All practice questions

1473 questions

Question 741Question

A logistics company is modernizing its data tier on AWS. The company needs a database solution to handle two distinct requirements: first, storing live, highly structured transaction records for order processing that requires full ACID compliance and SQL joins; second, running complex analytical queries over petabytes of historical tracking data to generate business intelligence reports. Which two AWS database services should the company select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon RDS; Amazon Redshift

Answer

Amazon RDS and Amazon Redshift
The workload involving live, highly structured transactional records requiring ACID compliance is best suited for Amazon RDS, which is a fully managed relational database service. The workload involving analytical queries over petabytes of historical data for business intelligence is best suited for Amazon Redshift, which is a fully managed data warehouse designed specifically for high-performance analysis of massive datasets.

Step-by-Step Solution

1
Analyze the first requirement
The requirement specifies storing live, highly structured transaction records with full ACID compliance and support for SQL joins. This is a classic Online Transaction Processing (OLTP) workload, which is best served by a relational database like Amazon RDS.
Amazon RDS manages relational engines (like PostgreSQL or MySQL) that enforce schema structure and ACID compliance.
2
Analyze the second requirement
The requirement specifies running complex analytical queries over petabytes of historical tracking data for business intelligence. This is an Online Analytical Processing (OLAP) workload, which is best served by a cloud data warehouse like Amazon Redshift.
Amazon Redshift uses columnar storage and parallel processing to analyze massive datasets efficiently.

Key Concept

Distinguishing between relational transactional databases (OLTP) and analytical data warehouses (OLAP) in AWS.
Question 742Question

A software development firm is deploying its microservices-based application using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring security groups to control network traffic allowed to reach the containers

Answer

Configuring security groups to control network traffic allowed to reach the containers
Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud.' When using AWS Fargate, AWS handles the host operating system, hypervisor, and physical security. The customer maintains control over, and responsibility for, configuring the security groups to manage inbound and outbound network traffic to their container tasks.

Step-by-Step Solution

1
Identify the service deployment model used in the scenario.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless/managed container environment.
Determining the service type helps define the boundary lines of the Shared Responsibility Model, separating customer tasks from AWS infrastructure tasks.
2
Evaluate the operational tasks against customer and AWS boundaries.
Configuring security groups to filter container traffic is a customer task, while host patching, physical security, and direct host compliance access are managed by AWS.
Under the Shared Responsibility Model, customers are responsible for managing access configurations (security in the cloud) such as security groups for container tasks.

Key Concept

Shared Responsibility Model
Question 743Question

A logistics company suspects that credentials for one of its administrative accounts have been compromised, leading to unauthorized resource creation in multiple AWS Regions. The security team wants to implement a service that continuously monitors their AWS accounts for malicious activity and anomalies, such as unauthorized API calls or unusual network traffic, without needing to write custom detection rules. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty is the correct AWS service to continuously monitor accounts for malicious activity and anomalies, such as unauthorized API calls, using intelligent threat detection.
Amazon GuardDuty is correct because it is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity, utilizing machine learning and anomaly detection to identify compromised credentials, unauthorized access, and malicious API patterns.

Step-by-Step Solution

1
Analyze the requirement for continuous, automated threat detection and account-level monitoring for compromised credentials and malicious activity.
Identify that the solution must analyze sources like CloudTrail events, VPC Flow Logs, and DNS logs to discover anomalies automatically.
This establishes the scope of security monitoring and logging needed for the scenario.
2
Evaluate the AWS security services to find the one that performs intelligent threat detection without requiring manual detection rule creation.
Select Amazon GuardDuty, as it uses machine learning and anomaly detection to identify threats like credential compromise across AWS accounts.
This distinguishes Amazon GuardDuty from performance monitoring tools, vulnerability scanners, or infrastructure DDoS protection.

Key Concept

AWS Security Logging, Monitoring, and Auditing using Amazon GuardDuty for threat detection.
Question 744Question

A startup is designing a new microservices-based application and wants to minimize operational overhead by using serverless compute options. The architecture team needs to select services where they do not have to provision, manage, or patch the underlying virtual servers.

Which of the following AWS compute services meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Lambda; AWS Fargate

Answer

AWS Lambda and AWS Fargate are serverless compute services that do not require managing underlying servers.
AWS Lambda and AWS Fargate are correct because both are serverless compute services. AWS Lambda runs code in response to events without provisioning servers, while AWS Fargate is a serverless compute engine for containers that eliminates the need to manage the underlying virtual machines.

Step-by-Step Solution

1
Identify the key requirement in the scenario.
The requirement is to select serverless AWS compute services that eliminate the need to provision, manage, or patch virtual servers.
Understanding the core constraint helps narrow down the correct AWS services.
2
Evaluate the compute services against the serverless criteria.
AWS Lambda and AWS Fargate run applications without requiring server management. Amazon EC2 and Amazon Lightsail require the user to manage virtual machines.
Distinguishing between serverless and server-based compute models leads to the correct selection.

Key Concept

AWS Serverless Compute Services
Question 745Question

A small local bakery wants to launch a simple WordPress website to showcase their daily menu and take custom cake orders. The business has a very limited IT budget and no cloud engineering experience. They require a web hosting solution that bundles compute, SSD-based storage, a pre-configured database, and static IP addresses into a single package with a predictable monthly price. Which AWS compute service should the bakery use to meet these requirements?

Show answer & explanation

Answer: Amazon Lightsail

Answer

Amazon Lightsail
Amazon Lightsail is the ideal choice because it is designed specifically for developers, small businesses, and users who need a simple virtual private server (VPS) solution. It provides pre-configured templates for common platforms like WordPress and bundles compute power, SSD-based storage, data transfer capacity, a database, and static IPs into a predictable, flat monthly pricing tier.

Step-by-Step Solution

1
Analyze the customer requirements: lack of cloud expertise, need for bundled resource packages (compute, storage, database), and strict predictable monthly pricing.
Identified the need for an easy-to-use virtual private server solution with low overhead and flat-rate pricing.
Ensures the selected service aligns with both technical capability constraints and cost management goals.
2
Compare AWS compute options: Amazon EC2 requires manual administration; AWS Lambda is event-driven serverless; AWS Fargate requires container orchestration; Amazon Lightsail offers pre-configured virtual private server bundles.
Determined that Amazon Lightsail is the only service that satisfies all the criteria of pre-configured simple bundles and flat monthly pricing.
Allows selecting the compute option that minimizes operational complexity.

Key Concept

Selecting the appropriate AWS compute service based on business needs, technical expertise, and cost predictability constraints.
Estimated Time:1m 30s
Question 746Question

A startup is setting up an application on AWS and must encrypt its customer data at rest. According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility regarding data protection?

Show answer & explanation

Answer: Enabling and configuring encryption for the application's storage volumes

Answer

Enabling and configuring encryption for the application's storage volumes
The correct answer is correct because configuring and enabling encryption for customer-controlled assets (such as storage volumes and database instances) is a customer responsibility ('Security in the Cloud') under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the boundary between customer and AWS responsibilities under the Shared Responsibility Model.
AWS is responsible for 'Security of the Cloud' (physical infrastructure, hardware, virtualization layer), while the customer is responsible for 'Security in the Cloud' (customer data, platform, applications, identity and access management).
This establishes which operations fall under AWS control versus customer control.
2
Evaluate the choices to determine which action is performed by the customer.
Enabling and configuring encryption on storage volumes is a configuration task performed by the customer on their own resources ('Security in the Cloud'). Tasks like physical security of hardware and drive decommissioning are 'Security of the Cloud' managed by AWS.
This identifies the correct customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for data protection configuration (Security in the Cloud), such as enabling encryption on storage volumes, while AWS manages the physical security and infrastructure (Security of the Cloud).
Question 747Question

A logistics company is designing a package tracking system to monitor real-time location telemetry from a fleet of delivery vehicles. The telemetry data consists of rapid, high-volume key-value writes that require single-digit millisecond latency at any scale. Concurrently, the company's data analysts need to perform complex SQL queries on petabytes of historical delivery data to optimize routes. Which two AWS database services should the company choose to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon DynamoDB; Amazon Redshift

Answer

Amazon DynamoDB and Amazon Redshift
The correct services are Amazon DynamoDB and Amazon Redshift. Amazon DynamoDB provides the required single-digit millisecond latency for high-volume key-value telemetry data. Amazon Redshift is designed specifically for running complex analytical SQL queries against petabytes of historical structured data.

Step-by-Step Solution

1
Analyze the real-time telemetry requirement
Identify that the telemetry data requires high-volume key-value writes and consistent, single-digit millisecond latency at any scale.
This workload profile maps directly to Amazon DynamoDB, which is optimized for high-throughput, low-latency NoSQL key-value use cases.
2
Analyze the historical analysis requirement
Identify that the data analysts require complex SQL queries on petabytes of historical shipping logs.
This analytical, large-scale SQL workload maps directly to Amazon Redshift, which is AWS's dedicated cloud data warehousing service designed for petabyte-scale analytics.
3
Evaluate and eliminate distractors
Eliminate options that fail to meet these requirements or violate AWS design principles.
Amazon RDS is not optimized for petabyte-scale data warehousing or extreme key-value writes. Amazon ElastiCache is an in-memory cache, not a persistent store. Amazon DocumentDB is a document store, not suited for the required telemetry performance or petabyte-scale SQL analytics.

Key Concept

AWS Database Services selection based on workload requirements (NoSQL key-value vs. analytical data warehousing)
Question 748Question

A retail company hosts its core inventory management system on a fleet of Amazon EC2 instances. The company's security policy requires automated, continuous assessments of these instances to identify software package vulnerabilities and unintended network paths that could lead to exposure. Which AWS service should the company use to automate these security assessments?

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector
Amazon Inspector is the correct service because it provides automated, continuous vulnerability management. It scans Amazon EC2 instances, Amazon Elastic Container Registry (ECR) container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the security requirement.
The company needs to continuously scan EC2 instances for software vulnerabilities and network path exposure.
This establishes the target service capability needed (host and vulnerability assessment).
2
Match the requirement with the correct AWS service capability.
Amazon Inspector is designed specifically for automated and continuous vulnerability scanning of EC2 instances, container images, and Lambda functions.
This distinguishes it from log-monitoring, API-logging, or shared infrastructure services.

Key Concept

Automated host and container vulnerability scanning using Amazon Inspector
Estimated Time:1m 30s
Question 749Question

A developer needs to write a shell script that runs on a local machine to automatically stop several Amazon EC2 instances every night. Which AWS tool is designed to support this type of command-line interaction and scripting?

Show answer & explanation

Answer: AWS Command Line Interface (AWS CLI)

Answer

AWS Command Line Interface (AWS CLI)
The AWS Command Line Interface (AWS CLI) is the correct choice because it is a unified tool that allows users to interact with and control AWS services via command-line commands and scripts, making it ideal for automating task execution from a local shell script.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to automate the stopping of EC2 instances using a shell script from a local command-line environment.
This helps determine whether a graphical, programmatic, or command-line tool is needed.
2
Evaluate the capabilities of the available AWS interaction methods.
The AWS Command Line Interface (AWS CLI) is specifically designed to execute AWS commands directly from shell scripts and terminal environments.
Matching the tool's core design to the requirement leads to the correct choice.

Key Concept

Command-line automation using the AWS CLI
Estimated Time:45s
Question 750Question

A medical device manufacturer is deploying an application on AWS that handles sensitive patient health data. The company's compliance framework requires that all data at rest be encrypted using keys stored on dedicated, single-tenant hardware security modules that the customer directly manages. Additionally, the company must maintain responsibility for configuring access to these keys.

Which of the following actions are responsibilities of the customer to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provisioning dedicated hardware security modules using AWS CloudHSM; Configuring key policies and user permissions to control access to the cryptographic keys

Answer

Provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions to control access to the cryptographic keys
The correct actions are provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions. AWS CloudHSM satisfies the compliance requirement for dedicated, single-tenant hardware. Managing permissions and policies to secure access to these keys is a customer responsibility under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the cryptographic hardware requirement (dedicated, single-tenant hardware security modules directly managed by the customer).
Determine that this maps to AWS CloudHSM rather than AWS Key Management Service (KMS).
AWS CloudHSM is the only AWS service offering dedicated, single-tenant HSMs under direct customer control.
2
Evaluate the customer's administrative boundaries for cryptographic keys under the Shared Responsibility Model.
Identify that configuring access policies and permissions is the customer's duty.
The customer is responsible for security 'in' the cloud, which includes configuring key policies and permissions.
3
Differentiate between customer responsibilities and AWS physical infrastructure duties.
Eliminate options involving physical security and hardware replacement.
AWS is responsible for security 'of' the cloud, meaning physical maintenance and facility security are handled exclusively by AWS.

Key Concept

Distinction between AWS KMS and AWS CloudHSM, and the mapping of data protection responsibilities under the AWS Shared Responsibility Model.
Question 751Question

A cloud architect needs to implement a network security control that operates at the subnet level to block traffic from a list of known malicious IP addresses before it reaches any EC2 instances. The control must evaluate traffic as it enters and leaves the subnet boundary, and any returned response traffic must be explicitly permitted by a rule because the control does not automatically remember connection states. Which AWS resource should the architect configure?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) are stateless firewalls that operate at the subnet level. They require rules to be configured for both inbound and outbound traffic because they do not track connection states.

Step-by-Step Solution

1
Identify the boundary level at which the firewall control must operate.
The requirement specifies the control must operate at the subnet level.
This helps narrow down the choices between instance-level controls and subnet-level controls.
2
Analyze the stateful or stateless behavior required for the firewall rules.
The control must evaluate traffic in both directions and does not automatically track connection states, requiring explicit return rules (stateless behavior).
This confirms that Network ACLs must be used, as they are stateless and operate at the subnet boundary, whereas Security Groups are stateful and operate at the instance level.

Key Concept

Understanding the differences in scope and state management between Security Groups and Network ACLs.
Estimated Time:1m 0s
Question 752Question

A company is deploying an application on Amazon EC2 instances that requires read and write access to an Amazon DynamoDB table. At the same time, the company needs to grant temporary access to external developers from a partner organization to collaborate on the project.

Which of the following actions align with AWS Identity and Access Management (IAM) best practices to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign an IAM role to the Amazon EC2 instances that grants the necessary permissions to access the Amazon DynamoDB table.; Configure a cross-account IAM role that the partner organization's developers can assume to access the required resources.

Answer

Assign an IAM role to the Amazon EC2 instances to grant permissions to the DynamoDB table, and configure a cross-account IAM role for the partner developers to assume.
The correct options represent AWS best practices for identity management. Assigning an IAM role to the EC2 instances allows secure application-to-service communication via temporary credentials. Configuring a cross-account IAM role for the external developers provides secure, temporary access to the partner organization without requiring new user creation or credential sharing.

Step-by-Step Solution

1
Analyze the access requirement for the application running on Amazon EC2 instances to access Amazon DynamoDB.
Determine that applications on EC2 should use temporary credentials provided by an IAM role associated with an EC2 instance profile, rather than storing long-term credentials like access keys on the instance.
This minimizes security risks by avoiding hardcoded or stored long-term access keys.
2
Analyze the access requirement for third-party developers from a partner organization.
Determine that cross-account access should be managed using IAM roles that external users can assume temporarily, rather than creating permanent IAM users or sharing root credentials.
This follows the security principle of granting temporary access and maintaining central control without sharing sensitive credentials.

Key Concept

AWS identity management best practices prioritize the use of temporary credentials via IAM roles for applications and third-party cross-account access, while strictly avoiding the use of long-term credentials or root accounts for operational tasks.
Question 753Question

A software company is planning to migrate its database workload to the AWS Cloud. Currently, database administrators spend several hours each week configuring database replication, managing operating system updates, and executing manual backups on local servers. To eliminate these tasks, the company decides to migrate to Amazon Aurora, allowing AWS to manage these operational responsibilities automatically.

Which AWS Cloud design principle does this decision directly represent?

Show answer & explanation

Answer: Services, not servers

Answer

Services, not servers
The correct answer is the option stating 'Services, not servers'. This AWS design principle encourages using managed services (such as Amazon Aurora) to reduce operational complexity. By choosing a managed database service, the organization delegates server maintenance, OS patching, and backups to AWS, freeing up internal teams to focus on core business applications.

Step-by-Step Solution

1
Analyze the operational requirements described in the scenario.
The company's database administrators are manually performing system-level administration tasks (OS patching, database backups, replication) on self-managed servers.
Understanding the current manual tasks helps identify the administrative overhead that needs to be eliminated.
2
Evaluate the proposed solution (migrating to Amazon Aurora).
Amazon Aurora is a fully managed relational database service that automates provisioning, patching, and backups.
Identifying the nature of the target service helps determine which cloud design principle applies.
3
Match the transition from self-managed servers to managed services with AWS Cloud design principles.
Using managed services instead of managing virtual servers directly aligns with the 'Services, not servers' design principle.
This confirms that the primary goal of the migration is to offload operational management to AWS.

Key Concept

The AWS Cloud design principle of choosing managed services over self-managed servers to reduce administrative overhead and operational effort.
Question 754Question

A systems administrator is configuring basic security boundaries for a new VPC deployment. To protect the environment, the administrator must understand the functional differences between Security Groups and Network Access Control Lists (Network ACLs). Which TWO statements accurately describe the characteristics of these two resources? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security Groups operate at the instance level and automatically allow return traffic for approved inbound requests due to their stateful nature.; Network ACLs operate at the subnet boundary and require explicit outbound rules to permit return traffic because they are stateless.

Answer

The correct answers are the statements that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet boundary and are stateless.
Security Groups are stateful firewalls that operate at the instance level (specifically the Elastic Network Interface), meaning outbound return traffic is automatically permitted for established inbound connections. In contrast, Network ACLs are stateless firewalls that operate at the subnet boundary, meaning they evaluate inbound and outbound traffic independently, requiring explicit rules in both directions.

Step-by-Step Solution

1
Identify the level at which Security Groups and Network ACLs operate.
Security Groups apply at the instance (network interface) level, while Network ACLs apply at the subnet boundary.
This distinguishes the scope of each firewall type.
2
Determine the stateful or stateless behavior of each control.
Security Groups are stateful (allowing return traffic automatically), whereas Network ACLs are stateless (requiring separate inbound and outbound rules).
This dictates how traffic return paths must be configured.
3
Evaluate the shared responsibility boundary for security group configurations.
Customers are responsible for configuring their own firewall rules (Security Groups and Network ACLs).
AWS does not manage customer-specific access control policies.

Key Concept

Comparison of Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level)
Question 755Question

An international digital news publisher wants to launch its content delivery application for readers across South America, Europe, and Asia to ensure low latency. Additionally, the publisher wants to focus its resources on developing software features rather than managing physical facilities, server racks, and utilities like cooling and electricity.

Which two benefits of the AWS Cloud directly support this publisher’s requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes; Stop spending money running and maintaining data centers

Answer

The correct options are the benefits of deploying globally to minimize latency ('Go global in minutes') and eliminating the management of physical infrastructure ('Stop spending money running and maintaining data centers').
The correct options are 'Go global in minutes' and 'Stop spending money running and maintaining data centers'. The news publisher's need to deploy services closer to global users (South America, Europe, and Asia) for low latency is addressed by 'Go global in minutes', which leverages the AWS global infrastructure. The need to avoid managing physical facilities, power, cooling, and hardware rack operations is addressed by 'Stop spending money running and maintaining data centers', as AWS assumes ownership of physical infrastructure management.

Step-by-Step Solution

1
Analyze the requirements in the scenario.
The news publisher needs to achieve low latency across South America, Europe, and Asia, and wants to avoid managing physical facilities, server racks, and utilities.
This establishes the target goals to map against the 6 benefits of the AWS Cloud.
2
Map the requirement for low latency across multiple continents to an AWS benefit.
Deploying applications globally with minimal latency maps to the benefit of 'Go global in minutes'.
AWS infrastructure is spread globally across many Regions, allowing fast deployment to multiple locations.
3
Map the requirement to avoid physical hardware, racks, and utility management to an AWS benefit.
Avoiding physical facilities, cooling, power, and server rack management maps to the benefit of 'Stop spending money running and maintaining data centers'.
AWS handles all underlying physical infrastructure management, allowing clients to focus on business and development.

Key Concept

The six core benefits of the AWS Cloud (specifically 'Go global in minutes' and 'Stop spending money running and maintaining data centers')
Question 756Question

A cloud architect is mapping several application workloads to the most appropriate AWS compute services. Match each business workload requirement to the AWS compute service that best fits its deployment, cost, and management constraints.

Click a left item, then click its matching right item

Items

A batch processing job that requires GPU-accelerated computing and kernel-level customizations to optimize deep learning training runs.
A lightweight, containerized microservice that serves API requests, requires rapid auto-scaling, and must run on a serverless architecture where users only pay when containers are running.
An event-driven function that processes log files uploaded to Amazon S3, executes code only when triggered, and runs for a maximum of 5 minutes per execution.
A small-scale developer environment containing a web server and a database that needs a simple, all-in-one package with a predictable monthly cost.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) The GPU and kernel-customized batch job matches Amazon EC2. 2) The serverless, containerized API microservice matches AWS Fargate. 3) The S3 event-driven file processing function matches AWS Lambda. 4) The developer environment with predictable monthly billing matches Amazon Lightsail.
The correct mapping pairs each workload to its optimal compute service based on the degree of control, cost predictability, container orchestration, and serverless constraints. GPU and kernel modifications map to Amazon EC2. Serverless API container workloads map to AWS Fargate. Event-driven S3 functions map to AWS Lambda. A simple, predictable-cost VPS bundle maps to Amazon Lightsail.

Step-by-Step Solution

1
Analyze the management and OS access requirements for each workload.
Identify that the batch processing job requires GPU acceleration and guest OS kernel-level modifications, which are only possible with full virtual machine control.
Since serverless options do not allow access to the underlying OS kernel, this workload must map to Amazon EC2.
2
Determine the container and scaling requirements.
Identify that the API microservice needs serverless containers that scale rapidly and bill only during runtime.
AWS Fargate is the serverless container execution engine designed exactly for running containers without provisioning underlying VMs.
3
Assess the event-driven behavior and execution duration.
Identify that log processing is triggered by S3 events, runs on-demand, and finishes in 5 minutes.
AWS Lambda is ideal for event-driven functions running short-lived processing logic.
4
Identify the simple environment and pricing requirements.
Identify that the developer environment requires a simple, pre-configured VPS with predictable pricing.
Amazon Lightsail provides an all-in-one VPS bundle with low, predictable monthly pricing.

Key Concept

Selecting the appropriate AWS Compute service based on workload, scaling, management, and cost requirements.
Estimated Time:2m 30s
Question 757Question

A media streaming company is designing a new platform on AWS. They require a fully managed database to store user profile preferences with single-digit millisecond latency at any scale. Additionally, they need a petabyte-scale data warehouse to run complex analytical queries on historical viewing habits. Which two AWS services should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon DynamoDB; Amazon Redshift

Answer

Amazon DynamoDB and Amazon Redshift
The correct services are Amazon DynamoDB and Amazon Redshift. Amazon DynamoDB provides the fast, single-digit millisecond latency needed for key-value lookups such as user profile preferences. Amazon Redshift is the dedicated AWS data warehouse service designed to run complex analytical queries against massive volumes of historical data.

Step-by-Step Solution

1
Analyze the first requirement: storing user profile preferences with single-digit millisecond latency at any scale.
Identify Amazon DynamoDB as the matching fully managed NoSQL database designed for fast key-value lookups.
DynamoDB is built specifically for low-latency, highly scalable NoSQL workloads.
2
Analyze the second requirement: a petabyte-scale data warehouse for complex analytical queries on historical viewing habits.
Identify Amazon Redshift as the matching AWS data warehouse service.
Redshift is designed for large-scale analytics and business intelligence workloads.

Key Concept

AWS Database Services selection based on workload type (NoSQL key-value vs. Data Warehouse)
Estimated Time:50s
Question 758Question

A software engineering team is building a microservice-based application. The application code, written in Python, must dynamically read metadata from an Amazon DynamoDB table and write files to an Amazon S3 bucket at runtime. Concurrently, the DevOps team needs a declarative, version-controlled method to automatically provision and update the required DynamoDB tables, S3 buckets, and Amazon ECS resources in a repeatable manner.

Which two AWS deployment and operating methods or tools should be utilized to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Software Development Kit (SDK); AWS CloudFormation

Answer

The correct tools are the AWS Software Development Kit (SDK) and AWS CloudFormation.
The AWS Software Development Kit (SDK) provides language-specific APIs (such as Boto3 for Python) that allow runtime application code to interact programmatically with AWS services like Amazon S3 and Amazon DynamoDB. AWS CloudFormation allows teams to define and provision infrastructure resources as code using declarative templates, ensuring repeatable and version-controlled deployments.

Step-by-Step Solution

1
Analyze the application code requirement.
The application code needs language-specific, programmatic integration to read from DynamoDB and write to S3 at runtime.
This indicates the need for the AWS Software Development Kit (SDK) rather than CLI or manual Console interaction.
2
Analyze the infrastructure provisioning requirement.
The DevOps team requires a declarative, version-controlled, repeatable template to manage and provision ECS, DynamoDB, and S3 resources.
This indicates the need for an Infrastructure as Code (IaC) tool like AWS CloudFormation.
3
Combine the requirements to select the two correct options.
The AWS SDK satisfies the programmatic application integration requirement, while AWS CloudFormation satisfies the declarative infrastructure provisioning requirement.
Choosing these two tools directly solves both requirements in the scenario.

Key Concept

Selecting appropriate AWS deployment and operating methods based on business and technical constraints
Question 759Question

A software development company is preparing to launch a new application. Instead of purchasing and setting up physical servers in a local facility, the company decides to deploy the application on AWS and pay for resources on a monthly basis based on active consumption. Which of the following best describes this financial change?

Show answer & explanation

Answer: A shift from Capital Expenses (CapEx) to Operating Expenses (OpEx)

Answer

A shift from Capital Expenses (CapEx) to Operating Expenses (OpEx)
The correct answer is the shift from Capital Expenses (CapEx) to Operating Expenses (OpEx). Physical server purchases require upfront financial investment in long-term assets (CapEx). In contrast, AWS operates on a consumption-based pricing model where costs are treated as day-to-day operating expenses (OpEx).

Step-by-Step Solution

1
Identify the initial payment model described.
Purchasing and setting up physical servers upfront is a Capital Expense (CapEx).
CapEx refers to money spent by a business to acquire or maintain fixed physical assets.
2
Identify the new cloud payment model.
Paying for AWS resources on a monthly basis based on active consumption is an Operating Expense (OpEx).
OpEx refers to the day-to-day operational costs of running a business, like utility billing.

Key Concept

Shifting from Capital Expenses (CapEx) to Operating Expenses (OpEx)
Question 760Question

A telemedicine platform hosts its patient portal application on Amazon EC2 instances. The platform's security team needs to implement a solution that continuously monitors the AWS account for malicious activity and unauthorized access, while also automatically scanning the EC2 instances for known software vulnerabilities and unintended network exposure. Which two AWS services should the security team use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty; Amazon Inspector

Answer

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection across the AWS environment, while Amazon Inspector scans the EC2 instances for software vulnerabilities and network exposure.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity such as credential compromise or malware, while Amazon Inspector automatically scans EC2 instances for software vulnerabilities and unintended network exposure. Together, they satisfy the requirement for both threat detection and vulnerability scanning.

Step-by-Step Solution

1
Analyze the requirement for host-level software vulnerability and network exposure scanning on Amazon EC2 instances.
Amazon Inspector is identified as the service designed for automated vulnerability assessment of EC2 instances.
Inspector performs software package vulnerability checks and assesses network reachability of hosts.
2
Analyze the requirement for continuous account-level monitoring for malicious activity and unauthorized behavior.
Amazon GuardDuty is identified as the designated intelligent threat detection service.
GuardDuty monitors logs (such as CloudTrail, VPC Flow Logs, and DNS logs) to detect activities like cryptomining, credential exfiltration, or unauthorized access.

Key Concept

AWS threat detection and vulnerability management services
PreviousPage 38 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin