Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 61Question →

An online gaming company wants to design its architecture on AWS. The company has two key requirements:

1. It must deploy its database across multiple isolated locations within a single geographic area to ensure high availability and automatic failover.
2. It must replicate its critical data to a separate geographic location hundreds of miles away to comply with its disaster recovery policy.

Which of the following AWS Global Infrastructure components should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Availability Zones; AWS Regions

Answer

The correct options are Availability Zones and AWS Regions. Availability Zones provide isolated locations within a single geographic region for high availability and failover, whereas AWS Regions represent separate geographic areas hundreds of miles apart, suitable for disaster recovery requirements.
Availability Zones provide high availability and automatic failover by offering isolated datacenters within a single region, while AWS Regions are geographically separated by hundreds of miles, providing the distance needed to satisfy the disaster recovery requirement.

Step-by-Step Solution

1
Analyze the first requirement: deploying a database across multiple isolated locations within a single geographic area for high availability.
Identify that Availability Zones are designed precisely for this purpose, providing isolated datacenters with low-latency connections within a single AWS Region.
Deploying across multiple Availability Zones protects against localized failures while maintaining sub-millisecond network latency.
2
Analyze the second requirement: replicating data to a separate geographic location hundreds of miles away for disaster recovery.
Identify that AWS Regions are geographically isolated areas separated by large distances, making them ideal for meeting strict disaster recovery and data residency policies.
Replicating data to another AWS Region protects against large-scale natural disasters that could impact an entire region.

Key Concept

AWS Global Infrastructure components, specifically the distinction and use cases for AWS Regions and Availability Zones.
Estimated Time:1m 30s
Question 62Question →

A multi-national retail corporation plans to migrate its inventory analysis system to AWS. The current on-premises system runs on a cluster of physical servers that cost 120,000topurchase(depreciatedover3years)plus120,000 to purchase (depreciated over 3 years) plus 3,000 monthly for datacenter space and power. The database utilization spikes heavily during seasonal sales events (about 15 days a year) but is minimal otherwise. To maximize the Total Cost of Ownership (TCO) reduction and leverage cloud economics, which strategy should the financial team approve?

Show answer & explanation

Answer: Transition to a variable operating expense (OpEx) model by using AWS Auto Scaling to dynamically match compute capacity with peak demand, combined with Savings Plans for the predictable baseline workload, minimizing overall Total Cost of Ownership (TCO).

Answer

Transition to a variable operating expense (OpEx) model by using AWS Auto Scaling to dynamically match compute capacity with peak demand, combined with Savings Plans for the predictable baseline workload, minimizing overall Total Cost of Ownership (TCO).
The correct strategy involves transitioning to an operational expenditure (OpEx) model using AWS Auto Scaling for peak demand and commitment-based pricing like Savings Plans for the baseline workload. This combination eliminates upfront capital expenditures (CapEx), matches resource consumption directly with demand, and minimizes the overall Total Cost of Ownership (TCO).

Step-by-Step Solution

1
Analyze the workload characteristics of the retail inventory system.
The workload has a predictable baseline with short, highly variable seasonal spikes (15 days per year).
Understanding the baseline and variable patterns is necessary to determine the appropriate cloud economics strategy.
2
Evaluate the financial transition from capital expenditures to operational expenditures.
On-premises requires upfront physical server purchases (CapEx), while AWS allows pay-as-you-go consumption (OpEx).
Shifting to OpEx eliminates the risk of depreciation and underutilized capacity.
3
Apply elasticity and pricing models to optimize the Total Cost of Ownership (TCO).
AWS Auto Scaling handles peak demand dynamically, and Savings Plans reduce costs for the baseline workload.
Combining elasticity with commitment discounts maximizes cost efficiency for both constant and variable workloads.

Key Concept

Leveraging elasticity and demand-driven scaling to transition from fixed capital expenditures (CapEx) to variable operating expenditures (OpEx), reducing the Total Cost of Ownership (TCO).
Question 63Question →

A software-as-a-service (SaaS) provider is preparing for an ISO 27001 certification audit of its order management application. To satisfy the auditors, the company must verify that the underlying AWS physical infrastructure is certified and identify which specific AWS services in their deployment are covered under this compliance standard. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Access AWS Artifact to retrieve the AWS ISO 27001 compliance report.; Refer to the AWS Services in Scope by Compliance Program documentation.

Answer

The company should access AWS Artifact to retrieve the AWS ISO 27001 compliance report and refer to the AWS Services in Scope by Compliance Program documentation to confirm which services are certified.
The correct options involve retrieving compliance documents from AWS Artifact and checking service certification scope. AWS Artifact is the self-service portal for AWS compliance reports, such as ISO 27001 certificates. Since not all AWS services are in scope for every standard, verifying the service-specific compliance status via the AWS Services in Scope documentation is required to confirm that the architecture meets audit criteria.

Step-by-Step Solution

1
Obtain physical infrastructure compliance reports.
Access the AWS Artifact console and download the ISO 27001 certification report, which serves as the official compliance documentation for AWS data centers.
AWS is responsible for physical security and provides third-party audit reports to customers for compliance verification.
2
Verify service-specific compliance scope.
Check the AWS Services in Scope by Compliance Program online documentation to confirm that the specific services used in the application are certified.
Not all AWS services are immediately covered under every compliance standard, so verifying in-scope services is a necessary audit step.

Key Concept

AWS Compliance and Governance via AWS Artifact and Services in Scope documentation
Question 64Question →

A logistics enterprise is migrating its legacy supply chain optimization tool to AWS. The application requires massive computing power for 33 hours every Sunday night to calculate optimal delivery routes, but remains completely idle for the rest of the week. Under their traditional on-premises model, the company had to purchase and maintain high-end physical servers that sat underutilized for 98%98\% of the week. Which of the following describes the financial transformation and the specific AWS Cloud benefit this migration achieves?

Show answer & explanation

Answer: Trading capital expense for variable expense, allowing the enterprise to pay only for the compute resources consumed during the active window rather than investing in upfront server hardware.

Answer

Trading capital expense for variable expense, allowing the enterprise to pay only for the compute resources consumed during the active window rather than investing in upfront server hardware.
The correct option correctly identifies the transition from capital expense (buying physical servers) to variable expense (paying only for the 33 hours of usage). This matches the definition of the AWS Cloud benefit: 'trade capital expense for variable expense'.

Step-by-Step Solution

1
Analyze the financial and operational pain points of the legacy supply chain application in the scenario.
The application runs for only 33 hours a week but required purchasing physical servers that remain idle for 98%98\% of the time.
This establishes the current baseline of high capital expenditure (CapEx) and low resource utilization.
2
Map the transition from purchasing hardware upfront to paying based on usage to the appropriate AWS Cloud benefit.
Paying only for resources when they are consumed instead of investing in physical assets represents 'trading capital expense for variable expense'.
This is a core cloud economics concept that shifts costs from CapEx to OpEx.
3
Evaluate the choices to find the one that accurately describes this economic benefit and avoids common misconceptions.
The correct option outlines trading capital expense for variable expense to pay only for consumed compute resources during the active window.
This option correctly matches the scenario's shift from fixed hardware investments to pay-as-you-go consumption.

Key Concept

Trading capital expense for variable expense is a key AWS Cloud benefit where users pay only for consumed computing resources on a utility basis instead of making heavy upfront investments in physical infrastructure.
Estimated Time:2m 0s
Question 65Question →

A global retail company is preparing for an annual PCI-DSS audit of its payment processing workload hosted on AWS. The compliance team needs to gather official documentation proving the physical security compliance of AWS data centers and establish a workflow to continuously audit and evaluate AWS resource configurations against regulatory standards. Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Download the AWS PCI-DSS compliance package and related security reports from AWS Artifact.; Use AWS Config to continuously record and evaluate resource configuration changes against compliance guidelines.

Answer

Retrieve the compliance documents from AWS Artifact, and use AWS Config to record and evaluate resource configuration compliance.
The correct options are downloading compliance documents from AWS Artifact and utilizing AWS Config for resource evaluation. AWS Artifact serves as the direct portal for retrieving official AWS audit reports (such as PCI-DSS packages) to verify the security of the AWS infrastructure. AWS Config provides the mechanism to continuously monitor, record, and evaluate resource configurations to ensure they align with compliance guidelines.

Step-by-Step Solution

1
Determine the resource responsible for providing AWS's third-party compliance reports and agreements.
Identify AWS Artifact as the self-service portal to download reports like SOC and PCI-DSS compliance packages.
AWS Artifact provides on-demand access to AWS compliance documentation to satisfy external audit requirements.
2
Determine the service designed to continuously audit, record, and evaluate resource configurations against compliance rules.
Select AWS Config as the configuration management and compliance auditing tool.
AWS Config tracks configuration history and evaluates changes against predefined rules to ensure governance.

Key Concept

Compliance and Governance
Question 66Question →

A financial company is redesigning its monolithic on-premises transactional application to run on the AWS Cloud. The development team wants to apply core AWS cloud design principles to improve the application's agility, reduce management overhead, and ensure high availability. Which of the following architectural choices directly implement AWS Cloud design principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying the application servers across multiple Availability Zones behind an Application Load Balancer to ensure the system remains operational if a zone fails.; Defining the infrastructure using AWS CloudFormation templates to easily deploy and terminate temporary environments for testing.

Answer

The correct choices are deploying the application servers across multiple Availability Zones behind an Application Load Balancer, and defining the infrastructure using AWS CloudFormation templates to deploy and terminate temporary environments.
Deploying the application servers across multiple Availability Zones behind an Application Load Balancer directly aligns with the 'design for failure' principle, as it prevents localized outages from bringing down the application. Defining the infrastructure as code using AWS CloudFormation templates implements the 'disposable resources' principle, enabling the team to easily spin up temporary testing environments and tear them down, thereby increasing operational agility.

Step-by-Step Solution

1
Analyze the requirement for improving high availability and reducing management overhead.
Deploying the application across multiple Availability Zones directly addresses high availability by eliminating a single point of failure (implementing 'design for failure').
AWS Infrastructure is designed around Availability Zones to isolate faults, and deploying across multiple zones protects against data center outages.
2
Analyze the requirement for improving agility and managing environments.
Defining the infrastructure as code with AWS CloudFormation templates allows the team to spin up and tear down testing environments on demand (implementing 'disposable resources').
In the cloud, resources are temporary and should be treated as disposable assets to optimize costs and deployment speed.
3
Evaluate and eliminate incorrect options based on cloud design anti-patterns.
Eliminated options involving a single large EC2 instance (monolith/single point of failure), fixed-capacity manual scaling (lack of elasticity), and customer guest OS patching (shared responsibility model mapping error).
These options represent common anti-patterns or misunderstandings of cloud concepts.

Key Concept

AWS Cloud Design Principles (Design for Failure and Disposable Resources)
Question 67Question →

A logistics company is migrating its tracking application to AWS and needs to set up a comprehensive monitoring and auditing solution. The company wants to track all administrative actions and API modifications made to their AWS resources for compliance auditing. Additionally, they need to collect system-level metrics, such as CPU utilization from their Amazon EC2 instances, and automatically send alerts if thresholds are exceeded.

Which of the following AWS services should the company configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail to audit and record all API calls, user activity, and resource modifications; Amazon CloudWatch to collect metrics, monitor resource performance, and trigger alarms based on thresholds

Answer

AWS CloudTrail and Amazon CloudWatch are the correct services to configure.
AWS CloudTrail tracks and logs user activity and API transactions to provide a complete history of actions for compliance. Amazon CloudWatch collects and monitors real-time performance metrics (like CPU utilization) and sends alerts when pre-defined resource thresholds are breached.

Step-by-Step Solution

1
Identify the service required to track administrative actions and API modifications for auditing.
AWS CloudTrail logs all API actions and management events.
This satisfies the requirement to maintain a record of all modifications and user actions for compliance.
2
Identify the service required to monitor performance metrics like CPU utilization and trigger alarms.
Amazon CloudWatch collects system-level metrics and manages alarms.
This satisfies the operational monitoring and alerting requirements.

Key Concept

AWS CloudTrail logs API calls and management events for compliance auditing, while Amazon CloudWatch monitors resource performance metrics and triggers operational alarms.
Question 68Question →

A financial technology company is preparing for a security audit and must establish robust auditing and monitoring controls. The company needs to maintain a complete history of all API calls made within their AWS environment for compliance verification. Additionally, the security team needs to receive immediate notifications if any unauthorized modifications are made to network security configurations, such as security group rules.

Which of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS CloudTrail to capture and log API calls, storing them in a secure Amazon S3 bucket for compliance auditing.; Create Amazon CloudWatch metric filters and alarms to notify security administrators in real-time when specific unauthorized API patterns occur in the logs.

Answer

Enable AWS CloudTrail to capture API calls for compliance auditing, and create Amazon CloudWatch metric filters and alarms for real-time notifications.
To satisfy both requirements, the company must use AWS CloudTrail to record a complete log of all API operations (like creating or modifying resources) and deliver them to S3. They must also use Amazon CloudWatch Logs to collect the logs, create metric filters for unauthorized patterns (e.g., security group updates), and configure CloudWatch Alarms to send real-time alerts.

Step-by-Step Solution

1
Identify the service responsible for auditing API requests and user activity.
AWS CloudTrail is identified as the service that records API activity and stores the history in an Amazon S3 bucket.
CloudTrail provides operational and risk auditing, governance, and compliance of your AWS account.
2
Identify the service responsible for monitoring metrics and setting up real-time alarms.
Amazon CloudWatch is identified as the service that can monitor logs, define metric filters, and configure alarms.
CloudWatch is used for monitoring resource utilization, log files, and triggering actions or alerts based on metrics.
3
Eliminate options that misrepresent the AWS Shared Responsibility Model or confuse services.
Options recommending Amazon Inspector for log analysis or requesting AWS-managed physical logs are eliminated.
Under the Shared Responsibility Model, physical infrastructure logs are AWS's responsibility and are not shared. Vulnerability scanning is distinct from active threat monitoring and log analysis.

Key Concept

AWS CloudTrail provides API auditing and activity logging, while Amazon CloudWatch provides performance metrics, log monitoring, and real-time alarms.
Question 69Question →

A startup is building a microservices-based financial news application. They run their staging and test environments using automated scripts that create exact copies of production on demand, and then terminate these environments when testing is complete. Additionally, they use Amazon Simple Queue Service (Amazon SQS) to pass messages between their front-end web server and the backend stock analysis engine to ensure that components can scale and fail independently.

Which of the following AWS Cloud design principles are illustrated by these practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Loose coupling; Disposable resources

Answer

Loose coupling and Disposable resources are the design principles demonstrated in this scenario.
The system demonstrates loose coupling by using Amazon SQS to buffer and decouple interactions between the front-end and the backend, letting them run independently. It also demonstrates disposable resources by using automated scripts to create and destroy temporary staging and testing environments on demand.

Step-by-Step Solution

1
Analyze the usage of Amazon SQS in the scenario.
SQS acts as a message buffer between the web tier and the analysis engine.
By using a queue, the front-end web server does not need to know details about the backend processing tier, enabling both components to fail or scale independently, demonstrating loose coupling.
2
Analyze the environment management strategy.
Staging and testing environments are automatically created on demand and destroyed afterward.
This exemplifies using disposable resources, where server instances and environments are treated as temporary assets rather than fixed, permanent infrastructure.

Key Concept

Identifying design principles of the AWS Cloud, specifically loose coupling and disposable resources.
Question 70Question →

A healthcare provider plans to migrate its legacy IT infrastructure to the AWS Cloud. The migration team has identified two key workloads for the first phase:
1. An on-premises payroll application that is highly customized and expensive to maintain. The provider decides to decommission it and purchase a modern software-as-a-service (SaaS) payroll solution from a third-party vendor on AWS Marketplace.
2. A patient records database running on a self-managed server. The provider wants to migrate this database to Amazon Relational Database Service (Amazon RDS) to reduce administrative overhead, without making any modifications to the database schema or application code.

Which two of the following migration strategies represent the correct approach for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Repurchasing for the payroll application; Replatforming for the patient records database

Answer

The correct migration strategies are repurchasing for the payroll application and replatforming for the patient records database.
Repurchasing is the correct strategy for the payroll application because it involves replacing the legacy system with a commercial SaaS product or package. Replatforming is the correct strategy for the patient records database because the workload is moved to a managed cloud service (Amazon RDS) to achieve operational optimizations without changing the database schema or application architecture.

Step-by-Step Solution

1
Analyze the migration plan for the payroll application.
The application is decommissioned and replaced with a third-party SaaS solution on AWS Marketplace.
This 'drop-and-shop' approach represents the Repurchasing strategy.
2
Analyze the migration plan for the patient records database.
The database is moved to a fully managed database service (Amazon RDS) to reduce operational overhead without changing schema or code.
This optimization ('tinkering') while keeping the core architecture intact represents the Replatforming strategy.

Key Concept

Selecting migration strategies (6 Rs) based on workload requirements and modernization goals.
Estimated Time:1m 30s
Question 71Question →

A retail company is preparing its web application for a major seasonal sales event. To ensure the application remains highly resilient and cost-effective during traffic fluctuations, the IT team wants to follow AWS Cloud architectural design principles. Which of the following options represent key AWS Cloud design principles that should be applied to this workload? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Build independent components that communicate via message queues or APIs to isolate failures.; Scale resource capacity automatically in response to real-time changes in consumer demand.

Answer

Building independent components that communicate via message queues or APIs, and scaling resource capacity automatically in response to real-time changes in consumer demand.
The correct options are building independent components that communicate via message queues or APIs, and scaling resource capacity automatically. These represent the principles of loose coupling and elasticity. Loose coupling isolates component failures so they do not cascade, while elasticity allows the infrastructure to scale dynamically to meet demand, ensuring both reliability and cost-efficiency.

Step-by-Step Solution

1
Analyze the requirements of the retail company's scenario, focusing on resilience and cost-effectiveness during a high-traffic seasonal event.
The architecture must be able to handle variable demand dynamically and prevent a single component's failure from disrupting the entire application.
This establishes that the system requires mechanisms for scaling dynamically and decoupling dependencies.
2
Evaluate the choices to identify which options represent standard AWS Cloud design principles that address these needs.
Building independent components that communicate via APIs or queues (loose coupling) and scaling automatically (elasticity) are selected as correct. Other options describing tight coupling, static sizing, and single monolithic instances are identified as anti-patterns.
To determine the correct architectural principles that match the scenario requirements.

Key Concept

Identify design principles of the AWS Cloud
Estimated Time:1m 0s
Question 72Question →

A healthcare technology company needs to expand its services to international markets. Previously, provisioning new infrastructure in physical colocation facilities took several weeks. By migrating to AWS, the company can now deploy its telehealth application to patients globally in a matter of minutes and spin up new testing environments in seconds to accelerate software release cycles.

Which two benefits of the AWS Cloud does this scenario directly illustrate? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes; Increase speed and agility

Answer

Go global in minutes and Increase speed and agility
The correct options are the benefits that refer to global deployment and agility. Deploying to patients globally in a matter of minutes directly illustrates the ability to go global in minutes, utilizing AWS's global infrastructure. Spinning up testing environments in seconds to accelerate release cycles illustrates the increase in speed and agility by reducing the time required to provision resource environments for developer experimentation.

Step-by-Step Solution

1
Analyze the business scenario and identify key infrastructure activities.
The scenario highlights deploying applications to international patients in minutes and spinning up testing environments in seconds.
This helps map the specific activities to the standard six benefits of the AWS Cloud.
2
Map the rapid global deployment activity to the corresponding AWS Cloud benefit.
Deploying internationally in minutes corresponds to the 'Go global in minutes' benefit.
AWS infrastructure allows developers to deploy applications in multiple regions around the world with just a few clicks.
3
Map the instant environment creation activity to the corresponding AWS Cloud benefit.
Spinning up new testing environments in seconds corresponds to 'Increase speed and agility'.
In a cloud environment, new resources are just a click away, dramatically reducing the time it takes to make those resources available to developers.

Key Concept

Benefits of the AWS Cloud
Estimated Time:1m 30s
Question 73Question →

A financial technology startup is setting up its AWS environment. An application running on Amazon ECS tasks needs to retrieve records from an Amazon DynamoDB table, while an external compliance auditor requires weekly console access to inspect security configurations without modifying any resources. Which TWO of the following identity and access management actions should the startup implement to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with the necessary DynamoDB read permissions and associate it with the Amazon ECS task definition.; Create a dedicated IAM user for the external auditor, require Multi-Factor Authentication (MFA), and attach a policy allowing read-only access to security settings.

Answer

The startup should configure an IAM role with DynamoDB read permissions for the ECS task definition and establish a dedicated IAM user with MFA and read-only permissions for the auditor.
The correct identity setup involves creating an IAM role for the ECS container tasks to assume temporary access credentials dynamically, and establishing a dedicated IAM user for the external auditor with a read-only policy and MFA enabled for safe administrative console access.

Step-by-Step Solution

1
Analyze the application's access requirements.
The ECS task running the application requires access to DynamoDB. Hardcoding or passing static credentials is a security risk, so an IAM role must be configured for the ECS task (task role) to provide temporary, automatically rotated security credentials.
This follows the principle of least privilege and eliminates long-term credentials for applications.
2
Analyze the auditor's access requirements.
The auditor requires access to the console to view security configurations. This is a human access requirement, which requires a dedicated IAM user or federated login, coupled with Multi-Factor Authentication (MFA) and a read-only policy.
This secures administrative/auditing endpoints and ensures individual accountability without granting write permissions.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account keys is highly discouraged. Reusing human IAM user credentials for application workloads is insecure. Asking AWS to manage IAM audit operations misinterprets the customer's responsibility under the Shared Responsibility Model.
This isolates human vs. machine identity and defines ownership of cloud security configurations.

Key Concept

The core of AWS identity security relies on isolating human identities (using IAM users/federation with MFA) and machine identities (using IAM roles for temporary credentials), whilst adhering to the Shared Responsibility Model where the customer owns resource access configuration.
Estimated Time:2m 30s
Question 74Question →

An IoT startup is redesigning its smart utility grid monitoring application. The application receives millions of periodic sensor events that must be processed, validated, and saved. The team wants to align with AWS Cloud design principles to minimize operational overhead and handle unpredictable traffic spikes without maintaining running servers. Which of the following architectural design choices align with AWS Cloud design principles to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying Amazon SQS to buffer incoming sensor data and decouple the ingestion tier from the processing tier.; Utilizing AWS Lambda to run processing logic only when events arrive, adhering to the 'services not servers' principle.

Answer

Deploying Amazon SQS to buffer incoming sensor data and decouple the ingestion tier from the processing tier, and utilizing AWS Lambda to run processing logic only when events arrive, adhering to the 'services not servers' principle.
The correct options are using Amazon SQS to buffer incoming sensor data and using AWS Lambda to run processing logic. Implementing Amazon SQS ensures that the system is loosely coupled, allowing the ingestion and processing layers to scale and fail independently. Utilizing AWS Lambda applies the 'services not servers' principle, enabling event-driven scaling without the operational overhead of provisioning or managing virtual servers.

Step-by-Step Solution

1
Analyze the business requirements for minimizing operational overhead and handling unpredictable traffic spikes without maintaining running servers.
Identified that serverless architectures ('services not servers') and asynchronous ingestion ('loose coupling') are required.
This helps match the needs to specific AWS Cloud design principles.
2
Evaluate the architectural options against AWS Cloud design principles.
Determined that Amazon SQS provides loose coupling and AWS Lambda provides a serverless execution environment, while the other options represent anti-patterns like tight coupling and lack of elasticity.
To select the two correct options that align with the AWS Well-Architected framework.

Key Concept

AWS Cloud design principles focus on building scalable, resilient, and efficient systems. Key principles include loose coupling, which reduces interdependencies between components, and 'services not servers', which leverages managed services to reduce operational overhead.
Question 75Question →

TerraGrow Agriculture is planning to migrate its legacy on-premises applications to the AWS Cloud. The company has identified two specific workloads for the first phase:

1. A proprietary crop-yield analysis application that must be moved immediately to AWS with absolutely no modifications to its code or configuration.
2. An on-premises legacy customer relationship management (CRM) database that will be decommissioned and replaced with a modern cloud-based Software-as-a-Service (SaaS) platform.

Which two AWS migration strategies should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehosting; Repurchasing

Answer

Rehosting and Repurchasing
Rehosting and Repurchasing are the correct strategies. Rehosting, often called 'lift-and-shift', moves workloads to AWS without modifying code or configuration, aligning with the crop-yield application requirement. Repurchasing, or 'drop-and-shop', replaces legacy systems with new cloud-native Software-as-a-Service (SaaS) products, matching the CRM replacement requirement.

Step-by-Step Solution

1
Analyze the migration requirements for the first workload (crop-yield analysis application).
The application must be moved quickly with zero changes to code or configuration, which maps to Rehosting (lift-and-shift).
Rehosting involves copying existing servers to AWS without modifications.
2
Analyze the migration requirements for the second workload (legacy CRM database).
The CRM database is being retired in favor of a new SaaS solution, which maps to Repurchasing (drop-and-shop).
Repurchasing involves adopting a different product, typically cloud-hosted SaaS, to replace a legacy system.

Key Concept

AWS Cloud migration strategies (6 Rs)
Estimated Time:1m 30s
Question 76Question →

A healthcare provider plans to store patient medical records in Amazon Simple Storage Service (Amazon S3) and must encrypt the data at rest to comply with regulatory standards. The provider wants to control their own encryption keys but wishes to avoid the operational overhead of provisioning, configuring, and maintaining dedicated, single-tenant hardware. Which solution and division of responsibility meets these requirements?

Show answer & explanation

Answer: Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.

Answer

Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.
The correct option correctly identifies that using AWS Key Management Service (KMS) with customer managed keys satisfies the requirements. AWS KMS is a multi-tenant service where AWS manages the hardware, provisioning, patching, and physical security, minimizing customer operational overhead. At the same time, the customer retains control over key policies, access permissions, and key rotation. This satisfies both the need for key control and low overhead.

Step-by-Step Solution

1
Analyze the business requirements to determine key management needs.
The scenario requires data encryption at rest under customer control, but explicitly specifies avoiding the operational overhead of dedicated single-tenant hardware.
This rules out AWS CloudHSM, which provides dedicated single-tenant HSM appliances that require significant customer administrative effort, and points to AWS Key Management Service (KMS) as the appropriate service.
2
Apply the AWS shared responsibility model to key management in AWS KMS.
For AWS KMS customer managed keys, the customer is responsible for logical controls such as defining key policies, key usage permissions, and scheduling rotation. AWS is responsible for the physical security, patching, scaling, and availability of the underlying multi-tenant HSM infrastructure.
This establishes the correct boundary of responsibility, identifying that physical maintenance of HSMs is always managed by AWS.

Key Concept

Shared responsibility model for data encryption at rest using AWS Key Management Service (KMS) versus AWS CloudHSM.
Question 77Question →

A retail analytics firm runs monthly batch processing jobs on self-managed physical servers. The volume of data fluctuates significantly each month, leading to frequent job failures due to under-provisioned hardware, or wasted costs from over-provisioned hardware sitting idle. Additionally, the development team has to wait several weeks for the procurement and setup of new hardware whenever they want to test new analytics algorithms.

The firm decides to migrate these workloads to AWS, enabling them to launch test environments in minutes and automatically scale resources to match the workload demand.

Which of the following benefits of the AWS Cloud are directly demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Increase speed and agility; Stop guessing capacity

Answer

The correct benefits are 'Increase speed and agility' and 'Stop guessing capacity'.
The correct answers are the benefits 'Increase speed and agility' and 'Stop guessing capacity'. The ability to provision resources in minutes rather than waiting weeks for hardware procurement directly represents increased speed and agility. Furthermore, automatically scaling resources to match the exact workload demand instead of under-provisioning or over-provisioning demonstrates the benefit of stopping guessing capacity.

Step-by-Step Solution

1
Analyze the business challenges in the scenario.
The firm struggles with waiting weeks for hardware procurement to test new algorithms, and either under-provisioning (causing failures) or over-provisioning (idle hardware costs).
Understanding the initial problems helps map them to the corresponding AWS Cloud benefits.
2
Map the migration outcomes to the defined benefits of the AWS Cloud.
Launching test environments in minutes maps to 'Increase speed and agility'. Dynamically adjusting resources to match the workload demand maps to 'Stop guessing capacity'.
These outcomes directly resolve the key pain points described in the scenario.

Key Concept

Benefits of the AWS Cloud
Question 78Question →

AeroParts Manufacturing is planning to migrate its on-premises workloads to the AWS Cloud:

* Workload 1: A proprietary inventory forecasting application that runs on a self-managed database. The company wants to move the database to Amazon Relational Database Service (Amazon RDS) to reduce administrative overhead, without changing the application's core code.
* Workload 2: A legacy human resources (HR) application that has high maintenance costs. The company has decided to discard the legacy system and purchase a license for a cloud-based Software-as-a-Service (SaaS) HR platform.

Which migration strategies represent the correct approaches for Workload 1 and Workload 2? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Replatforming for Workload 1; Repurchasing for Workload 2

Answer

Replatforming for Workload 1 and Repurchasing for Workload 2 are the correct migration strategies.
The correct strategies are Replatforming for Workload 1 and Repurchasing for Workload 2. Replatforming involves making slight optimizations to take advantage of cloud platforms, such as migrating a self-managed database to Amazon RDS, without modifying the application's core code. Repurchasing involves transitioning to a different product, typically a Software-as-a-Service (SaaS) model, which matches the action of replacing the legacy HR application with a licensed SaaS platform.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 involves moving a self-managed database to Amazon RDS (a managed service) without altering the application's core code.
This type of optimization, where minor platform changes are made to leverage cloud benefits without re-architecting, is known as Replatforming.
2
Analyze the requirements for Workload 2.
Workload 2 involves discarding a legacy HR system and moving to a cloud-based SaaS provider.
Replacing a custom or legacy system with a commercially available off-the-shelf SaaS model is known as Repurchasing.

Key Concept

The 6 Rs Migration Strategies (Rehosting, Replatforming, Refactoring, Repurchasing, Retaining, Retiring) define how existing workloads are moved to the AWS Cloud.

Alternative Method

Analyze each workload option against the definitions of the 6 Rs migration strategies to eliminate strategies that do not match the business scenario.
Estimated Time:1m 30s
Question 79Question →

A biomedical research institution occasionally runs high-throughput genomic sequencing workloads that require thousands of compute instances for a few days. Once the analysis is complete, the computational resources are shut down completely. Instead of building an on-premises high-performance computing (HPC) cluster, the institution deploys these workloads on AWS.

Which of the following benefits of the AWS Cloud are directly demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity, as the institution can provision resources dynamically to match workload demands and shut them down when idle.; Increase speed and agility, as researchers can spin up resources in minutes rather than waiting weeks for IT infrastructure procurement.

Answer

The correct answers are the benefits of stopping guessing capacity and increasing speed and agility.
The scenario demonstrates two distinct AWS benefits: 'Stop guessing capacity' and 'Increase speed and agility'. By provisioning instances only when needed and terminating them when the workload is complete, the institution avoids guessing what size HPC cluster they must build. Furthermore, the ability to deploy thousands of instances in minutes rather than spending months procuring physical servers demonstrates speed and agility.

Step-by-Step Solution

1
Analyze the workload characteristics in the scenario.
The sequencing workloads are sporadic and massive, requiring thousands of instances for only a few days and zero resources when idle.
Understanding the usage pattern helps identify which AWS benefits map to these business needs.
2
Evaluate the AWS Cloud benefits against the workload requirements.
Spinning up resources quickly when needed maps to 'Increase speed and agility'. Shutting down instances completely during idle periods maps to 'Stop guessing capacity'.
This matches the requirements of the workload to the defined 6 benefits of AWS Cloud computing.
3
Eliminate the incorrect options based on cloud concepts and best practices.
Shifting OpEx to CapEx, permanently over-provisioning resources, and relying on monolithic architectures contradict cloud principles.
This confirms the two correct choices by validating that the remaining choices represent architectural or financial misconceptions.

Key Concept

Benefits of the AWS Cloud
Estimated Time:1m 30s
Question 80Question →

A startup is reviewing its AWS security configuration. Currently, all developers share a single IAM user with administrator privileges to manage resources, and an application running on Amazon EC2 instances uses hardcoded access keys to write data to an Amazon S3 bucket. Which of the following actions should the security team take to align with AWS security best practices? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Create individual IAM users for each developer and place them in an IAM group with the necessary administrative policies attached.; Attach an IAM role to the EC2 instances to grant the application temporary access to the S3 bucket instead of using hardcoded credentials.

Answer

Create individual IAM users for each developer and place them in an IAM group with the necessary administrative policies attached, and attach an IAM role to the EC2 instances to grant the application temporary access to the S3 bucket instead of using hardcoded credentials.
Creating individual IAM users and placing them in groups ensures that each developer has unique credentials and accountability for their actions. Attaching an IAM role to the EC2 instances allows the application to assume temporary credentials, which eliminates the security risk of storing long-term access keys inside the application code.

Step-by-Step Solution

1
Analyze the developer access setup and identify security risks.
The current setup uses a shared IAM user, which prevents individual accountability and violates identity management best practices.
Establishing individual IAM users grouped by job function is the recommended method to manage user identities and track actions.
2
Analyze the application access setup and identify security risks.
The application uses hardcoded access keys, which can be compromised if code is exposed.
AWS recommends using IAM roles to assign temporary credentials to applications running on AWS compute services like EC2.

Key Concept

AWS IAM Best Practices including individual users, groups, and temporary credentials via IAM roles.
PreviousPage 4 / 74Next