Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 981Question →

An enterprise is establishing a multi-account AWS environment. The cloud operations team must satisfy the following governance goals:

1. Automatically set up a secure, governed multi-account AWS environment (landing zone) based on AWS best practices.
2. Centrally enforce security guidelines by applying policy controls that restrict allowed AWS services and API actions across all member accounts.

Which AWS services should the enterprise implement to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: AWS Control Tower; AWS Organizations

Answer

AWS Control Tower and AWS Organizations
AWS Control Tower automates the creation of a multi-account environment (landing zone) using best-practice blueprints. AWS Organizations acts as the underlying service to manage these accounts centrally and apply Service Control Policies (SCPs) to enforce permission boundaries and restrict API calls.

Step-by-Step Solution

1
Analyze the requirement for establishing a secure, governed multi-account landing zone.
AWS Control Tower is the specific service designed to automate landing zone setup under AWS best practices.
This directly matches the first goal of setting up a governed multi-account environment.
2
Analyze the requirement for centrally restricting AWS services and API actions across all member accounts.
AWS Organizations provides Service Control Policies (SCPs) which act as guardrails to centrally restrict member account permissions.
This directly matches the second goal of enforcing central security guidelines.

Key Concept

Multi-account governance using landing zones and central policy boundaries
Question 982Question →

A multinational e-commerce company wants to implement a customer feedback analysis pipeline. The system needs to ingest raw audio recordings of customer service calls, convert them into text transcripts, translate those transcripts from multiple languages into English, and then analyze the translated text to identify key themes and determine if the customer sentiment was positive, negative, or neutral. To perform the final step of analyzing the English text transcripts to extract key themes and determine customer sentiment, which AWS service should the company select?

Show answer & explanation

Answer: Amazon Comprehend

Answer

Amazon Comprehend
Amazon Comprehend is a natural language processing (NLP) service that uses machine learning to find insights and relationships in text. It has built-in capabilities to identify key phrases (themes) and determine the sentiment (positive, negative, neutral, or mixed) of text, which matches the final step of the pipeline.

Step-by-Step Solution

1
Identify the distinct stages in the described customer feedback analysis pipeline.
Stage 1: Speech-to-text conversion (audio to transcript). Stage 2: Machine translation (source language to English). Stage 3: Text analysis (extracting themes and sentiment).
Deconstructing the pipeline helps isolate the specific requirement of the final step.
2
Map the final step (analyzing English text transcripts to extract key themes and determine customer sentiment) to the correct AWS Machine Learning service.
Amazon Comprehend is the AWS service designed for natural language processing (NLP) tasks such as key phrase extraction and sentiment analysis.
This matches the requirements of the final analysis phase of the pipeline.
3
Evaluate the other services mentioned in the pipeline to ensure they do not perform this specific text analysis step.
Amazon Transcribe handles speech-to-text; Amazon Translate handles language translation; Amazon Lex is for building interactive chatbots.
Verifying the capabilities of alternate services confirms that Amazon Comprehend is the only correct choice for the specified step.

Key Concept

AWS Machine Learning services are specialized for specific tasks; Amazon Comprehend is designed for natural language processing (NLP) and text analysis (such as sentiment and key phrase extraction), whereas other services handle speech-to-text, translation, or conversational bots.
Estimated Time:1m 30s
Question 983Question →

When designing a deployment strategy on AWS, a cloud practitioner must understand the relationship between AWS Regions and Availability Zones. Which of the following statements are correct regarding these infrastructure components? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An AWS Region is a geographic area that contains multiple, isolated Availability Zones.; Availability Zones are distinct physical locations within a Region designed to be isolated from failures in other Availability Zones.

Answer

An AWS Region is a geographic area that contains multiple, isolated Availability Zones, and Availability Zones are distinct physical locations within a Region designed to be isolated from failures in other Availability Zones.
An AWS Region is a geographic location containing multiple, physically separated Availability Zones. Each Availability Zone is a distinct physical location made of one or more data centers, with redundant power, networking, and connectivity, designed to isolate failures from other zones.

Step-by-Step Solution

1
Identify the definitions of AWS Regions and Availability Zones.
An AWS Region represents a geographic territory, while an Availability Zone represents one or more physical data centers within that territory.
Understanding the structural hierarchy is necessary to evaluate the statements.
2
Determine how failure isolation is achieved.
Availability Zones are designed with independent power, cooling, and network connectivity to isolate failures.
This confirms the statement about physical isolation is correct.

Key Concept

AWS Regions and Availability Zones
Question 984Question →

A smart home IoT company is designing the backend for its smart appliance ecosystem. The architecture requires two distinct data storage solutions:

1. A database to store rapid, high-volume device telemetry data (such as temperature and humidity readings) that has a flexible schema and requires single-digit millisecond latency.
2. A database to store user subscription profiles, device ownership records, and billing transactions, which requires strict transactional (ACID) compliance and supports complex SQL relational queries.

Which two AWS services should the company select to meet these database requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon DynamoDB; Amazon Aurora

Answer

Amazon DynamoDB and Amazon Aurora
Amazon DynamoDB meets the telemetry requirement because it is a managed NoSQL database service that scales seamlessly to handle high-volume write traffic with single-digit millisecond latency and flexible schemas. Amazon Aurora meets the subscription and billing transactional requirement because it is a managed, highly available relational database service compatible with MySQL and PostgreSQL, supporting ACID transactions and complex SQL joins.

Step-by-Step Solution

1
Analyze the requirements for the first database solution.
The device telemetry requires single-digit millisecond latency, a flexible schema, and high-frequency writes. This matches the characteristics of a key-value NoSQL database.
Amazon DynamoDB is the primary AWS NoSQL database that offers fast, flexible, and highly scalable key-value storage suitable for telemetry ingestion.
2
Analyze the requirements for the second database solution.
The profile and billing transactions require complex SQL query support and ACID compliance (relational database).
Amazon Aurora is a managed relational database service that provides high performance, SQL compatibility, and strict ACID transaction guarantees.

Key Concept

AWS Database Services
Question 985Question →

A media streaming company plans to run containerized video-processing tasks where each task runs for up to 45 minutes. The company wants to run these containers on demand without the operational overhead of provisioning, patching, or scaling virtual servers. Which AWS compute service is the most appropriate for this scenario?

Show answer & explanation

Answer: AWS Fargate

Answer

AWS Fargate is the most appropriate service because it runs containers serverlessly, eliminating the need to manage virtual servers, and has no 15-minute execution time limit like AWS Lambda.
AWS Fargate is a serverless compute engine for containers that works with Amazon ECS. It removes the need to provision, configure, or patch virtual machines, and it does not have the 15-minute runtime limit of AWS Lambda, making it perfect for containerized tasks that run for up to 45 minutes.

Step-by-Step Solution

1
Analyze the container execution duration requirement.
The tasks run for up to 45 minutes, which rules out AWS Lambda due to its 15-minute execution limit.
AWS Lambda is designed for short-running event-driven workloads.
2
Analyze the server management requirement.
The company wants to avoid managing, provisioning, or patching servers, which rules out Amazon EC2.
Amazon EC2 requires user maintenance of operating systems.
3
Evaluate the remaining options for container execution.
AWS Fargate runs containers serverlessly and does not impose a 15-minute execution limit.
It matches all requirements including serverless management and container runtimes.

Key Concept

Selecting serverless container services based on operational overhead and task duration
Question 986Question →

A medical clinic needs to archive historical patient records for regulatory compliance. These records are rarely accessed, but they must be retained securely for ten years. The clinic is looking for the most cost-effective storage solution in AWS and can tolerate a retrieval time of 12 hours. Which AWS storage service or tier should the clinic use?

Show answer & explanation

Answer: Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Glacier Deep Archive
Amazon S3 Glacier Deep Archive is the most cost-effective storage class in Amazon S3. It is designed for archiving data that is accessed rarely, typically less than once or twice a year, and supports retrieval times of up to 12 hours, matching the compliance and cost requirements of this scenario.

Step-by-Step Solution

1
Analyze the access pattern and retrieval requirements of the scenario.
The documents are rarely accessed, must be stored for ten years, and retrieval times can take up to 12 hours.
Understanding these criteria narrows down the choices from active block storage to cold object storage classes.
2
Compare the cost and retrieval characteristics of the available storage options.
Amazon S3 Glacier Deep Archive is the lowest-cost storage class in AWS and offers retrievals within 12 hours, which aligns perfectly with the requirements.
Selecting the class that matches both the cost optimization goal and the 12-hour retrieval tolerance ensures the optimal solution.

Key Concept

AWS storage classes are optimized for different access patterns, performance levels, and costs, with Amazon S3 Glacier Deep Archive providing the lowest-cost tier for long-term archiving.
Question 987Question →

A media streaming startup is configuring network security for its delivery servers within an Amazon VPC. The system administrator needs to block traffic from a list of known malicious IP addresses at the subnet boundary. The administrator must also manually define both inbound and outbound rules because the firewall does not automatically allow return traffic. Which AWS feature meets these requirements?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that both inbound traffic and outbound response traffic must be explicitly defined in the rules. Additionally, they support explicit deny rules to block specific IP addresses.

Step-by-Step Solution

1
Analyze the operational boundary required for the network firewall.
The firewall must operate at the subnet boundary rather than the individual instance level.
This rules out Security Groups, which act at the instance level, and focuses attention on Network ACLs.
2
Evaluate the stateful or stateless behavior required for the traffic control.
The requirement states that return traffic is not automatically allowed, necessitating explicit outbound rules.
This indicates stateless behavior, which is a defining characteristic of Network ACLs.

Key Concept

Network ACLs are stateless firewalls operating at the subnet level that can explicitly allow or deny traffic based on IP addresses.
Estimated Time:1m 0s
Question 988Question →

A rapidly growing software startup has configured isolated testing environments in separate Virtual Private Clouds (VPCs) across several AWS accounts. The network engineering team must implement a centralized routing hub to connect all these testing VPCs and link them to the local office. In addition, the security team requires a mechanism to prevent inbound traffic from specific blacklisted IP addresses from entering any subnet. Which TWO AWS services or features should the team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Transit Gateway; Network Access Control Lists (Network ACLs)

Answer

AWS Transit Gateway and Network Access Control Lists (Network ACLs)
The correct options are the centralized cloud router and the subnet-level traffic filter. AWS Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks in a hub-and-spoke topology, simplifying configuration. Network Access Control Lists (Network ACLs) act as stateless firewalls at the subnet boundary and support explicit deny rules, which are necessary to block specific inbound IP addresses.

Step-by-Step Solution

1
Analyze the connectivity requirement: Connecting multiple VPCs across different accounts to each other and to an on-premises location.
Identify AWS Transit Gateway as the central hub service designed to simplify routing for multi-VPC and hybrid setups, avoiding the complexity of a full mesh of peerings.
Transit Gateway acts as a single gateway connecting all VPCs and on-premises networks, serving as a hub.
2
Analyze the security requirement: Blocking specific inbound IP addresses at the subnet level.
Identify Network Access Control Lists (Network ACLs) as the feature that operates at the subnet boundary and supports explicit deny rules.
Security Groups operate at the instance level and only support allow rules, so Network ACLs must be used to block specific blacklisted IPs.

Key Concept

Centralized hybrid routing and subnet-level traffic filtering
Question 989Question →

A healthcare software provider is deploying a patient management platform on AWS. The platform has two specific storage requirements:

1. A shared file storage system that can be accessed concurrently by a fleet of Linux-based Amazon EC2 application servers distributed across multiple Availability Zones to share state and configuration files.
2. A cost-effective archiving repository for patient medical records that are rarely accessed but must be preserved for 7 years to meet compliance standards, with the ability to retrieve any record within a few minutes if requested.

Which two AWS storage options should the provider select to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) for the shared application state and configuration files.; Amazon S3 Glacier Flexible Retrieval for the long-term archiving of medical records.

Answer

Amazon Elastic File System (Amazon EFS) and Amazon S3 Glacier Flexible Retrieval are the correct storage options.
The correct options are Amazon Elastic File System (Amazon EFS) and Amazon S3 Glacier Flexible Retrieval. EFS provides a fully managed shared file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. S3 Glacier Flexible Retrieval is designed for cost-effective, long-term archiving of rarely accessed data, with Expedited retrieval options that deliver files within 1-5 minutes.

Step-by-Step Solution

1
Analyze the first requirement: a shared file system accessible concurrently by multiple Linux EC2 instances across multiple Availability Zones.
Identify Amazon Elastic File System (Amazon EFS) as the managed solution designed for concurrent, multi-AZ shared file storage for Linux workloads.
Amazon EBS volumes are typically restricted to a single instance and a single AZ, and Instance Store is local ephemeral block storage.
2
Analyze the second requirement: long-term, cost-effective archiving of regulatory compliance documents (7 years retention) that are rarely accessed but need retrieval in minutes.
Identify Amazon S3 Glacier Flexible Retrieval as the appropriate storage tier because it provides low-cost archiving and supports Expedited retrievals in 1-5 minutes.
Amazon S3 Standard is too expensive for rarely accessed archiving, and EC2 Instance Store does not persist data, failing the 7-year durability requirement.

Key Concept

Selecting appropriate AWS storage services based on access pattern, latency, concurrency, durability, and cost requirements.
Question 990Question →

A financial services company is planning to migrate its on-premises document management system to AWS. The company must address two specific requirements:

1. Transfer a 600 TB600\text{ TB} archive of historical bank statements to Amazon S3. The company's on-premises internet connection has a maximum outbound bandwidth of 50 Mbps50\text{ Mbps}, and the migration must be completed within 2121 days.
2. Provide local on-premises applications with low-latency access to frequently used active documents that are stored in Amazon S3, using standard file sharing protocols.

Which two AWS services or features should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Snowball Edge Storage Optimized; Amazon S3 File Gateway

Answer

AWS Snowball Edge Storage Optimized and Amazon S3 File Gateway
AWS Snowball Edge Storage Optimized is the correct choice for migrating the 600 TB600\text{ TB} archive because the network bandwidth (50 Mbps50\text{ Mbps}) makes online transfer mathematically impossible within 2121 days. Shipping physical storage appliances is the standard practice for this scenario. Amazon S3 File Gateway is the correct hybrid storage solution because it provides a local on-premises cache for files in S3 and supports NFS and SMB protocols directly.

Step-by-Step Solution

1
Analyze the data migration constraint
A 600 TB600\text{ TB} archive needs to be moved over a 50 Mbps50\text{ Mbps} connection within 2121 days. Calculating the theoretical transfer time shows it would take over 1,1001,100 days (>3>3 years) to complete over the network. Therefore, an offline, physical migration method is required.
To determine whether online or offline migration services are viable.
2
Identify the physical transfer service
AWS Snowball Edge Storage Optimized provides physical appliances to ship terabytes or petabytes of data to AWS, bypassing network constraints completely.
To satisfy the offline migration requirement for the 600 TB600\text{ TB} archive.
3
Analyze the on-premises file access requirement
On-premises applications need low-latency access to files stored in Amazon S3 using standard file sharing protocols (NFS/SMB). This requires a hybrid storage solution that offers local caching.
To find a service that bridges local applications to cloud-native object storage.
4
Identify the hybrid storage caching service
Amazon S3 File Gateway acts as a software appliance installed on-premises, serving as a cache that presents S3 objects as files over NFS or SMB protocols.
To satisfy the low-latency caching and standard protocol access requirement.

Key Concept

Selecting appropriate AWS hybrid storage and offline data migration services based on network bandwidth constraints and local access protocols.
Question 991Question →

An IT compliance auditor wants to quickly generate a list of all active IAM users in the company's AWS account. The auditor needs to run a one-line command from their local workstation's terminal and save the output as a text file for an audit report. Which AWS tool or service should the auditor use to perform this action?

Show answer & explanation

Answer: AWS Command Line Interface (AWS CLI)

Answer

AWS Command Line Interface (AWS CLI)
The AWS Command Line Interface (AWS CLI) is an open-source tool that enables interaction with AWS services using commands in a command-line shell. It is the best choice for running a quick, one-line query from a local workstation's terminal to list IAM users and redirect the output to a text file.

Step-by-Step Solution

1
Identify the user's operational requirement.
The requirement is to run a one-line command from a local terminal to retrieve a list of active IAM users and save the output as a text file.
This establishes the need for a command-line tool capable of scripting and redirecting output to a file.
2
Evaluate the available AWS operating and deployment methods against this requirement.
The AWS Command Line Interface (AWS CLI) allows users to control services from the command line and automate tasks through scripts.
This matches the requirement for a terminal-based command execution that outputs structured data (which can be redirected to a text file).

Key Concept

AWS Command Line Interface (AWS CLI)
Estimated Time:1m 0s
Question 992Question →

A retail company plans to host a web application that must run continuously on a virtual machine where they have full control over the operating system, including the ability to install custom software packages. Which AWS compute service is best suited for this workload?

Show answer & explanation

Answer: Amazon Elastic Compute Cloud (Amazon EC2)

Answer

Amazon Elastic Compute Cloud (Amazon EC2) is the most appropriate service because it provides virtual machines with full administrative control over the operating system.
Amazon Elastic Compute Cloud (Amazon EC2) provides virtual servers in the cloud. It gives the customer full administrative control (root or administrator access) to configure the operating system, install custom applications, and run persistent, continuous workloads.

Step-by-Step Solution

1
Analyze the business requirements to identify the hosting environment and control level needed.
The application requires continuous running on a virtual machine with full operating system control and custom software installation.
This establishes that the customer requires an Infrastructure as a Service (IaaS) model where they maintain operating system administrative access.
2
Compare the requirements against the control levels of AWS compute services.
Amazon EC2 is the only option that offers raw virtual machines with full administrative control, while the other choices are container or serverless offerings that abstract the OS.
This identifies the correct service that matches the need for operating system customization and continuous execution.

Key Concept

Amazon EC2 provides virtual machines (instances) where the customer has full administrative control over the operating system, configuration, and software stack, representing the Infrastructure as a Service (IaaS) model.
Question 993Question →

An organization is evaluating different AWS compute offerings for its upcoming migration. Match each workload requirement to the most appropriate AWS compute service.

Click a left item, then click its matching right item

Items

A short-lived microservice that processes media uploads under 45 seconds and must scale to zero when inactive.
A legacy accounting application requiring custom kernel modifications and direct root access to the underlying operating system.
A containerized e-commerce API that needs serverless deployment without any virtual machine management overhead.
A simple promotional WordPress website needing low, predictable monthly pricing bundled with data transfer.

Matches

Show answer & explanation

Answer

The correct matches pair: 1) the event-driven scaling-to-zero workload with AWS Lambda; 2) the legacy system requiring kernel-level OS configurations with Amazon EC2; 3) the serverless containerized workload with AWS Fargate; and 4) the simple website with predictable pricing with Amazon Lightsail.
The correct matches map each distinct application requirement to the AWS compute service that meets its management, pricing, and infrastructure needs: AWS Lambda for event-driven serverless functions; Amazon EC2 for workloads needing full operating system customization; AWS Fargate for serverless container workloads; and Amazon Lightsail for simple, low-cost virtual private servers.

Step-by-Step Solution

1
Analyze each workload on the left to identify their primary constraints.
Identified specific characteristics: event-driven serverless scaling (left_1), kernel/root OS access (left_2), serverless containers (left_3), and predictable, simple cost VPS (left_4).
Understanding key workload characteristics is necessary to match them with specialized AWS compute categories.
2
Evaluate the capabilities of the compute services on the right.
Mapped AWS Lambda (event-driven functions), Amazon EC2 (fully customizable virtual machines), AWS Fargate (serverless container orchestration), and Amazon Lightsail (predictable VPS packages).
This defines the target features of each compute offering to determine the ideal pairings.
3
Perform the matching based on architectural best practices.
Matched left_1 with AWS Lambda, left_2 with Amazon EC2, left_3 with AWS Fargate, and left_4 with Amazon Lightsail.
This aligns the workloads with their corresponding optimal AWS compute service.

Key Concept

Selecting appropriate AWS compute services based on operational and application needs
Question 994Question →

A startup wants to set up automated email alerts that trigger if their monthly infrastructure spend is forecast to exceed $500. Which AWS tool should they use to implement this proactive cost tracking?

Show answer & explanation

Answer: AWS Budgets

Answer

AWS Budgets
AWS Budgets is the correct tool because it enables customers to define custom budgets and receive automated notifications (via email or Amazon SNS) when their costs or usage exceed, or are forecasted to exceed, a defined threshold. This matches the startup's operational goal of receiving an email notification when forecasted monthly spend exceeds $500.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is proactive, automated alerting based on a cost threshold ($500) and forecasting.
This helps determine whether to look for a planning tool, a reactive analysis tool, or an active alerting tool.
2
Evaluate the AWS tools based on their capabilities.
AWS Budgets is designed for setting up alerts on current or forecasted costs and usage, whereas AWS Cost Explorer is for historical analysis, AWS Pricing Calculator is for pre-deployment estimation, and AWS Billing Conductor is for custom pricing allocation.
Matching capabilities ensures the correct service is selected.

Key Concept

Using AWS Budgets for proactive cost tracking and threshold alerting.
Question 995Question →

A retail company wants to migrate its customer transaction images to Amazon S3. The access patterns for these images are highly unpredictable, with some images being accessed frequently during promotion periods and others not accessed for months. The company wants to optimize its storage costs automatically without manual intervention or performance degradation when access patterns change. Which Amazon S3 storage class should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Intelligent-Tiering
The correct answer is Amazon S3 Intelligent-Tiering. This storage class is specifically designed to optimize storage costs by automatically moving data to the most cost-effective access tier when access patterns change. It is ideal for data with unknown or unpredictable access patterns, and it does not charge retrieval fees or require manual management.

Step-by-Step Solution

1
Analyze the storage requirements: object storage (images), unpredictable access patterns, and the need for automatic cost optimization with zero operational overhead.
The solution must support object storage (Amazon S3) and feature automated cost tiering without retrieval fees or manual management.
This narrows down the potential solutions to Amazon S3 storage classes that support automated lifecycle or tiering capabilities.
2
Evaluate the S3 storage classes against the requirement of 'unpredictable access' and 'automatic cost optimization'.
Amazon S3 Intelligent-Tiering is the only storage class that monitors access patterns and automatically moves data between frequent and infrequent tiers without retrieval fees or manual rules.
Other classes like S3 Standard-IA or S3 Glacier Instant Retrieval charge retrieval fees and are designed for predictable infrequent or archival patterns, respectively.

Key Concept

Selecting the appropriate Amazon S3 storage class based on access patterns and cost optimization requirements.
Question 996Question →

A financial technology company hosts a transaction processing application on Amazon EC2 instances within a private subnet. The security team must implement a network security strategy that blocks specific malicious IP addresses at the subnet boundary and restricts instance-level access to only authorized application servers. Which of the following configurations should the cloud practitioner implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses.; Configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.

Answer

The correct configurations are to configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses, and configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.
The correct options describe configuring a Network ACL to deny traffic from the malicious IP addresses at the subnet boundary and configuring a Security Group to allow traffic only from authorized application servers. Network ACLs operate at the subnet level and support both allow and deny rules, making them the correct choice for blocking specific IPs. Security Groups operate at the instance level, are stateful, and allow specifying which sources are permitted to access the EC2 instances.

Step-by-Step Solution

1
Analyze the requirement to block malicious IP addresses at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules, which is suitable for blocking specific IP addresses.
Security Groups operate at the instance level and only support allow rules, so they cannot be used to block specific IPs at the subnet boundary.
2
Analyze the requirement to restrict instance-level access to authorized application servers.
Identify that Security Groups operate at the instance level and can be configured with inbound rules to allow traffic from specific sources, such as the authorized application servers.
Security Groups are stateful firewalls that filter traffic at the instance level, making them ideal for restricting access to specific instances.

Key Concept

Understanding the differences between Security Groups (stateful, instance-level, allow rules only) and Network ACLs (stateless, subnet-level, allow and deny rules).
Estimated Time:1m 30s
Question 997Question →

An educational technology (EdTech) startup is launching a new interactive virtual classroom application. The company wants to minimize upfront infrastructure costs and focus its engineering resources on developing software features rather than managing physical server racks and electrical facilities. Which of the following AWS Cloud benefits directly address these business requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trading capital expense for variable expense; Stop spending money running and maintaining data centers

Answer

Trading capital expense for variable expense and stop spending money running and maintaining data centers
The correct benefits are trading capital expense for variable expense, which replaces heavy upfront infrastructure investments with a pay-as-you-go model, and stopping spending money running and maintaining data centers, which lets the startup focus on its core software development instead of physical infrastructure maintenance.

Step-by-Step Solution

1
Analyze the business requirements from the scenario: minimizing upfront infrastructure costs and focusing engineering efforts on software instead of hardware maintenance.
Identified two goals: converting high upfront capital expenditures to variable operational expenditures, and offloading physical data center operations.
This establishes the criteria for selecting the correct AWS Cloud benefits.
2
Evaluate the standard 6 AWS Cloud benefits against the identified goals.
The goal of minimizing upfront costs maps directly to 'Trading capital expense for variable expense', and the goal of avoiding hardware/facility management maps to 'Stop spending money running and maintaining data centers'.
Matching the goals to the official AWS Cloud benefits guarantees a correct and document-supported selection.

Key Concept

The 6 Advantages of Cloud Computing
Question 998Question →

A startup is deploying a web application on AWS. To protect the application from localized failures, such as a power outage or flooding at a specific data center, they need to run redundant virtual servers in physically isolated locations within the same geographic area. Which AWS Global Infrastructure component should the startup use to host these redundant servers?

Show answer & explanation

Answer: Availability Zones

Answer

Availability Zones
Availability Zones are physically distinct locations within an AWS Region. Each Availability Zone consists of one or more data centers with independent power, cooling, and network connectivity. This design allows developers to run applications in a highly available and fault-tolerant manner, protecting them from localized disruptions like power outages or natural disasters affecting a single facility.

Step-by-Step Solution

1
Analyze the requirement for physically isolated locations within the same geographic area to protect against localized failures like power outages.
Identify that the solution must provide local fault isolation and high availability without introducing the complexity of multi-region deployment.
This helps narrow down the infrastructure components to those operating within a single AWS Region.
2
Evaluate the AWS Global Infrastructure components against this requirement.
Availability Zones consist of one or more discrete data centers with redundant power, networking, and connectivity, separated physically to isolate failures.
Deploying across multiple Availability Zones ensures that if one zone fails, the application remains running in another zone.

Key Concept

AWS Availability Zones provide physical isolation and fault tolerance within an AWS Region.
Question 999Question →

A company needs to configure storage in AWS for two distinct use cases. First, they need a highly durable object storage solution to store and retrieve static office documents. Second, they need a persistent block storage volume to attach to a single Amazon EC2 instance for a relational database. Which two AWS storage services should the company use to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Amazon Simple Storage Service (Amazon S3); Amazon Elastic Block Store (Amazon EBS)

Answer

The company should use Amazon Simple Storage Service (Amazon S3) for document object storage, and Amazon Elastic Block Store (Amazon EBS) for database block storage.
Amazon Simple Storage Service (Amazon S3) is the correct choice for storing static documents because it is designed for highly durable object storage. Amazon Elastic Block Store (Amazon EBS) is the correct choice for the relational database because it provides persistent, low-latency block storage that can be attached to a single EC2 instance.

Step-by-Step Solution

1
Analyze the first requirement: highly durable object storage for static office documents.
Identify Amazon Simple Storage Service (Amazon S3) as the primary AWS service designed for object storage with high durability.
Amazon S3 is built to store and retrieve any amount of data as objects from anywhere on the web, making it the perfect fit for static files like documents.
2
Analyze the second requirement: persistent block storage attached to a single EC2 instance for a database.
Identify Amazon Elastic Block Store (Amazon EBS) as the primary AWS service that provides persistent, low-latency block-level storage volumes for EC2 instances.
Databases require high-performance, persistent block storage, which is the primary use case for Amazon EBS volumes.

Key Concept

AWS Storage Services classification and use cases (Object storage vs. Block storage vs. File storage)
Question 1000Question →

AquaPure Utilities operates an on-premises data center where it recently purchased high-capacity servers to run a monthly water-quality simulation that lasts for 48 hours. During the rest of the month, these servers remain largely idle, yet the utility must continue to pay for power, cooling, and physical security. By migrating this simulation workload to AWS and paying only for the compute resources during the active 48-hour window, which concept of cloud economics is AquaPure Utilities primarily leveraging?

Show answer & explanation

Answer: Trading capital expense (CapEx) for variable operating expense (OpEx) to pay only for active resource consumption

Answer

Trading capital expense (CapEx) for variable operating expense (OpEx) to pay only for active resource consumption
The correct answer is the trade-off of capital expense (CapEx) for variable operating expense (OpEx). By running the simulation on AWS, the utility avoids upfront server purchases and pays only for resources consumed during the 48-hour window.

Step-by-Step Solution

1
Analyze the current on-premises cost structure and utilization pattern.
The utility has high upfront capital expenses (CapEx) for hardware that remains idle 93% of the time, resulting in inefficient spending on power and space.
To identify the source of financial inefficiency.
2
Evaluate the impact of moving the periodic simulation to a cloud consumption model.
On AWS, the utility can use compute resources on-demand and pay only for the 48 hours of simulation time, converting fixed upfront hardware costs into variable operational expenses (OpEx).
To determine the cloud economic principle that solves the identified inefficiency.

Key Concept

The transition from capital expenses (CapEx) to variable operational expenses (OpEx) in cloud economics.
Estimated Time:1m 30s
PreviousPage 50 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin