Examkin

All practice questions

1473 questions

All types1,473Multiple choice755Multiple select693Matching25
Question 141Question →

An aerospace manufacturing firm is evaluating its cloud migration strategy for two specific workloads:

* Workload 1: A customized commercial off-the-shelf (COTS) HR system that is nearing its license expiration. The company has decided to retire the system and purchase a subscription to a cloud-hosted Software-as-a-Service (SaaS) platform, migrating their active user records to the new SaaS platform.
* Workload 2: A proprietary Java application running on an on-premises web server. The engineering team plans to migrate the application to AWS by containerizing it and hosting it on AWS App Runner to reduce runtime management tasks. The application code will remain unchanged, but the team will adjust the application's configuration to use environment variables for database connections.

Which of the following migration strategies describe the planned paths for Workload 1 and Workload 2? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Repurchasing for Workload 1; Replatforming for Workload 2

Answer

Repurchasing for Workload 1 and Replatforming for Workload 2
The correct choices are Repurchasing for Workload 1 and Replatforming for Workload 2. Repurchasing is the process of moving from a legacy or commercial off-the-shelf (COTS) license model to a cloud-based Software-as-a-Service (SaaS) subscription model. Replatforming involves modifying the deployment platform (e.g., containerizing it for a managed service like AWS App Runner) to gain benefits like reduced administrative overhead, without modifying the application's core code architecture.

Step-by-Step Solution

1
Analyze the migration plan and target destination for Workload 1.
Workload 1 is a commercial off-the-shelf (COTS) HR system that is being retired in favor of a subscription to a cloud-hosted SaaS platform.
Moving from an existing licensed application to a different cloud-hosted product (typically SaaS) is the definition of the Repurchasing strategy.
2
Analyze the migration plan and target destination for Workload 2.
Workload 2 is a Java application being containerized and moved to AWS App Runner without changing its core application code.
Deploying the workload to a managed container service to eliminate OS-level maintenance without altering its core architecture represents the Replatforming strategy (lift-tinker-and-shift).
3
Synthesize the findings to match the options.
The correct strategies are Repurchasing for Workload 1 and Replatforming for Workload 2.
This accurately reflects the chosen pathways for both workloads.

Key Concept

Cloud migration strategies (6 Rs)
Estimated Time:2m 0s
Question 142Question →

A company is setting up a new multi-department environment on AWS. The security team is defining identity and access management policies for corporate employees, applications running on Amazon EC2 instances, and administrative workflows. Which of the following are recommended AWS IAM best practices for managing access for these entities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign IAM roles to Amazon EC2 instances instead of storing long-term AWS access keys within the application code.; Use AWS IAM Identity Center to federate employee identities from the company's existing identity provider for console access.

Answer

Assigning IAM roles to Amazon EC2 instances to avoid storing hardcoded credentials, and using AWS IAM Identity Center to federate employee identities from an existing identity provider.
The correct practices are to assign IAM roles to EC2 instances so applications can access resources using temporary security credentials, and to use AWS IAM Identity Center to federate employee identities from an existing identity provider. This aligns with the principle of least privilege and avoids managing long-term static credentials.

Step-by-Step Solution

1
Analyze the credentials requirement for applications running on Amazon EC2 instances.
Identify that applications should use temporary credentials retrieved dynamically using IAM roles, rather than storing long-term credentials in the code.
This reduces the risk of credential exposure and complies with AWS security best practices.
2
Analyze the credentials requirement for corporate employee login access.
Identify that centrally managed single sign-on using AWS IAM Identity Center federated with the existing identity provider is the recommended approach.
Federation enables centralized administration, enforces security controls like MFA, and eliminates the need to manage separate long-term IAM users.

Key Concept

AWS IAM best practices for managing credentials and access for applications and human users
Estimated Time:1m 30s
Question 143Question →

A healthcare provider is planning to migrate its applications to the AWS Cloud. The migration team has decided on the following plans for two of their systems:

- The patient scheduling application's server VMs will be moved to Amazon EC2 without changes, but its backend relational database will be migrated from a self-managed on-premises server to Amazon Aurora to reduce operational overhead without modifying the application's core code.
- The legacy custom document management system will be decommissioned, and its capabilities will be fully replaced by a third-party software-as-a-service (SaaS) solution purchased through AWS Marketplace.

Which of the following migration strategies are represented in this plan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replatforming; Repurchasing

Answer

The correct strategies are Replatforming and Repurchasing.
The correct answers are Replatforming and Repurchasing. Moving the database from an on-premises self-managed server to a managed service like Amazon Aurora without altering the core application code represents Replatforming. Decommissioning the custom legacy document management system and replacing it with a third-party SaaS product from AWS Marketplace represents Repurchasing.

Step-by-Step Solution

1
Analyze the migration plan for the patient scheduling application.
The database is migrated to Amazon Aurora to reduce administrative overhead while the core code remains unchanged.
This corresponds to Replatforming (lift, tinker, and shift), where the database is optimized using a managed service without rewriting the core application.
2
Analyze the migration plan for the legacy document management system.
The legacy custom system is decommissioned and replaced by a third-party SaaS product purchased from AWS Marketplace.
This corresponds to Repurchasing (drop and shop), where an application is discarded in favor of a commercially available SaaS platform.

Key Concept

Understand the 6 Rs cloud migration strategies: Rehosting, Replatforming, Refactoring, Repurchasing, Retaining, and Retiring.
Question 144Question →

A gaming company is designing a global multiplayer game backend on AWS. The backend must handle highly volatile traffic spikes, process game logs for analytics, and update player profiles without causing game-play interruption if any downstream reporting service experiences an outage. The engineering team wants to strictly adhere to the AWS Cloud design principles of loose coupling and elasticity. Which of the following design choices should the company implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement an Amazon EventBridge event bus to route game events asynchronously to decoupled downstream services, such as analytics and leaderboards.; Deploy the game session manager using an Auto Scaling group of Amazon EC2 instances that scales dynamically based on real-time player connection metrics.

Answer

Implementing an Amazon EventBridge event bus to route game events asynchronously to decoupled downstream services, and deploying the game session manager using an Auto Scaling group of Amazon EC2 instances that scales dynamically based on real-time player connection metrics.
The correct design choices are routing events asynchronously via Amazon EventBridge and scaling the session manager dynamically with an Auto Scaling group. Asynchronous routing decouples independent components so that a failure in one does not cascade. Dynamic scaling ensures elasticity by automatically provisioning resources to match real-time demand.

Step-by-Step Solution

1
Analyze the architectural requirements for loose coupling to prevent downstream outages from disrupting the main gameplay loop.
Determine that communication between the core game session manager and downstream services (analytics and leaderboards) must be asynchronous and event-driven.
Asynchronous routing prevents cascading failures and decouples the services, satisfying the loose coupling principle.
2
Analyze the architectural requirements for elasticity to handle volatile traffic spikes efficiently.
Determine that compute resource capacity must scale dynamically in response to real-time load, rather than using fixed pre-provisioned assets.
Dynamic scaling aligns resource consumption and costs with actual demand, satisfying the elasticity principle.
3
Evaluate the choices to identify correct implementations and eliminate anti-patterns.
Identify Amazon EventBridge asynchronous routing and Auto Scaling group deployment as correct answers. Monolithic consolidation, synchronous writes, and fixed-capacity fleets are flagged as violations of AWS design principles.
This isolates the options that demonstrate loose coupling and elasticity.

Key Concept

AWS Cloud Design Principles: Loose Coupling and Elasticity
Question 145Question →

A healthcare provider wants to migrate its legacy on-premises billing system to the AWS Cloud. During the planning phase, the IT team decides to discard the existing custom-built software and instead subscribe to a fully managed, equivalent Software as a Service (SaaS) application available on the AWS Marketplace. Which cloud migration strategy does this decision represent?

Show answer & explanation

Answer: Repurchasing

Answer

Repurchasing
Repurchasing (also known as drop-and-shop) is the strategy where a company decides to abandon its legacy system and purchase a commercial Software as a Service (SaaS) platform, often from the AWS Marketplace, to replace it.

Step-by-Step Solution

1
Analyze the migration scenario described in the stem.
The company is abandoning its custom-built billing software and replacing it with a fully managed SaaS application from the AWS Marketplace.
Understanding the core actions of the migration helps classify it under one of the 6 Rs migration strategies.
2
Compare the scenario against the definitions of the 6 Rs migration strategies.
Repurchasing is defined as moving to a different product, typically a SaaS model, and retiring the existing system.
This matches the decision to discard the custom software and subscribe to an equivalent SaaS solution.

Key Concept

Repurchasing migration strategy
Estimated Time:45s
Question 146Question →

A municipal transit authority plans to migrate its legacy on-premises customer ticketing database to the AWS Cloud. The database currently runs on a self-managed PostgreSQL engine. To reduce operational overhead associated with patching, backups, and operating system maintenance without altering the application code or schema, the authority decides to migrate the database to Amazon Relational Database Service (Amazon RDS) for PostgreSQL. Which migration strategy is this organization employing?

Show answer & explanation

Answer: Replatforming

Answer

Replatforming
Replatforming is the correct migration strategy because it involves taking an existing application and moving it to the cloud while introducing some level of optimization, such as using a managed service like Amazon RDS, without modifying the underlying application architecture.

Step-by-Step Solution

1
Analyze the migration scenario details.
The transit authority is migrating an existing PostgreSQL database to Amazon RDS for PostgreSQL to reduce management tasks while keeping application code and database schema unchanged.
This establishes that the core code is not being rewritten (eliminating refactoring) and the software is not being replaced by a third-party SaaS solution (eliminating repurchasing).
2
Compare the action taken to the definitions of Rehosting and Replatforming.
Moving to Amazon RDS introduces a platform change (from self-managed to AWS-managed) to optimize operations, which is the definition of Replatforming (lift-tinker-and-shift). Rehosting would mean running the database on Amazon EC2 with no operational optimizations to the platform itself.
This confirms Replatforming as the correct strategy.

Key Concept

Replatforming Migration Strategy
Estimated Time:1m 0s
Question 147Question →

A healthcare technology company is deploying a serverless application that processes patient health records. The architecture consists of an HTTPS endpoint hosted on Amazon API Gateway, custom backend logic running in AWS Lambda, and patient data stored in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which two security and operational tasks are the responsibility of the customer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables; Defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda

Answer

Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables, and defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda.
For serverless services like AWS Lambda, Amazon DynamoDB, and Amazon API Gateway, AWS assumes responsibility for the entire infrastructure stack, including physical hardware, OS patching, runtime environments, and virtualization. The customer remains responsible for data classification, configuring Identity and Access Management (IAM) execution roles and access policies, API Gateway authorization configurations, and securing the custom application code deployed to the environment.

Step-by-Step Solution

1
Analyze the service models of the resources in the scenario.
Amazon API Gateway, AWS Lambda, and Amazon DynamoDB are fully managed, serverless (Platform as a Service) resources.
Under the Shared Responsibility Model, the boundary between customer and AWS duties shifts depending on the service category.
2
Identify AWS responsibilities for serverless resources.
AWS is responsible for physical security, hardware management, hypervisor security, operating system patching, and runtime updates.
These lower-level infrastructure tasks are fully managed and abstracted away from the customer in serverless offerings.
3
Identify customer responsibilities for serverless resources.
The customer is responsible for configurations, identity and access control (IAM), client-side encryption, API Gateway authentication, and writing secure application code.
Even in a fully managed model, the customer must control access to their data and secure the application logic.
4
Match the options to the correct responsibility boundaries.
Configuring IAM roles and setting up API authorization/securing application code are customer duties, whereas patching container runtimes, physical disk security, and hypervisor management are AWS duties.
This separates customer actions (security in the cloud) from AWS actions (security of the cloud).

Key Concept

Shared Responsibility Model for Serverless Services
Question 148Question →

A financial services company is planning to migrate a core application to the AWS Cloud. The application experiences predictable spikes in demand during the first three days of each month, requiring ten times the standard compute capacity. Under their current on-premises model, the company must maintain hardware provisioned for these peak loads, leading to high capital expenditures and underutilized servers for the rest of the month.

Which of the following AWS Cloud benefits directly address these operational and financial challenges? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Trading fixed expense for variable expense, allowing the company to pay only for the resources they consume instead of investing heavily in data centers and servers.; Stopping guessing capacity, ensuring the company can scale up automatically to meet the monthly three-day demand peak and scale back down during quiet periods.

Answer

The correct benefits are trading fixed expense for variable expense and stopping guessing capacity.
The correct answers are the options describing 'Trading fixed expense for variable expense' and 'Stopping guessing capacity'. Shifting from fixed to variable expenses allows the business to pay only for resources when they are actually consumed rather than investing in physical infrastructure upfront. Stopping guessing capacity allows the company to automatically scale up to handle the month-end demand spikes and scale down during the rest of the month, eliminating resource waste.

Step-by-Step Solution

1
Analyze the financial challenge in the scenario.
The company has high capital expenditures due to purchasing upfront physical hardware.
Identifying the root financial inefficiency is necessary to map it to the corresponding AWS benefit.
2
Map the financial challenge to the AWS Cloud benefit.
The benefit is 'trading fixed expense for variable expense' (or capital expense to variable operating expense).
This benefit directly replaces large upfront hardware investments with pay-as-you-go pricing.
3
Analyze the operational challenge in the scenario.
The company must provision for peak capacity, leading to severe resource underutilization for 90% of the month.
Identifying the capacity management inefficiency is necessary to map it to the corresponding AWS benefit.
4
Map the operational challenge to the AWS Cloud benefit.
The benefit is 'stopping guessing capacity'.
This benefit uses elasticity to scale up automatically during the 3-day spike and scale down afterward, eliminating underutilized idle capacity.

Key Concept

The benefits of AWS Cloud computing, specifically trading fixed expense for variable expense and stopping guessing capacity.
Estimated Time:2m 0s
Question 149Question →

A company is using Amazon DynamoDB to store application data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Show answer & explanation

Answer: Configuring Identity and Access Management (IAM) policies to control database access

Answer

Configuring Identity and Access Management (IAM) policies to control database access
Configuring Identity and Access Management (IAM) policies to control database access is the correct answer. Under the Shared Responsibility Model, the customer is always responsible for managing access to their data and configuring permissions, regardless of whether the service is managed or unmanaged.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (PaaS/Managed service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS) like Amazon EC2, or a managed service (PaaS) like Amazon DynamoDB.
2
Determine the boundary of responsibility for a managed database service.
AWS handles the physical security, hardware infrastructure, virtualization layer, operating system, and database engine software. The customer is responsible for data classification, encryption settings, and resource access control.
Applying the Shared Responsibility Model rules for managed services.
3
Evaluate the choices to identify the task that falls under the customer's control.
Configuring access policies using IAM is managed by the customer, whereas OS patching, hardware replacement, and physical security are managed by AWS.
Select the option that represents a customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS handles the infrastructure layers including database software patching, operating system maintenance, and hardware management. The customer remains responsible for configuration tasks, such as managing access controls (IAM) and securing their data.
Estimated Time:45s
Question 150Question →

A software development company is migrating its monolithic API to a serverless architecture using AWS Lambda. As part of this transition, the security team is defining operational tasks under the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer when deploying code to AWS Lambda?

Show answer & explanation

Answer: Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions

Answer

Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions
For serverless services like AWS Lambda, AWS manages the underlying physical infrastructure, virtualization layer, operating systems, and runtimes. The customer is responsible for writing secure application code and managing access control, which includes defining IAM execution roles and configuring resource-based policies to govern function access.

Step-by-Step Solution

1
Analyze the service model of AWS Lambda
AWS Lambda is a serverless (PaaS/managed) compute service.
Understanding the service type helps define the boundary of responsibility; serverless services shift more infrastructure management tasks (like OS patching and runtime maintenance) to AWS.
2
Differentiate between customer and AWS responsibilities for Lambda
AWS manages the physical security, hardware, virtualization layer, operating system, and runtime. The customer manages application code, data, and access permissions (IAM).
This allows identifying which of the options represents a task that is managed by the customer ('security in the cloud') vs AWS ('security of the cloud').

Key Concept

Shared Responsibility Model for Serverless Services
Question 151Question →

A company needs to grant a newly hired security analyst access to the AWS Management Console to audit resource configurations. The analyst requires their own permanent credentials to log in. Which IAM entity should the administrator create to meet this requirement?

Show answer & explanation

Answer: An IAM user

Answer

An IAM user
An IAM user represents a person or service that requires permanent credentials to interact with AWS, making it the correct entity for a new employee requiring long-term console access.

Step-by-Step Solution

1
Identify the requirement for permanent, individual console login credentials.
Determine that the employee needs a unique identity with persistent login credentials.
This helps select the appropriate credential type in AWS IAM.
2
Compare AWS IAM entities to identify the correct resource.
An IAM user provides the long-term credentials (password and access keys) needed for direct console login.
IAM roles are for temporary credentials, and root accounts should not be used for daily tasks.

Key Concept

IAM Users vs. IAM Roles and Credentials Best Practices
Estimated Time:45s
Question 152Question →

A gaming company needs to perform daily stress testing on a replica of their production environment. Instead of keeping a dedicated test environment running constantly, the team uses infrastructure as code (IaC) to dynamically provision a complete, identical copy of their environment every morning, run the automated tests, and terminate all resources at the end of the day. Which AWS Cloud design principle is this team implementing to optimize their testing process?

Show answer & explanation

Answer: Treating servers as disposable resources

Answer

Treating servers as disposable resources
The correct answer is treating servers as disposable resources. In cloud computing, you can instantiate resources on demand, use them for the duration of a task, and then terminate them immediately. Using infrastructure as code (IaC) to dynamically deploy and tear down identical copies of production environments for testing is a primary example of this principle, preventing costs associated with running idle environments.

Step-by-Step Solution

1
Analyze the scenario details: the team provisions replicas daily using infrastructure as code (IaC) and terminates them at the end of the day.
Identified that the servers and environments are temporary and easily replaceable.
Understanding the lifecycle of the provisioned resources helps link the practice to a specific AWS design principle.
2
Map the practice of creating and destroying temporary environments to the core AWS Cloud design principles.
Determined that treating servers as temporary, replaceable assets represents the 'disposable resources' design principle.
This mapping identifies the correct architectural principle being applied in the scenario.

Key Concept

Treating servers as disposable resources
Estimated Time:1m 0s
Question 153Question →

A software development team creates a new testing environment on AWS for every code deployment. The environment, consisting of several virtual servers and a database, is created automatically using a script, used to run automated tests, and then completely deleted as soon as the tests are completed. Which AWS Cloud design principle is directly demonstrated by this workflow?

Show answer & explanation

Answer: Disposable resources

Answer

Disposable resources, which involves treating computing infrastructure as temporary assets that are dynamically provisioned for a task and terminated immediately when finished.
The scenario describes a workflow where resources are dynamically created for a specific purpose (testing) and then completely destroyed immediately afterward. This directly aligns with the AWS Cloud design principle of 'disposable resources', which encourages treating servers and databases as temporary assets rather than permanent, static infrastructure.

Step-by-Step Solution

1
Analyze the lifecycle of the infrastructure described in the scenario.
The virtual servers and databases are created automatically by a script, used for testing, and completely deleted immediately after.
Understanding the timeline and purpose of the resources helps identify which design principle is being put into practice.
2
Evaluate the AWS Cloud design principles against the observed resource lifecycle.
The practice of treating infrastructure as temporary and easily replaceable rather than permanent aligns with 'disposable resources'.
This matches the definition of disposable resources, where components are launched, used, and discarded programmatically.

Key Concept

Disposable resources
Question 154Question →

A company plans to migrate its legacy on-premises web application to AWS. The primary goals are to minimize the operational overhead associated with infrastructure maintenance and to ensure the application remains highly available and resilient to individual hardware failures. Which of the following architectural actions align with these AWS Cloud design principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the application across multiple Availability Zones and configure an Elastic Load Balancer to distribute traffic.; Replace self-managed relational databases on virtual servers with fully managed database services like Amazon RDS.

Answer

Deploying the application across multiple Availability Zones with an Elastic Load Balancer, and replacing self-managed databases with Amazon RDS.
Deploying the application across multiple Availability Zones with an Elastic Load Balancer ensures that the architecture is resilient to localized infrastructure failures (design for failure). Replacing self-managed databases with Amazon RDS shifts administrative operational tasks such as software patching, OS updates, and physical backups to AWS (services, not servers).

Step-by-Step Solution

1
Analyze the requirements to reduce operational maintenance overhead and ensure high availability against hardware failures.
Identify that the system should utilize managed services and built-in redundancy across different physical locations.
This points directly to 'services, not servers' (managed services) and 'design for failure' (redundancy across Availability Zones).
2
Evaluate the design options to select those that implement managed database features and high-availability load balancing.
Amazon RDS manages database operations, and multi-AZ deployment with Elastic Load Balancing automatically routes traffic away from failed zones.
Both options implement the cloud design principles requested.
3
Check the remaining options for anti-patterns or incorrect mappings under the AWS Shared Responsibility Model.
Eliminate single-instance consolidation (single point of failure), fixed-capacity sizing (lacks elasticity), and physical data center auditing (AWS responsibility).
These choices represent bad architectural practices or operational misunderstandings.

Key Concept

AWS Cloud Design Principles (Design for Failure, Services not Servers, Elasticity)
Question 155Question →

A developer using an IAM user in a development account (Account A) requires temporary access to perform administrative tasks on an Amazon DynamoDB table located in a production account (Account B). To adhere to AWS security best practices and the principle of least privilege, which of the following configuration steps must be implemented? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the production account (Account B), create an IAM role with a trust policy that allows the IAM user in the development account (Account A) to assume the role.; In the development account (Account A), attach an identity-based policy to the developer's IAM user that allows the sts:AssumeRole action targeting the role in Account B.

Answer

To establish secure cross-account access, you must create an IAM role in the production account (Account B) with a trust policy that permits the development account user to assume it, and attach an identity-based policy in the development account (Account A) allowing the user to call the sts:AssumeRole action on the production role.
The correct steps require establishing trust between the two accounts using an IAM role and granting the user permissions to assume that role. Creating an IAM role in the destination account with a trust policy defines who can assume the role. Attaching an identity-based policy in the source account allowing the sts:AssumeRole action gives the source user the ability to request the role's temporary credentials. This combination enables secure cross-account access without using permanent credentials.

Step-by-Step Solution

1
Configure trust in the target account
An IAM role is created in the production account (Account B) with a trust policy specifying the AWS account ID or specific IAM user ARN of the development account (Account A) as the trusted principal.
This establishes that the production account trusts the development account's identity to assume the role.
2
Grant delegation permission in the source account
An IAM policy is attached to the IAM user or group in the development account (Account A) containing an 'Allow' effect for the 'sts:AssumeRole' action on the target role's ARN.
This permits the IAM user in Account A to execute the API call required to assume the role and retrieve temporary credentials.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials
Question 156Question →

A startup has five developers who all need the same administrative permissions to manage Amazon EC2 resources. According to AWS security best practices, which of the following is the most efficient way to manage these permissions?

Show answer & explanation

Answer: Create an IAM group, attach the required IAM policy to the group, and add the developer users to the group.

Answer

Creating an IAM group, attaching the required policy to the group, and adding the users to the group is the recommended method to manage collective permissions.
Creating an IAM group and attaching the required policy to it is the AWS-recommended best practice for managing permissions for multiple users with the same job function. This centralized approach simplifies permission updates and ensures that new developers can quickly inherit the required permissions by simply being added to the group.

Step-by-Step Solution

1
Analyze the scenario requirements.
Five developers require identical administrative permissions to manage Amazon EC2 resources.
To apply AWS security best practices efficiently, we need a method that scales and maintains individual user accountability.
2
Evaluate IAM features for collective permission management.
Using an IAM group allows policies to be attached once and applied to all member users.
This is the standard, secure, and low-maintenance approach recommended by AWS.

Key Concept

AWS IAM Groups and Permission Management
Question 157Question →

A gaming company has a mobile application that needs to securely write game state files to an Amazon S3 bucket. Millions of players will use this application, and they must not have permanent AWS credentials embedded in the app code. Which approach should the company use to grant this access?

Show answer & explanation

Answer: Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.

Answer

Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.
The correct approach is to authenticate users via a public identity provider and assume an IAM role. This leverages web identity federation, allowing mobile users to obtain temporary, limited-privilege security credentials to access Amazon S3 without embedding permanent access keys in the application binary.

Step-by-Step Solution

1
Analyze the requirement of providing access to millions of external mobile application users without embedding static credentials.
Eliminate solutions involving long-term access keys or static IAM user credentials.
Embedding static keys in client-side applications exposes them to extraction.
2
Identify the AWS mechanism designed for providing temporary credentials to external users.
Select IAM roles as the mechanism to provide temporary security credentials.
IAM roles provide short-lived, auto-rotating credentials.
3
Determine how external mobile users can be authenticated before assuming the role.
Use web identity federation with an OIDC-compatible identity provider.
This allows external users to authenticate using existing identity providers (like Google or Amazon) to assume the role.

Key Concept

Temporary security credentials via IAM roles and web identity federation
Estimated Time:2m 0s
Question 158Question →

A media streaming platform hosts its user profile service on AWS. The application is designed to store user session state locally in the memory of the individual Amazon EC2 instances that host the service. An Auto Scaling group automatically scales the number of EC2 instances out or in based on traffic demand. During off-peak hours, when the Auto Scaling group terminates underutilized instances, active users whose sessions were hosted on those specific instances are suddenly logged out and lose their progress. To align with AWS cloud design principles and prevent session loss, how should the application architecture be modified?

Show answer & explanation

Answer: Store the session state in a centralized, external data store such as Amazon ElastiCache or Amazon DynamoDB, making the web tier stateless.

Answer

Store the session state in a centralized, external data store such as Amazon ElastiCache or Amazon DynamoDB, making the web tier stateless.
Storing the session state in a centralized, external data store (such as Amazon ElastiCache or Amazon DynamoDB) makes the web tier stateless. This aligns with AWS design principles because the EC2 instances become completely interchangeable. When instances scale in or out, or if an instance fails, users are not logged out because their session data is safely retrieved from the external database or cache.

Step-by-Step Solution

1
Identify the cause of user logouts during scale-in events.
User session data is stored locally in the memory of individual EC2 instances, meaning terminating an instance destroys the session data hosted on it.
To pinpoint the architectural bottleneck causing state loss.
2
Select the appropriate cloud design principle to address state dependency.
The concept of statelessness (under the 'Design for failure' and 'Elasticity' principles) requires separating compute resources from session state.
Decoupling session state makes the compute instances interchangeable, allowing seamless scaling and resilience.
3
Determine the target destination for externalized state.
Use a low-latency, centralized managed storage service like Amazon ElastiCache (in-memory) or Amazon DynamoDB (NoSQL key-value store).
This allows any running EC2 instance to fetch and update the session state for any user request.

Key Concept

Statelessness and Decoupling Application State
Question 159Question →

A media streaming company is deploying a containerized microservice using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team needs to define the operational boundaries between the company and AWS to ensure compliance. Which of the following operational tasks is the sole responsibility of the customer under the AWS Shared Responsibility Model for this architecture?

Show answer & explanation

Answer: Patching vulnerabilities within the application code and software packages packaged inside the container image

Answer

Patching vulnerabilities within the application code and software packages packaged inside the container image
Under the AWS Shared Responsibility Model, AWS Fargate is a serverless compute engine for containers. Because the customer does not manage the underlying virtual servers or host operating systems, AWS is responsible for patching and securing the hypervisor and hosts. However, the customer is responsible for the container image itself, which includes patching the application code, runtimes, and dependencies packaged inside the image.

Step-by-Step Solution

1
Analyze the deployment model and AWS service in use.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless container environment.
Establishing the platform type defines the Shared Responsibility Model boundary; serverless container services shift host management and patching to AWS.
2
Differentiate between the responsibilities of AWS and the customer for serverless container layers.
AWS secures the infrastructure, physical hosts, and hypervisors. The customer remains responsible for everything packaged inside the container image (application code, runtimes, packages) as well as access configurations (IAM roles, security groups).
This separation determines which operations the customer must perform to keep the containerized workload secure.
3
Identify the option that represents a valid, correct customer responsibility.
Securing and patching application code and libraries packaged inside the container image is the customer's responsibility. The other options are managed by AWS, conceptually incorrect, or violate policy.
Validates the correct answer and confirms the distractors are incorrect based on the model boundary.

Key Concept

AWS Shared Responsibility Model applied to serverless container services (AWS Fargate)
Estimated Time:1m 30s
Question 160Question →

A company needs to restrict its database administrators from modifying Amazon RDS instances when they are working outside of the corporate network or outside of standard business hours. Which IAM mechanism should the security team implement to enforce these specific access conditions?

Show answer & explanation

Answer: An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group

Answer

An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group
The correct answer is the option that suggests using an IAM policy with a Condition element containing the aws:SourceIp and aws:CurrentTime keys. This allows the security team to specify exactly when and from where the policy permits database administration tasks, conforming to best practices.

Step-by-Step Solution

1
Analyze the access control requirements
Identify that the restrictions are based on network location (IP address) and request time (business hours).
This determines which variables or policy attributes must be evaluated during policy execution.
2
Evaluate the capabilities of IAM Policy elements
Determine that the 'Condition' block in IAM JSON policies allows specifying conditions under which the policy statement is in effect, using global condition keys like 'aws:SourceIp' and 'aws:CurrentTime'.
This matches the exact parameters of the requirement (network source and time constraints).
3
Apply the policy to the appropriate identity
Attach the policy containing these conditions to the IAM group or role used by database administrators.
Attaching the policy directly to the identity ensures that all administrative requests made by those users are evaluated against these rules.

Key Concept

IAM Policy Conditions
PreviousPage 8 / 74Next
All practice questions — AWS Certified Cloud Practitioner | Examkin