Estimated Time:45s
PreviousPage 36 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin