Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 121Question →

A logistics and distribution firm is evaluating a migration to the AWS Cloud. The company's leadership wants to eliminate the high overhead costs associated with powering, cooling, and protecting physical server rooms. Furthermore, they want to leverage the lower pricing that AWS can offer due to its high volume of aggregated customer usage. Which of the following are benefits of migrating to the AWS Cloud that align with these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop spending money running and maintaining data centers; Benefit from massive economies of scale

Answer

The benefits of 'Stop spending money running and maintaining data centers' and 'Benefit from massive economies of scale' are the two benefits that align with the company's goals.
The correct options are stopping spending money running and maintaining data centers, and benefiting from massive economies of scale. These directly map to the logistics firm's goals of eliminating physical infrastructure overhead and leveraging lower volume-based pricing.

Step-by-Step Solution

1
Analyze the company's requirements from the scenario: eliminating the overhead of physical server rooms, and utilizing lower pricing from high aggregated usage.
The requirements demand reduction in facility maintenance costs and leveraging volume-based price reductions.
Understanding the customer's specific business drivers helps map them to correct AWS Cloud benefits.
2
Map the analyzed requirements to the official six benefits of AWS Cloud computing.
Eliminating physical server rooms maps to 'Stop spending money running and maintaining data centers'. Lower pricing from aggregated usage maps to 'Benefit from massive economies of scale'.
This confirms the alignment between the scenario's challenges and the standard benefits of cloud adoption.

Key Concept

Benefits of the AWS Cloud
Question 122Question →

A company has a fleet of Amazon EC2 instances that need to dynamically retrieve customer reports from a private Amazon S3 bucket. The lead developer wants to ensure that the application on these instances has secure, programmatic access without hardcoding credentials or exposing the account to security risks. Which approach aligns with the AWS-recommended best practice for granting this access?

Show answer & explanation

Answer: Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.

Answer

Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.
The correct approach is to create an IAM role with the appropriate S3 permissions and attach it to the EC2 instances using an instance profile. This allows the application on the EC2 instances to retrieve temporary security credentials dynamically, eliminating the need to store static, long-term access keys on the instance.

Step-by-Step Solution

1
Analyze the access requirement for an EC2 instance application to retrieve data from a private S3 bucket.
The application needs programmatic access to S3 bucket APIs.
Identifying the resource and access pattern helps narrow down correct credential types.
2
Eliminate choices suggesting the use of permanent, long-term credentials or root user access on EC2 instances.
Discard methods relying on hardcoded IAM user access keys or root account credentials.
Hardcoding access keys or using the root user violates the principle of least privilege and exposes the account to significant security risks.
3
Distinguish between customer and AWS responsibility regarding resource configuration and access control.
Understand that S3 bucket policies and EC2 access permissions are managed by the customer, not AWS Support.
According to the AWS Shared Responsibility Model, Identity and Access Management configuration is 'security in the cloud' and lies entirely with the customer.
4
Apply the recommended IAM mechanism for temporary programmatic access from AWS services.
Select the option that configures an IAM role associated with an EC2 instance profile.
IAM roles provide temporary, automatically rotated security credentials to applications running on EC2 instances, eliminating key management overhead and security leaks.

Key Concept

Identity and Access Management (IAM) Roles and Access Control Best Practices
Estimated Time:2m 0s
Question 123Question →

A multi-department enterprise needs to grant a third-party auditing firm temporary, read-only access to specific AWS Billing reports and Amazon CloudTrail logs in their production AWS account. The auditing firm has its own AWS account. Which of the following approaches is the most secure and aligns with AWS Identity and Access Management (IAM) best practices to accomplish this?

Show answer & explanation

Answer: Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.

Answer

Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.
The correct option correctly identifies using a cross-account IAM role with an external ID. An IAM role is designed for delegating secure access without needing to share long-term AWS credentials. The trust policy permits the third party's AWS account to assume the role, and the external ID prevents the confused deputy security issue.

Step-by-Step Solution

1
Evaluate identity delegation options for external third parties.
Determine that cross-account access using IAM roles is the secure path as it generates temporary credentials rather than using static access keys.
This minimizes the risk of credential leakage and simplifies access management by avoiding IAM user creation for external entities.
2
Apply the principle of least privilege and security mitigations.
Ensure the role has read-only permissions and utilizes an external ID in the trust policy.
Least privilege limits exposure, and the external ID mitigates the confused deputy security vulnerability in multi-tenant environments.

Key Concept

Delegating access to AWS resources using IAM roles for cross-account third-party entities
Question 124Question →

A gaming company is launching a new multiplayer game. The team cannot accurately predict how many players will join on launch day. They want to avoid paying for idle servers if player turnout is low, while also ensuring the game does not crash if player turnout is high. Which AWS Cloud benefit is directly demonstrated in this scenario?

Show answer & explanation

Answer: Stop guessing capacity

Answer

Stop guessing capacity
The correct answer is the option stating that customers can stop guessing capacity. This benefit allows organizations to automatically adjust resource capacity in response to real-time traffic demand, avoiding both the cost of idle resources and the performance issues of under-provisioned infrastructure.

Step-by-Step Solution

1
Analyze the business scenario's requirements.
The company has unpredictable user demand and needs to scale resources dynamically to avoid high costs (over-provisioning) or crashes (under-provisioning).
Understanding the core requirement helps map it to the correct AWS Cloud benefit.
2
Map the scenario requirements to the six benefits of AWS Cloud computing.
The scenario directly describes eliminating the need to guess infrastructure capacity by scaling up or down dynamically, which aligns with 'Stop guessing capacity'.
Identifying the correct AWS definition ensures alignment with exam expectations.

Key Concept

Eliminating infrastructure capacity guessing to prevent resource waste and application downtime.
Estimated Time:1m 0s
Question 125Question →

A software development company is designing a new continuous integration and continuous deployment (CI/CD) pipeline on AWS. The pipeline must run multiple automated tests on isolated, clean environments for every code commit, and then clean up all resources immediately after the tests complete. Which two of the following design decisions demonstrate the application of the 'disposable resources' design principle?

Select all that apply

Show answer & explanation

Answer: Using AWS CloudFormation templates to programmatically provision identical testing environments for each commit and deleting the stacks automatically after test execution.; Configuring the test runner to launch temporary Amazon EC2 Spot Instances that boot up, execute the tests, and are terminated immediately upon completion.

Answer

The correct decisions are: using AWS CloudFormation templates to programmatically provision and delete testing environments, and using temporary Amazon EC2 Spot Instances that are terminated immediately after test execution.
The correct design decisions involve using AWS CloudFormation to automatically provision and delete testing environments, and utilizing temporary Amazon EC2 Spot Instances that are terminated immediately after use. Both decisions treat infrastructure as temporary and disposable, allowing environments to be created and destroyed programmatically to optimize costs and maintain consistency.

Step-by-Step Solution

1
Analyze the business and technical requirements of the scenario.
The scenario requires isolated, clean environments for automated testing that are terminated immediately after execution to minimize costs.
Understanding the lifecycle of the required resources is necessary to match them with the appropriate AWS design principle.
2
Evaluate the design decisions against the definition of 'disposable resources'.
The principle of disposable resources states that servers and other components should be treated as temporary assets that can be easily replaced, typically enabled through automation and Infrastructure as Code (IaC).
Applying the core definition of the AWS design principle helps filter out static or manual architectures.
3
Identify options that utilize automated provisioning and teardown of temporary components.
Using AWS CloudFormation to automatically spin up and destroy identical stacks, and using EC2 Spot Instances that are terminated post-execution, are both practices that align with disposable resources.
These actions programmatically manage the resource lifecycle dynamically based on demand rather than maintaining fixed assets.

Key Concept

Disposable resources instead of fixed servers is a core AWS Cloud design principle. It states that infrastructure components should be treated as temporary assets that can be programmatically launched, configured, and terminated on demand, rather than being treated as permanent, static servers.
Estimated Time:2m 30s
Question 126Question →

A multinational retail company is hosting its web applications on Amazon EC2 instances and is preparing for an upcoming external security audit. The company needs to document the exact division of security tasks between themselves and AWS. Which of the following tasks is the sole responsibility of AWS under the AWS Shared Responsibility Model?

Show answer & explanation

Answer: Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances

Answer

Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances
Under the AWS Shared Responsibility Model, AWS is responsible for 'Security of the Cloud,' which encompasses the physical infrastructure, global network, hardware, and virtualization hypervisor. For Amazon EC2, which is an Infrastructure as a Service (IaaS) service, the hypervisor layer is managed exclusively by AWS, making the patching of this layer the sole responsibility of AWS.

Step-by-Step Solution

1
Identify the service type in the scenario
The scenario specifies Amazon EC2, which is an Infrastructure as a Service (IaaS) offering.
The division of responsibilities under the AWS Shared Responsibility Model depends heavily on whether the service is IaaS, PaaS, or SaaS.
2
Determine the boundary between AWS and customer responsibilities for IaaS
For EC2, AWS manages the physical security, hardware, and the virtualization layer (hypervisor). The customer manages everything from the guest operating system upward, including network traffic configurations and IAM permissions.
This helps isolate which options belong to AWS (security of the cloud) and which belong to the customer (security in the cloud).
3
Evaluate the options against this boundary
Hypervisor maintenance is an infrastructure/virtualization layer task managed by AWS. Guest OS patching, NACL configuration, and compliance document retrieval from the portal are active tasks performed by the customer.
To select the correct option representing the sole responsibility of AWS.

Key Concept

Shared Responsibility Model IaaS boundaries
Estimated Time:2m 0s
Question 127Question →

A media company is migrating a legacy web application to AWS. To avoid managing virtual machines, the team decides to package the application's code into containers and run it on AWS Fargate, and migrate the underlying MySQL database to Amazon Aurora MySQL. The application's core code and business logic remain completely unchanged. Which migration strategy is the company executing?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
The correct strategy is replatforming because the company is migrating its application to the cloud with minor optimizations—specifically moving to managed container orchestration (AWS Fargate) and a managed database service (Amazon Aurora)—without changing the core application logic.

Step-by-Step Solution

1
Identify the architectural and infrastructure changes made during migration.
The application is moved to containers on AWS Fargate, and the database is moved to Amazon Aurora.
Analyzing infrastructure modifications helps classify the migration type.
2
Examine whether the application's core code or business logic has been modified.
The application's core code and business logic remain completely unchanged.
No code changes rules out the refactoring strategy, which requires re-architecting application code.
3
Distinguish between a direct lift-and-shift (rehosting) and optimizations using managed services (replatforming).
Moving to Fargate and Aurora represents optimizations using managed services without changing application code.
Replatforming involves modifying the platform to reduce operational overhead while keeping the core application intact.

Key Concept

AWS Cloud Migration Strategies
Question 128Question →

A healthcare provider is planning to migrate its patient portal to AWS to handle unpredictable seasonal traffic. The IT director proposes that by deploying this application on AWS and utilizing dynamic resource scaling, the organization will benefit by transitioning their IT spending from operating expenses (OpEx) to capital expenses (CapEx). Which of the following statements directly refutes the IT director's proposal by correctly identifying a core benefit of the AWS Cloud?

Show answer & explanation

Answer: The organization will transition from capital expenses (CapEx) to variable operating expenses (OpEx), which represents the benefit of trading upfront expense for variable expense.

Answer

The organization will transition from capital expenses (CapEx) to variable operating expenses (OpEx), which represents the benefit of trading upfront expense for variable expense.
The correct answer accurately states that migrating to AWS allows organizations to shift their IT spending from capital expenses (CapEx)—such as physical servers and data centers—to variable operating expenses (OpEx), where they only pay for the resources they use. This directly aligns with the AWS Cloud benefit of trading upfront expense for variable expense.

Step-by-Step Solution

1
Analyze the IT director's statement regarding the transition from operating expenses (OpEx) to capital expenses (CapEx).
Identify that the statement is financially backward; cloud computing is characterized by shifting from capital expenses (buying servers upfront) to operating expenses (paying for what is used).
Understanding cloud economics requires recognizing that the primary financial shift is from CapEx to OpEx.
2
Map this financial shift to the official six benefits of the AWS Cloud.
The transition from upfront capital costs to variable running costs aligns directly with the benefit of trading upfront expense for variable expense.
This matches the official AWS Cloud Practitioner definition of cloud benefits.
3
Evaluate the alternative options to identify the correct response.
Select the statement that correctly defines the transition from CapEx to variable OpEx, and reject options that suggest maintaining CapEx, owning physical hardware, or eliminating OpEx entirely.
This ensures the correct cloud benefit is identified while refuting the incorrect financial assertions.

Key Concept

Understanding the financial and operational benefits of the AWS Cloud, specifically trading upfront capital expenses for variable operating expenses.
Question 129Question →

A software development firm wants to reduce the time it takes to deploy new testing environments for its developers. In their on-premises data center, provisioning physical hardware requires waiting several weeks for procurement and configuration. By migrating to the AWS Cloud, the developers can spin up new resource stacks in minutes. Which benefit of the AWS Cloud does this scenario demonstrate?

Show answer & explanation

Answer: Increase speed and agility

Answer

Increase speed and agility
The correct answer is the option stating 'Increase speed and agility'. In a cloud environment, new IT resources are only a click away, which means developers can reduce the time it takes to make those resources available to them from weeks to just minutes. This dramatically increases the speed and agility of the organization, as the cost and time it takes to experiment and develop are significantly lower.

Step-by-Step Solution

1
Analyze the scenario details.
The software development firm transitions from waiting weeks for physical hardware on-premises to provisioning resource stacks in minutes on AWS.
Identifying the key improvement (reducing deployment time from weeks to minutes) is necessary to map it to a specific AWS Cloud benefit.
2
Map the scenario's outcome to the six documented AWS Cloud benefits.
The ability to rapidly deploy and configure resources reduces time-to-market and allows for faster experimentation, which represents the benefit of increased speed and agility.
Comparing the scenario's characteristics against official AWS Cloud benefits helps identify the correct definition.

Key Concept

The benefit of increased speed and agility in AWS allows businesses to reduce the time required to spin up resources, fostering faster innovation and deployment.
Estimated Time:45s
Question 130Question →

An agricultural technology company wants to launch a new crop-monitoring application but has limited initial funding. Instead of purchasing physical servers and networking hardware upfront, the company decides to build the system on AWS and pay only for the computing resources they actually use. Which benefit of the AWS Cloud is directly demonstrated by this approach?

Show answer & explanation

Answer: Trading fixed expense for variable expense

Answer

Trading fixed expense for variable expense
The correct answer is the choice describing the trade-off of fixed expenses for variable expenses. In cloud computing, you pay only for the resources you consume (a variable expense) instead of investing heavily in physical data centers and servers (a fixed capital expense) before you know how you are going to use them.

Step-by-Step Solution

1
Analyze the financial transition described in the scenario.
The company avoids paying upfront capital expenses (fixed cost) for physical hardware and instead pays for resources based on actual consumption (variable cost).
Identifying the shift from upfront capital expenditure to ongoing operational expenditure is key to selecting the correct AWS Cloud benefit.
2
Match this financial model with the official six advantages of cloud computing.
The scenario directly aligns with the cloud benefit defined as 'trading fixed expense for variable expense'.
This matches the AWS definition where businesses pay only for what they consume, allowing them to remain agile without significant upfront investments.

Key Concept

Trading fixed expense for variable expense (CapEx to OpEx)
Question 131Question →

A financial institution is migrating its retail banking platform to AWS. During the portfolio discovery phase, the migration team identifies a proprietary mainframe ledger application that has strict hardware dependencies and cannot be modified or easily migrated. The team decides to keep this mainframe ledger running in their on-premises data center for the foreseeable future, while establishing a dedicated network connection to integrate it with the newly migrated web frontend on AWS.

Which of the following migration strategies is the institution applying to the mainframe ledger application?

Show answer & explanation

Answer: Retaining

Answer

Retaining
The correct strategy is Retaining. Retaining (also known as re-visit) involves keeping applications in their source environment (on-premises) during a migration. This is common for workloads with major hardware/software dependencies that cannot run in the cloud, or applications that need to be revisited later. The mainframe ledger is being kept on-premises for these reasons.

Step-by-Step Solution

1
Analyze the migration scenario and identify the target workload being evaluated.
The target workload is a legacy mainframe ledger application with strict hardware dependencies.
This establishes which component's migration strategy is being questioned.
2
Determine the action taken by the IT team regarding the ledger application's deployment location.
The team decides to keep the ledger running on-premises rather than moving it to AWS.
Understanding where the application resides post-migration narrows down the 6 Rs strategies.
3
Map this decision to one of the AWS 6 Rs migration strategies.
Keeping an application on-premises because of dependency constraints or lack of readiness is defined as the Retaining strategy.
Retaining is chosen when components must remain in the source environment while other parts of the portfolio migrate.

Key Concept

AWS Cloud Migration Strategies (6 Rs) - Retaining
Question 132Question →

A financial services company is migrating a multi-tier application to AWS. The web tier will be deployed on Amazon EC2 instances, while the data tier will utilize Amazon RDS for PostgreSQL. The company's security policy requires guest operating system patching and firewall port configurations to be strictly maintained. According to the AWS Shared Responsibility Model, which of the following statements correctly identifies the division of operational responsibilities between the customer and AWS for this deployment?

Show answer & explanation

Answer: The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.

Answer

The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.
Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Infrastructure as a Service (IaaS) offerings like Amazon EC2, the customer is responsible for guest operating system patching. For managed database services like Amazon RDS, AWS is responsible for patching the guest operating system and the database engine. However, configuring network access controls (such as security groups and firewall ports) is a customer responsibility across both IaaS and managed database tiers to ensure secure access control.

Step-by-Step Solution

1
Analyze the service model for the web tier using Amazon EC2.
Identify EC2 as Infrastructure as a Service (IaaS).
Under the Shared Responsibility Model, IaaS gives the customer full control over the guest operating system, making them responsible for patching it.
2
Analyze the service model for the data tier using Amazon RDS.
Identify RDS as a managed database platform service (PaaS).
Because RDS is a managed service, AWS abstracts the operating system layer, meaning AWS is responsible for patching the guest operating system and database engine.
3
Evaluate the firewall configuration requirements (Security Groups).
Determine that security group configuration for both EC2 and RDS is a customer task.
Although AWS provides the security group infrastructure, configuring the inbound/outbound rules to protect applications and data represents security 'in' the cloud, which is always the customer's responsibility.
4
Synthesize the findings to identify the correct division of responsibilities.
The customer patches EC2, AWS patches RDS, and the customer configures security groups for both.
This correctly separates IaaS responsibilities from managed database platform responsibilities.

Key Concept

IaaS vs. Managed Database Shared Responsibility Boundaries
Question 133Question →

A financial services company uses an Amazon Simple Storage Service (Amazon S3) bucket to store sensitive customer account statements. Which of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring S3 bucket policies to restrict access to authorized users; Enabling server-side encryption for objects uploaded to the bucket

Answer

Configuring S3 bucket policies to restrict access to authorized users and enabling server-side encryption for objects uploaded to the bucket are customer responsibilities.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon S3, this includes managing data access permissions (such as bucket policies) and configuring encryption settings (such as server-side encryption). AWS is responsible for security 'of' the cloud, which includes the physical infrastructure and the underlying software platform.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon S3 is a fully managed object storage service.
For managed services, AWS handles the infrastructure, physical security, and underlying operating systems, while the customer manages data classification, access permissions, and encryption settings.
2
Evaluate the customer-side responsibilities (security 'in' the cloud) for S3.
Configuring bucket policies and enabling server-side encryption are operations performed by the customer on their own data.
These controls determine who can access the objects and whether the data is encrypted at rest, which are customer responsibilities.
3
Evaluate the AWS-side responsibilities (security 'of' the cloud) for S3.
Managing physical drives, patching the storage node operating systems, and data center physical security are handled by AWS.
These tasks involve physical infrastructure and the virtualization/management layer of the storage service, which are fully managed by AWS.

Key Concept

Shared Responsibility Model for Managed Services
Question 134Question →

An organization is designing a financial transaction processing pipeline on AWS. The system must handle highly unpredictable transaction volumes, ensure that downstream failures in third-party settlement APIs do not disrupt upstream transaction ingestion, and allow developers to test changes in isolated environments that match production scale without incurring permanent infrastructure costs. Which of the following design choices align with AWS Cloud design principles to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Decouple the ingestion layer from the settlement processing layer using message queues to ensure downstream API failures do not block transaction intake.; Use infrastructure as code to provision and terminate temporary, full-scale testing environments on demand, rather than keeping a dedicated staging environment active.

Answer

Decouple the ingestion layer from the settlement processing layer using message queues to ensure downstream API failures do not block transaction intake; and Use infrastructure as code to provision and terminate temporary, full-scale testing environments on demand, rather than keeping a dedicated staging environment active.
The correct choices are to decouple the ingestion and settlement layers using message queues, and to use infrastructure as code to manage temporary testing environments. Using message queues allows the system to achieve loose coupling, meaning the components act independently, and downstream failures do not prevent upstream data ingestion. Utilizing infrastructure as code to spin up and tear down test environments implements the principle of disposable resources, allowing the organization to test at scale only when needed without paying for idle assets.

Step-by-Step Solution

1
Identify the system requirement for handling downstream failures without affecting ingestion.
Downstream settlement failure isolation is needed, indicating a loose coupling and design for failure architecture.
This isolates independent components so that a failure in one does not cascade.
2
Identify the requirement for testing at scale without permanent costs.
The environments must be treated as disposable resources, created on-demand and terminated when finished.
This aligns with the principle of disposable resources, replacing fixed staging servers with temporary ones.
3
Evaluate the architectural options to determine which align with these cloud design principles.
Decoupling with message queues and using infrastructure as code to provision/terminate environments on-demand are selected.
These directly manifest the target AWS design principles.
4
Eliminate choices that represent anti-patterns.
Consolidating layers is a monolithic anti-pattern; pre-provisioning capacity ignores elasticity; expecting AWS to patch EC2 OS violates the shared responsibility model.
These options run counter to core AWS cloud concepts and security frameworks.

Key Concept

AWS Cloud Design Principles (Loose Coupling, Disposable Resources)
Estimated Time:3m 0s
Question 135Question →

A gaming studio is launching a new online multiplayer game. The studio wants to deploy the application to players worldwide with low latency and avoid pre-purchasing physical servers for potential spikes in user traffic.

Which of the following benefits of the AWS Cloud directly support these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Go global in minutes; Stop guessing capacity

Answer

The two correct benefits are deploying globally in minutes and not having to guess capacity limits.
The correct options are the benefits of deploying globally in minutes and not guessing capacity. Deploying globally in minutes allows the studio to host resources closer to players worldwide, reducing latency. Stopping guessing capacity allows the studio to scale resources automatically based on demand rather than paying for idle capacity.

Step-by-Step Solution

1
Analyze the requirements in the scenario.
The studio needs to deploy globally with low latency and handle dynamic traffic spikes without pre-purchasing physical servers.
This helps map the business requirements to the specific benefits of the AWS Cloud.
2
Identify the AWS Cloud benefits that match these requirements.
Deploying globally with low latency maps to the benefit of going global in minutes. Handling traffic dynamically without pre-purchasing or guessing capacity maps to the benefit of stopping guessing capacity.
Matching requirements directly to official cloud benefits yields the correct answer.

Key Concept

Benefits of the AWS Cloud
Question 136Question →

A healthcare organization stores medical imaging files and patient records in Amazon Simple Storage Service (Amazon S3) buckets. Under the AWS Shared Responsibility Model, which of the following security tasks are the sole responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring bucket policies and Access Control Lists (ACLs) to restrict access to the buckets; Enabling server-side encryption to protect data at rest within the buckets

Answer

The customer is responsible for configuring bucket policies and Access Control Lists (ACLs) to restrict access, and enabling server-side encryption to protect data at rest.
Under the AWS Shared Responsibility Model, the customer maintains control and responsibility for security 'in' the cloud. For a managed service like Amazon S3, this includes managing data access permissions through bucket policies and Access Control Lists (ACLs), as well as configuring server-side encryption to secure stored data at rest.

Step-by-Step Solution

1
Analyze the service model of Amazon S3.
Amazon S3 is a fully managed cloud object storage service, meaning the physical infrastructure, virtualization, and host operating system are managed by AWS.
Understanding the service type helps delineate where the customer controls settings versus where AWS manages infrastructure.
2
Identify customer-controlled data security settings.
The customer controls who can access the data (via bucket policies and Access Control Lists) and whether the data is encrypted at rest (via server-side encryption configuration).
Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes data protection and access management.
3
Differentiate customer tasks from AWS infrastructure tasks.
Tasks like physical drive disposal, hypervisor management, and server OS patching belong to the infrastructure layer, which AWS secures ('of' the cloud).
Eliminating infrastructure management tasks allows isolating the correct customer-side responsibilities.

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (infrastructure, physical hardware, virtualization, and managed service OS patching), while the customer is responsible for security 'in' the cloud (data classification, access management via bucket policies/ACLs, and encryption settings).
Question 137Question →

A startup is setting up its first AWS account and wants to follow AWS Identity and Access Management (IAM) best practices to secure access for its developers and services. Which two recommendations should the startup implement to secure the account? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and avoid using it for everyday tasks.; Create individual IAM users for each developer and manage their permissions using IAM groups.

Answer

Enabling multi-factor authentication (MFA) on the AWS account root user while avoiding its everyday use, and creating individual IAM users for each developer to manage their permissions using IAM groups.
According to AWS security best practices, the AWS account root user should have multi-factor authentication (MFA) enabled and should not be used for daily administrative tasks. Instead, individual IAM users should be created for each developer, and their permissions should be managed collectively using IAM groups to adhere to the principle of least privilege.

Step-by-Step Solution

1
Analyze AWS security recommendations for the root account.
Identify that enabling MFA on the root account and restricting its everyday use is a fundamental best practice.
The root user has complete access to all resources and represents a single point of failure if compromised.
2
Analyze AWS security recommendations for human identity and access management.
Identify that creating individual IAM users and using IAM groups to manage permissions is the standard approach.
This establishes individual accountability and simplifies administration, aligning with the principle of least privilege.

Key Concept

AWS IAM Best Practices for User Management and Root Account Security
Question 138Question →

A healthcare company is designing a system on AWS to process patient telemetry data from wearable devices. The system must ingest incoming data streams, store them securely, and automatically generate reports when new data arrives. The architecture should minimize operational overhead and ensure that a failure in the reporting component does not disrupt the ingestion of patient data.

Which of the following architectural decisions align with AWS Cloud design principles to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon Simple Queue Service (Amazon SQS) to decouple the telemetry data ingestion layer from the report generation process.; Use AWS Lambda to run the report generation code instead of provisioning and managing persistent virtual servers.

Answer

Deploying Amazon SQS to decouple the layers and using AWS Lambda to run report generation code instead of managing servers.
The correct options are deploying Amazon SQS to decouple the ingestion layer from the report generation process and using AWS Lambda to run report generation serverlessly. The SQS option demonstrates loose coupling, which prevents failures in downstream components from affecting upstream ingestion. The Lambda option aligns with the 'services, not servers' principle, eliminating server administration tasks and scaling automatically.

Step-by-Step Solution

1
Analyze the requirements to identify the core AWS design principles needed.
The requirements ask to decouple components (preventing reporting failures from affecting ingestion) and minimize operational overhead (avoiding server management).
This maps directly to the design principles of loose coupling and using managed services (services, not servers).
2
Evaluate the architectural options against the design principle of loose coupling.
Using an asynchronous queue like Amazon SQS decouples the services, ensuring that a failure in report generation doesn't block ingestion. Direct API calls (synchronous) or monolithic deployment violate this principle.
Loose coupling ensures components can scale and fail independently.
3
Evaluate the architectural options against the design principle of 'services, not servers' or reducing operational overhead.
Using AWS Lambda allows running code serverlessly without managing underlying operating systems or virtual instances. Managing or over-provisioning EC2 instances manually violates this principle.
Using managed services reduces administrative burden and increases agility.

Key Concept

AWS Cloud design principles such as loose coupling, design for failure, and services not servers.
Question 139Question →

A company is building a hybrid application where an on-premises server must upload log files directly to an Amazon S3 bucket. Additionally, a third-party auditing agency requires temporary, read-only access to inspect the S3 bucket's access configurations. To meet compliance standards, the company must avoid configuring or managing long-term AWS credentials for either the on-premises server or the external auditors. Which of the following solutions should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS Identity and Access Management (IAM) Roles Anywhere to enable the on-premises server to exchange digital certificates for short-term AWS credentials.; Configure identity federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.

Answer

The correct solutions are configuring AWS Identity and Access Management (IAM) Roles Anywhere for the on-premises application to exchange digital certificates for temporary credentials, and configuring federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.
Configuring AWS Identity and Access Management (IAM) Roles Anywhere allows the on-premises server to authenticate using public key infrastructure (PKI) certificates to dynamically obtain temporary credentials. Setting up SAML 2.0 or OIDC federation allows external auditors to leverage their existing identity provider to assume an IAM role, obtaining temporary credentials for the audit duration without needing permanent IAM user accounts.

Step-by-Step Solution

1
Analyze the requirements for the on-premises server, which needs programmatic access to S3 without managing long-term security keys.
Identify that AWS IAM Roles Anywhere is designed specifically to grant temporary credentials to workloads outside of AWS using public key infrastructure (PKI) certificates.
This satisfies the requirement to avoid managing long-term AWS credentials for on-premises servers.
2
Analyze the requirements for the third-party auditors who need temporary, administrative-free access to read S3 bucket access logs.
Identify that federation using external identity providers (SAML 2.0 or OIDC) allows external users to assume IAM roles with temporary credentials dynamically.
This eliminates the administrative overhead of managing local IAM users for third-party auditing partners.
3
Evaluate the distractors against AWS security best practices and the Shared Responsibility Model.
Discard the options to use the root account credentials, create permanent IAM users with access keys, or rely on AWS Support to configure customer security settings.
These distractors introduce security risks, use long-term credentials, or misinterpret the boundaries of the Shared Responsibility Model.

Key Concept

Programmatic access security using temporary credentials (IAM Roles Anywhere and Identity Federation) in place of long-term credentials (IAM Users and Root accounts).
Question 140Question →

A digital media company is launching a live video streaming service for a major international tournament. The company expects a massive, unpredictable surge in user traffic during live matches, followed by periods of near-zero activity. The CFO requires that the company only pay for active resource usage during the tournament and avoid upfront infrastructure investments. Which of the following benefits of the AWS Cloud directly address this scenario? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Trade fixed expense for variable expense

Answer

The benefits of 'Stop guessing capacity' and 'Trade fixed expense for variable expense' directly address the requirements.
The scenario highlights two distinct requirements: handling unpredictable traffic spikes without wasting capacity, and paying only for active usage without upfront investments. The benefit of 'Stop guessing capacity' allows the system to scale dynamically to meet the exact demand of the tournament matches. The benefit of 'Trade fixed expense for variable expense' allows the company to pay only for the resources they consume rather than buying physical servers upfront.

Step-by-Step Solution

1
Analyze the operational traffic requirements.
Identify that the massive, unpredictable spikes and drops in user traffic require a system that can scale resources on demand, matching 'Stop guessing capacity' (elasticity).
This avoids both under-provisioning during peak matches and over-provisioning during idle periods.
2
Analyze the financial requirements.
Identify that the CFO's goal of paying only for active resource usage and avoiding upfront infrastructure investments matches 'Trade fixed expense for variable expense'.
This shifts cost from capital expenses (CapEx) to operating expenses (OpEx).
3
Evaluate the choices and eliminate distractors.
Confirm that the options corresponding to these two benefits are correct, while eliminating options that reverse CapEx/OpEx, advocate for static peak provisioning, or promote monolithic design.
This ensures the final answer aligns with official AWS cloud benefits and architecture best practices.

Key Concept

The six core benefits of the AWS Cloud, specifically focusing on dynamic scaling (elasticity) and the shift from capital expenses (CapEx) to operational expenses (OpEx).
Estimated Time:2m 30s
PreviousPage 7 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin