All practice questions

1473 questions

Question 821Question

A developer is writing a Node.js application that needs to retrieve files from an Amazon Simple Storage Service (Amazon S3) bucket. To implement this, the developer wants to make API calls to S3 directly from within the application code using native JavaScript libraries. Which AWS tool is designed to provide this language-specific programmatic interface?

Show answer & explanation

Answer: AWS Software Development Kit (SDK)

Answer

AWS Software Development Kit (SDK)
The AWS Software Development Kit (SDK) provides language-specific APIs and libraries that allow developers to interact programmatically with AWS services directly from their application code, such as using JavaScript in a Node.js project.

Step-by-Step Solution

1
Identify the core requirement of the scenario: integrating S3 retrieval programmatically inside custom Node.js application code.
Recognize that the solution must be a development library or tool designed for application integration.
This narrows down the choices from general management or provisioning tools to development-specific tools.
2
Evaluate the options against this requirement: AWS CloudFormation is for infrastructure provisioning, AWS Management Console is a manual web GUI, and AWS CLI is for running shell commands in a terminal.
Determine that none of these three tools are designed for programmatic import as a library inside application code.
Using incorrect tools leads to poor design, security risks, or implementation failure.
3
Verify the purpose of the AWS Software Development Kit (SDK).
Confirm that the AWS SDK provides the exact language-specific APIs and libraries needed for Node.js application integration.
This matches the target requirement of language-specific programmatic access.

Key Concept

Programmatic access to AWS services via language-specific SDKs
Estimated Time:45s
Question 822Question

A company has deployed applications across 50 VPCs in multiple AWS accounts and needs to implement a network architecture that allows all VPCs to communicate with each other transitively while minimizing connection complexity. Additionally, the company must implement a stateless firewall mechanism at the boundary of each subnet to restrict traffic from specific IP ranges. Which combination of AWS services and features should the company use to meet these requirements?

Show answer & explanation

Answer: AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless filtering.

Answer

AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless filtering.
The correct option combines AWS Transit Gateway and Network ACLs. AWS Transit Gateway acts as a central hub to connect VPCs transitively, which is highly scalable for a 50-VPC setup. Network ACLs operate at the subnet boundary and are stateless, meeting the requirement to block traffic from specific IP ranges without tracking connection state.

Step-by-Step Solution

1
Evaluate the requirement for interconnecting 50 VPCs transitively with minimal complexity.
AWS Transit Gateway is identified as the ideal hub-and-spoke solution, as VPC Peering is non-transitive and requires a complex full-mesh configuration of 1,225 connections.
VPC Peering does not scale efficiently for a high number of VPCs requiring transitive communication.
2
Evaluate the requirement for a stateless firewall at the subnet boundary.
Network Access Control Lists (Network ACLs) are identified as the appropriate solution because they are stateless and applied at the subnet boundary, whereas Security Groups are stateful and applied at the instance level.
Security Groups cannot perform stateless filtering at the subnet boundary.
3
Combine the chosen routing and security services to find the matching option.
The correct combination is AWS Transit Gateway and Network ACLs.
This combination satisfies both the transitive hub-and-spoke networking requirement and the subnet-level stateless security requirement.

Key Concept

AWS Transit Gateway provides transitive routing for scaling multi-VPC architectures, while Network ACLs offer stateless security filtering at the subnet boundary.
Question 823Question

A gaming company is developing a new online multiplayer game. The system architecture requires two specific capabilities: an in-memory caching layer to store active player session states with sub-millisecond response times, and a fully managed relational database to handle structured player account transaction records.

Which AWS services should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon ElastiCache; Amazon Relational Database Service (Amazon RDS)

Answer

Amazon ElastiCache and Amazon Relational Database Service (Amazon RDS)
Amazon ElastiCache is the correct selection for the caching layer because it provides a fully managed, in-memory data store with sub-millisecond response times. Amazon Relational Database Service (Amazon RDS) is the correct selection for the transaction database because it is a managed relational database service capable of structured player transaction records with full transactional support.

Step-by-Step Solution

1
Identify the caching requirement.
The requirement is an in-memory caching layer with sub-millisecond latency for session state storage, which points to Amazon ElastiCache.
Amazon ElastiCache stores data in-memory (using Redis or Memcached) to achieve sub-millisecond performance.
2
Identify the relational database requirement.
The requirement is a fully managed relational database to handle structured transactional data, which points to Amazon RDS.
Amazon RDS is a managed service for relational databases (such as PostgreSQL, MySQL, SQL Server) that provides relational capabilities and ACID compliance.

Key Concept

Selecting appropriate AWS database, caching, and storage services based on access speed and structured data requirements.
Question 824Question

An organization is evaluating hosting models for their application workloads on AWS. Match each operational requirement to the most appropriate AWS compute service.

Click a left item, then click its matching right item

Items

Deploying containerized microservices where the customer defines CPU and memory requirements, but AWS manages server provisioning, operating system patching, and scaling.
Running a legacy application that requires custom kernel modifications, direct administrative root access, and persistent state on the guest operating system.
Launching a simple developer-friendly project that needs a bundled virtual private server (VPS) package with a predictable, flat-rate monthly pricing model.
Executing short-lived, event-driven code that runs in response to database changes or file uploads, automatically scales down to zero, and incurs no idle capacity charges.

Matches

Show answer & explanation

Answer

Matching AWS Fargate for serverless containers, Amazon EC2 for full guest OS control, Amazon Lightsail for simple pre-configured virtual private servers, and AWS Lambda for event-driven functions.
AWS Fargate matches the serverless container configuration requirement. Amazon EC2 matches the legacy custom-kernel/direct-access requirement. Amazon Lightsail matches the low-cost, flat-rate, pre-configured VPS requirement. AWS Lambda matches the serverless, event-driven scale-to-zero function execution requirement.

Step-by-Step Solution

1
Analyze containerized application requirements that specify container-level resources but forbid managing host servers.
Identify AWS Fargate as the serverless compute engine for containers.
AWS Fargate abstracts server management, allowing users to define container specifications while AWS handles the scaling and patching of the underlying instances.
2
Examine requirements for administrative access, custom kernel configuration, and direct OS control.
Identify Amazon EC2 as the correct service.
Amazon EC2 provides virtual machines with full administrative control, allowing users to choose the OS and modify the kernel.
3
Determine which service provides pre-configured VPS resources under a simple, flat pricing tier.
Identify Amazon Lightsail.
Amazon Lightsail bundles compute, storage, and networking features into a single, predictable monthly fee, making it ideal for simple applications.
4
Identify the event-driven compute model that scales to zero and has zero idle charges.
Identify AWS Lambda.
AWS Lambda executes code only when triggered by events, dynamically scaling based on incoming requests and charging only for active runtime.

Key Concept

Selecting AWS compute services based on operational responsibility, degree of control, and infrastructure architecture.
Question 825Question

A company wants to allow its corporate employees to log in to the AWS Management Console using their existing Active Directory credentials. The security team wants to avoid the administrative overhead of creating and managing individual IAM users for each employee. Which of the following is the AWS-recommended approach to grant this access?

Show answer & explanation

Answer: Configure identity federation to grant employees temporary security credentials by assuming an IAM role.

Answer

Configure identity federation to grant employees temporary security credentials by assuming an IAM role.
Identity federation enables external users to access AWS resources securely using their existing corporate credentials. Instead of creating individual IAM users, the identity provider authenticates the users, and AWS maps their identity to an IAM role. The role provides them with temporary security credentials to access the AWS Management Console.

Step-by-Step Solution

1
Identify the requirement for using existing Active Directory credentials without creating individual IAM users in the AWS account.
The requirement points to identity federation, which maps external identities to AWS resources.
Identity federation eliminates the administrative overhead of managing separate credentials in AWS.
2
Select the secure mechanism to delegate permissions to these federated identities.
IAM roles are used to delegate temporary security credentials to trusted external entities.
Using roles ensures that external users do not require permanent IAM user credentials to access AWS resources.

Key Concept

Identity federation and IAM roles for external user access
Estimated Time:1m 0s
Question 826Question

An organization is designing a highly resilient architecture on AWS to comply with strict national data privacy regulations. The workload must remain operational even in the event of a complete data center cluster outage within a geographic territory, and customer data must never leave the country's regulatory boundaries. Which of the following architectural rules describe how AWS Global Infrastructure supports these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS does not replicate customer data outside of the specifically selected AWS Region unless the customer explicitly configures and authorizes cross-region replication.; Each Availability Zone within an AWS Region is physically isolated, contains independent power and cooling infrastructure, and is connected to other zones via high-speed, low-latency private networking.

Answer

AWS does not replicate customer data outside of the selected Region unless configured by the customer, and Availability Zones are physically isolated with independent power and cooling, connected via low-latency private networks.
The correct architectural rules are that AWS does not replicate customer data outside the selected Region without customer configuration, ensuring data sovereignty, and that Availability Zones are physically isolated with independent power/cooling, connected by low-latency private networks for high availability. These design features allow organizations to design for high availability within a single country's regulatory boundaries.

Step-by-Step Solution

1
Analyze the requirement for data residency/sovereignty within a country's boundaries.
Identify that AWS Regions map to geographic countries or territories, and AWS guarantees that customer data remains strictly within the selected Region unless cross-region replication is explicitly configured by the customer.
This establishes that selecting a single Region in the target country guarantees compliance with data residency laws.
2
Analyze the requirement for resilience against a complete data center cluster outage.
Identify that Availability Zones are physically isolated locations containing one or more data centers, with independent power, cooling, and network infrastructure, connected by low-latency private links.
Deploying resources across multiple Availability Zones in a single Region provides high availability and fault isolation within the regulatory boundaries.
3
Evaluate the options to match these architectural principles.
Select the option specifying that AWS does not automatically replicate data outside the selected Region, and the option describing the physical isolation and private low-latency connections of Availability Zones.
This combination directly fulfills both the compliance/residency and resilience requirements.

Key Concept

AWS Region and Availability Zone architecture, isolation, and data residency characteristics.
Estimated Time:2m 0s
Question 827Question

A digital marketing agency needs to deploy two new workloads on AWS:
1. A simple promotional website that requires a pre-configured web server, database, and domain management, all under a predictable monthly pricing plan.
2. A short-lived, event-driven microservice that runs code in response to user contact form submissions, executing for less than five seconds.

Which TWO AWS compute services should the agency select to host these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Lightsail; AWS Lambda

Answer

Amazon Lightsail and AWS Lambda
Amazon Lightsail is the best choice for the first workload because it provides pre-configured templates for popular web applications and databases with a simple, predictable monthly pricing plan. AWS Lambda is the ideal fit for the second workload because it is a serverless service that executes code on demand for short-lived events, scaling automatically without needing server management.

Step-by-Step Solution

1
Analyze the requirements of the first workload: a basic website requiring a pre-configured stack (web server, database) and a predictable, simple monthly cost.
Amazon Lightsail is designed specifically for this use case, providing a simplified console, bundled resources, and predictable pricing.
Choosing Amazon Lightsail satisfies the first requirement efficiently without administrative overhead or variable billing concerns.
2
Analyze the requirements of the second workload: an event-driven, short-lived task running for less than 5 seconds in response to uploads.
AWS Lambda is a serverless compute service that runs code only when triggered by events and charges only for execution time.
Choosing AWS Lambda avoids provisioning a continuous server for sporadic, short-lived tasks, minimizing costs.

Key Concept

Selecting appropriate AWS compute services based on workload characteristics such as administrative effort, event-driven nature, and cost predictability.
Estimated Time:1m 30s
Question 828Question

A digital publishing platform requires a database solution to store millions of unstructured user preferences and reading histories. This system needs a flexible schema and must deliver single-digit millisecond latency at scale. Additionally, the platform needs to run complex, resource-intensive daily SQL analytical reports on terabytes of historical reader interaction logs without degrading the performance of the live platform. Which TWO database services should be selected to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon DynamoDB to store the unstructured user preferences and reading histories with low latency; Amazon Redshift to run complex analytical queries over large historical datasets

Answer

The correct database services are Amazon DynamoDB for unstructured, low-latency preferences, and Amazon Redshift for aggregate historical analysis.
Amazon DynamoDB is a fully managed NoSQL key-value database designed to store unstructured user preferences with flexible schemas and provide single-digit millisecond response times at scale. Amazon Redshift is a managed data warehouse optimized for complex SQL queries over massive historical datasets, allowing resource-heavy analysis to run in isolation without impacting live user operations.

Step-by-Step Solution

1
Analyze the operational data storage requirements.
The application needs to store unstructured user preferences with flexible schemas and single-digit millisecond response times. This points directly to Amazon DynamoDB, which is optimized for high-throughput, low-latency NoSQL data.
Choosing the correct transactional storage tier reduces overhead and ensures performance.
2
Analyze the analytical data reporting requirements.
The system requires complex daily SQL reports on historical reader behavior across terabytes of logs. This points directly to Amazon Redshift, a column-oriented OLAP data warehouse that isolates analytical workloads from primary transactions.
Isolating operational and analytical databases ensures that analytics do not saturate production resources.
3
Evaluate the distractors based on the Shared Responsibility Model and architectural design principles.
Amazon RDS for PostgreSQL is relational and unsuitable for unstructured data with strict low-latency requirements. Consolidating the workloads in Amazon Aurora violates decoupling principles. Using self-managed databases on Amazon EC2 incorrectly assumes AWS manages OS and database updates.
Validating compliance against AWS best practices eliminates incorrect database patterns.

Key Concept

Selecting and combining purpose-built AWS database services to decouple transactional and analytical workloads, matching schema patterns and low-latency performance requirements.
Estimated Time:2m 0s
Question 829Question

A company is selecting compute services for various workloads. Match each business workload requirement with the AWS compute service that is most appropriate.

Click a left item, then click its matching right item

Items

Amazon EC2
AWS Lambda
Amazon Lightsail
AWS Fargate

Matches

Show answer & explanation

Answer

The correct matches pair Amazon EC2 with legacy applications requiring OS administrative access, AWS Lambda with short event-driven code execution, Amazon Lightsail with simple websites under predictable pricing, and AWS Fargate with serverless container deployment.
Each compute service on AWS is optimized for specific levels of control, scale, and simplicity. Amazon EC2 matches full administrative OS access; AWS Lambda matches short-lived, event-driven functions; Amazon Lightsail matches pre-configured software with predictable monthly pricing; and AWS Fargate matches containerized applications run without provisioning underlying EC2 instances.

Step-by-Step Solution

1
Evaluate the infrastructure management requirements of each workload (e.g., control over the OS, serverless execution, containerization, or simple pre-configured setups).
Identify that full root/OS access requires Amazon EC2, serverless execution of short-lived code requires AWS Lambda, simple pre-configured websites map to Amazon Lightsail, and serverless containers require AWS Fargate.
This establishes the fundamental alignment between the AWS compute service types and the business constraints.
2
Verify each service alignment against the AWS Shared Responsibility Model and operational model to ensure accuracy.
Confirm that Amazon EC2 provides maximum control, AWS Lambda is event-driven serverless, Amazon Lightsail is simplified VPS, and AWS Fargate is container-focused serverless.
Ensures no incorrect pairings are made based on minor service overlaps.

Key Concept

AWS Compute Services Selection
Estimated Time:1m 30s
Question 830Question

A logistics company is migrating its traditional web application to AWS. The application relies on a relational database schema that requires complex SQL queries and table joins. To minimize management effort, the company wants AWS to handle database setup, operating system patching, and automated backups, while maintaining standard MySQL compatibility. Which AWS database option meets these requirements?

Show answer & explanation

Answer: Amazon RDS for MySQL

Answer

Amazon RDS for MySQL
Amazon RDS is a managed service for relational databases that simplifies database administration. It automates setup, operating system patching, and database backups, while providing full compatibility with MySQL, thereby satisfying all of the company's requirements.

Step-by-Step Solution

1
Identify the data structure and querying needs.
The application requires a relational database schema with complex SQL queries and table joins.
This rules out non-relational options like Amazon DynamoDB, which does not support native SQL joins.
2
Determine the management overhead constraints.
The client wants automated backups, OS patching, and managed setup.
This rules out self-managing MySQL on Amazon EC2, where these operational tasks fall under the customer's responsibility.
3
Match the workload type to the appropriate database service.
A web application requires transactional processing (OLTP), not analytical processing (OLAP).
This rules out Amazon Redshift, which is optimized for data warehousing and large-scale analytics rather than high-concurrency transactional web apps.

Key Concept

Selecting the appropriate managed relational database service in AWS to balance relational query capabilities and operational management overhead.
Question 831Question

A database administrator is configuring a database on an Amazon EC2 instance. The database requires a temporary storage location for scratch space, query caching, and swap files that provides the lowest latency and highest I/O performance. The data in this location does not need to persist if the EC2 instance is stopped or terminated. Which AWS storage option meets these requirements?

Show answer & explanation

Answer: Amazon EC2 Instance Store

Answer

Amazon EC2 Instance Store
The correct answer is Amazon EC2 Instance Store because it provides block-level storage physically attached to the host computer. This direct attachment delivers the lowest latency and highest I/O performance, making it ideal for temporary scratch space, cache, and swap files. Because it is ephemeral, the data is lost when the instance is stopped or terminated, which aligns with the customer's requirement where persistence is not needed.

Step-by-Step Solution

1
Analyze the application requirements from the scenario.
Identify key requirements: block-level storage (for query caching, database scratch space, swap files), absolute lowest latency, and data persistence is not required (temporary storage).
This helps narrow down the choices by eliminating storage types that do not match these criteria.
2
Evaluate the storage options based on physical location and persistence.
Identify that instance stores are physically attached to the host, offering the lowest possible latency and temporary lifecycle (ephemeral). EBS, EFS, and S3 are network-accessible and have higher latency.
Choosing the option that matches both performance (locally attached) and lifecycle (ephemeral) requirements guarantees the most optimal design.

Key Concept

Understanding the difference between ephemeral block storage (Instance Store) and persistent network storage (EBS/EFS/S3) for EC2 instances.
Estimated Time:1m 0s
Question 832Question

A financial services firm hosts a reporting database on Amazon EC2 instances in a private subnet. A cloud practitioner needs to configure network security controls to protect the database. They must implement both a security group and a network access control list (network ACL). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The security group automatically allows outbound response traffic if the inbound request is allowed on port 33063306, because security groups are stateful.; The network ACL requires an outbound rule to allow response traffic even if the inbound request on port 33063306 is allowed, because network ACLs are stateless.

Answer

The correct answers are the statements describing that security groups automatically allow return traffic because they are stateful, and that network ACLs require an outbound rule to allow return traffic because they are stateless.
Security groups are stateful, which means they automatically allow return traffic for any established connection. Network ACLs are stateless, meaning they evaluate traffic going in and out of the subnet independently. Therefore, to support a database connection, a network ACL requires explicit rules for both inbound database request traffic and outbound return traffic, whereas a security group only requires an inbound rule.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Since security groups are stateful, allowing inbound traffic on port 33063306 automatically allows return outbound traffic.
Stateful firewalls track the connection state and allow response traffic automatically.
2
Analyze the stateless behavior of Network ACLs.
Since network ACLs are stateless, allowing inbound traffic on port 33063306 does not automatically allow return outbound traffic. An outbound rule must be explicitly created.
Stateless firewalls evaluate rules for inbound and outbound traffic independently without tracking connection states.
3
Verify subnet vs. instance level placement and responsibilities.
Security groups apply at the instance/network interface level, while network ACLs apply at the subnet level. Both are customer-configured security controls.
This confirms that the other options mischaracterize their operating boundaries or misapply the Shared Responsibility Model.

Key Concept

Stateful vs. Stateless Network Security Controls (Security Groups and Network ACLs)
Estimated Time:1m 30s
Question 833Question

A financial services startup is planning its deployment and operational strategy on AWS. The operations team has two key requirements: first, they must define and deploy the startup's entire network and server infrastructure in a repeatable, automated manner using templates; second, they need to run automated bash scripts from local administrator terminals to query resource status and stop non-production instances during off-hours. Which two AWS methods or tools should the startup use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudFormation to define and provision the infrastructure using templates; AWS Command Line Interface (CLI) to run automated bash scripts from local terminals

Answer

AWS CloudFormation to define and provision the infrastructure using templates, and AWS Command Line Interface (CLI) to run automated bash scripts from local terminals
The startup should use AWS CloudFormation to define and provision their network and server infrastructure. AWS CloudFormation allows users to deploy resources repeatably using JSON or YAML templates. For running automated bash scripts from local command-line terminals, they should use the AWS Command Line Interface (CLI), which is built to control AWS services from terminal shells.

Step-by-Step Solution

1
Analyze the first requirement to provision repeatable infrastructure using templates.
Identify AWS CloudFormation as the service designed for infrastructure as code (IaC) to model and deploy resources via templates.
AWS CloudFormation uses JSON or YAML templates to deploy and manage stacks of resources consistently.
2
Analyze the second requirement to run automated bash scripts from local administrator terminals.
Identify the AWS Command Line Interface (CLI) as the tool that enables running commands and scripts directly from a terminal shell.
The AWS CLI is designed for shell scripting and command-line management of AWS resources.

Key Concept

AWS Deployment and Operating Methods
Estimated Time:1m 30s
Question 834Question

A company is setting up a temporary data processing workload on Amazon EC2. The application requires two types of storage: a cost-effective, durable storage option to archive final reports that are rarely accessed, and a high-performance, temporary scratch space directly attached to the instance that does not need to persist after the instance is stopped.

Which two AWS storage options should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon S3 Glacier Flexible Retrieval; Amazon EC2 Instance Store

Answer

Amazon S3 Glacier Flexible Retrieval and Amazon EC2 Instance Store
Amazon S3 Glacier Flexible Retrieval provides highly durable, low-cost archiving for data that is rarely accessed, satisfying the first requirement. Amazon EC2 Instance Store provides ephemeral, high-performance block storage directly attached to the host, satisfying the second requirement for scratch space that does not need to persist beyond the lifecycle of the instance.

Step-by-Step Solution

1
Analyze the first requirement: cost-effective, durable storage to archive final reports that are rarely accessed.
Identify Amazon S3 Glacier Flexible Retrieval as the optimal service designed specifically for secure, durable, low-cost archiving of infrequently accessed data.
S3 Glacier classes are tailored for archival workloads with retrieval times ranging from minutes to hours at a fraction of standard storage costs.
2
Analyze the second requirement: high-performance, temporary scratch space directly attached to an EC2 instance that does not need to persist after instance shutdown.
Identify Amazon EC2 Instance Store as the service providing high-performance, temporary block storage that lives and dies with the host instance.
Instance store is physically attached to the host computer, offering low latency and high I/O, but is ephemeral, meaning its data is lost if the instance is stopped or terminated.

Key Concept

Selecting appropriate AWS storage classes and types (archival object storage vs. ephemeral instance block storage) based on cost, durability, and lifecycle requirements.
Question 835Question

A software development firm, DevFlow Solutions, is migrating its legacy code compilation and testing server environment to AWS. Currently, they maintain several high-performance physical servers in their office that are only utilized when developers push code, which happens sporadically throughout the day. By moving this workload to AWS and using a pay-as-you-go pricing model with on-demand resources, DevFlow Solutions changes how they account for these infrastructure costs. Which of the following best describes this economic shift?

Show answer & explanation

Answer: Trading capital expenses (CapEx) for operating expenses (OpEx), allowing the company to pay only for the compute resources they consume.

Answer

Trading capital expenses (CapEx) for operating expenses (OpEx), allowing the company to pay only for the compute resources they consume.
The correct answer is the option indicating the shift from capital expenses to operating expenses. Buying physical servers requires substantial upfront capital, which is categorized as Capital Expense (CapEx). By migrating to AWS and adopting a pay-as-you-go model, DevFlow Solutions shifts these costs to variable operating expenses (OpEx), paying only for the compute capacity utilized when developers run builds.

Step-by-Step Solution

1
Analyze the financial characteristics of the legacy environment.
DevFlow Solutions currently owns physical servers, which requires upfront payment and represents Capital Expense (CapEx).
To understand the economic shift, we must first identify the initial cost structure of on-premises hardware.
2
Analyze the cloud-based payment model described in the scenario.
The pay-as-you-go model charging only for resources consumed during sporadic usage represents Operating Expense (OpEx).
Cloud services are billed as variable utility costs, which falls under operational spending.
3
Synthesize the transition to determine the nature of the economic shift.
The shift represents trading capital expenses (CapEx) for operating expenses (OpEx) to pay only for consumed compute.
Matching the transition from upfront capital costs to variable operational costs yields the correct economic concept.

Key Concept

Trading Capital Expense for Operating Expense
Estimated Time:1m 0s
Question 836Question

A software development studio observes that the cost of their computing resources has decreased over time even though their usage has remained constant. They learn that AWS achieves lower prices by aggregating usage from hundreds of thousands of customers and passing the savings on to their users. Which benefit of the AWS Cloud does this trend illustrate?

Show answer & explanation

Answer: Benefiting from massive economies of scale

Answer

Benefiting from massive economies of scale
The correct option is 'Benefiting from massive economies of scale' because AWS can achieve lower pay-as-you-go pricing by aggregating usage from hundreds of thousands of customers. This translates into massive purchasing power, resulting in lower unit costs for hardware and operational services, which AWS passes on to its customers as price reductions.

Step-by-Step Solution

1
Analyze the business scenario to identify the core phenomenon being described.
The scenario describes a reduction in resource unit costs driven by AWS aggregating usage from hundreds of thousands of active customers.
Identifying the root cause of the cost savings allows matching it to the correct AWS Cloud benefit.
2
Compare the identified phenomenon against the definition of AWS Cloud benefits.
The ability to lower pricing due to high-volume aggregate purchasing is defined by AWS as benefiting from massive economies of scale.
This confirms which cloud benefit matches the scenario.

Key Concept

AWS Cloud economies of scale benefit
Question 837Question

A media production company has migrated its collaborative design assets from on-premises storage to Amazon FSx for Windows File Server. Under the AWS Shared Responsibility Model, which of the following operational tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring security groups to control network traffic to and from the file system.; Managing file-level and directory-level access control lists (NTFS permissions) for shared folders.

Answer

The customer is responsible for configuring security groups to control network traffic to the file system, and managing NTFS permissions for files and folders.
For managed services such as Amazon FSx for Windows File Server, AWS takes responsibility for infrastructure security (security 'of' the cloud), which includes data center physical security, hardware repairs, and operating system updates. The customer remains responsible for security configurations within the service (security 'in' the cloud), such as managing resource-level access permissions (NTFS ACLs) and implementing network access controls through security groups.

Step-by-Step Solution

1
Identify the AWS service type for Amazon FSx for Windows File Server.
It is a fully managed storage service.
Managed services shift the operational burden of infrastructure, hardware, and OS patching to AWS.
2
Differentiate between customer and AWS responsibilities for this managed service.
AWS handles physical security, hardware replication, and Windows Server OS patching. The customer retains control over network access rules and folder/file permissions.
This classification determines which tasks fall under 'security in the cloud' versus 'security of the cloud'.
3
Select the two options representing customer-managed security tasks.
Configuring security groups and managing NTFS folder permissions are identified as the customer's responsibility.
These are access control configurations executed by the customer within their virtual environment.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 30s
Question 838Question

An organization has just created a new AWS account and is planning its initial security and access control setup. The IT manager needs to secure the account access and configure day-to-day administrative privileges. Which of the following actions align with AWS security best practices for managing access in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure multi-factor authentication (MFA) on the root account and lock away its credentials, using it only for specific tasks that strictly require root privileges.; Generate distinct IAM identities for each IT administrator with administrative policies attached, ensuring they use these credentials for routine management tasks.

Answer

Configuring multi-factor authentication (MFA) on the root account and restricting its usage, along with generating distinct IAM identities for each administrator for routine operations, are the recommended security practices.
Securing the root account with MFA and locking away its credentials ensures that the highest-privileged identity in the account is protected against unauthorized access. Creating individual IAM identities for daily administrative duties provides proper tracking, logging, and access control without exposing the root account.

Step-by-Step Solution

1
Evaluate root account safety requirements.
The root account has full permissions and should be secured using multi-factor authentication (MFA), and its credentials should not be shared or used for everyday administrative tasks.
This minimizes the blast radius and reduces the risk of accidental configuration changes or unauthorized root access.
2
Determine the proper method for configuring administrative access.
Individual IAM users or identities must be created for each administrator with the necessary permissions attached for daily tasks.
This establishes individual accountability and aligns with the principle of least privilege by not relying on root credentials.

Key Concept

AWS Identity and Access Management (IAM) best practices focus on securing the root user with MFA and creating individual identities with appropriate permissions for daily operational tasks.
Question 839Question

An online retail store wants to streamline its operations on AWS. The store requires a solution that automatically deploys a web application and manages capacity provisioning, load balancing, and scaling without manual template configuration. Additionally, the development team needs to build a custom application that programmatically uploads transaction logs from their local office to Amazon Simple Storage Service (Amazon S3).

Which two AWS offerings should be selected to support these tasks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Elastic Beanstalk; AWS SDK

Answer

AWS Elastic Beanstalk and the AWS SDK
AWS Elastic Beanstalk is correct because it is a platform as a service (PaaS) that automatically handles capacity provisioning, load balancing, auto-scaling, and health monitoring for web applications without template management. The AWS SDK is correct because it allows developers to write custom code in standard programming languages to interact programmatically with AWS services like Amazon S3.

Step-by-Step Solution

1
Analyze the first requirement: deploying a web application with automated capacity, load balancing, scaling, and health monitoring, while avoiding infrastructure template management.
Identify AWS Elastic Beanstalk as the platform as a service (PaaS) solution that handles these tasks automatically, unlike AWS CloudFormation which requires templates.
Elastic Beanstalk abstractly manages the deployment details without template maintenance.
2
Analyze the second requirement: building a custom application that programmatically uploads transaction logs from an on-premises location to Amazon S3.
Identify the AWS SDK as the correct programmatic interface for writing application code to communicate with AWS resources.
The AWS SDK provides API wrappers in standard programming languages for automation.

Key Concept

AWS Deployment and Operating Methods
Estimated Time:1m 0s
Question 840Question

An IT administrator is designing a storage architecture for a corporate application on AWS. The application has two key requirements:

1. It needs a persistent block storage volume to serve as the boot drive for a single Amazon EC2 instance.
2. It needs a shared file system that can be accessed and updated simultaneously by multiple EC2 instances using the Network File System (NFS) protocol.

Which two AWS storage services should the administrator select? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic Block Store (Amazon EBS); Amazon Elastic File System (Amazon EFS)

Answer

Amazon Elastic Block Store (Amazon EBS) and Amazon Elastic File System (Amazon EFS)
Amazon Elastic Block Store (Amazon EBS) provides persistent, low-latency block storage volumes that are designed to be attached to a single EC2 instance, making it the ideal choice for an instance boot volume. Amazon Elastic File System (Amazon EFS) provides a fully managed shared file system that supports the Network File System (NFS) protocol, allowing hundreds of EC2 instances to mount and access the storage concurrently.

Step-by-Step Solution

1
Identify the storage requirement for the EC2 boot drive.
Amazon Elastic Block Store (Amazon EBS) is selected.
EC2 instances require a persistent block storage service (Amazon EBS) to serve as a durable boot drive that retains data when the instance is stopped.
2
Identify the storage requirement for the shared, multi-instance file system using the NFS protocol.
Amazon Elastic File System (Amazon EFS) is selected.
Amazon EFS is designed as a managed shared file system that supports the NFS protocol, allowing multiple EC2 instances to read and write to the same storage concurrently.

Key Concept

AWS storage services differ by their architecture (block vs. file vs. object) and access patterns (single instance vs. multi-instance concurrent access).
Estimated Time:1m 0s
PreviousPage 42 / 74Next