Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 1101Question →

An eco-tourism agency hosts its public-facing room booking portal on Amazon EC2 instances within a public subnet, and its internal database on EC2 instances within a private subnet. The security team needs to configure network security controls to meet two requirements: block specific malicious public IP addresses at the subnet boundary, and allow the web servers to communicate with the database while ensuring return traffic is automatically allowed at the instance level. Which TWO configurations should the security team implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an inbound deny rule in the Network ACL associated with the web server subnet to block the malicious IP addresses.; Configure the database security group to allow inbound traffic from the web servers, relying on the stateful nature of security groups to permit return traffic.

Answer

The security team should create an inbound deny rule in the Network ACL associated with the web server subnet, and configure the database security group to allow inbound traffic from the web servers.
The requirements are met by combining a Network ACL and a Security Group. A Network ACL operates at the subnet boundary and supports explicit deny rules, which allows the security team to block specific malicious IP addresses. A security group operates at the instance level and is stateful, meaning that allowing inbound traffic automatically permits the corresponding outbound return traffic without requiring separate outbound configuration.

Step-by-Step Solution

1
Identify the service required to block specific IP addresses at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, allowing the blocking of specific malicious IP addresses.
Security groups do not support deny rules and operate at the instance level, not the subnet boundary.
2
Identify the configuration required to allow instance-to-instance communication with automatic return traffic.
Security groups are stateful firewalls at the instance level; allowing inbound traffic automatically permits the corresponding return traffic.
Using a stateful security group eliminates the need to configure outbound rules for return traffic, whereas a stateless Network ACL would require explicit configuration in both directions.

Key Concept

Security groups are stateful firewalls at the instance level that support only allow rules, whereas Network ACLs are stateless firewalls at the subnet level that support both allow and deny rules.
Question 1102Question →

An online education platform is migrating its core infrastructure to Amazon EC2. The platform's workload profile includes:

* An administrative student portal database that must run continuously 24/7 with a highly predictable baseline compute load.
* A video transcoding service that processes user-uploaded lecture videos; this process is stateless, fault-tolerant, can be paused or resumed, and has no strict completion deadline.
* A virtual classroom application that experiences highly unpredictable, short-duration spikes in user traffic whenever a popular live session is announced.

To optimize costs while meeting application requirements, which of the following pricing model strategies should the company implement? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Deploy the video transcoding service using Spot Instances to utilize spare capacity at the lowest price point.; Deploy the virtual classroom application's dynamic scaling capacity using On-Demand Instances to accommodate unpredictable traffic spikes.

Answer

Deploy the video transcoding service using Spot Instances and deploy the virtual classroom application's dynamic scaling capacity using On-Demand Instances.
The correct strategy uses Spot Instances for the video transcoding service because it is a stateless, fault-tolerant workload that can handle interruptions, allowing the company to run it at a significant discount. It also uses On-Demand Instances for the virtual classroom application's dynamic scaling capacity because the traffic spikes are unpredictable, meaning the company needs immediate, reliable compute capacity without committing to long-term costs.

Step-by-Step Solution

1
Analyze the video transcoding workload characteristics.
The video transcoding job is identified as stateless, fault-tolerant, and flexible with no strict completion deadline.
Workloads with these traits are optimal candidates for Spot Instances, which provide spare AWS capacity at significant discounts in exchange for potential interruption.
2
Analyze the virtual classroom workload characteristics.
The virtual classroom application experiences highly unpredictable, short-duration spikes.
Unpredictable spikes require instant scale-up capabilities without any long-term capacity commitment, making On-Demand Instances the most appropriate choice.
3
Analyze the student portal database workload characteristics.
The database requires continuous 24/7 operation with a highly predictable baseline compute load.
Predictable, steady-state workloads should be covered by Reserved Instances or Savings Plans to secure discounts, rather than expensive On-Demand pricing or interruptible Spot Instances.

Key Concept

Selecting the optimal Amazon EC2 pricing model based on workload characteristics (predictability, fault tolerance, and duration) to maximize cost efficiency.
Question 1103Question →

A media production company is designing a collaborative editing workflow on AWS. The design requires a shared file system that can be accessed concurrently by multiple Amazon EC2 instances distributed across different Availability Zones. Additionally, the company must store historical video archives for long-term preservation at the lowest possible storage cost, where a retrieval time of a few hours is acceptable. Which two AWS storage services should the company choose to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS); Amazon S3 Glacier Flexible Retrieval

Answer

Amazon Elastic File System (Amazon EFS) and Amazon S3 Glacier Flexible Retrieval
The correct services are Amazon Elastic File System (Amazon EFS) and Amazon S3 Glacier Flexible Retrieval. EFS meets the requirement for a POSIX-compliant shared file system accessible concurrently by EC2 instances across multiple Availability Zones. S3 Glacier Flexible Retrieval meets the requirement for low-cost archival storage where a retrieval window of a few hours is acceptable.

Step-by-Step Solution

1
Analyze the requirement for concurrent shared access across multiple EC2 instances in different Availability Zones.
Identify Amazon Elastic File System (Amazon EFS) as the managed file storage service that support POSIX file system interface and concurrent access across multiple AZs.
Block storage options like EBS cannot natively provide concurrent shared file access across instances in different Availability Zones.
2
Analyze the requirement for long-term preservation of historical video archives at the lowest possible cost with a retrieval time of a few hours.
Identify Amazon S3 Glacier Flexible Retrieval as the optimal low-cost archival storage class that supports retrieval within 3-5 hours (or minutes using expedited retrieval).
Standard object storage is too expensive for archival storage, and temporary instance store does not persist data.

Key Concept

AWS Storage Service Selection based on access patterns, protocol, and cost requirements
Question 1104Question →

A logistics company is deploying a fleet of delivery tracking applications on Amazon EC2. The applications require two types of storage:

1. A high-performance block storage volume attached to a single EC2 instance that holds transaction logs and must persist if the instance is stopped or restarted.
2. A fully managed shared file system that can be accessed concurrently by multiple EC2 instances across multiple Availability Zones to store shared configuration and report templates.

Which TWO AWS storage services should the company select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon EBS; Amazon EFS

Answer

Amazon EBS and Amazon EFS
Amazon EBS is the correct choice for persistent block storage for an EC2 instance, ensuring logs are preserved during instance stops. Amazon EFS is correct for a shared file system that must be accessed concurrently by multiple EC2 instances across multiple Availability Zones.

Step-by-Step Solution

1
Analyze the first requirement: persistent block storage for transaction logs attached to a single EC2 instance.
Identify Amazon EBS as the service that provides persistent, low-latency block storage volumes for EC2.
Since the data must persist when the instance is stopped or restarted, ephemeral options like Instance Store are unsuitable.
2
Analyze the second requirement: a shared file system accessible by multiple EC2 instances across multiple Availability Zones simultaneously.
Identify Amazon EFS as the service that provides a serverless, shared file system supporting the Network File System (NFS) protocol.
EFS allows concurrent access from multiple instances across different Availability Zones, unlike standard block storage.

Key Concept

Selecting the appropriate AWS storage services (block versus file) based on application requirements for persistence and multi-instance sharing.
Question 1105Question →

A retail logistics company, ZenithFreight, is moving its on-premises package tracking system to AWS. The company currently pays upfront for physical servers, network switches, and data center cooling, which must be depreciated over five years. On AWS, ZenithFreight will pay a monthly invoice based on the compute and storage resources it actually uses each hour. Which of the following represents the primary cloud economics shift ZenithFreight is making, and its associated benefit?

Show answer & explanation

Answer: Shifting from Capital Expenditures (CapEx) to Operational Expenditures (OpEx), which allows the company to trade fixed capital expenses for variable operational costs.

Answer

Shifting from Capital Expenditures (CapEx) to Operational Expenditures (OpEx), which allows the company to trade fixed capital expenses for variable operational costs.
The correct answer accurately describes the transition from Capital Expenditures (CapEx) to Operational Expenditures (OpEx). On-premises data centers require substantial upfront capital investments (CapEx) for hardware and facilities that must be depreciated. In contrast, AWS allows businesses to pay for services on a variable, pay-as-you-go basis as an ongoing operational cost (OpEx).

Step-by-Step Solution

1
Identify the current on-premises cost structure.
ZenithFreight's upfront payments for hardware and facilities represent Capital Expenditures (CapEx).
Establishing the starting financial state is necessary to trace the economic shift.
2
Analyze the cloud cost model for ZenithFreight's workload.
The hourly, utility-based payment structure on AWS represents Operational Expenditures (OpEx).
This determines the destination financial model in cloud economics.
3
Correlate the shift with the primary benefit of cloud computing.
Trading upfront CapEx for variable OpEx enables paying only for what is used.
Matching the correct transition and benefit identifies the correct answer.

Key Concept

CapEx to OpEx Shift
Estimated Time:1m 0s
Question 1106Question →

A company's operations team needs to execute a configuration script and apply a security patch across a fleet of 50 Amazon EC2 instances. The team wants to perform this task centrally and securely, without manually logging into each instance or managing SSH/RDP credentials. Which AWS service should the operations team use to meet these requirements?

Show answer & explanation

Answer: AWS Systems Manager

Answer

AWS Systems Manager
AWS Systems Manager is correct because its Run Command feature allows administrators to securely execute commands, scripts, and apply OS patches on a group of EC2 instances centrally without requiring SSH or RDP credentials.

Step-by-Step Solution

1
Identify the core requirement of the scenario: executing configuration scripts and applying patches centrally on running Amazon EC2 instances without direct remote login (SSH/RDP).
Requirements mapped to centralized operational management and remote command execution.
This establishes the functional boundary for the correct service selection.
2
Evaluate the available AWS services to determine which one is designed for operational management, patching, and remote command execution on instances.
AWS Systems Manager provides the Run Command and Patch Manager features which address these requirements.
Determining the correct service requires matching service capabilities against scenario constraints.
3
Evaluate distractors to ensure they do not fit the operational management paradigm requested.
Provisioning and deployment tools (CloudFormation, Elastic Beanstalk, CodeDeploy) are verified to be incorrect.
This step ensures that common misconceptions regarding provisioning versus operations are eliminated.

Key Concept

AWS Systems Manager provides centralized operational management for AWS resources, including the execution of administrative commands and patching across multiple instances without needing to manage individual access credentials.
Question 1107Question →

A database administrator is planning to configure a standby database instance to ensure application availability in case of a physical data center failure. To achieve this, the standby database should be deployed to a different isolated site within the same geographic area. Which AWS Global Infrastructure component should the administrator choose for the standby database?

Show answer & explanation

Answer: Availability Zone

Answer

Availability Zone
The correct answer is Availability Zone. Availability Zones are isolated locations within a single AWS Region, designed to be physically separated from other Availability Zones and equipped with independent power, cooling, and network infrastructure. This design ensures that a failure in one facility does not affect others, making them the correct choice for deploying standby database instances for high availability.

Step-by-Step Solution

1
Analyze the scenario requirements
The requirement is to deploy a standby database to an isolated, physical data center location within the same geographic area to ensure high availability.
This helps identify which AWS infrastructure component provides localized physical isolation.
2
Evaluate the AWS Global Infrastructure components
Availability Zones consist of one or more discrete data centers within an AWS Region, isolated from each other to prevent concurrent failures.
This matches the criteria of isolated sites within the same geographic region.

Key Concept

Availability Zones provide physical isolation and redundancy within a single AWS Region.
Estimated Time:45s
Question 1108Question →

A financial company is designing a multi-VPC architecture on AWS consisting of 1212 VPCs that all require full interconnection with each other. At the same time, the security team needs to block all inbound traffic from a specific external IP address range (198.51.100.0/24198.51.100.0/24) at the subnet boundary of their web tier. Which AWS networking design should the company use to meet these requirements with the least administrative complexity?

Show answer & explanation

Answer: Use AWS Transit Gateway to interconnect the VPCs, and implement a Network Access Control List (Network ACL) with a deny rule at the web tier subnet boundary.

Answer

Use AWS Transit Gateway to interconnect the VPCs, and implement a Network Access Control List (Network ACL) with a deny rule at the web tier subnet boundary.
Using AWS Transit Gateway simplifies the architecture by acting as a central hub to connect all 12 VPCs, removing the need to configure and manage 66 individual VPC Peering connections. To meet the security requirement, a Network Access Control List (Network ACL) is used because it operates at the subnet boundary and supports explicit deny rules to block traffic from the specified IP range (198.51.100.0/24198.51.100.0/24).

Step-by-Step Solution

1
Evaluate the complexity of interconnecting 12 VPCs using VPC Peering versus AWS Transit Gateway.
A full mesh using VPC Peering requires 12×112=66\frac{12 \times 11}{2} = 66 point-to-point connections, which is complex to manage. AWS Transit Gateway acts as a centralized cloud router, requiring only 12 attachments (one per VPC).
To identify the service that minimizes administrative overhead for multi-VPC routing.
2
Determine the correct firewall mechanism to block a specific external IP range at the subnet level.
Network ACLs are stateless, apply at the subnet boundary, and support explicit deny rules. Security Groups are stateful, apply at the instance level, and support only allow rules.
To satisfy the security requirement of blocking inbound traffic from a specific IP block before it reaches the instances in the subnet.

Key Concept

Multi-VPC routing scaling and subnet-level firewall rules
Question 1109Question →

A medical research institute is deploying a genomics platform on Amazon EC2 with three distinct workloads:

1. A public-facing web portal that must run continuously 24/7 with a predictable, constant baseline capacity.
2. A data analysis cluster that processes large genetic datasets. The processing jobs are fault-tolerant, can be paused and resumed, and have no strict completion deadlines.
3. A clinical reporting application used by hospital staff during local business hours (9:00 AM to 5:00 PM, Monday through Friday). This application requires constant availability during these hours and cannot tolerate any service interruptions.

Which combination of Amazon EC2 pricing models is the most cost-effective for these workloads?

Show answer & explanation

Answer: Savings Plans for the public-facing web portal, Spot Instances for the data analysis cluster, and On-Demand Instances for the clinical reporting application

Answer

Savings Plans for the public-facing web portal, Spot Instances for the data analysis cluster, and On-Demand Instances for the clinical reporting application
The public-facing web portal has a continuous, predictable 24/7 load, making a commitment-based model like Savings Plans (or Reserved Instances) the most cost-effective choice. The data analysis cluster runs fault-tolerant, interruptible workloads, which are ideal for Spot Instances to achieve the maximum discount. The clinical reporting application only runs during business hours (40 hours per week, which is approximately 24% utilization). Committing to a 24/7 Savings Plan for this application would be wasteful compared to using On-Demand Instances and shutting them down outside of business hours.

Step-by-Step Solution

1
Evaluate the pricing model for the 24/7 public web portal.
Savings Plans or Reserved Instances are chosen.
Since the portal requires continuous, predictable 24/7 availability, committing to a 1-year or 3-year term yields the highest discount compared to On-Demand rates.
2
Evaluate the pricing model for the data analysis cluster.
Spot Instances are chosen.
Because the processing jobs are fault-tolerant, can be paused and resumed, and have no tight deadlines, they can utilize spare AWS capacity via Spot Instances at up to a 90% discount.
3
Evaluate the pricing model for the clinical reporting application.
On-Demand Instances are chosen.
The application runs only 40 hours a week. Running On-Demand costs less because the utilization is only 40 hours/168 hours≈23.8%40 \text{ hours} / 168 \text{ hours} \approx 23.8\%. Purchasing a 24/7 commitment (Savings Plan or Reserved Instance) for this workload would charge for the remaining 128 unused hours, making it more expensive than paying the On-Demand rate.
4
Combine the decisions into a single optimal recommendation.
Savings Plans for the portal, Spot Instances for the analysis, and On-Demand for the reporting application.
This combination minimizes the total cost of ownership (TCO) while matching the reliability constraints of each workload.

Key Concept

Selecting cost-optimized Amazon EC2 pricing models based on workload utilization, predictability, and fault tolerance.
Question 1110Question →

A company is planning to migrate their on-premises database workloads to Amazon Aurora. Before any resources are launched, they need to generate an estimate of the expected monthly charges. Additionally, once the workloads are active, they want to receive automated email notifications if their actual costs exceed their monthly budget.

Which AWS Billing and Cost Management tools should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Pricing Calculator; AWS Budgets

Answer

The correct tools are the AWS Pricing Calculator for estimating costs before deployment, and AWS Budgets for setting up threshold alerts for active resources.
The AWS Pricing Calculator is the correct tool for estimating the costs of services prior to launch. AWS Budgets is the correct tool for setting up budget thresholds and receiving proactive email alerts when those thresholds are crossed.

Step-by-Step Solution

1
Identify the pre-deployment requirement: estimating costs before launching Amazon Aurora.
The AWS Pricing Calculator is selected as it is specifically designed for modeling and estimating potential cloud spending before resources exist.
Estimating costs before launching resources requires a planning tool rather than an active monitoring or analysis tool.
2
Identify the post-deployment requirement: receiving automated notifications when spending exceeds a threshold.
AWS Budgets is selected because it enables setting custom cost limits and sending proactive email notifications based on actual or forecasted spending.
Proactive alerting on threshold breaches requires AWS Budgets, whereas other tools like AWS Cost Explorer are focused on historical analysis and visualization.

Key Concept

Differentiating between proactive budgeting/alerting tools and pre-deployment cost estimation tools in AWS.
Question 1111Question →

A company is planning to deploy two distinct workloads on AWS:

1. A containerized microservices API where the company wants to run containers without provisioning, configuring, or managing the physical host servers.
2. A legacy database application that requires full root access to the operating system to install custom kernel modules and operates on a highly predictable resource utilization pattern.

Which AWS compute services should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Fargate to deploy the containerized microservices, as it removes the need to provision and manage the underlying host servers.; Amazon EC2 to deploy the legacy database application, which provides full control over the guest operating system configurations.

Answer

The correct options are AWS Fargate (for running containers without managing host servers) and Amazon EC2 (for the legacy database requiring root operating system control).
AWS Fargate is a serverless compute engine for containers that allows you to run containers without managing the underlying EC2 instances or host infrastructure. Amazon EC2 provides virtual machines in the cloud, giving customers full root-level control over the operating system, which is required to install custom kernel modules or proprietary software.

Step-by-Step Solution

1
Analyze the containerized workload requirements.
The workload requires running containers without managing physical host servers. AWS Fargate matches this need by providing serverless container execution.
This eliminates the operational overhead of provisioning and scaling underlying virtual machines.
2
Analyze the legacy database workload requirements.
The database needs root access to install custom kernel modules and has highly predictable utilization. Amazon EC2 matches this because it offers full guest OS control.
Unlike fully managed or serverless services, EC2 allows deep operating system level customizations.

Key Concept

Selecting appropriate AWS compute services based on administrative control needs and container infrastructure management preferences.
Estimated Time:1m 30s
Question 1112Question →

A company is setting up a secure network infrastructure inside Amazon Virtual Private Cloud (Amazon VPC). To protect their resources, they want to understand the key differences between security groups and network access control lists (network ACLs). Which two statements correctly describe the characteristics of these network security features?

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning return traffic is automatically allowed.; Network ACLs are stateless, meaning return traffic must be explicitly allowed by rules.

Answer

Security groups are stateful, meaning return traffic is automatically allowed; and network ACLs are stateless, meaning return traffic must be explicitly allowed by rules.
Security groups are stateful, meaning that if you send an inbound request, the outbound response is automatically allowed. Conversely, network ACLs are stateless, requiring you to configure explicit inbound and outbound rules for traffic to flow in both directions.

Step-by-Step Solution

1
Differentiate between the resource boundaries of the two features.
Security groups act as a firewall for Amazon EC2 instances (at the instance/ENI level), while network ACLs act as a firewall at the subnet boundary.
This helps eliminate options that incorrectly map the security boundary.
2
Determine how state is maintained for inbound and outbound traffic.
Security groups are stateful (automatically allowing return traffic), whereas network ACLs are stateless (requiring explicit rules for both directions).
This identifies the correct operational characteristics of both features.

Key Concept

VPC Security: Security Groups vs Network ACLs
Estimated Time:45s
Question 1113Question →

A logistics company is deploying a global package tracking system on AWS. The security team mandates that all telemetry data must be encrypted in transit from the tracking devices to the application's Application Load Balancer. Under the AWS Shared Responsibility Model, which of the following actions is the responsibility of the customer to meet this requirement?

Show answer & explanation

Answer: Configuring the Application Load Balancer with an HTTPS listener and associating a valid SSL/TLS certificate

Answer

Configuring the Application Load Balancer with an HTTPS listener and associating a valid SSL/TLS certificate
Under the AWS Shared Responsibility Model, AWS secures the physical infrastructure and hypervisor layers, while the customer is responsible for configuring security settings for their deployed resources. For encrypting data in transit to an Application Load Balancer, the customer must configure an HTTPS listener and associate it with an SSL/TLS certificate (which can be provisioned via AWS Certificate Manager).

Step-by-Step Solution

1
Identify the boundary of responsibility for data protection in transit under the AWS Shared Responsibility Model.
The customer is responsible for configuring encryption of data in transit for their applications (such as setting up HTTPS), while AWS is responsible for securing the underlying physical infrastructure and networks.
This establishes which layer of the security configuration the customer must perform.
2
Evaluate the standard mechanism for securing connections to an Application Load Balancer.
The customer must create an HTTPS listener on the load balancer and configure it with an SSL/TLS certificate.
This configuration enables SSL/TLS termination at the load balancer, ensuring transit encryption from the client.

Key Concept

AWS Shared Responsibility Model for Data in Transit Encryption
Estimated Time:1m 30s
Question 1114Question →

A company is building a fraud detection application that needs to analyze relationship connections between different entities, such as users, credit cards, IP addresses, and transactions, to identify organized fraud rings. Which managed AWS database service is optimized for storing and querying these highly connected graph relationships?

Show answer & explanation

Answer: Amazon Neptune

Answer

Amazon Neptune is the correct service because it is a managed graph database optimized for storing and querying highly connected graph relationships.
Amazon Neptune is a fully managed graph database service specifically optimized for storing and querying highly connected datasets. It supports popular graph query languages like Apache TinkerPop Gremlin and W3C's SPARQL, making it ideal for use cases like fraud detection, recommendation engines, and social networks where relationships between data points are the primary focus.

Step-by-Step Solution

1
Identify the key data requirements in the scenario.
The application needs to track and query highly connected entity relationships (users, credit cards, IP addresses) to detect patterns (graph structure).
Understanding the structure of the data and query patterns is the first step in selecting the correct AWS database service.
2
Evaluate the candidate AWS database services against the graph relationship requirement.
Amazon Neptune is a dedicated graph database, whereas Amazon RDS is relational, Amazon DynamoDB is key-value/document NoSQL, and Amazon ElastiCache is an in-memory cache.
Matching the architectural workload (graph analysis) to the purpose-built AWS database service ensures high performance and correct design.

Key Concept

AWS Graph Databases (Amazon Neptune)
Question 1115Question →

A company needs to implement a simple, automated solution to stop all non-production Amazon EC2 instances every evening at 19:00. The systems administrator plans to write a shell script on an on-premises server that will execute API commands to filter and stop these instances. Which AWS tool or service is best suited to execute these commands directly from the shell script with minimal development effort?

Show answer & explanation

Answer: AWS Command Line Interface (CLI)

Answer

AWS Command Line Interface (CLI)
The AWS Command Line Interface (CLI) is the most efficient choice because it allows the administrator to run commands directly from the shell script, requiring only simple syntax and no programming language compilation or runtime overhead.

Step-by-Step Solution

1
Identify the environment and execution requirement
The requirement specifies running commands directly from a local shell script.
This determines which interface is compatible with shell command execution.
2
Evaluate the development overhead of options
Using CLI commands in a bash script requires minimal setup compared to writing application code for an SDK.
The goal is to complete the automation task with the least development effort.
3
Select the tool that supports command-line automation
The AWS Command Line Interface (CLI) allows users to query resources and run management commands directly in shell scripts.
It matches the scripting requirement and minimizes code complexity.

Key Concept

Methods of Deploying and Operating in AWS
Question 1116Question →

A software development company wants to allow its developers to access the AWS Management Console using their existing corporate Active Directory credentials. The security team needs to configure this access without creating individual IAM users for each developer. Which of the following approaches represents the AWS-recommended best practice to achieve this?

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles.

Answer

Configuring identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles is the correct approach.
Configuring identity federation using AWS IAM Identity Center allows the organization to leverage its existing corporate identity provider. By mapping Active Directory groups to IAM roles, developers can sign in with their corporate credentials and assume temporary security credentials, eliminating the need to create and maintain individual IAM users in AWS.

Step-by-Step Solution

1
Identify the requirement of using existing corporate credentials for AWS console access without creating local IAM users.
This points to a need for identity federation rather than standard IAM user creation.
Federation delegates authentication to an external identity provider.
2
Determine the appropriate AWS service for integration.
AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and applications.
It simplifies multi-account access and integrates with external identity sources like Active Directory.
3
Map the corporate identities to AWS permissions.
Active Directory groups are mapped to specific IAM roles that define the permissions developers will assume upon login.
IAM roles provide temporary credentials, ensuring secure and automated access control.

Key Concept

Identity Federation and Role-Based Access Control
Question 1117Question →

A startup wants to launch two new workloads on AWS: a containerized application where they do not want to manage or patch any underlying servers, and an event-driven task that runs code only when new images are uploaded to an Amazon S3 bucket.

Which two AWS compute services should the startup choose to meet these needs? (Select two.)

Select all that apply

Show answer & explanation

Answer: AWS Fargate; AWS Lambda

Answer

AWS Fargate and AWS Lambda are the correct compute services to meet the startup's requirements.
AWS Fargate allows you to run containerized applications without managing the underlying virtual machines or patching operating systems. AWS Lambda is an event-driven, serverless compute service that runs code in response to triggers like Amazon S3 uploads without provisioning any servers.

Step-by-Step Solution

1
Identify the service that runs containerized applications without requiring the customer to manage or patch underlying virtual servers.
AWS Fargate is a serverless compute engine for containers that removes the need to provision and manage servers.
This satisfies the first workload requirement for the containerized application.
2
Identify the service that runs code in response to events, such as uploading files to Amazon S3, without managing servers.
AWS Lambda is an event-driven serverless service that executes code in response to S3 bucket triggers.
This satisfies the second workload requirement for the image upload trigger.

Key Concept

Selecting appropriate AWS compute services based on requirements such as serverless, containerization, and event-driven architectures.
Estimated Time:1m 0s
Question 1118Question →

A travel agency is launching a new booking platform. The platform has two requirements:
1. It must store and manage flight bookings and hotel reservations, which requires support for complex table joins and strong transaction integrity (ACID compliance).
2. It must store temporary flight search results and user session tokens to ensure sub-millisecond response times for frequent repeat searches.

Which of the following database services should the agency choose to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora; Amazon ElastiCache

Answer

Amazon Aurora and Amazon ElastiCache
Amazon Aurora provides the transactional compliance and relational capabilities required to manage complex hotel and flight reservations safely. Amazon ElastiCache offers the low-latency, in-memory caching performance necessary to handle session tokens and temporary search queries under sub-millisecond latency constraints.

Step-by-Step Solution

1
Evaluate the first requirement for flight bookings and hotel reservations.
This require transactional integrity (ACID compliance) and relational structures (table joins), which maps to relational database solutions such as Amazon Aurora.
Relational databases are designed to handle complex relationships between datasets with strong schema enforcement.
2
Evaluate the second requirement for temporary search results and session tokens.
This requires sub-millisecond response times for transient data, which maps to in-memory caching solutions such as Amazon ElastiCache.
In-memory caching reduces read latency to sub-millisecond levels by avoiding disk operations.

Key Concept

Selecting and combining relational and in-memory database services to support decoupled application requirements.
Estimated Time:1m 30s
Question 1119Question →

A cloud operations team wants to optimize the management of their AWS environment. They need to select AWS services that will allow them to meet the following two requirements:

1. Run shell scripts and install software patches across a fleet of Amazon EC2 instances without needing to manage SSH keys or bastion hosts.
2. Track and evaluate the configuration history of their AWS resources against predefined compliance rules.

Which of the following AWS services should the team select? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Systems Manager; AWS Config

Answer

The correct answers are AWS Systems Manager and AWS Config.
AWS Systems Manager enables secure remote management of EC2 instances (such as running shell scripts or applying patches) without managing SSH keys. AWS Config records configuration histories and evaluates resource compliance against specified guidelines.

Step-by-Step Solution

1
Identify the AWS service designed for automated fleet management, scripting, and patching without SSH keys.
AWS Systems Manager (specifically Run Command) meets this requirement.
It allows secure command execution across instance fleets.
2
Identify the AWS service designed to record configuration history and evaluate resources against compliance rules.
AWS Config meets this requirement.
It acts as a configuration auditor and compliance evaluator.
3
Select both AWS Systems Manager and AWS Config as the required services.
The final choices are AWS Systems Manager and AWS Config.
Together they satisfy both operational objectives.

Key Concept

AWS Management and Governance Tools
Estimated Time:1m 30s
Question 1120Question →

A media company stores user-generated videos on AWS. The access patterns for these videos are highly unpredictable; some videos become viral and are accessed frequently, while others are rarely viewed. The company wants to automatically save on storage costs without manually moving data and without affecting retrieval performance. Which Amazon S3 storage class is designed to meet this requirement?

Show answer & explanation

Answer: Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Intelligent-Tiering
The correct answer is Amazon S3 Intelligent-Tiering. This storage class automatically optimizes storage costs by moving data between access tiers when access patterns change, without any retrieval fees or operational overhead.

Step-by-Step Solution

1
Analyze the workload requirements
The scenario describes storage for data with unpredictable or changing access patterns (some videos viral, some rarely viewed) where cost optimization is desired without performance impact or manual management.
Identifying the key performance and cost constraints helps narrow down the correct S3 storage class.
2
Evaluate S3 storage classes based on automation and access patterns
Only Amazon S3 Intelligent-Tiering monitors access patterns and automatically moves objects between frequent and infrequent access tiers without retrieval fees.
Other classes like Standard-IA require manual management/lifecycles and charge retrieval fees, while Glacier classes do not support immediate millisecond-level retrieval for active user files.

Key Concept

Selecting the appropriate Amazon S3 storage class based on access patterns and cost optimization requirements.
PreviousPage 56 / 74Next