All practice questions

1473 questions

Question 1121Question

A financial services firm is deploying a high-performance database application on Amazon EC2 instances. The database requires a persistent block storage volume that supports consistent sub-millisecond latency for transactional writes, where data must remain intact even if the instances are stopped. Additionally, the firm needs to create point-in-time backups of this storage that are stored durably across multiple Availability Zones and can be restored as new volumes.

Which two AWS storage options or features should the company select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon EBS Provisioned IOPS SSD (io2) volumes; Amazon EBS Snapshots

Answer

Amazon EBS Provisioned IOPS SSD (io2) volumes and Amazon EBS Snapshots
The correct options are the ones recommending Amazon EBS Provisioned IOPS SSD (io2) volumes and Amazon EBS Snapshots. Amazon EBS Provisioned IOPS SSD (io2) volumes provide the required high-performance, persistent block storage with sub-millisecond latency that persists even when the instances are stopped. Amazon EBS Snapshots provide the point-in-time, incremental backups of these volumes that are stored durably across multiple Availability Zones in S3 and can be restored as new EBS volumes.

Step-by-Step Solution

1
Identify the primary storage requirement: block-level storage, persistent across instance stops, and sub-millisecond latency for transactional writes.
Amazon EBS Provisioned IOPS SSD (io2) volumes satisfy this, while Amazon EC2 Instance Store is ephemeral and Amazon EFS is file-level storage.
Databases require high-performance, persistent block storage.
2
Identify the backup requirement: point-in-time, highly durable across multiple Availability Zones, and restorable to new volumes.
Amazon EBS Snapshots satisfy this requirement by saving volume data incrementally to S3 (which spans multiple Availability Zones).
Snapshots protect against data loss and allow restoration of volumes in any Availability Zone.

Key Concept

Selecting appropriate persistent block storage and backup solutions on AWS
Question 1122Question

A media company needs to run a daily video transcoding job that processes user uploads. The workload is stateless, can be interrupted at any time without data loss, and does not have a strict completion deadline. Which Amazon EC2 pricing model is the most cost-effective choice for this workload?

Show answer & explanation

Answer: Spot Instances

Answer

Spot Instances
Spot Instances are the most cost-effective choice for this workload because they offer up to a 90% discount compared to On-Demand prices by utilizing unused AWS capacity. Because the transcoding job is stateless and has no strict completion deadline, it can easily tolerate the interruptions that may occur when AWS reclaims the capacity.

Step-by-Step Solution

1
Identify key characteristics of the workload from the scenario: it is daily, stateless, interruptible, and has no strict deadline.
The workload is classified as fault-tolerant and flexible.
This classification allows us to filter out pricing models that charge a premium for uninterrupted service.
2
Compare the requirements against AWS EC2 pricing models to find the lowest-cost option that supports interruptions.
Spot Instances match the requirements and offer the lowest cost.
Spot Instances leverage unused EC2 capacity at significant discounts in exchange for the possibility of being reclaimed by AWS with a two-minute warning.

Key Concept

Selecting the optimal Amazon EC2 pricing model based on workload characteristics.
Estimated Time:45s
Question 1123Question

A gaming company is planning to launch a new multiplayer game. The development team needs to estimate the cost of the required AWS resources before deploying them, and they also want to receive email alerts if their actual monthly AWS spending crosses a specific limit.

Which of the following AWS tools should the company use to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: AWS Pricing Calculator to estimate the costs of the new architecture before any resources are deployed; AWS Budgets to define custom cost thresholds and receive alerts when spending exceeds those limits

Answer

The company should use the AWS Pricing Calculator to estimate the costs before deployment, and AWS Budgets to set up threshold-based cost alerts.
To estimate costs before deployment, the AWS Pricing Calculator should be used as it is designed to model and price hypothetical architectures. To monitor spending and receive alerts when custom thresholds are exceeded, AWS Budgets should be used as it supports configuring email notifications based on defined spending limits.

Step-by-Step Solution

1
Identify the tool needed for pre-deployment cost estimation.
AWS Pricing Calculator allows users to estimate the cost of AWS services for a planned architecture before deploying resources.
This matches the requirement to estimate the cost of the required resources before launch.
2
Identify the tool needed for threshold-based cost notifications.
AWS Budgets allows users to set custom budgets and configure alerts that trigger when costs exceed specified thresholds.
This matches the requirement to receive email alerts when actual monthly spending crosses a limit.

Key Concept

Differentiating between AWS pre-deployment cost estimation and proactive budget alerting tools.
Question 1124Question

A financial services organization is planning to migrate its workloads to AWS. The organization currently owns unused perpetual licenses for a third-party database monitoring agent and also wants to purchase a new software-as-a-service (SaaS) analytics solution from the same software vendor. Which two of the following options describe how the organization can utilize AWS Marketplace to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying the database monitoring agent using the Bring Your Own License (BYOL) model, which allows the use of existing licenses while paying only for the underlying AWS infrastructure resources.; Subscribing to the vendor's SaaS-based analytics dashboard through AWS Marketplace to consolidate the software transaction into a single monthly AWS bill.

Answer

The organization can achieve its goals by deploying the database monitoring agent using the Bring Your Own License (BYOL) model, which runs existing licenses on AWS infrastructure, and by subscribing to the SaaS-based analytics dashboard through AWS Marketplace, which consolidates software charges onto the monthly AWS invoice.
The correct options represent the primary capabilities of AWS Marketplace for hybrid software deployment. The Bring Your Own License (BYOL) model allows customers to migrate workloads to AWS using existing licenses, paying AWS only for the underlying infrastructure resources. Subscribing to SaaS products through AWS Marketplace consolidates third-party software costs onto a single AWS invoice, streamlining procurement.

Step-by-Step Solution

1
Analyze the organization's requirement to reuse existing third-party perpetual licenses on AWS.
Identify that the Bring Your Own License (BYOL) model in AWS Marketplace allows customers to run software utilizing licenses purchased outside of AWS, avoiding double-paying for licensing.
This determines how the database monitoring agent licensing is handled.
2
Analyze the requirement to purchase a new SaaS analytics solution while simplifying billing and procurement.
Identify that subscribing to SaaS solutions via AWS Marketplace consolidates vendor pricing and charges directly into the customer's monthly AWS bill.
This determines the mechanism for SaaS dashboard procurement and consolidated invoicing.
3
Evaluate the incorrect options against AWS security, billing, and support models.
Verify that customer-managed EC2 software patching belongs to the customer (Shared Responsibility), AWS usage is operational expenditure (OpEx), and third-party software troubleshooting remains the vendor's responsibility rather than AWS Support's.
This ensures the correctness of distractors and validates the linked misconceptions.

Key Concept

AWS Marketplace deployment models (BYOL), SaaS integration, and billing consolidation
Estimated Time:2m 0s
Question 1125Question

A media streaming company wants to run single-digit millisecond latency-sensitive applications for users in a specific metropolitan area, while also caching video content globally. Which two AWS Global Infrastructure components should the company use to meet these requirements?

Select all that apply

Show answer & explanation

Answer: AWS Local Zones to run application workloads close to end-users in the specific metropolitan area; AWS Edge Locations to cache video content globally using Amazon CloudFront

Answer

AWS Local Zones and AWS Edge Locations
AWS Local Zones allow running latency-sensitive application workloads close to end-users in specific metropolitan areas. AWS Edge Locations cache video content globally via Amazon CloudFront, reducing latency for media retrieval.

Step-by-Step Solution

1
Identify the service component needed for single-digit millisecond latency in specific metropolitan areas.
AWS Local Zones
AWS Local Zones are specifically designed to place compute and storage closer to end-users in major metropolitan areas.
2
Identify the infrastructure component required for global video content caching.
AWS Edge Locations
AWS Edge Locations serve as local caching points for Amazon CloudFront to deliver content globally with low latency.

Key Concept

AWS Global Infrastructure components (Local Zones and Edge Locations)
Question 1126Question

A company is designing a network architecture on AWS. They have multiple VPCs across different AWS accounts that need to communicate with each other in a hub-and-spoke model to simplify routing management. Additionally, they must block traffic from a specific range of malicious external IP addresses at the subnet boundary before it reaches any resources. Which AWS networking services or features should be configured to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Transit Gateway to interconnect the VPCs; Network Access Control Lists (Network ACLs) to block the IP addresses

Answer

AWS Transit Gateway to interconnect the VPCs and Network Access Control Lists (Network ACLs) to block the IP addresses
AWS Transit Gateway simplifies the network architecture by connecting multiple VPCs in a hub-and-spoke topology, avoiding the complexity of a full-mesh VPC Peering network. Network Access Control Lists (Network ACLs) operate at the subnet boundary and support explicit deny rules, which allows them to block traffic from specific IP ranges before it reaches any resources inside the subnets.

Step-by-Step Solution

1
Analyze the requirement for connecting multiple VPCs in a hub-and-spoke model.
Identify AWS Transit Gateway as the central hub that simplifies multi-VPC routing, whereas VPC Peering would require complex mesh configurations.
VPC Peering does not scale easily for large numbers of VPCs due to lack of edge-to-edge routing, making Transit Gateway the correct choice.
2
Analyze the requirement to block malicious external IP addresses at the subnet boundary.
Identify Network Access Control Lists (Network ACLs) as stateless firewalls operating at the subnet level that support explicit deny rules.
Security Groups operate at the instance level and only support allow rules, so they cannot block specific IP ranges at the subnet boundary.

Key Concept

AWS network routing and subnet-level security controls
Estimated Time:2m 0s
Question 1127Question

A media company needs to run a containerized application to process video rendering jobs. Each rendering job takes approximately two hours to complete. The company wants to run these containerized workloads without provisioning or managing the underlying virtual instances or operating systems. Which AWS compute service is the most suitable to meet these requirements?

Show answer & explanation

Answer: AWS Fargate

Answer

AWS Fargate
AWS Fargate is the correct choice because it is a serverless compute engine for containers. It allows users to run containerized applications without provisioning, configuring, or scaling virtual machine instances, and it does not impose a short runtime execution limit like AWS Lambda, making it ideal for a two-hour containerized rendering job.

Step-by-Step Solution

1
Analyze the workload requirements
The workload is containerized, requires long-running execution (two hours), and must be run without managing underlying servers or operating systems.
This establishes the constraints for compute service selection.
2
Evaluate the AWS compute services against the serverless container requirement
AWS Fargate allows running containers in a serverless fashion without managing virtual machine infrastructure.
Identifying the service that matches both container support and serverless management model is necessary.
3
Verify execution time compatibility
AWS Fargate can run containers for hours, satisfying the two-hour requirement, whereas AWS Lambda is limited to 15 minutes.
Ensuring the selected service does not have technical execution limits that block the workload.

Key Concept

AWS Compute Services - Serverless Containers
Estimated Time:1m 30s
Question 1128Question

A SaaS company needs to review its daily AWS resource consumption from the previous month to identify which specific service components are driving a recent spike in execution costs. They also want to use this historical consumption data to project their cloud expenses for the next billing cycle. Which AWS tool is designed to provide these visual reports and cost projections?

Show answer & explanation

Answer: AWS Cost Explorer

Answer

AWS Cost Explorer
AWS Cost Explorer is the correct choice because it is designed to visualize, analyze, and manage AWS costs and usage over time. It allows users to inspect daily or monthly granularity, filter by service or tag, and generate projections (forecasts) of future costs based on historical consumption trends.

Step-by-Step Solution

1
Identify the primary requirement: the user wants to analyze past costs (historical data) and project future costs (forecasting).
The tool must support historical data analysis and forecasting.
This rules out tools that are purely proactive or pre-deployment.
2
Evaluate the capabilities of the available billing tools against these needs.
AWS Cost Explorer is built specifically to visualize, analyze, and forecast costs and usage based on historical trends.
Choosing the service that matches both historical visual analytics and future cost projections.

Key Concept

AWS Billing and Cost Management Tools
Question 1129Question

A healthcare provider is setting up a multi-account AWS environment with twenty Virtual Private Clouds (VPCs) that all need to communicate with a central shared-services VPC. Additionally, the security team requires the ability to block traffic from specific malicious IP addresses at the subnet boundary.

Which of the following AWS network components or configurations should be implemented to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Transit Gateway to connect the VPCs; Network Access Control Lists (NACLs) configured at the subnet level

Answer

AWS Transit Gateway and Network Access Control Lists (NACLs) configured at the subnet level
AWS Transit Gateway acts as a centralized cloud router to simplify network connectivity when interconnecting many VPCs. Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, which allows the security team to block malicious IP addresses before they reach the instances.

Step-by-Step Solution

1
Analyze the connectivity requirement for interconnecting twenty VPCs to a central shared-services VPC.
AWS Transit Gateway is identified as the correct hub-and-spoke solution to simplify routing and management across multiple VPCs.
VPC Peering does not scale easily for a large number of VPC connections due to the overhead of creating and maintaining multiple point-to-point peering relationships.
2
Analyze the security requirement to block traffic from specific malicious IP addresses at the subnet boundary.
Network Access Control Lists (NACLs) are selected because they operate at the subnet level and support explicit deny rules.
Security Groups operate at the instance level and only support allow rules, making them incapable of blocking specific IP addresses at the subnet boundary.

Key Concept

AWS Transit Gateway provides simplified multi-VPC routing, while Network Access Control Lists (NACLs) provide stateless subnet-level traffic filtering with explicit deny rules.
Estimated Time:1m 30s
Question 1130Question

A software development firm wants to prevent cost overruns in its testing environment. The company needs to configure a mechanism that will automatically apply a restrictive IAM policy to a developer group if the actual monthly spend in the environment exceeds 3,0003,000. Which AWS billing and cost management tool should the company use to configure this automated threshold-based action?

Show answer & explanation

Answer: AWS Budgets

Answer

AWS Budgets is the correct tool because it supports budget actions that can automate responses, such as applying restrictive IAM policies, when cost thresholds are crossed.
AWS Budgets allows users to set custom cost and usage budgets. It also supports budget actions, which can be configured to automatically execute specific mitigation steps—such as applying a restrictive IAM policy, applying Service Control Policies (SCPs), or stopping targeted EC2/RDS instances—when actual or forecasted costs exceed a defined threshold.

Step-by-Step Solution

1
Identify the requirement for threshold-based cost alerting combined with automated administrative action (attaching an IAM policy).
The solution must support both monitoring spending thresholds and executing automated programmatic responses.
This rules out purely analytical or planning tools.
2
Evaluate the capabilities of the available AWS cost management tools.
AWS Budgets is the only tool in the cost management suite that supports 'Budget Actions' to automatically run tasks like applying IAM policies or stopping resources when thresholds are breached.
Other tools like AWS Cost Explorer and AWS Pricing Calculator are limited to analysis and estimation, respectively.

Key Concept

AWS Budgets allows you to set custom budgets that track your AWS costs and usage, and configure automated budget actions (such as applying restrictive IAM policies or stopping resources) to control costs programmatically when limits are exceeded.
Question 1131Question

A company needs to implement a solution on AWS that satisfies two operational requirements:

1. Track user activity and API operations across the AWS infrastructure for security auditing and compliance.
2. Monitor application and resource performance, collect log files, and trigger automated alerts when usage thresholds are exceeded.

Which AWS services should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS CloudTrail; Amazon CloudWatch

Answer

AWS CloudTrail and Amazon CloudWatch
AWS CloudTrail and Amazon CloudWatch are the correct selections. AWS CloudTrail records API calls, console activities, and user events to support governance and compliance audits. Amazon CloudWatch collects performance metrics and logs, and triggers alarms based on defined thresholds.

Step-by-Step Solution

1
Analyze the first requirement: tracking user activity and API operations across the infrastructure.
Identify AWS CloudTrail as the service designed specifically for auditing, logging, and monitoring API requests and console interactions.
AWS CloudTrail maintains a history of API events to enable operational auditing and security analysis.
2
Analyze the second requirement: monitoring resource performance, collecting logs, and triggering alerts.
Identify Amazon CloudWatch as the management service that handles real-time resource performance metrics, dashboard visualization, log collection, and metric alarms.
Amazon CloudWatch is the primary monitoring tool for gathering operational metrics and establishing automated threshold alerts.

Key Concept

Distinguishing between AWS auditing (CloudTrail) and performance monitoring/alerting (CloudWatch) services.
Estimated Time:1m 30s
Question 1132Question

A logistics company needs to run a brief data transformation script each time a new telemetry file is uploaded to an Amazon S3 bucket. The script takes less than ten seconds to execute, runs only a few times an hour, and the company wants to avoid provisioning or managing any servers. Which AWS compute service is best suited for this workload?

Show answer & explanation

Answer: AWS Lambda

Answer

AWS Lambda is the most appropriate service because it is an event-driven, serverless compute service that executes code in response to triggers like Amazon S3 uploads without requiring any server administration.
AWS Lambda is correct because it is a serverless compute service designed to run code in response to events, such as file uploads to Amazon S3, without requiring the user to manage servers or pay for idle time.

Step-by-Step Solution

1
Analyze the workload characteristics
The script is short-running (under 10 seconds), runs occasionally (a few times per hour), is triggered by an event (Amazon S3 upload), and requires zero server management.
Understanding the execution duration, frequency, trigger type, and management overhead helps narrow down the appropriate AWS compute service.
2
Evaluate the compute services against the requirements
AWS Lambda is serverless and event-driven, charging only for compute time used. Amazon EC2 and Amazon Lightsail require provisioning and managing virtual servers and charge for continuous uptime. AWS Elastic Beanstalk runs on top of provisioned EC2 instances.
Comparing service capabilities ensures the selection of the most cost-effective and low-overhead option.

Key Concept

Identifying the correct AWS compute service based on business needs, specifically serverless event-driven execution with AWS Lambda.
Estimated Time:45s
Question 1133Question

A company needs to adopt the appropriate AWS tools for two different operational requirements:

1. A developer wants to write a custom Python application that programmatically uploads data to Amazon S3.
2. A cloud engineer needs to define, version-control, and replicate their entire multi-tier environment (including networks and databases) using templates.

Which two tools or operating methods should the company use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS Software Development Kit (SDK); AWS CloudFormation

Answer

The company should use the AWS SDK for the programmatic Python script and AWS CloudFormation to define and replicate their infrastructure using templates.
The AWS SDK provides language-specific APIs (such as Boto3 for Python) that allow developers to programmatically interact with AWS services, making it the correct choice for the S3 upload script. AWS CloudFormation allows users to model and set up AWS resources using JSON or YAML templates, enabling version control and repeatable deployment of the entire multi-tier infrastructure.

Step-by-Step Solution

1
Identify the programmatic access requirement
Writing a custom Python script to interact programmatically with AWS services requires an API wrapper or library, which is the role of the AWS SDK.
The developer needs programmatical access rather than manual console interaction.
2
Identify the infrastructure templating requirement
Defining, version-controlling, and replicating an entire multi-tier environment using templates requires an Infrastructure as Code (IaC) tool, which is the role of AWS CloudFormation.
The cloud engineer needs a repeatable template-based deployment method.
3
Exclude incorrect options
AWS Elastic Beanstalk, Amazon EBS, and AWS Budgets do not meet these specific requirements.
Elastic Beanstalk is for web application hosting, Amazon EBS is block storage, and AWS Budgets is for cost management.

Key Concept

AWS deployment and operating methods including the AWS SDK and AWS CloudFormation.
Question 1134Question

A financial services firm is deploying a web application on Amazon EC2 instances in a new Virtual Private Cloud (VPC). The network security team wants to configure a firewall control that operates at the instance level. They require that any inbound traffic allowed into the instance is automatically permitted to flow outbound, without needing to create a corresponding outbound rule. Which AWS resource meets these requirements?

Show answer & explanation

Answer: A security group, because it is stateful and evaluates traffic at the instance level.

Answer

A security group, because it is stateful and evaluates traffic at the instance level.
The correct answer states that a security group is stateful and operates at the instance level. In AWS, security groups act as virtual firewalls for EC2 instances. Because they are stateful, connection tracking automatically permits response traffic to flow back to the client even if no outbound rules allow it.

Step-by-Step Solution

1
Determine the required evaluation boundary (subnet vs. instance).
The requirement specifies instance-level control, which aligns with Security Groups rather than Network ACLs (which operate at the subnet level).
Identifying the correct layer of defense helps narrow down the appropriate AWS security service.
2
Identify the statefulness requirements for return traffic.
The requirement demands that return traffic is automatically allowed without explicit rules. This is the definition of stateful connection tracking, which is supported by Security Groups.
Stateless controls like Network ACLs evaluate inbound and outbound traffic independently, requiring manual rules for both directions.

Key Concept

AWS Security Groups are stateful firewalls that operate at the instance level, whereas Network ACLs are stateless firewalls that operate at the subnet level.
Question 1135Question

A media company is building an automated metadata archiving pipeline for its catalog of Spanish-language news broadcasts. The pipeline must perform the following tasks:
1. Convert the spoken Spanish audio of the broadcasts into written Spanish text.
2. Translate the generated Spanish text into English text.
3. Analyze the video frames to detect and extract on-screen news banners (text) and identify prominent public figures or brand logos.
To minimize custom machine learning model development, the company wants to use pre-trained AWS AI services. Which combination of AWS services should the company use to meet these requirements?

Show answer & explanation

Answer: Amazon Transcribe to convert the spoken audio to text, Amazon Translate to translate the text, and Amazon Rekognition to extract text and identify public figures from the video frames

Answer

The combination of Amazon Transcribe to convert the spoken audio to text, Amazon Translate to translate the text, and Amazon Rekognition to extract text and identify public figures from the video frames.
The correct option correctly maps each task to the corresponding fully managed, pre-trained AWS AI service: Amazon Transcribe converts the spoken Spanish audio to text, Amazon Translate translates the Spanish text into English, and Amazon Rekognition extracts on-screen text and identifies public figures from the video frames.

Step-by-Step Solution

1
Identify the service required to convert the pre-recorded spoken Spanish audio into written text.
Amazon Transcribe is selected because it is the AWS service designed for speech-to-text conversion.
Converting spoken audio to written text requires a transcription service, not a conversational chatbot (Lex) or a text-to-speech converter (Polly).
2
Identify the service required to translate the transcribed Spanish text into English text.
Amazon Translate is selected because it is designed for fluent text translation between languages.
Translation is the primary function of Amazon Translate, whereas Amazon Comprehend is designed for NLP analysis such as sentiment and key phrase detection, not language translation.
3
Identify the service required to analyze the video frames to detect text and recognize public figures/logos.
Amazon Rekognition is selected because it is a computer vision service with pre-trained capabilities for text-in-image extraction (OCR), object detection, and celebrity recognition.
Using Amazon Rekognition avoids custom model development, unlike Amazon SageMaker which would require building and training models from scratch.

Key Concept

AWS Machine Learning Services
Estimated Time:2m 0s
Question 1136Question

A healthcare provider plans to build a patient portal on AWS. The portal will run on Amazon EC2 instances and store sensitive medical imaging files in an Amazon S3 bucket. Compliance regulations require all data to be encrypted both at rest and in transit.

Which of the following actions are the responsibility of the customer to ensure data protection under the AWS Shared Responsibility Model? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transit; Defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at rest

Answer

Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transit, and defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at rest
The correct actions are configuring SSL/TLS (HTTPS) for data in transit and defining key policies for AWS KMS customer managed keys. Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud,' which includes encrypting their own data in transit (by using HTTPS protocols) and managing access control to their encryption keys (via key policies).

Step-by-Step Solution

1
Identify the data protection requirements in the scenario.
The compliance regulations require encryption at rest and encryption in transit for patient data.
This establishes the scope of the required security controls.
2
Apply the AWS Shared Responsibility Model to differentiate customer and AWS duties for encryption.
The customer is responsible for configuring SSL/TLS (HTTPS) for data in transit and managing key policies for AWS KMS keys at rest. AWS is responsible for physical hardware security and underlying infrastructure maintenance.
This isolates the tasks that fall under customer ownership from those managed automatically by AWS.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (including physical security, hypervisors, and managed service infrastructure), while the customer manages security 'in' the cloud (including configuring secure transport protocols, managing encryption keys, and defining key policies).
Question 1137Question

A healthcare clinic wants to improve accessibility for its patient portal. The clinic needs to convert written patient guides into natural-sounding spoken audio files, and implement a conversational chatbot to help patients schedule appointments. Which two AWS machine learning services should the clinic use to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon Polly; Amazon Lex

Answer

Amazon Polly and Amazon Lex
Amazon Polly is correct because it is a service that turns text into lifelike speech, addressing the requirement for audio guides. Amazon Lex is correct because it is used to build conversational interfaces for applications using voice and text, addressing the chatbot requirement.

Step-by-Step Solution

1
Identify the service for text-to-speech conversion.
Amazon Polly
Converting written patient guides into spoken audio files requires a text-to-speech service.
2
Identify the service for building conversational interfaces.
Amazon Lex
Creating a chatbot to help patients schedule appointments requires natural language understanding and conversational interface design.

Key Concept

AWS Machine Learning Services
Estimated Time:45s
Question 1138Question

A growing digital marketing agency wants to streamline permissions management for its designers, copywriters, and analysts. The agency needs to ensure that when a new designer joins, they automatically receive the correct permissions, and when they change roles, their permissions are updated easily. Which of the following options represent AWS-recommended best practices to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Organize IAM users into IAM groups based on job functions and attach policies to the groups.; Apply the principle of least privilege by granting only the permissions required for each job function.

Answer

Organizing IAM users into groups based on job functions and applying the principle of least privilege by granting only the necessary permissions.
Organizing users into IAM groups based on job functions simplifies the management of permissions because policies can be attached to the group rather than individual users. Moving a user between groups automatically updates their permissions. Additionally, applying the principle of least privilege ensures that users have only the minimum access necessary, which improves security.

Step-by-Step Solution

1
Analyze the requirements for streamlining access control and permissions updates for different job functions.
Identify that managing permissions individually is inefficient and that groups are the AWS-recommended way to manage permissions for multiple users with similar job functions.
Grouping simplifies policy attachment and ensures consistency.
2
Evaluate the security principles for granting access to resources.
Apply the principle of least privilege, ensuring that users have only the permissions required for their specific role.
This reduces the blast radius of compromised credentials.

Key Concept

AWS IAM Groups and the Principle of Least Privilege
Question 1139Question

A university research department needs to visualize their AWS spending patterns over the last three months to identify cost trends and generate a report for the department head. Which AWS tool should they use to analyze and graph this historical cost data?

Show answer & explanation

Answer: AWS Cost Explorer

Answer

AWS Cost Explorer
AWS Cost Explorer is specifically designed to allow users to visualize, understand, and manage their AWS costs and usage over time. It provides high-level charts and detailed breakdowns of historical spend (such as the last three months), making it the ideal tool for identifying spending trends and generating reports.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to analyze and visualize historical AWS cost data over the last three months.
This helps determine if the tool needs to be proactive (alerting), predictive (estimating), or analytical (historical).
2
Evaluate the capabilities of the available AWS Billing and Cost Management tools against the requirement.
AWS Cost Explorer provides default reports and graphs to analyze past cost and usage, whereas other tools serve different purposes like alerting (AWS Budgets) or pre-deployment estimation (AWS Pricing Calculator).
Matching the specific business need (historical cost visualization) to the correct service definition ensures the correct tool is selected.

Key Concept

AWS Cost Explorer is used to visualize, analyze, and graph historical cost and usage data, helping organizations identify trends and optimize their AWS spend.
Estimated Time:45s
Question 1140Question

An organization is reviewing AWS Support plans to identify tiers that provide access to a Technical Account Manager (TAM). Which two AWS Support plans should the organization consider? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Enterprise On-Ramp Support; Enterprise Support

Answer

Enterprise Support and Enterprise On-Ramp Support
Enterprise Support and Enterprise On-Ramp Support are the only plans that include access to a Technical Account Manager. Enterprise Support features a dedicated Technical Account Manager, while Enterprise On-Ramp offers access to a pooled group of Technical Account Managers.

Step-by-Step Solution

1
Determine which AWS Support plans include the Technical Account Manager role.
Only the Enterprise-level support tiers include access to a Technical Account Manager.
Lower-level support tiers like Basic, Developer, and Business do not offer this service.
2
Select the correct Enterprise-level tiers from the options.
Enterprise On-Ramp and Enterprise Support are the two options that offer either pooled or dedicated Technical Account Manager services.
These are the correct plans that satisfy the requirement.

Key Concept

AWS Support plans that include Technical Account Manager services
PreviousPage 57 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin