Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 861Question →

A system administrator wants to automate the process of stopping several Amazon EC2 instances at the end of each day by writing a shell script that runs on their local computer. Which AWS tool should the administrator install to run these administrative commands directly from the terminal?

Show answer & explanation

Answer: AWS Command Line Interface (CLI)

Answer

AWS Command Line Interface (CLI)
The AWS Command Line Interface (CLI) is the correct tool because it allows administrators to execute commands directly from their local terminal and incorporate them into shell scripts (such as bash or zsh) to automate tasks like stopping EC2 instances.

Step-by-Step Solution

1
Analyze the administrator's requirement: the need to automate a task (stopping instances) using a shell script that runs on a local computer's terminal.
Identified that the solution must support scriptable, command-based execution directly from a shell environment.
This filters out graphical user interfaces and application-level code libraries.
2
Evaluate the available AWS operating methods against the terminal-based command requirement.
The AWS Command Line Interface (CLI) is specifically designed for shell scripting and command execution. The AWS Management Console is a browser-based GUI. AWS SDKs are code libraries. AWS CloudFormation is for provisioning resources using templates.
Selecting the option that matches command-line shell scripts leads directly to the correct operating method.

Key Concept

AWS Command Line Interface (CLI) is used for automating tasks through shell scripts and executing commands directly from a terminal.
Question 862Question →

A retail company, GreenSprout Foods, plans to launch an e-commerce platform. Instead of purchasing physical servers and networking hardware upfront, the company decides to host the website on AWS, where they pay only for the resources they consume on a monthly basis. What economic term describes this transition in spending?

Show answer & explanation

Answer: Transitioning from capital expenses (CapEx) to operating expenses (OpEx)

Answer

Transitioning from capital expenses (CapEx) to operating expenses (OpEx)
The correct answer is the option describing the transition from capital expenses to operating expenses. By hosting its platform on AWS rather than building a private data center, the company avoids upfront physical hardware purchases (CapEx) and instead pays variable costs based on monthly resource usage (OpEx).

Step-by-Step Solution

1
Identify the type of expense avoided by not purchasing physical hardware upfront.
Purchasing physical servers and hardware represents a capital expense (CapEx).
CapEx involves upfront spending on physical assets that are depreciated over time.
2
Identify the type of expense incurred by paying monthly for consumed cloud resources.
Paying for ongoing cloud resource consumption represents an operating expense (OpEx).
OpEx involves day-to-day operational costs where you pay for what you use.
3
Select the option that correctly describes the direction of this economic shift.
The shift is from CapEx (upfront hardware) to OpEx (monthly consumption).
This matches the core cloud economics benefit of trading capital expense for operating expense.

Key Concept

Trading capital expenses for operating expenses allows businesses to pay for resources dynamically rather than investing heavily in physical data centers upfront.
Estimated Time:45s
Question 863Question →

A renewable energy monitoring company is planning to migrate its data analytics workloads from on-premises infrastructure to the AWS Cloud. The company wants to eliminate the upfront hardware costs of purchasing servers and reduce the overhead of managing physical server racks across multiple regions. Which two of the following AWS Cloud benefits directly address these business requirements?

Select all that apply

Show answer & explanation

Answer: Trading capital expense for variable expense; Stop spending money running and maintaining data centers

Answer

Trading capital expense for variable expense and stopping spending money running and maintaining data centers are the correct benefits.
Trading capital expense for variable expense allows the company to pay only for resources consumed rather than investing heavily in physical servers upfront. Stopping spending money running and maintaining data centers offloads physical infrastructure management, such as rack installation, power, and cooling, to AWS.

Step-by-Step Solution

1
Analyze the company's requirements.
The company wants to eliminate upfront costs for purchasing servers and reduce the operational effort of running physical data centers.
This maps the company's specific needs directly to the core business benefits of cloud computing.
2
Evaluate the AWS Cloud benefits against these requirements.
Trading capital expense for variable expense eliminates upfront server costs, while stopping spending money running and maintaining data centers removes the physical server rack overhead.
This confirms that the selected benefits align with the AWS Certified Cloud Practitioner curriculum definitions.

Key Concept

AWS Cloud Benefits (CapEx vs. OpEx and Data Center Maintenance)
Question 864Question →

AquaSmart, a water conservation utility, is preparing a business case to migrate its municipal water monitoring system from an on-premises data center to the AWS Cloud. The system currently experiences predictable baseline usage with sudden, massive spikes in telemetry data traffic during summer droughts. Which two of the following reflect the cloud economics principles that explain how this migration will reduce the utility's Total Cost of Ownership (TCO)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trading capital expenses (CapEx) for variable operating expenses (OpEx) by paying only for active cloud infrastructure instead of purchasing physical hardware upfront.; Leveraging cloud elasticity to scale resources dynamically during seasonal droughts and scale down during low-demand periods, avoiding payment for idle capacity.

Answer

The correct answers are the option stating that variable operating expenses are traded for capital expenses, and the option describing the use of elasticity to scale resources dynamically based on demand.
The correct options represent the fundamental economic benefits of the AWS Cloud. First, trading capital expenses (CapEx) for variable operating expenses (OpEx) allows organizations to pay only for resources consumed rather than investing in physical infrastructure upfront. Second, cloud elasticity enables the dynamic scaling of resources to match seasonal demand spikes, ensuring the company does not pay for idle capacity during low-usage periods.

Step-by-Step Solution

1
Identify the financial transition
Transitioning from physical server purchases to dynamic cloud pricing represents a shift from Capital Expenditures (CapEx) to Operating Expenses (OpEx).
This shows how upfront capital is saved and converted into smaller, continuous operating costs.
2
Identify the utilization strategy
Varying resources dynamically to match seasonal usage (drought spikes) represents the concept of elasticity.
Elasticity helps the utility scale down during low-use periods to stop paying for idle hardware, which is a major driver of TCO reduction.

Key Concept

Cloud Economics: CapEx to OpEx shift and Elasticity
Estimated Time:1m 30s
Question 865Question →

A startup is developing a mobile application and needs to implement user registration, sign-in, and access control. To minimize administrative overhead and avoid managing virtual servers, the development team decides to use Amazon Cognito instead of deploying and maintaining a custom authentication system on Amazon EC2. Which AWS Cloud design principle does this decision best represent?

Show answer & explanation

Answer: Services not servers

Answer

Services not servers
By utilizing Amazon Cognito, a fully managed service, the startup delegates the responsibilities of provisioning, scaling, patching, and maintaining servers to AWS. This directly aligns with the 'services not servers' design principle, which advises using managed services to reduce operational overhead.

Step-by-Step Solution

1
Analyze the scenario and identify the primary architectural goal of the development team.
The team wants to implement user authentication while avoiding the provisioning, scaling, patching, and maintenance of virtual servers (Amazon EC2).
Understanding the core business and technical driver helps map the decision to the correct AWS design principle.
2
Evaluate the AWS Cloud design principles against the choice of using Amazon Cognito instead of EC2.
Using Amazon Cognito represents opting for a fully managed service where AWS manages the underlying infrastructure. This aligns with the 'services not servers' design principle.
The principle of 'services not servers' encourages offloading infrastructure management to managed services so developers can focus on application code.

Key Concept

Services not servers (managed services)
Estimated Time:1m 0s
Question 866Question →

A fleet of Internet of Things (IoT) sensors deployed in the field needs to programmatically send temperature telemetry data directly to an Amazon DynamoDB table. The sensors run custom Python applications. Which AWS tool or interface should be embedded in the sensors' Python code to enable this programmatic data ingestion?

Show answer & explanation

Answer: AWS Software Development Kit (SDK)

Answer

AWS Software Development Kit (SDK)
The AWS Software Development Kit (SDK) is the correct choice because it provides language-specific API libraries (such as Boto3 for Python) that allow application code to interact programmatically and natively with AWS services like Amazon DynamoDB. This is the standard, secure, and most performant way to send data to AWS from custom applications.

Step-by-Step Solution

1
Analyze the access requirements of the scenario.
The IoT sensors run custom Python code and must programmatically interact with Amazon DynamoDB to ingest runtime telemetry data.
Understanding the mode of interaction (programmatic vs. manual) and the environment (code execution vs. command line) narrows down the appropriate tool.
2
Evaluate the capabilities of the available AWS interaction methods.
The AWS SDK provides APIs and libraries specifically built for programming languages like Python. The AWS Management Console is for manual graphical tasks, the AWS CLI is for command-line shell execution, and AWS CloudFormation is for infrastructure provisioning.
Comparing the primary design purpose of each tool allows selection of the one matching the programmatic requirements.
3
Select the correct option based on the evaluation.
The AWS SDK (specifically the Boto3 library for Python) is chosen as the standard method for application-level integration.
It natively implements the DynamoDB API operations directly within the Python runtime of the sensors.

Key Concept

AWS programmatic access methods and tools, specifically the AWS SDK, and how they contrast with other deployment and management tools like the CLI, Console, and CloudFormation.
Question 867Question →

A biotechnology startup uses Amazon DynamoDB to store and query gene sequencing metadata. To comply with industry security regulations, the startup must implement strict access control and verify compliance of the cloud environment. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

Show answer & explanation

Answer: Managing the identity and access management (IAM) policies that regulate access to the database tables

Answer

Managing the identity and access management (IAM) policies that regulate access to the database tables
For managed services like Amazon DynamoDB, AWS handles infrastructure, hardware, and operating system management. The customer remains responsible for data access controls, which is achieved by defining and managing identity and access management (IAM) policies.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon DynamoDB is classified as a managed platform-as-a-service (PaaS) database service.
Determining the service type helps define where the boundary lies between AWS and customer responsibilities.
2
Evaluate customer versus AWS responsibilities for Amazon DynamoDB.
AWS is responsible for physical security, infrastructure, operating system patching, and database engine maintenance. The customer is responsible for data classification, encryption settings, and identity and access management (IAM) policies.
This isolates the task that belongs to the customer under the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model, security of the database platform and infrastructure is the responsibility of AWS, while configuring data access controls (such as IAM policies) remains the responsibility of the customer.
Estimated Time:1m 30s
Question 868Question →

A company is designing the network security architecture for a new web application deployed across multiple subnets in a Virtual Private Cloud (VPC). The cloud practitioner needs to configure instance-level firewalls that automatically allow return traffic for established connections, as well as subnet-level firewalls where rules must be explicitly configured for both inbound and outbound traffic.

Which of the following AWS network security features should be configured to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups to control traffic at the instance level; Network access control lists (network ACLs) to control traffic at the subnet level

Answer

Security groups should be configured to control traffic at the instance level, and network access control lists (network ACLs) should be configured to control traffic at the subnet level.
Security groups operate at the instance level (specifically the elastic network interface) and are stateful, meaning any allowed inbound request automatically allows return outbound traffic. Network Access Control Lists (network ACLs) operate at the subnet level and are stateless, meaning rules must be explicitly defined for both inbound and outbound traffic to allow return communication.

Step-by-Step Solution

1
Analyze the requirements for instance-level security and automatically allowed return traffic.
Identify that security groups are applied at the instance level (elastic network interface) and are stateful, which automatically permits return traffic for allowed connections.
This matches the requirement for stateful, instance-level protection.
2
Analyze the requirements for subnet-level security and explicit inbound/outbound rules.
Identify that network access control lists (network ACLs) operate at the subnet level and are stateless, requiring explicit rules for both traffic directions.
This matches the requirement for stateless, subnet-level protection.

Key Concept

The difference between stateful security groups operating at the instance level and stateless network ACLs operating at the subnet level.
Estimated Time:1m 30s
Question 869Question →

A company is setting up a new website on AWS. The website requires a highly durable storage service to host public static assets, such as images and stylesheets, directly to users. Additionally, the website's host virtual machine needs a persistent block storage volume for its operating system boot drive. Which two AWS storage services should the company select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon Simple Storage Service (Amazon S3); Amazon Elastic Block Store (Amazon EBS)

Answer

Amazon Simple Storage Service (Amazon S3) and Amazon Elastic Block Store (Amazon EBS)
Amazon Simple Storage Service (Amazon S3) is the correct choice for hosting static assets because it is designed for scalable, durable object storage with direct web accessibility. Amazon Elastic Block Store (Amazon EBS) is the correct choice for the boot volume because it provides persistent, low-latency block storage that remains intact when the EC2 instance is stopped.

Step-by-Step Solution

1
Identify the requirement for hosting public static assets.
Amazon S3 is the optimal service for object storage, static website hosting, and direct web access.
It allows objects to be fetched directly via HTTP endpoints and handles high scale automatically.
2
Identify the requirement for a persistent boot drive for a virtual machine.
Amazon EBS provides persistent block storage volumes that serve as the operating system drives for EC2.
It offers low-latency block-level storage that persists independently of the lifecycle of the instance.

Key Concept

Selecting appropriate storage types based on persistency, access patterns, and protocol requirements.
Question 870Question →

A financial services company is deploying an application on AWS. The application will store credit card transactions in an Amazon S3 bucket and use Amazon RDS for MySQL to manage active customer accounts. The company's compliance policy requires all data to be encrypted at rest and encrypted in transit.

According to the AWS Shared Responsibility Model, which two of the following actions are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling server-side encryption (SSE) on the Amazon S3 bucket; Configuring SSL/TLS connections for data transmitted to the Amazon RDS database

Answer

Enabling server-side encryption (SSE) on the Amazon S3 bucket and configuring SSL/TLS connections for data transmitted to the Amazon RDS database are the responsibilities of the customer.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring data protection settings within AWS services. Enabling server-side encryption (SSE) on the Amazon S3 bucket protects data at rest, while configuring SSL/TLS connections for the Amazon RDS database protects data in transit. Both are customer-controlled configurations.

Step-by-Step Solution

1
Identify the service data protection requirements in the scenario.
The scenario requires encryption at rest for Amazon S3 and Amazon RDS, and encryption in transit for database traffic.
To classify responsibilities, we must first identify what security features are being configured.
2
Apply the AWS Shared Responsibility Model to the identified tasks.
Configuring encryption settings (such as enabling SSE on S3 and setting up SSL/TLS for database connections) is 'security in the cloud' and thus a customer responsibility. Managing hardware security, replacing disk drives, and provisioning KMS multi-tenant infrastructure is 'security of the cloud' and thus AWS's responsibility.
Distinguishing between customer responsibilities (logical configuration and data protection) and AWS responsibilities (physical infrastructure and service management) determines the correct options.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages security *of* the cloud (physical infrastructure, virtualization layer, and global infrastructure). The customer is responsible for security *in* the cloud, which includes data protection (encryption at rest and in transit) and access management.

AreaCustomer Responsibility (Security IN the Cloud)AWS Responsibility (Security OF the Cloud)
Data at RestEnabling server-side encryption (SSE), managing customer master keys (CMKs)Physical security of HSMs, media disposal, physical storage maintenance
Data in TransitConfiguring SSL/TLS, managing network traffic encryptionMaintaining the physical network and AWS global infrastructure
Estimated Time:1m 30s
Question 871Question →

An AWS IAM user has two identity-based policies attached to their identity. The first policy explicitly allows the 's3:GetObject' action on all Amazon S3 resources, while the second policy explicitly denies the 's3:GetObject' action on a specific S3 bucket named 'financial-records'. Which of the following describes the final access decision when the user attempts to retrieve an object from the 'financial-records' bucket?

Show answer & explanation

Answer: Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.

Answer

Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.
The correct answer is that access is denied because in AWS IAM policy evaluation, an explicit deny always overrides any explicit allows. Even though the first policy grants read access to all S3 buckets, the second policy's explicit deny on the specific bucket ensures that any request to retrieve objects from that bucket is blocked.

Step-by-Step Solution

1
Analyze the attached IAM policies to identify all applicable statements.
There is one policy statement that explicitly allows the action on all S3 resources, and another statement that explicitly denies the action on the 'financial-records' bucket.
AWS evaluates all policies attached to the user identity simultaneously to determine permissions.
2
Apply the AWS IAM policy evaluation hierarchy.
The explicit deny on the specific bucket takes precedence over the general explicit allow.
By default, all requests are denied in AWS. An explicit allow overrides the default deny, but any explicit deny always overrides any explicit allows.

Key Concept

AWS IAM Policy Evaluation Logic (Explicit Deny Override)
Question 872Question →

A company's new finance analyst needs to manually review the billing dashboard and check monthly spending summaries in the AWS account. The analyst has no coding experience and requires a graphical user interface (GUI) accessible via a web browser. Which AWS tool is most appropriate for the analyst to use?

Show answer & explanation

Answer: AWS Management Console

Answer

AWS Management Console
The AWS Management Console is a web-based graphical interface that allows users to access, configure, and manage AWS resources manually, including the billing dashboard, without needing coding or command-line experience.

Step-by-Step Solution

1
Identify the user requirements from the scenario.
The analyst needs a manual, browser-based graphical user interface (GUI) with no programming or command-line experience required.
Understanding the user's technical constraints and operational goals helps rule out automated and programmatic interfaces.
2
Evaluate the AWS interfaces against these requirements.
The AWS Management Console is a web-based GUI that fits these requirements perfectly, while the CLI, SDK, and CloudFormation are script-based, code-based, or template-based solutions.
Selecting the method that aligns with the visual and manual requirements leads to the correct interface.

Key Concept

The AWS Management Console is the primary web-based graphical interface used to interact with and manage AWS resources manually.
Question 873Question →

An organization is designing a high-frequency financial analytics platform. The architecture has two primary requirements:

1. The relational database tier must support synchronous replication and automatic failover across physically separated facilities while remaining within a single national boundary for compliance.
2. The data ingestion compute tier must run as close as possible to users in metropolitan areas that do not host a full AWS Region, to minimize network latency.

Which of the following deployment strategies should the organization use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the relational database tier across multiple Availability Zones in a single AWS Region.; Deploy the data ingestion compute tier in AWS Local Zones located in the targeted metropolitan areas.

Answer

Deploying the relational database tier across multiple Availability Zones in a single AWS Region, and deploying the data ingestion compute tier in AWS Local Zones located in the targeted metropolitan areas.
To achieve high availability with synchronous replication and automatic failover within a single national boundary, the database must be deployed across multiple Availability Zones within a single AWS Region. To deliver ultra-low latency compute to metropolitan areas without a local AWS Region, AWS Local Zones should be utilized to host the data ingestion tier close to the end-users.

Step-by-Step Solution

1
Analyze database requirements
Identified that synchronous replication, physical isolation, and data residency require a multi-AZ deployment within a single AWS Region.
Regions offer data sovereignty boundaries, and Availability Zones within a Region provide the low-latency physical isolation necessary for synchronous database replication.
2
Analyze compute placement requirements
Identified that low-latency compute in metropolitan areas without a full Region requires the use of AWS Local Zones.
AWS Local Zones extend AWS Regions to bring compute resources closer to metropolitan areas, minimizing latency for local end-users.

Key Concept

Understanding the distinct use cases and architectural properties of AWS Regions, Availability Zones, Local Zones, and Edge Locations.
Question 874Question →

A digital marketing agency, PixelReach, is planning to migrate its workloads from a local colocation facility to the AWS Cloud. The company currently pays for physical hardware maintenance, power, cooling, and rack space. Which two of the following describe how cloud economics will change the company's financial model after migrating to AWS?

Select all that apply

Show answer & explanation

Answer: The company transitions from upfront capital expenses (CapEx) to variable operating expenses (OpEx).; The company reduces its total cost of ownership (TCO) by eliminating physical data center maintenance, power, and cooling costs.

Answer

The company transitions from upfront capital expenses (CapEx) to variable operating expenses (OpEx), and the company reduces its total cost of ownership (TCO) by eliminating physical data center maintenance, power, and cooling costs.
Transitioning to AWS shifts the financial structure from capital expenses (CapEx) to variable operating expenses (OpEx) since there are no physical assets to buy. Additionally, Total Cost of Ownership (TCO) drops because the costs of power, cooling, physical space, and hardware upkeep are handled by AWS.

Step-by-Step Solution

1
Analyze how cloud migration affects capital and operating expenditures.
Transitioning to AWS eliminates fixed upfront costs (CapEx) in favor of variable utility-based costs (OpEx).
AWS operates on a pay-as-you-go model rather than requiring physical hardware purchases.
2
Evaluate how cloud migration impacts ongoing facilities costs.
Eliminating physical server maintenance, rack space rental, power, and cooling reduces the customer's overall Total Cost of Ownership (TCO).
AWS absorbs the operational costs of running physical data centers.

Key Concept

Understanding how cloud economics shifts spending from CapEx to OpEx and lowers TCO by removing physical infrastructure maintenance.
Estimated Time:1m 0s
Question 875Question →

A development team is deploying a containerized application across multiple Linux-based Amazon EC2 instances. The application requires a shared storage solution that supports concurrent read and write access from all instances using the standard Network File System (NFS) protocol. Which AWS storage service should the team select for this application?

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS)

Answer

Amazon Elastic File System (Amazon EFS)
Amazon Elastic File System (Amazon EFS) provides a fully managed, scalable file system that supports the Network File System (NFS) protocol and allows concurrent read and write access from multiple Amazon EC2 instances simultaneously.

Step-by-Step Solution

1
Analyze the requirements of the application, which are shared access from multiple Amazon EC2 instances and support for the standard Network File System (NFS) protocol.
Identify that a file storage service supporting NFS and concurrent access is needed.
This narrows down the choice to AWS file storage solutions rather than block or object storage.
2
Evaluate the available AWS storage services against these requirements.
Determine that Amazon Elastic File System (Amazon EFS) is the managed NFS file system service that allows multiple EC2 instances to connect simultaneously.
This confirms Amazon Elastic File System (Amazon EFS) as the correct choice, while Amazon EBS, Amazon S3, and Amazon EC2 Instance Store do not meet these criteria.

Key Concept

AWS file storage options supporting concurrent access and NFS protocol
Question 876Question →

A wellness startup, FitPulse, is launching a new mobile workout application. Instead of purchasing physical servers and hosting them in a private data center, the company decides to build its backend on AWS to pay only for the compute resources it consumes on an hourly basis.

Which of the following economic benefits of the AWS Cloud does this decision directly represent?

Show answer & explanation

Answer: Trading capital expenses for operating expenses

Answer

Trading capital expenses for operating expenses
By utilizing AWS, the startup avoids large upfront investments in physical infrastructure (capital expenses) and instead pays for services as they are consumed (operating expenses). This model lowers the barrier to entry and aligns ongoing costs with usage.

Step-by-Step Solution

1
Analyze the financial difference between on-premises and AWS models in the scenario.
On-premises deployment requires buying physical hardware upfront (capital expenses / CapEx), whereas AWS allows paying for resources as they are used (operating expenses / OpEx).
Understanding what financial transaction type is being replaced by cloud adoption.
2
Evaluate the choices to identify the concept that maps to replacing upfront hardware purchases with ongoing hourly consumption costs.
Trading capital expenses for operating expenses is the correct term for this shift.
Selecting the option that matches the core economic benefit demonstrated by the startup's decision.

Key Concept

CapEx vs OpEx shift in cloud economics
Question 877Question →

An enterprise is expanding its cloud infrastructure to include 1212 Virtual Private Clouds (VPCs) across multiple AWS accounts. To simplify routing, they need a central hub to interconnect all VPCs with their on-premises data center. At the same time, the security team requires the ability to block inbound traffic from a specific set of known malicious public IP addresses at the boundary of each subnet. Which combination of AWS services and security features should the cloud practitioner recommend to meet these requirements?

Show answer & explanation

Answer: Deploy AWS Transit Gateway as a centralized router to connect all VPCs and the on-premises network, and use Network Access Control Lists (NACLs) to deny the malicious IP addresses at the subnet level.

Answer

Deploy AWS Transit Gateway as a centralized router to connect all VPCs and the on-premises network, and use Network Access Control Lists (NACLs) to deny the malicious IP addresses at the subnet level.
Deploying AWS Transit Gateway acts as a cloud router, simplifying the network topology by connecting multiple VPCs and on-premises networks to a central hub instead of managing a complex web of point-to-point peering connections. Network Access Control Lists (NACLs) are stateless and operate at the subnet boundary, allowing explicit deny rules to block specific IP addresses before traffic reaches the instances.

Step-by-Step Solution

1
Determine the routing architecture needed to connect 1212 VPCs and an on-premises network.
Identify AWS Transit Gateway as the optimal hub-and-spoke solution, reducing connection complexity from n(n−1)2\frac{n(n-1)}{2} (which is 6666 peering connections for 1212 VPCs) to 1212 VPC attachments plus one VPN/Direct Connect attachment.
VPC Peering does not support transitive routing and becomes administratively complex as the number of VPCs grows.
2
Determine the security control required to block inbound traffic from specific malicious public IP addresses at the subnet boundary.
Identify Network Access Control Lists (NACLs) as the correct choice since they are stateless, operate at the subnet level, and support explicit deny rules.
Security Groups are stateful, operate at the instance level, and only support allow rules, making them incapable of explicitly blocking specific IP addresses.

Key Concept

AWS Transit Gateway for centralized routing and Network ACLs for subnet-level stateless IP blocking.
Estimated Time:2m 0s
Question 878Question →

Match each business workload requirement with the most appropriate AWS compute service.

Click a left item, then click its matching right item

Items

Amazon EC2
AWS Lambda
Amazon Lightsail
AWS Fargate

Matches

Show answer & explanation

Answer

Amazon EC2 matches with running a legacy database application requiring full administrative control; AWS Lambda matches with running short-lived backend code triggered by S3 uploads; Amazon Lightsail matches with deploying a simple, pre-configured WordPress website; AWS Fargate matches with deploying containerized microservices without managing servers.
Each compute service matches its corresponding requirement: Amazon EC2 provides full root access to the operating system; AWS Lambda runs event-driven backend code in response to S3 uploads; Amazon Lightsail offers pre-configured application templates with predictable pricing; AWS Fargate runs containerized applications without needing to manage EC2 instances.

Step-by-Step Solution

1
Analyze each compute workload requirement to identify key constraints, such as OS access, pricing predictability, containerization, and serverless trigger conditions.
Identify that legacy databases need OS access (EC2), WordPress needs simplicity/predictable costs (Lightsail), containers without host management need serverless container execution (Fargate), and S3 triggers need event-driven code (Lambda).
This establishes the primary mapping logic based on core AWS compute service characteristics.
2
Connect each service to the corresponding business requirement.
EC2 maps to the legacy database; Lambda maps to S3 event code; Lightsail maps to WordPress; Fargate maps to serverless containers.
This yields the complete and correct match of AWS compute services to the given scenarios.

Key Concept

AWS Compute Services
Question 879Question →

A digital marketing agency wants to aggregate and analyze petabytes of historical promotional campaign data to identify long-term consumer trends. Which AWS service is designed specifically for this type of data warehousing and complex analytical query workload?

Show answer & explanation

Answer: Amazon Redshift

Answer

Amazon Redshift is the correct choice because it is a fully managed data warehouse service designed to run complex analytical queries over massive datasets.
Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed to handle complex analytical queries on massive datasets, making it the ideal fit for aggregating and analyzing historical campaign data.

Step-by-Step Solution

1
Identify the primary business requirement in the scenario.
The requirement is to analyze petabytes of historical campaign data using complex analytical queries.
This establishes that the workload is analytical (OLAP) and operates at a very large scale (petabytes), rather than a transactional (OLTP) database workload.
2
Evaluate the available AWS database and storage options against this requirement.
Amazon Redshift is a dedicated cloud data warehouse service that matches this exact pattern. Other options like Amazon DynamoDB (NoSQL transactional), Amazon ElastiCache (in-memory caching), and Amazon EBS (block storage) do not support petabyte-scale data warehousing or complex analytical queries.
Selecting the service specifically designed for data warehousing ensures optimal query performance and integration with business intelligence tools.

Key Concept

AWS Data Warehousing Services
Question 880Question →

A media startup is launching an application where users upload and share photos. The access patterns for these photos are highly unpredictable, with some files being viewed thousands of times in the first week and then never again, while others are accessed randomly months later. The startup wants to minimize storage costs automatically without paying retrieval fees or incurring operational overhead to manage lifecycle policies. Which AWS storage solution is best suited for this scenario?

Show answer & explanation

Answer: Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Intelligent-Tiering
Amazon S3 Intelligent-Tiering is the only cloud storage class that delivers automatic cost savings by moving data between two access tiers (frequent access and infrequent access) when access patterns change, without any activation fees, retrieval fees, or lifecycle rules to configure.

Step-by-Step Solution

1
Analyze the storage requirements of the scenario.
The application requires object storage (user-uploaded photos) with unpredictable access patterns, automatic cost optimization, no retrieval fees, and minimal operational overhead.
Identifying the data type (objects) and access pattern constraints narrows down the appropriate storage services and classes.
2
Evaluate the available S3 storage classes against the constraints.
Amazon S3 Intelligent-Tiering automatically manages data movement between access tiers without retrieval fees or operational overhead, which directly matches all the criteria.
Other S3 storage classes like Standard-IA charge retrieval fees and require manual management of lifecycle policies, making them unsuitable for unpredictable patterns.

Key Concept

Amazon S3 Storage Classes and Cost Optimization
Estimated Time:1m 30s
PreviousPage 44 / 74Next