All practice questions

1473 questions

Question 1061Question

Match each AWS compute service to the description that best represents its primary features and typical use cases.

Click a left item, then click its matching right item

Items

Amazon EC2
AWS Lambda
Amazon Lightsail

Matches

Show answer & explanation

Answer

Amazon EC2 matches to resizable virtual servers that provide full administrator control over the operating system. AWS Lambda matches to serverless compute service that runs code in response to events without provisioning or managing servers. Amazon Lightsail matches to virtual private servers with pre-configured templates and predictable monthly pricing.
Each service is correctly aligned to its core design goal: Amazon EC2 for control and custom configuration, AWS Lambda for serverless event-driven automation, and Amazon Lightsail for simplicity and flat-rate monthly costs.

Step-by-Step Solution

1
Identify the key characteristics of Amazon EC2.
Amazon EC2 offers virtual machines (instances) with complete control over the guest operating system and customizable resources.
This matches the definition highlighting full administrator control.
2
Identify the key characteristics of AWS Lambda.
AWS Lambda is serverless and executes code when triggered by events (like file uploads or HTTP requests).
This matches the definition highlighting serverless event-driven execution.
3
Identify the key characteristics of Amazon Lightsail.
Amazon Lightsail is designed for simple, predictable workloads with flat-rate pricing and preconfigured software templates.
This matches the definition highlighting pre-configured templates and predictable monthly pricing.

Key Concept

AWS Compute Services
Question 1062Question

A company wants to automate application deployments to a fleet of Amazon EC2 instances and on-premises servers. The operations team needs a service that can deploy software updates, web content, or configuration files without requiring manual SSH access to each server or causing application downtime.

Which AWS service is designed to automate these application deployments to EC2 instances and on-premises servers?

Show answer & explanation

Answer: AWS CodeDeploy

Answer

AWS CodeDeploy
AWS CodeDeploy is designed specifically to automate application deployments to any instance, including Amazon EC2 instances and on-premises servers, allowing for rapid deployment of new features and avoiding downtime during deployment.

Step-by-Step Solution

1
Analyze the scenario requirements.
Identify that the solution must automate application deployments to both Amazon EC2 instances and on-premises servers, while avoiding manual server configuration or downtime.
To filter out services that do not support hybrid (on-premises and cloud) deployments or do not focus on application-level deployment.
2
Evaluate the capability of the candidate AWS services.
AWS CodeDeploy is specifically built to deploy application packages to EC2 instances and on-premises servers. AWS CloudFormation and AWS Elastic Beanstalk are provisioning tools, and AWS Lambda is a serverless compute platform.
To select the tool designed specifically for application deployment across hybrid environments.

Key Concept

AWS Developer Tools for Application Deployment
Question 1063Question

An online retail company is designing its operational procedures on AWS. The company has two key requirements:

1. A developer needs to write a custom Go application that programmatically transfers transaction records directly into an Amazon S3 bucket.
2. A DevOps engineer needs to define a reusable, text-based template to provision identical testing environments with VPCs and EC2 instances.

Which of the following AWS deployment and operating methods are appropriate for these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Software Development Kit (SDK) to programmatically upload transaction records from within the Go application code; AWS CloudFormation to create template files that define and deploy the identical testing environments

Answer

AWS Software Development Kit (SDK) to programmatically upload transaction records from within the Go application code, and AWS CloudFormation to create template files that define and deploy the identical testing environments.
The correct options are using the AWS SDK for custom Go code integration and AWS CloudFormation for templated, repeatable environment deployments. The AWS SDK offers APIs tailored to programming languages like Go, making programmatic operations seamless. AWS CloudFormation allows users to define resource configurations in JSON or YAML templates to deploy infrastructure repeatedly and reliably.

Step-by-Step Solution

1
Analyze the first requirement: writing a custom Go application to programmatically upload files.
Identify that the AWS Software Development Kit (SDK) is designed for writing code in programming languages (like Go) to interact programmatically with AWS services.
Integrating AWS service actions into application code requires language-specific SDK libraries.
2
Analyze the second requirement: defining reusable, text-based templates to provision identical testing environments.
Identify that AWS CloudFormation is the service used to write infrastructure templates (JSON or YAML) to deploy resources in a repeatable manner.
Infrastructure as Code (IaC) is implemented via CloudFormation templates in AWS.

Key Concept

Selecting the correct AWS interaction method (SDK, CloudFormation, CLI, Console) based on operational and deployment requirements.
Question 1064Question

Match each workload requirement to the most appropriate AWS compute service.

Click a left item, then click its matching right item

Items

A containerized API that must be run on a serverless compute engine where you pay only for the resources consumed by the container itself.
A simple testing environment for a developer requiring a bundled virtual machine with pre-configured memory, SSD storage, and static IP addresses at a predictable monthly cost.
A serverless task that runs automated database backups on a scheduled CRON trigger, executing in under 3 minutes.
An enterprise resource planning (ERP) application that requires direct access to the underlying OS to install proprietary device drivers and configuration files.

Matches

Show answer & explanation

Answer

The containerized API matches with AWS Fargate; the simple testing environment matches with Amazon Lightsail; the short-lived scheduled database backup task matches with AWS Lambda; and the enterprise application requiring OS-level root access matches with Amazon EC2.
AWS Fargate is designed for running serverless containers without administrative overhead. Amazon Lightsail is optimized for quick, predictable virtual machine packages for simple environments. AWS Lambda is the ideal serverless tool for short, event-driven, or scheduled scripts. Amazon EC2 provides full root access and control over the operating system for legacy or customized software configurations.

Step-by-Step Solution

1
Analyze the serverless container execution requirement.
The requirement specifies running a containerized workload serverlessly without managing virtual machines. This matches AWS Fargate.
AWS Fargate is the primary serverless compute engine for running containers in Amazon ECS or EKS without server management.
2
Evaluate the requirement for a predictable, bundled virtual private server.
The developer needs a simple, bundled virtual machine with pre-configured resources at a predictable cost. This matches Amazon Lightsail.
Amazon Lightsail simplifies virtual private server management by bundling compute, storage, and networking into a single fixed monthly fee.
3
Identify the best option for the short, scheduled backup script.
The backup task runs on a schedule and completes within 3 minutes. This matches AWS Lambda.
AWS Lambda is ideal for event-driven, short-lived tasks that run in response to schedule expressions without needing a continuously running server.
4
Assess the operational control required by the ERP application.
The application requires access to the operating system to install custom drivers. This matches Amazon EC2.
Amazon EC2 provides virtual servers with complete administrative access (root/Administrator level) to configure the OS as needed.

Key Concept

Differentiating AWS compute services based on operational overhead, containerization requirements, level of administrative control, and pricing models.
Estimated Time:1m 30s
Question 1065Question

A software developer is writing a backend application in Python that runs on Amazon EC2. The application must programmatically retrieve configuration files from an Amazon S3 bucket and insert records into an Amazon DynamoDB table in real-time as transactions occur. Which AWS tool or method is specifically designed to enable this programmatic interaction within the application's code?

Show answer & explanation

Answer: AWS Software Development Kit (AWS SDK)

Answer

AWS Software Development Kit (AWS SDK)
The AWS Software Development Kit (AWS SDK) provides language-specific APIs (such as Boto3 for Python) that allow developers to integrate and interact programmatically with AWS services directly from within their application code.

Step-by-Step Solution

1
Analyze the operational requirements of the application scenario.
The application backend, written in Python, needs to programmatically execute API calls (get objects from S3 and write items to DynamoDB) automatically at runtime.
This establishes that the required interaction is programmatic and embedded within application source code rather than manual or administrative.
2
Match the programmatic runtime requirement to the appropriate AWS interaction method.
The AWS Software Development Kit (AWS SDK) provides the necessary language-specific libraries (such as Boto3 for Python) to interact with S3 and DynamoDB from code.
The other methods (CLI, Console, CloudFormation) are designed for administrative scripting, manual interaction, or infrastructure provisioning, rather than in-application runtime API calls.

Key Concept

The AWS Software Development Kit (SDK) is the primary tool for programmatic service integration inside application code.
Estimated Time:1m 0s
Question 1066Question

A research institution is deploying an analytics application on AWS. The application requires two distinct storage solutions:

1. A shared, POSIX-compliant file system that can be accessed concurrently by a fleet of over 100 Amazon EC2 instances.
2. A high-performance, persistent block storage volume attached to a single EC2 instance for a transactional database.

Which two AWS storage services should the organization choose to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) to provide the shared file system; Amazon Elastic Block Store (Amazon EBS) to provide the persistent block storage for the database

Answer

Amazon Elastic File System (Amazon EFS) should be selected for the concurrent, POSIX-compliant shared file system, and Amazon Elastic Block Store (Amazon EBS) should be selected to provide persistent block storage for the transactional database.
The system requires a shared file system accessible by many instances simultaneously, which matches Amazon Elastic File System (Amazon EFS). It also requires persistent block storage for a single database instance, which matches Amazon Elastic Block Store (Amazon EBS).

Step-by-Step Solution

1
Analyze the first requirement: a shared, POSIX-compliant file system that supports concurrent access from multiple (100+) EC2 instances.
Identify Amazon Elastic File System (Amazon EFS) as the correct choice since it is a fully managed network file system (NFS) designed for multi-instance concurrent access.
Amazon EFS is natively POSIX-compliant and supports simultaneous mounts from multiple EC2 instances, whereas EBS is typically limited to single-instance attachment at this scale and S3 is object storage rather than a native file system.
2
Analyze the second requirement: persistent block storage attached to a single EC2 instance for a transactional database.
Identify Amazon Elastic Block Store (Amazon EBS) as the correct choice since it offers persistent block-level storage volumes for a single instance.
Amazon EC2 Instance Store is temporary (ephemeral) storage and does not persist data when the instance is stopped, making it unsuitable for a persistent database. S3 Glacier is for archival storage and does not support block-level access or low-latency database workloads.

Key Concept

Selecting appropriate AWS storage services based on access pattern (object vs. file vs. block) and persistence requirements.

Alternative Method

For database storage, while Amazon RDS is a managed database service that could be used, the scenario specifies attaching a storage volume to a single self-managed EC2 instance, which restricts the choice to EC2-compatible block storage (EBS).
Estimated Time:2m 0s
Question 1067Question

A company is planning to deploy a new web application on AWS. The development team wants to write templates to define and provision the required infrastructure as code. At the same time, they want a platform-as-a-service solution to deploy the application code without manually managing the underlying EC2 instances, load balancers, or scaling policies. Which of the following AWS services should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudFormation; AWS Elastic Beanstalk

Answer

AWS CloudFormation and AWS Elastic Beanstalk
AWS CloudFormation satisfies the infrastructure as code requirement by allowing users to define resources in templates. AWS Elastic Beanstalk satisfies the application deployment requirement by acting as a platform-as-a-service that manages capacity provisioning, load balancing, auto-scaling, and health monitoring.

Step-by-Step Solution

1
Identify the service needed for writing templates to define and provision infrastructure as code.
AWS CloudFormation
AWS CloudFormation is the AWS service designed for infrastructure as code modeling and provisioning using templates.
2
Identify the service needed to deploy code quickly without manually managing the underlying infrastructure components.
AWS Elastic Beanstalk
AWS Elastic Beanstalk is the platform-as-a-service (PaaS) that handles capacity provisioning, auto-scaling, load balancing, and monitoring automatically.

Key Concept

Distinguishing between AWS resource provisioning and deployment services like AWS CloudFormation and AWS Elastic Beanstalk.
Question 1068Question

An AWS partner manages multiple client accounts under a single consolidated bill. The partner needs to apply custom pricing rules, such as specific markups, and generate customized pro forma bills for each client. Which AWS tool should the partner use for this purpose?

Show answer & explanation

Answer: AWS Billing Conductor

Answer

AWS Billing Conductor
AWS Billing Conductor is the correct tool because it allows AWS partners and enterprise customers to define custom pricing rules, apply markups or discounts, and organize accounts into billing groups to generate customized pro forma bills.

Step-by-Step Solution

1
Identify the core business requirement from the scenario.
The requirement is to customize billing data, apply custom pricing rules (markups), and generate custom pro forma invoices for multiple clients sharing a consolidated bill.
This helps determine which cost management tool supports billing data customization and pro forma invoicing.
2
Evaluate the capabilities of the available AWS Billing and Cost Management tools.
AWS Billing Conductor supports custom pricing rules and pro forma billing, while AWS Budgets tracks budget thresholds, AWS Cost Explorer analyzes historical spend, and AWS Pricing Calculator estimates future costs.
Matching the requirements to the correct service capabilities identifies the appropriate tool.

Key Concept

AWS Billing Conductor is used to customize billing rates and generate pro forma bills for clients or business units under a consolidated billing structure.
Question 1069Question

A logistics firm runs a vehicle tracking application on Amazon EC2 instances within a specific subnet in a Virtual Private Cloud (VPC). The security team must implement a solution that allows incoming HTTPS traffic to the EC2 instances from a trusted corporate partner's IP address range. Additionally, they must block all inbound traffic from a known malicious IP range at the subnet boundary. Which combination of AWS network security actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an inbound rule in the Security Group associated with the EC2 instances to allow HTTPS traffic from the partner's IP address range; Create an inbound deny rule in the Network Access Control List (Network ACL) associated with the subnet to block the malicious IP range

Answer

The correct actions are to create an inbound allow rule in a Security Group for the trusted partner's IP range, and to create an inbound deny rule in a Network ACL for the malicious IP range.
To allow traffic to specific EC2 instances, you configure an inbound allow rule in a Security Group, which operates at the instance level. To block a malicious IP range at the subnet boundary, you configure an inbound deny rule in a Network ACL, which operates at the subnet level and supports explicit deny rules.

Step-by-Step Solution

1
Analyze the requirement to allow inbound traffic from a trusted partner's IP range at the EC2 instance level.
Identify that Security Groups are the primary tool for instance-level firewall protection and support allow rules.
Security Groups control inbound and outbound traffic at the instance interface level.
2
Analyze the requirement to block a known malicious IP range at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules.
Network ACLs act as a stateless firewall to filter traffic before it enters or leaves the subnet boundary, and support explicit deny rules.

Key Concept

The difference between instance-level stateful Security Groups and subnet-level stateless Network ACLs in AWS VPC architecture.
Estimated Time:1m 30s
Question 1070Question

A digital health startup is launching a telemedicine application. The startup wants to pay for computing resources only when the application is actively running, rather than investing in physical servers upfront. Additionally, the developers want the infrastructure to scale up or down automatically in response to daily patient traffic fluctuations, avoiding the need to predict peak capacity.

Which two benefits of the AWS Cloud directly align with the startup's requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trade fixed expense for variable expense; Stop guessing capacity

Answer

Trading fixed expense for variable expense and stopping guessing capacity are the correct answers.
The startup's goal to pay only for active resources instead of physical servers represents the benefit of trading fixed expense for variable expense. The goal to scale resources automatically based on traffic without predicting peak capacity represents the benefit of stopping guessing capacity.

Step-by-Step Solution

1
Analyze the first requirement: pay for resources only when active rather than buying physical servers upfront.
This matches the benefit 'Trade fixed expense for variable expense' because it shifts spending from capital expenses (fixed servers) to operational expenses (variable usage).
Identify the economic benefit described in the scenario.
2
Analyze the second requirement: automatically scale capacity up or down to match traffic fluctuations without predicting peak capacity.
This matches the benefit 'Stop guessing capacity' by leveraging elasticity to scale dynamically based on demand rather than over-provisioning.
Identify the operational benefit described in the scenario.

Key Concept

AWS Cloud Benefits (specifically Trading Fixed Expense for Variable Expense, and Stopping Guessing Capacity)
Question 1071Question

A marketing department needs to store product images and PDF brochures. These assets must be publicly accessible via direct URL links from the internet to be embedded in marketing emails. Which AWS storage service is best suited for storing and serving these files directly over the web?

Show answer & explanation

Answer: Amazon Simple Storage Service (Amazon S3)

Answer

Amazon Simple Storage Service (Amazon S3)
Amazon Simple Storage Service (Amazon S3) is an object storage service designed to store and serve static content, such as images and PDFs, directly to the web. Each object in Amazon S3 is assigned a unique URL, allowing direct access from internet applications or marketing emails when configured with appropriate public permissions.

Step-by-Step Solution

1
Analyze the access requirement for the stored files.
The files (images and PDFs) must be directly accessible to users via public URL links over the internet.
This determines whether the storage interface needs to support direct web access (object storage) or requires attachment to a compute instance (block or file storage).
2
Evaluate the capabilities of the available AWS storage services.
Amazon S3 allows objects to be configured for public access and provides direct HTTP/HTTPS URLs for each object. Services like EBS and EFS must be mounted to EC2 instances and cannot serve files directly to the web, while S3 Glacier is intended for archival data with delayed retrieval times.
Matching the requirements to the correct service capabilities leads to selecting the most suitable and direct solution.

Key Concept

Selecting the appropriate AWS storage service based on access patterns (object storage for web-facing static assets).
Estimated Time:45s
Question 1072Question

A media broadcasting network is developing a news distribution platform. The platform has two requirements: first, it must store structured user subscription information and article metadata, allowing complex SQL queries and relational integrity; second, it must temporarily store and serve the most popular articles in memory to minimize read latency for visitors. Which AWS services should be selected to handle these data requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora; Amazon ElastiCache

Answer

Amazon Aurora and Amazon ElastiCache
Amazon Aurora provides a high-performance relational database that supports standard SQL queries and table joins, satisfying the requirement to store structured subscriptions and article metadata. Amazon ElastiCache functions as an in-memory caching layer that speeds up article access by storing popular content in RAM, reducing overall read latency.

Step-by-Step Solution

1
Identify the service required for structured relational data that involves complex SQL queries.
Amazon Aurora is selected as the relational database engine because it is fully compatible with MySQL and PostgreSQL and designed for complex relational transactional workloads.
The requirement specifies structured user subscription data and article metadata requiring complex SQL queries and relational integrity.
2
Identify the service required to cache popular articles in memory to reduce read latency.
Amazon ElastiCache is selected because it provides managed in-memory caching capabilities.
The requirement specifies storing popular articles in memory to minimize read latency for visitors.
3
Combine the selected services and eliminate inappropriate alternatives.
The final selection is Amazon Aurora and Amazon ElastiCache.
The other options represent NoSQL, data warehousing, or object storage services that do not align with the specific transactional relational and caching requirements.

Key Concept

Selecting AWS database services based on relational query requirements and low-latency cache requirements.
Estimated Time:1m 30s
Question 1073Question

An online education platform plans to host its virtual classroom software on AWS to serve students located exclusively in South America. To ensure these students experience the lowest network latency when accessing the platform, in which AWS Global Infrastructure component should the platform's primary servers be deployed?

Show answer & explanation

Answer: An AWS Region located in South America

Answer

An AWS Region located in South America
Deploying the primary servers in an AWS Region located in South America is the correct choice because AWS Regions represent distinct geographic locations. Choosing the Region closest to the end-users minimizes the physical distance the network traffic must travel, resulting in the lowest latency and best user experience.

Step-by-Step Solution

1
Analyze the user requirement of minimizing network latency for users located in South America.
Identify that geographical proximity between the application servers and the end-users is the primary factor in reducing network latency.
Data travels faster over shorter physical distances, so hosting resources near the user base is necessary.
2
Evaluate the AWS Global Infrastructure components to determine which one hosts primary servers in a specific geographic area.
Determine that AWS Regions allow customers to deploy active applications and virtual machines closer to their target users, while Edge Locations are only for caching content and Availability Zones are sub-components within a Region.
Selecting the closest AWS Region ensures the primary server infrastructure is physically near the end-users.

Key Concept

AWS Regions are geographic areas that host infrastructure. Choosing a Region close to end-users is the primary method for reducing network latency for application servers.
Question 1074Question

An insurance firm needs to archive historical policy documents to meet compliance regulations. These files are rarely accessed, but when a customer requests a policy lookup, the document must be retrieved immediately (within milliseconds). The firm wants to minimize storage costs without sacrificing durability. Which Amazon S3 storage class should the firm choose?

Show answer & explanation

Answer: Amazon S3 Standard-Infrequent Access

Answer

Amazon S3 Standard-Infrequent Access is the correct choice because it is designed for infrequently accessed data that requires rapid, millisecond retrieval when requested, providing the necessary durability and low latency at a lower storage cost than Amazon S3 Standard.
Amazon S3 Standard-Infrequent Access is the correct choice because it is specifically designed for data that is accessed less frequently but requires rapid, millisecond retrieval when requested. It provides the same durability and low latency as Amazon S3 Standard but at a lower storage cost, matching the requirements of the scenario.

Step-by-Step Solution

1
Analyze the access frequency and retrieval time requirements.
The documents are accessed infrequently but must be retrieved within milliseconds when requested.
This eliminates archive classes with minutes-to-hours retrieval times, such as Glacier Flexible Retrieval.
2
Compare the remaining storage options to find the most cost-effective solution.
Amazon S3 Standard-Infrequent Access offers the same durability and low latency as Amazon S3 Standard but at a lower storage cost, fitting the cost-optimization goal.
This provides the required millisecond performance while minimizing monthly storage fees.

Key Concept

Selecting S3 storage classes based on access frequency, retrieval speed requirements, and cost-efficiency.
Estimated Time:1m 0s
Question 1075Question

A digital publishing company is storing sensitive author manuscripts in an Amazon S3 bucket. The company mandates the use of server-side encryption with AWS Key Management Service (SSE-KMS) to protect the data at rest. Under the AWS Shared Responsibility Model, which of the following security-related tasks is the responsibility of the customer?

Show answer & explanation

Answer: Defining and managing the key policies that control access to the encryption keys

Answer

Defining and managing the key policies that control access to the encryption keys
The correct answer is correct because configuring key policies determines who can access the keys, which is a customer-side configuration control under the Shared Responsibility Model.

Step-by-Step Solution

1
Analyze the encryption requirement in the scenario.
The scenario requires using server-side encryption with AWS KMS (SSE-KMS) on Amazon S3.
This establishes that the service in use is AWS Key Management Service (KMS), which is an AWS-managed service.
2
Apply the Shared Responsibility Model boundaries to the KMS service.
AWS is responsible for physical security, hardware maintenance, and patching the host OS. The customer is responsible for configuring access policies, key rotation, and usage permissions.
This helps isolate customer duties from AWS duties.
3
Evaluate the choices to identify the task managed by the customer.
Defining key policies is a customer configuration task, whereas physical security, OS patching, and dedicated HSM provisioning do not apply to the customer's KMS configuration.
This yields the correct answer and identifies why other choices represent AWS responsibilities or incorrect service mappings.

Key Concept

The AWS Shared Responsibility Model specifies that for managed services like AWS KMS, AWS manages the underlying infrastructure and physical security, while the customer manages access policies and key configurations.
Estimated Time:1m 15s
Question 1076Question

A technology company is building a containerized web application on AWS that runs across multiple Availability Zones. The application architecture has two key storage requirements:

First, it requires a fully managed, shared file system that can be concurrently mounted by all container instances to access shared configuration files.

Second, it requires a cost-effective object storage solution to store user profile images that are accessed infrequently but must be available immediately when requested.

Which two AWS storage services should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS); Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Answer

Amazon Elastic File System (Amazon EFS) and Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
The correct options are Amazon Elastic File System (Amazon EFS) and Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon EFS provides a fully managed shared file system that can be accessed concurrently by multiple containers across Availability Zones, satisfying the first requirement. Amazon S3 Standard-IA offers lower-cost object storage for infrequently accessed files while still guaranteeing immediate (millisecond) retrieval times, satisfying the second requirement.

Step-by-Step Solution

1
Analyze the first requirement: a shared file system concurrently mounted by containers across multiple Availability Zones.
Identify Amazon Elastic File System (Amazon EFS) as the appropriate service, since it supports POSIX compliance and simultaneous access from multiple instances/containers across AZs.
Amazon EBS is block storage meant for single instances (with limited Multi-Attach support not suited for general cross-AZ file systems), and Instance Store is local, temporary storage.
2
Analyze the second requirement: object storage for infrequently accessed data that must be immediately available.
Identify Amazon S3 Standard-Infrequent Access (S3 Standard-IA) as the correct choice, as it provides cheaper storage for infrequent access with millisecond retrieval.
Amazon S3 Glacier Flexible Retrieval is archival and requires minutes to hours for data retrieval, which fails the immediate availability requirement.

Key Concept

Selecting the appropriate AWS storage services (Amazon EFS for shared file storage and Amazon S3 Standard-IA for cost-effective, infrequently accessed object storage with immediate retrieval) based on application requirements.
Question 1077Question

An organization is designing a two-tier application in an Amazon VPC. The database tier must be completely isolated from direct inbound internet traffic, while the web tier must accept public web traffic from the internet. Which two configuration options will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a public subnet with a route pointing to an Internet Gateway for the web tier; Configure a private subnet without a route pointing to an Internet Gateway for the database tier

Answer

Configure a public subnet with a route pointing to an Internet Gateway for the web tier, and configure a private subnet without a route pointing to an Internet Gateway for the database tier.
The correct architecture uses a public subnet with a route to an Internet Gateway to allow web traffic to reach the web tier, and a private subnet without an Internet Gateway route to keep the database tier isolated. Communication between subnets in the same VPC is enabled by default via local routing, so VPC Peering or Transit Gateway are not required.

Step-by-Step Solution

1
Identify the requirement for the web tier.
The web tier must accept public web traffic, which requires placing it in a public subnet that has a route to an Internet Gateway.
An Internet Gateway is the VPC component that enables communication between resources in the VPC and the internet.
2
Identify the requirement for the database tier.
The database tier must be isolated from direct internet access, which requires placing it in a private subnet with no route to an Internet Gateway.
Preventing a route to the Internet Gateway ensures that the resources cannot be accessed directly from the public internet.

Key Concept

VPC Subnet Types and Routing (Public vs. Private Subnets)
Question 1078Question

A media streaming company is planning to deploy a globally distributed application across multiple AWS Regions. The architecture team has established two specific requirements:

1. Route global client traffic to the AWS Region that offers the lowest latency, with automatic redirection to an alternate region if the primary region becomes unhealthy.
2. Establish a dedicated, private physical network connection from the company's on-premises offices to AWS, bypassing the public internet entirely.

Which two AWS network services or features should the company select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon Route 53; AWS Direct Connect

Answer

Amazon Route 53 and AWS Direct Connect
Amazon Route 53 and AWS Direct Connect are the correct choices. Amazon Route 53 is a highly available and scalable Domain Name System (DNS) service that can route end-users to the nearest AWS Region using latency-based routing, while also performing health checks to fail over to a healthy region. AWS Direct Connect establishes a dedicated, private physical network connection from an on-premises facility directly to AWS, bypassing the public internet entirely.

Step-by-Step Solution

1
Analyze the first requirement: routing global client traffic to the nearest AWS Region based on lowest latency, with automatic failover.
Amazon Route 53 is identified as the correct service because it supports latency-based routing policies and DNS health checks to automatically redirect traffic away from unhealthy regions.
Ensures that global users experience low latency and high availability.
2
Analyze the second requirement: establishing a dedicated, private physical connection from on-premises offices to AWS, bypassing the public internet.
AWS Direct Connect is identified as the correct service because it links an on-premises network directly to an AWS Direct Connect location over a dedicated physical network cable, completely bypassing the public internet.
Meets the requirement for private, consistent, and secure hybrid network connectivity.
3
Evaluate and eliminate the incorrect options.
VPC Peering is eliminated as it only connects VPCs to each other. Network ACLs are eliminated as they function as subnet-level firewalls. Amazon CloudWatch is eliminated as it is a monitoring service.
Verifies that none of the distractors meet the specified requirements.

Key Concept

AWS Network Services
Estimated Time:2m 0s
Question 1079Question

A software development team is building a microservices-based application on AWS. They need to solve two main operational challenges:
1. Automatically compile their application code, run unit tests, and generate deployable artifacts whenever code changes are committed.
2. Monitor, analyze, and debug request latency and performance issues as user transactions flow through the interconnected microservices.

Which TWO AWS services should the team use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CodeBuild; AWS X-Ray

Answer

AWS CodeBuild and AWS X-Ray
AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages that are ready to deploy. AWS X-Ray helps developers analyze and debug distributed applications, such as microservices, by tracing user requests as they travel through the application.

Step-by-Step Solution

1
Analyze the first requirement: Automatically compile application code, run unit tests, and generate deployable artifacts.
AWS CodeBuild is identified as the service designed for building, compiling, and testing code.
AWS CodeBuild is the primary managed service for running builds and creating deployment artifacts.
2
Analyze the second requirement: Monitor, analyze, and debug request latency and performance issues across microservices.
AWS X-Ray is identified as the distributed tracing tool for analyzing latency and request flows.
AWS X-Ray provides end-to-end tracing capability for microservices to pinpoint latency issues.

Key Concept

AWS Developer Tools
Estimated Time:1m 30s
Question 1080Question

A fintech startup is deploying a transaction processing application on AWS. They need to configure access control for two distinct scenarios: first, an application running on an Amazon EC2 instance that needs to read and write transactions to an Amazon DynamoDB table; second, a cloud engineer who requires access to the AWS Management Console to monitor resources. Which of the following identity and access management practices should the startup implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM role with the minimum permissions required to access the DynamoDB table and attach it to the EC2 instance profile.; Create a dedicated IAM user for the cloud engineer, assign permissions using an IAM group, and enable multi-factor authentication (MFA).

Answer

The startup should configure an IAM role with the minimum permissions for DynamoDB access and attach it to the EC2 instance profile, and also create a dedicated IAM user for the cloud engineer, assigning permissions through an IAM group with multi-factor authentication (MFA) enabled.
The correct configurations involve using an IAM role for the EC2 instance to safely access the DynamoDB table via temporary credentials, and creating a dedicated IAM user with MFA and group-based permissions for the cloud engineer. These steps adhere to the AWS best practices of avoiding root user usage for daily operations and utilizing temporary credentials where possible.

Step-by-Step Solution

1
Identify the access requirements for the EC2 instance application.
The application needs access to a DynamoDB table. Instead of using long-term credentials like an IAM user's access keys, the secure approach is to use temporary credentials.
Attaching an IAM role to the EC2 instance profile provides the application with temporary, automatically rotated credentials, eliminating the risk of exposed secrets.
2
Identify the access requirements for the cloud engineer.
The engineer needs to access the console. The best practice is to create a dedicated IAM user with permissions managed via a group and protect the account with multi-factor authentication (MFA).
Using the root user for daily activities is highly discouraged, and group-based permissions simplify access management while MFA adds an extra layer of security.

Key Concept

AWS Identity and Access Management (IAM) best practices for applications and administrators
PreviousPage 54 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin