Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 921Question →

A company has a single Virtual Private Cloud (VPC) containing a public subnet and a private subnet. The company needs to design a security and routing strategy that satisfies the following requirements:
1. Traffic from a list of specific, known malicious public IP addresses must be blocked from entering the public subnet.
2. Web servers in the public subnet must be allowed to initiate connections to database instances in the private subnet on port 3306, while all other inbound traffic to the database instances is restricted.

Which of the following configurations should the network administrator implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Network Access Control List (NACL) associated with the public subnet with inbound rules that explicitly deny traffic from the malicious IP addresses.; Create a Security Group for the database instances that allows inbound traffic on port 3306 from the Security Group of the web servers.

Answer

Implementing a Network Access Control List (NACL) to explicitly deny the malicious IP addresses at the public subnet level, and configuring a Security Group for the database instances to allow inbound traffic on port 3306 from the web servers' Security Group.
To block specific malicious IP addresses before they reach any resources, a Network Access Control List (NACL) must be configured with explicit DENY rules at the subnet boundary. To secure database instances, a Security Group must be created that allows inbound traffic on port 3306 from the web servers' Security Group. Security Groups are stateful and apply to instances, while NACLs are stateless and apply to subnets.

Step-by-Step Solution

1
Identify the mechanism needed to block traffic from specific external IP addresses.
A Network Access Control List (NACL) is selected because it operates at the subnet boundary and supports explicit DENY rules.
Security Groups only support ALLOW rules and cannot be configured to block specific IP addresses while permitting others.
2
Identify the mechanism needed to restrict database access to only the web servers on port 3306.
A Security Group is configured for the database instances, referencing the web servers' Security Group as the source for inbound port 3306 traffic.
Security Groups provide instance-level, stateful firewall protection and allow referencing other security groups to dynamically control access.
3
Evaluate the routing path between subnets in the same VPC.
Inter-subnet communication is handled automatically by the local route table of the VPC.
VPC Peering is intended to connect distinct VPCs and is not used to route traffic between subnets within a single VPC.

Key Concept

The primary differences between Security Groups (stateful, instance-level, ALLOW-only) and Network ACLs (stateless, subnet-level, ALLOW/DENY), and basic VPC subnet routing constraints.
Estimated Time:2m 0s
Question 922Question →

A company is hosting a virtual classroom platform with video processing workloads on Amazon EC2 instances inside a private subnet. The security team wants to implement a multi-layered security approach: they need to block a specific range of malicious external IP addresses at the subnet boundary, and they must allow administrative SSH traffic to the instances from a designated bastion host while ensuring that the return traffic is automatically permitted. Which TWO of the following configurations should the team implement?

Select all that apply

Show answer & explanation

Answer: Add an inbound deny rule for the malicious IP range to the Network Access Control List (Network ACL) associated with the subnet; Add an inbound allow rule for SSH from the bastion host IP address to the Security Group associated with the EC2 instances

Answer

Configure an inbound deny rule for the malicious IP range in the Network Access Control List (Network ACL) associated with the subnet, and configure an inbound allow rule for SSH from the bastion host in the Security Group associated with the EC2 instances.
The correct configurations involve using a Network ACL at the subnet boundary to explicitly deny the malicious IP range, and using a stateful Security Group at the instance level to allow inbound SSH from the bastion host. Since Network ACLs support deny rules and operate at the subnet level, they block the traffic before it reaches the instances. Since Security Groups are stateful, return traffic is automatically allowed, making outbound configurations for this stream unnecessary.

Step-by-Step Solution

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network ACLs operate at the subnet level and support explicit deny rules. Therefore, an inbound deny rule must be added to the Network ACL associated with the private subnet.
Security groups operate at the instance level and only support allow rules, so they cannot be used to explicitly deny traffic from a specific IP range.
2
Analyze the requirement to allow SSH traffic to the EC2 instances from a bastion host with automatic return traffic.
Security groups operate at the instance level and are stateful. Adding an inbound allow rule for SSH from the bastion host's IP address will automatically permit the outbound return traffic.
Since security groups are stateful, no matching outbound rule is required to allow return traffic, unlike Network ACLs which are stateless.

Key Concept

Security Groups are stateful firewalls operating at the instance level (allowing only allow rules), whereas Network ACLs are stateless firewalls operating at the subnet level (supporting both allow and deny rules). Under the Shared Responsibility Model, configuration of these firewalls is the customer's responsibility.
Question 923Question →

An independent blogger wants to deploy a standard WordPress website. They have limited cloud administration experience and require a simplified service that packages virtual servers, storage, databases, and networking into a predictable, low-cost monthly plan. Which AWS service is designed to meet these specific needs?

Show answer & explanation

Answer: Amazon Lightsail

Answer

Amazon Lightsail
Amazon Lightsail is designed to provide an easy-to-use virtual private server (VPS) experience. It bundles all necessary resources—including virtual machines, SSD-based storage, databases, and static IP addresses—into a simple, predictable monthly plan, making it the ideal fit for hosting standard web applications with minimal administrative effort.

Step-by-Step Solution

1
Identify the key requirements from the scenario: standard WordPress hosting, low administrative overhead, and bundled resources with predictable pricing.
Establishes a need for a pre-packaged Virtual Private Server (VPS) solution rather than modular infrastructure.
This filters out highly customizable, manual infrastructure setups and serverless execution models.
2
Evaluate the compute options against the identified requirements.
Amazon Lightsail matches all criteria by offering a simplified, bundled service with flat-rate pricing.
Other options require advanced configuration (Amazon EC2, Amazon ECS) or do not natively host persistent monolithic web applications (AWS Lambda).

Key Concept

Matching workloads to the appropriate AWS compute service based on administrative overhead, pricing simplicity, and architectural fit.
Estimated Time:1m 0s
Question 924Question →

A software development company is building a custom developer portal. The portal needs to programmatically launch and terminate Amazon EC2 instances on behalf of users by executing backend application code written in Python. Additionally, the development team wants to run quick, ad-hoc queries from their local command-line terminals to list active resources without opening a web browser. Which of the following tools or methods should the team use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Software Development Kit (SDK); AWS Command Line Interface (CLI)

Answer

AWS Software Development Kit (SDK) and AWS Command Line Interface (CLI)
The requirement to programmatically launch and terminate instances from Python code is solved by the AWS Software Development Kit (SDK), which offers libraries for languages like Python. The requirement to run ad-hoc command-line queries from a terminal is solved by the AWS Command Line Interface (CLI), which allows direct control of AWS services from a local command shell.

Step-by-Step Solution

1
Analyze the first requirement: programmatically launching and terminating instances via Python backend code.
Identify that the AWS Software Development Kit (SDK) is designed for programmatic interaction using programming languages.
The SDK provides language-specific APIs to interact with AWS resources directly from application code.
2
Analyze the second requirement: running quick, ad-hoc queries from a local command-line terminal without a web browser.
Identify that the AWS Command Line Interface (CLI) is the primary tool for running commands from terminal shells.
The CLI enables quick execution of commands to query and manage resources from a command-line environment.

Key Concept

Differentiation and application of AWS interaction methods (Console, CLI, SDK, CloudFormation)
Question 925Question →

A financial services firm is deploying a containerized analytics application on AWS and has identified two storage requirements. First, the application needs a shared file system that supports the NFSv4 protocol and can be mounted concurrently by hundreds of container instances running across multiple Availability Zones. Second, the application requires a persistent block storage solution for a transactional database hosted on a single Amazon EC2 instance, which must retain data independently of the instance's life cycle. Which two AWS storage solutions should be selected to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) to provide the shared, multi-Availability Zone file storage; Amazon Elastic Block Store (Amazon EBS) to provide the persistent block storage for the database

Answer

Amazon Elastic File System (Amazon EFS) for the shared file storage and Amazon Elastic Block Store (Amazon EBS) for the database persistent block storage.
Amazon Elastic File System (Amazon EFS) provides a fully managed, shared file system that can be concurrently mounted by hundreds of instances across multiple Availability Zones, satisfying the container shared storage requirement. Amazon Elastic Block Store (Amazon EBS) provides highly durable, persistent block storage volumes that survive instance stop/start cycles, making it the correct choice for the transactional database requirement.

Step-by-Step Solution

1
Analyze the first requirement: a shared, multi-AZ file system supporting NFSv4 for container instances.
Amazon Elastic File System (Amazon EFS) is identified as the correct fit because it provides fully managed, concurrent, multi-AZ file access via NFSv4.
Other options like S3 (object storage) or EBS (typically single-AZ block storage) do not natively meet the multi-AZ concurrent POSIX file storage requirement.
2
Analyze the second requirement: persistent block storage for a database on a single EC2 instance that retains data when stopped.
Amazon Elastic Block Store (Amazon EBS) is identified as the correct fit because it is persistent block storage.
Amazon EC2 Instance Store is ruled out because it is ephemeral and does not retain data when stopped.
3
Evaluate administrative responsibility for self-managed options.
A self-managed NFS server on EC2 is rejected because it places the burden of OS patching on the customer under the Shared Responsibility Model.
AWS does not automatically patch guest operating systems on EC2 instances.

Key Concept

Selecting appropriate AWS storage services (EFS vs. EBS vs. S3 vs. Instance Store) based on durability, accessibility, and performance requirements.
Estimated Time:3m 0s
Question 926Question →

A technology startup is designing the infrastructure for a new e-commerce application on AWS. The development team has implemented two major guidelines for their deployment: first, they design the application components (such as the frontend, backend APIs, and database) to interact through well-defined APIs so that changes or issues in one component do not affect the others; second, they use automated infrastructure-as-code scripts to dynamically provision temporary staging environments for testing and destroy them immediately after the test suite completes.

Which of the following AWS Cloud design principles are directly represented by these architectural guidelines? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Loose coupling; Disposable resources instead of fixed servers

Answer

The correct principles are loose coupling and utilizing disposable resources instead of fixed servers.
The correct principles are loose coupling and utilizing disposable resources instead of fixed servers. Designing components to interact via APIs without dependency represents loose coupling, as it limits the blast radius of failures. Using scripts to provision and immediately destroy staging environments represents using disposable resources instead of fixed servers, which reduces overhead and optimizes cost.

Step-by-Step Solution

1
Analyze the first guideline in the scenario, where components interact via well-defined APIs to limit the impact of changes or failures on other components.
This aligns with the principle of loose coupling, which reduces dependencies between systems.
To identify which AWS design principles are being practiced.
2
Analyze the second guideline, where temporary staging environments are automatically created using scripts and destroyed immediately after testing.
This aligns with the principle of disposable resources instead of fixed servers, which treats infrastructure as temporary and programmatically managed assets.
To identify the second design principle being applied in the scenario.

Key Concept

AWS Cloud Design Principles (Loose Coupling and Disposable Resources)
Question 927Question →

A company needs to host a legacy application that requires custom kernel modifications and direct root access to the operating system. Which AWS compute service is best suited for this workload?

Show answer & explanation

Answer: Amazon Elastic Compute Cloud (Amazon EC2)

Answer

Amazon Elastic Compute Cloud (Amazon EC2)
Amazon Elastic Compute Cloud (Amazon EC2) provides virtual machines (instances) where the customer has full administrative control over the guest operating system. This allows the customer to perform custom kernel modifications, configure the OS, and run legacy software that requires root privileges.

Step-by-Step Solution

1
Identify the key requirement in the scenario.
The application requires direct root access to the operating system and custom kernel modifications.
This establishes the level of control and responsibility the customer needs over the compute infrastructure.
2
Evaluate the management and control models of the given AWS compute services.
AWS Lambda and AWS Fargate are serverless options that abstract the OS completely. Amazon Lightsail is a preconfigured, simplified VPS. Only Amazon EC2 provides full guest OS administration.
By understanding the shared responsibility boundaries of each service, we can match the workload's administration needs to the correct service.
3
Select the service that satisfies the full administrative control requirement.
Amazon EC2 is selected as the correct service.
Amazon EC2 provides virtual instances where customers are responsible for managing the guest OS, including the kernel.

Key Concept

Shared responsibility and administration control levels of AWS compute services.
Question 928Question →

A financial technology company is deploying a payment processing application on AWS. Their security policy mandates that all transaction logs must be encrypted at rest using cryptographic keys where the customer maintains direct control over key access policies. Furthermore, all data transmitted between their application servers and the database must be encrypted. Which of the following actions are responsibilities of the customer under the AWS Shared Responsibility Model to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring SSL/TLS certificates on the database and enabling secure transport protocols for data in transit; Creating and managing key policies to control user permissions for customer managed keys in AWS Key Management Service (AWS KMS)

Answer

The correct responsibilities of the customer are configuring SSL/TLS certificates on the database and enabling secure transport protocols for data in transit, and creating and managing key policies to control user permissions for customer managed keys in AWS Key Management Service (AWS KMS).
Under the AWS Shared Responsibility Model, the customer is responsible for data protection parameters they configure within the cloud. This includes configuring secure communication protocols (like SSL/TLS) for data in transit and managing access controls (such as key policies) for customer managed keys at rest.

Step-by-Step Solution

1
Analyze the requirement for encryption in transit.
The scenario requires securing data in transit between application servers and the database. According to the AWS Shared Responsibility Model, configuring secure connection protocols (SSL/TLS) on the customer's resources is the customer's responsibility.
AWS provides the secure infrastructure, but the customer must configure the network settings, applications, and databases to use secure transport layers.
2
Analyze the requirement for encryption at rest and key policy control.
The customer needs control over key access policies. Using AWS Key Management Service (AWS KMS), the customer must create and configure key policies to determine who can use or manage the keys.
AWS manages the availability and physical security of AWS KMS, but logical control and authorization policies belong to the customer.

Key Concept

Shared Responsibility Model for Data Protection and Encryption
Question 929Question →

A company is designing a new e-commerce application. The application requires a transactional database to store customer order history with strict ACID compliance and a relational structure. Additionally, the company needs a data warehousing solution to perform complex analytical queries and business intelligence reporting on years of historical sales data.

Which AWS services should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora; Amazon Redshift

Answer

Amazon Aurora and Amazon Redshift are the appropriate services.
Amazon Aurora provides a fully managed relational database engine compatible with MySQL and PostgreSQL, ensuring strict transactional ACID compliance for customer order history. Amazon Redshift is a fast, petabyte-scale data warehouse service that enables complex analytical queries and business intelligence reporting on historical sales data.

Step-by-Step Solution

1
Identify the primary workload requirements.
The first requirement is a relational database with strict ACID compliance for transactional history. The second requirement is a data warehousing service for complex analytical and business intelligence queries.
Analyzing the requirements allows us to map them to the correct category of AWS database services.
2
Select the service that fits the transactional relational database requirement.
Amazon Aurora is selected as the relational database engine because it supports transactional, ACID-compliant data storage.
Relational requirements require structured tables with schema consistency and transaction support.
3
Select the service that fits the analytical data warehousing requirement.
Amazon Redshift is selected because it is built for high-performance analytical queries across large datasets.
Standard transactional databases are not optimized for heavy analytical workloads, which require a dedicated data warehouse.

Key Concept

AWS Database Services
Question 930Question →

A media company is migrating its video editing workflow to AWS. The architecture requires a storage solution that allows multiple Amazon EC2 instances to concurrently read and write to the same shared directory of raw video files. Additionally, the company needs a durable, cost-effective storage tier to store finalized video files, which must automatically transition to lower-cost archival tiers after 30 days. Which two AWS storage solutions or features should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) to serve as the shared, concurrent file system for the video editing EC2 instances.; Amazon Simple Storage Service (Amazon S3) with lifecycle configurations to store finalized assets and automate archival transitions.

Answer

Amazon Elastic File System (Amazon EFS) to serve as the shared file system, and Amazon Simple Storage Service (Amazon S3) with lifecycle configurations to manage finalized assets and archival transitions.
Amazon Elastic File System (Amazon EFS) satisfies the requirement for a shared file system that multiple EC2 instances can read and write to concurrently. Amazon Simple Storage Service (Amazon S3) combined with S3 Lifecycle rules satisfies the requirement for durable, cost-effective storage that can automatically archive files to colder tiers after 30 days.

Step-by-Step Solution

1
Analyze the requirement for concurrent, shared access to a single directory from multiple EC2 instances.
Select Amazon Elastic File System (Amazon EFS) because it is designed to be mounted simultaneously by multiple instances using the NFS protocol.
Block storage options like EBS do not easily support concurrent multi-instance writing across multiple Availability Zones without complex setup, whereas EFS handles this natively.
2
Analyze the requirement for durable, cost-effective object storage with automated transition to archival tiers after 30 days.
Select Amazon Simple Storage Service (Amazon S3) with lifecycle policies.
Amazon S3 provides high durability for finalized files, and S3 Lifecycle configurations can be set to automatically transition files to colder storage classes (such as S3 Glacier) after a set duration.

Key Concept

Selecting appropriate AWS storage services based on access pattern (shared file vs. object storage) and lifecycle management requirements.
Estimated Time:1m 30s
Question 931Question →

A company is deploying an application on Amazon Elastic Compute Cloud (Amazon EC2) that must securely read data from an Amazon Simple Storage Service (Amazon S3) bucket and write results to an Amazon DynamoDB table. The security team mandates that no long-term credentials be stored on the instance and that the principle of least privilege be strictly followed. Which of the following actions should the company perform to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, and associate it with the EC2 instance profile.; Attach an IAM policy to the IAM role that explicitly grants 's3:GetObject' and 'dynamodb:PutItem' permissions on the specific resources.

Answer

Creating an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, associating it with the EC2 instance profile, and attaching an IAM policy that explicitly grants only the necessary S3 read and DynamoDB write permissions to that role.
To secure applications on EC2, the best practice is to assign an IAM role to the EC2 instance profile. The application can then fetch temporary credentials automatically via the AWS SDK. To follow the principle of least privilege, a policy should be attached to this role that limits access to only the specific S3 and DynamoDB actions required.

Step-by-Step Solution

1
Create an IAM policy with limited permissions.
An IAM policy document is defined that permits only 's3:GetObject' and 'dynamodb:PutItem' on the specific resources.
This establishes the principle of least privilege by ensuring the application can only perform the actions it requires.
2
Create and configure an IAM role for the EC2 instance.
An IAM role is created with a trust relationship allowing the EC2 service to assume it. The policy from Step 1 is attached to this role, and the role is linked to an EC2 instance profile.
This allows the application running on the EC2 instance to automatically request and use temporary credentials, eliminating the need to store long-term access keys on the instance.

Key Concept

AWS Identity and Access Management (IAM) Roles and Least Privilege Policy Design
Estimated Time:1m 30s
Question 932Question →

A media streaming startup deploys its backend APIs using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the startup?

Show answer & explanation

Answer: Configuring the IAM execution role to restrict the function's access to other AWS resources.

Answer

Configuring the IAM execution role to restrict the function's access to other AWS resources.
Configuring the IAM execution role is the customer's responsibility. Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes data classification, identity and access management (IAM), and the configuration of code and permissions. AWS Lambda is a serverless (PaaS) service, so AWS manages the underlying physical infrastructure, virtualization hypervisor, operating system, and runtime environments.

Step-by-Step Solution

1
Identify the service model and the service type referenced in the scenario.
The scenario involves AWS Lambda, which is a serverless / Platform as a Service (PaaS) offering.
The division of responsibilities depends on the type of service being used (IaaS, PaaS, or SaaS).
2
Distinguish between the customer's responsibility (security 'in' the cloud) and AWS's responsibility (security 'of' the cloud) for serverless services.
For serverless services, AWS manages the physical security, hardware, hypervisor, OS, and runtime. The customer is responsible for configurations, code, data, and access control (IAM).
This boundary defines which tasks must be performed by the customer and which are handled automatically by AWS.
3
Evaluate the options to find the task that falls under the customer's responsibility.
Configuring the IAM execution role is an access control configuration task and is the customer's responsibility.
This confirms the correct option based on the defined boundary.

Key Concept

AWS Shared Responsibility Model for Serverless Services
Estimated Time:1m 0s
Question 933Question →

ByteQuest Studios is migrating its game development servers from an on-premises data center to the AWS Cloud. By doing so, the company will no longer need to make upfront investments in physical servers and network hardware. Instead, they will pay only for the resources they use on a monthly basis. Which of the following describes the primary financial shift of this transition?

Show answer & explanation

Answer: The shift from upfront capital expenses (CapEx) to variable operating expenses (OpEx)

Answer

The shift from upfront capital expenses (CapEx) to variable operating expenses (OpEx)
The correct answer is correct because transitioning to the AWS Cloud allows organizations to trade capital expenses (CapEx)—such as investments in physical servers and data center infrastructure—for variable operating expenses (OpEx), where they pay only for the IT resources they consume.

Step-by-Step Solution

1
Analyze the pre-migration infrastructure costs where physical servers are purchased upfront.
Identify this upfront hardware investment as a Capital Expense (CapEx).
To establish the initial financial baseline of the on-premises datacenter model.
2
Evaluate the post-migration consumption model where resources are billed monthly based on usage.
Identify the flexible pay-as-you-go AWS usage billing as an Operating Expense (OpEx).
To determine how cloud consumption changes the corporate cost structure.
3
Compare the two models to determine the primary financial transition.
Confirm that the change replaces upfront CapEx with variable OpEx.
To select the matching option that represents this fundamental cloud economic shift.

Key Concept

Replacing upfront capital expenses (CapEx) with variable operating expenses (OpEx) to pay only for the resources consumed.
Estimated Time:45s
Question 934Question →

NovaKitchens, a food delivery startup, manages order dispatching infrastructure that experiences predictable demand spikes during lunch and dinner, but remains virtually idle between 10 PM and 11 AM. The startup is planning to migrate these systems from an on-premises data center to AWS. The finance department needs to evaluate how this transition affects their cost structure.

Which TWO statements correctly describe the economic or financial benefits of this migration for NovaKitchens?

Select all that apply

Show answer & explanation

Answer: By shifting from a Capital Expense (CapEx) model to an Operating Expense (OpEx) model, NovaKitchens avoids large upfront investments in physical server infrastructure.; Using cloud elasticity allows NovaKitchens to scale down compute capacity during idle hours, minimizing costs associated with unused resources.

Answer

The correct options are shifting from a Capital Expense (CapEx) model to an Operating Expense (OpEx) model, and using cloud elasticity to scale down compute capacity during idle hours.
Shifting to the cloud enables organizations to trade capital expenses (CapEx) for operating expenses (OpEx), removing the requirement for upfront server investments. Additionally, using cloud elasticity helps dynamically align resource provisioning with demand, saving money by scaling down during off-peak hours.

Step-by-Step Solution

1
Analyze the financial impact of migrating from physical hardware to AWS utility billing.
Transition from upfront CapEx (buying servers) to flexible, consumption-based OpEx.
This shows the change in cost categorization from capital to operational expenses.
2
Analyze how variable demand (high during meals, idle overnight) is optimized on AWS.
Elasticity allows resources to match demand, scaling down to save costs during off-peak times.
This establishes how the workload profile matches cloud-native economic benefits.

Key Concept

Cloud economics relies on converting capital expenditures into operating expenses and utilizing elasticity to eliminate idle capacity costs.
Question 935Question →

A financial services firm is migrating a critical transaction-processing workload to AWS. The application must achieve zero data loss (Recovery Point Objective of 0) during a physical site failure, satisfy strict data residency laws requiring all data to remain within a specific country, and minimize latency for users in that country. To meet these requirements, how should the firm design its infrastructure using AWS Regions and Availability Zones?

Show answer & explanation

Answer: Deploy the application across multiple Availability Zones within a single AWS Region located in the target country, utilizing synchronous replication between the zones.

Answer

Deploy the application across multiple Availability Zones within a single AWS Region located in the target country, utilizing synchronous replication between the zones.
Deploying the application across multiple Availability Zones within a single AWS Region located in the target country meets all requirements. Availability Zones within the same Region are connected by high-speed, private fiber-optic networks that support the low-latency required for synchronous replication (achieving RPO of 0). Because all selected Availability Zones reside within the single Region in the target country, the data residency requirement is fully satisfied.

Step-by-Step Solution

1
Analyze the data residency requirement.
The workload and its data must remain within the specific country, meaning all infrastructure components used must reside in an AWS Region physically located inside that country.
Choosing a Region within the country guarantees compliance with local data residency laws.
2
Analyze the low-latency and zero data loss (RPO = 0) requirement.
Synchronous database replication must be used to ensure zero data loss during a site failure. This requires the low-latency connections only available between Availability Zones within the same AWS Region.
Replication across different AWS Regions is asynchronous because the physical distance introduces latency that makes synchronous replication impractical for real-time transactions.
3
Analyze the high-availability and physical site failure requirement.
Deploying the application across multiple Availability Zones within that single Region provides protection against fire, lightning strikes, power outages, and other localized physical disasters.
Each Availability Zone is physically separated, located in different flood plains, and supplied by independent power grids, preventing correlated failures.

Key Concept

AWS Regions vs Availability Zones Connectivity and Boundaries
Estimated Time:2m 0s
Question 936Question →

A company is hosting a multi-tier web application in an Amazon Virtual Private Cloud (Amazon VPC). The security team has identified a range of malicious IP addresses, 198.51.100.0/22198.51.100.0/22, that must be blocked from accessing the application. Additionally, the web servers must only accept inbound traffic on TCP ports 8080 and 443443, and the return traffic to the clients must be allowed automatically without configuring any additional outbound rules. Which combination of AWS network security features will meet these requirements?

Show answer & explanation

Answer: A stateless Network Access Control List (Network ACL) at the subnet level to deny traffic from 198.51.100.0/22198.51.100.0/22, and a stateful Security Group at the instance level to allow inbound traffic on TCP ports 8080 and 443443.

Answer

A stateless Network Access Control List (Network ACL) at the subnet level to deny traffic from the malicious IP range, and a stateful Security Group at the instance level to allow inbound traffic on TCP ports 8080 and 443443.
A stateless Network ACL operates at the subnet level and supports explicit deny rules, which allows it to block the malicious CIDR range (198.51.100.0/22198.51.100.0/22) before traffic reaches any EC2 instances. A stateful Security Group operates at the instance level and automatically tracks connection states, ensuring that inbound traffic allowed on TCP ports 8080 and 443443 can receive return traffic without requiring explicit outbound configuration.

Step-by-Step Solution

1
Evaluate the requirement to block the malicious CIDR block 198.51.100.0/22198.51.100.0/22.
Determine that Network ACLs support both allow and deny rules, whereas Security Groups only support allow rules.
An explicit deny rule is required to block specific IP addresses, which can only be configured in a Network ACL.
2
Evaluate the requirement to allow inbound traffic on TCP ports 8080 and 443443 and automatically permit return traffic.
Determine that Security Groups are stateful, meaning return traffic is automatically allowed, whereas Network ACLs are stateless and require explicit outbound rules for return traffic.
Using a stateful Security Group satisfies the requirement of allowing return traffic automatically without additional outbound configuration.
3
Determine the correct deployment boundary for each security feature.
Verify that Network ACLs are applied at the subnet level, while Security Groups are applied at the elastic network interface (instance) level.
This configuration correctly blocks malicious traffic at the subnet boundary before it reaches the instances, and applies granular access controls on the instances themselves.

Key Concept

The operational differences and use cases for stateful Security Groups and stateless Network ACLs within an Amazon VPC.
Estimated Time:2m 0s
Question 937Question →

An online gaming platform is deploying a new database on Amazon EC2 instances to store player profile data. The security team must ensure that all data stored on the EC2 instances' Amazon Elastic Block Store (EBS) volumes is encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is the customer’s responsibility in this scenario?

Show answer & explanation

Answer: Enabling encryption on the Amazon EBS volumes during creation or at the account level.

Answer

Enabling encryption on the Amazon EBS volumes during creation or at the account level.
The correct answer is correct because configuring encryption at rest for storage resources like Amazon EBS volumes falls under security 'in' the cloud, which is the customer's responsibility.

Step-by-Step Solution

1
Analyze the scenario and identify that the customer is encrypting data at rest on Amazon EBS volumes.
Identify that EBS volume encryption configuration is controlled by the customer.
To determine which part of the task falls under customer control vs. AWS control.
2
Apply the AWS Shared Responsibility Model boundaries to data encryption.
Determine that enabling encryption settings on EBS is security 'in' the cloud (customer responsibility), while maintaining physical infrastructure and hardware security is security 'of' the cloud (AWS responsibility).
To eliminate AWS-managed infrastructure tasks and find the customer action.

Key Concept

AWS Shared Responsibility Model for Data Encryption at Rest
Question 938Question →

A healthcare provider must retain historical patient medical images for 7 years to comply with regulatory standards. These files are rarely accessed (fewer than two times a year), but if a patient returns for an emergency follow-up, the images must be available for immediate viewing within milliseconds. The provider wants to minimize storage costs while meeting this response time SLA. Which Amazon S3 storage class is the most appropriate?

Show answer & explanation

Answer: Amazon S3 Glacier Instant Retrieval

Answer

Amazon S3 Glacier Instant Retrieval
Amazon S3 Glacier Instant Retrieval is the most cost-effective storage class for archiving data that is accessed very rarely (such as once or twice a year) but still requires immediate access in milliseconds. It provides the same low latency and high throughput as Amazon S3 Standard, but at a significantly lower storage cost, matching the requirements of the hospital's emergency access SLA.

Step-by-Step Solution

1
Analyze the access frequency and retention requirements.
The patient records are rarely accessed (fewer than two times a year) and must be retained for 7 years, indicating an archive storage class is appropriate.
Determining the access frequency helps eliminate hot storage tiers and guides selection toward archival tiers to minimize costs.
2
Evaluate the retrieval speed (latency) requirement.
The records must be accessible within milliseconds for emergency scenarios.
This millisecond requirement eliminates archive classes that require minutes or hours to retrieve data, such as S3 Glacier Flexible Retrieval and S3 Glacier Deep Archive.
3
Compare the remaining options for cost-effectiveness based on access frequency.
Amazon S3 Glacier Instant Retrieval offers a lower storage price than Amazon S3 Standard-IA while meeting the millisecond retrieval requirement, making it the most cost-effective option for quarterly/semi-annual access patterns.
Comparing costs ensures the final selection satisfies the primary objective of minimizing storage fees.

Key Concept

AWS Storage Classes and Lifecycle Management
Estimated Time:2m 0s
Question 939Question →

A biotechnology company, BioVanguard Research, is planning to migrate its molecular modeling simulations to AWS. These simulation workloads run sporadically based on active research projects, requiring high compute power for brief periods, followed by weeks of inactivity. The finance department is evaluating the cost implications of moving from their current on-premises high-performance computing (HPC) cluster to the AWS Cloud. Which of the following represent key cloud economic concepts or benefits that apply to this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transitioning from upfront capital investments in physical servers to variable operational costs that align with actual simulation run times; Leveraging cloud elasticity to scale compute resources down to zero during weeks of inactivity, eliminating payment for idle capacity

Answer

Transitioning from upfront capital investments in physical servers to variable operational costs that align with actual simulation run times, and leveraging cloud elasticity to scale compute resources down to zero during weeks of inactivity, eliminating payment for idle capacity.
The correct options are transitioning from upfront capital investments to variable operational costs, and leveraging cloud elasticity to scale compute resources down to zero during inactivity. The shift from CapEx to OpEx allows the company to pay only for active compute usage instead of investing in physical servers upfront. Elasticity ensures they can dynamically terminate resources when not in use, eliminating charges for idle time.

Step-by-Step Solution

1
Analyze the workload pattern.
The simulation workloads run sporadically, requiring massive compute capacity for short bursts, followed by prolonged periods of inactivity.
Understanding the usage pattern is critical to determining which pricing and scaling models yield the best economic benefit.
2
Evaluate the shift in expense models.
Moving to the cloud shifts the workload from a capital expense model (buying servers upfront) to an operational expense model (paying as you go).
This allows the company to avoid capital overhead for hardware that remains idle during research gaps.
3
Apply scaling mechanisms to optimize costs.
Using elasticity to dynamically provision instances when simulations run, and terminate them when idle, ensures cost optimization.
Elasticity prevents the business from paying for unused compute capacity, aligning operational costs directly with research activity.

Key Concept

Understanding cloud economics, specifically shifting from CapEx to OpEx and utilizing elasticity to eliminate idle capacity costs.
Estimated Time:1m 30s
Question 940Question →

A company is hosting a legacy relational database on a single Amazon EC2 instance. The database requires persistent, low-latency, block-level storage that supports frequent random reads and writes, and can be backed up using point-in-time snapshots. Which AWS storage service best meets these requirements?

Show answer & explanation

Answer: Amazon Elastic Block Store (Amazon EBS)

Answer

Amazon Elastic Block Store (Amazon EBS)
Amazon Elastic Block Store (Amazon EBS) is the correct choice because it provides persistent block-level storage that is directly attached to a single EC2 instance, offering the low-latency performance required by transactional databases and support for point-in-time snapshots.

Step-by-Step Solution

1
Analyze the storage requirements of the database workload.
The database needs block-level storage that is persistent, provides low latency, supports a single EC2 instance, and can be backed up using snapshots.
Identifying the workload characteristics helps narrow down the appropriate AWS storage type (object, file, block, or ephemeral).
2
Evaluate the storage type (object vs. file vs. block).
Object storage (S3) is unsuitable for relational database files due to its API-based access. File storage (EFS) is shared network file storage. Block storage (EBS and Instance Store) is appropriate for database drives.
Relational databases require block-level access for performance and transactional integrity.
3
Evaluate durability and persistence requirements.
EC2 Instance Store is ephemeral (data lost on instance stop/termination). Amazon EBS is persistent and supports snapshots.
Since the data must persist after instance stop/termination and support backups, EBS is the correct choice.

Key Concept

Amazon Elastic Block Store (Amazon EBS) provides persistent, low-latency block-level storage volumes for Amazon EC2 instances, suitable for database applications.
Estimated Time:1m 0s
PreviousPage 47 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin