All practice questions

693 questions

Question 1Question

A cloud architect is reviewing the compute requirements for a media distribution platform. The platform has two distinct components:

1. A video rendering pipeline that requires deep customization of the underlying Linux kernel and direct access to physical GPU hardware resources.
2. A containerized metadata extraction service that runs on an event-driven basis in response to user uploads, with highly unpredictable traffic and a strict requirement to avoid managing host servers.

Which two of the following compute solutions should the architect select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Amazon EC2 instances configured with custom Amazon Machine Images (AMIs) to support the required custom operating system kernel and GPU access; AWS Fargate to run the containerized metadata extraction service dynamically without provisioning or managing host servers

Answer

The architect should select Amazon EC2 instances configured with custom Amazon Machine Images (AMIs) to support the custom operating system and GPU requirements, and AWS Fargate to run the containerized metadata extraction service dynamically without provisioning or managing host servers.
Selecting Amazon EC2 with custom AMIs and AWS Fargate is correct because EC2 provides the administrative access needed to customize the operating system kernel and utilize physical GPU instances, while AWS Fargate provides a serverless compute engine to run containerized workloads dynamically without host management.

Step-by-Step Solution

1
Analyze the video rendering pipeline requirements: deep kernel customization and direct GPU hardware access.
Identify that a service granting full control over the guest operating system (IaaS) and supporting GPU hardware instances is required. Amazon EC2 meets these criteria.
Serverless or fully managed services do not allow direct kernel configuration or physical hardware mappings.
2
Analyze the metadata extraction service requirements: containerized, event-driven, unpredictable usage, and no host server management.
Identify that a serverless container orchestration platform is required. AWS Fargate runs containers without requiring instance management.
AWS Fargate manages the underlying compute infrastructure automatically, scaling to meet demand without operational overhead.
3
Evaluate the remaining options against the AWS Shared Responsibility Model and service limitations.
Eliminate the option suggesting AWS patches EC2 guest operating systems, and eliminate AWS Lambda due to its inability to run custom kernels or access physical GPU hardware.
Operating system patching on EC2 is a customer responsibility, and Lambda does not support the rendering workload's hardware and kernel needs.

Key Concept

Selecting appropriate AWS compute services based on operational control, infrastructure management boundaries, and application architecture.
Question 2Question

A global media network is migrating its digital publishing platform to AWS. The network needs to ensure that its primary publishing database is resilient against localized disasters, such as power grid failures or flooding, within its main operating market. Additionally, the network must deliver static image and video assets to a worldwide audience with minimal delay. Which of the following AWS Global Infrastructure design decisions will meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Deploying the primary database across multiple Availability Zones within a single AWS Region; Utilizing AWS Edge Locations to cache and serve static media assets globally

Answer

Deploying the primary database across multiple Availability Zones within a single AWS Region, and utilizing AWS Edge Locations to cache and serve static media assets globally.
Deploying the primary database across multiple Availability Zones within a single AWS Region ensures high availability and resilience because each Availability Zone is physically isolated with independent infrastructure (power, cooling, network). Utilizing AWS Edge Locations to cache and serve static media assets globally reduces latency for international viewers by serving files from locations closer to them.

Step-by-Step Solution

1
Analyze the high-availability requirement for the database.
Identify that protecting against localized disasters (power failures, flooding) within a market requires deploying resources across physically separated locations within the same region (Availability Zones).
Availability Zones are isolated locations within a geographic AWS Region that are connected through low-latency links but are on separate power and flood plains.
2
Analyze the low-latency content delivery requirement.
Identify that serving static images and videos to a worldwide audience with minimal delay requires caching content close to the users.
AWS Edge Locations cache content close to global end-users, reducing latency for static assets.

Key Concept

AWS Global Infrastructure components, specifically the distinction between AWS Regions, Availability Zones, and Edge Locations.
Question 3Question

A municipal utility enterprise operates a smart grid analytics platform. The workload fluctuates dramatically and unpredictably based on seasonal weather patterns, leading to periods where on-premises servers run at 95% capacity, followed by weeks of near-zero utilization. To address this, the enterprise wants to migrate to a model where they only pay for resources when they are actively consumed, eliminating the need to pre-allocate hardware. Furthermore, they are mandated to quickly replicate their software environment to support municipal grids across South America and Europe with sub-second response times. Which of the following core benefits of the AWS Cloud directly support the resolution of these operational challenges? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Stop guessing capacity; Go global in minutes

Answer

The correct answers are the benefits to go global in minutes and to stop guessing capacity.
The correct options are stopping guessing capacity and going global in minutes. Stopping guessing capacity allows the utility enterprise to scale automatically to match variable workloads instead of maintaining idle on-premises hardware. Going global in minutes enables them to rapidly deploy applications to multiple global AWS Regions to reduce latency for municipal partners in South America and Europe.

Step-by-Step Solution

1
Analyze the first requirement: dealing with dramatic, unpredictable workload fluctuations and eliminating pre-allocated hardware.
Identify that the ability to scale resources automatically to meet demand without upfront capacity planning corresponds to the AWS benefit of stopping guessing capacity.
This matches the operational challenge of weather-induced traffic spikes.
2
Analyze the second requirement: replicating the software environment across South America and Europe with sub-second response times.
Identify that the capability to deploy applications in multiple regions globally with minimal effort corresponds to the AWS benefit of going global in minutes.
This addresses the geographical expansion requirement with low latency.

Key Concept

Benefits of the AWS Cloud (Stop guessing capacity and Go global in minutes)
Estimated Time:2m 0s
Question 4Question

A media streaming company is redesigning its video processing and delivery platform to handle highly fluctuating demand. The platform experiences sudden spikes in traffic during popular video releases and very low traffic during off-peak hours. Which two architectural decisions align with the AWS Cloud design principles of elasticity and services not servers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configuring Amazon EC2 Auto Scaling to dynamically adjust the number of active virtual servers in response to fluctuating user demand; Utilizing AWS Lambda to transcode short video clips serverlessly without provisioning or managing underlying virtual machines

Answer

The correct architectural decisions are configuring Amazon EC2 Auto Scaling to dynamically adjust the number of active virtual servers in response to fluctuating user demand, and utilizing AWS Lambda to transcode short video clips serverlessly without provisioning or managing underlying virtual machines.
The correct choices are using Amazon EC2 Auto Scaling to dynamically adjust instance count, which is a direct application of elasticity, and using AWS Lambda to run code serverlessly, which applies the 'services, not servers' principle. Together, they allow the application to scale dynamically based on demand and minimize server management overhead.

Step-by-Step Solution

1
Analyze the requirements in the scenario.
The platform needs to handle fluctuating traffic efficiently (demand spikes vs. off-peak lows) using elasticity and 'services not servers' principles.
Understanding the core cloud design principles requested is key to identifying correct answers.
2
Evaluate options for the elasticity principle.
Configuring Amazon EC2 Auto Scaling allows the platform to scale out/in automatically to match the demand curve, proving elastic.
Elasticity is the ability to match resource supply to demand dynamically.
3
Evaluate options for the 'services not servers' principle.
Utilizing AWS Lambda allows executing code serverlessly without managing underlying operating systems or virtual machines.
The 'services, not servers' principle advocates using managed and serverless offerings to reduce operational overhead.

Key Concept

AWS Cloud Design Principles: Elasticity and Services not Servers
Estimated Time:1m 30s
Question 5Question

A multi-department enterprise wants to secure its AWS environment by implementing the principle of least privilege and reducing security risks associated with credential management. The administrator must configure access for both developers (human users) and applications running on Amazon EC2 instances (machine identities). Which two methods represent AWS security best practices for managing these identities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use AWS IAM Identity Center to federate human identities and centrally manage user access to AWS accounts.; Attach an IAM role to the Amazon EC2 instances to provide applications with temporary security credentials.

Answer

The correct practices are to use AWS IAM Identity Center for federated human access, and to attach IAM roles to Amazon EC2 instances for secure machine access using temporary credentials.
Centrally managing human user identities with AWS IAM Identity Center and using IAM roles to assign temporary credentials to EC2 instances are the industry-standard AWS best practices. They eliminate the need for permanent access keys, simplify credential rotation, and preserve detailed accountability in audit logs.

Step-by-Step Solution

1
Analyze the requirements for human identities (developers).
Identify that AWS IAM Identity Center is the modern, recommended approach to centrally manage federated human access instead of creating static IAM users.
Reduces credential management overhead and aligns with the best practice of avoiding long-term IAM user credentials.
2
Analyze the requirements for machine identities (applications running on EC2 instances).
Identify that IAM roles should be attached to EC2 instances to provide temporary, automatically rotated security credentials.
Eliminates the risk of hardcoding or storing long-term API access keys in application configuration files.
3
Evaluate the incorrect choices to ensure they violate AWS security best practices.
Confirm that using the root user, sharing IAM accounts, or storing long-term access keys on EC2 instances are insecure configurations.
These practices increase the attack surface and violate the principles of least privilege and individual accountability.

Key Concept

AWS IAM best practices for securing human and machine access using federation and temporary credentials.
Question 6Question

A retail corporation is designing a hybrid cloud architecture and needs to secure its data at rest on AWS. The security compliance policy states that the keys used for encrypting financial transactions must be stored on dedicated, single-tenant cryptographic hardware controlled entirely by the customer. However, for standard application logs stored in Amazon S3, the company wants to use a fully managed service where AWS handles the physical hardware management, but the customer retains control over key policies and rotation.

Which two of the following actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions.; Use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.

Answer

Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions, and use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys. AWS CloudHSM satisfies the need for dedicated, single-tenant hardware cryptographic keys controlled entirely by the customer. AWS KMS with customer managed keys satisfies the requirement for a fully managed multi-tenant key service where AWS manages the underlying HSM hardware while the customer retains control over key policies and key rotation.

Step-by-Step Solution

1
Analyze the encryption requirements for the financial transaction keys.
The requirement specifies dedicated, single-tenant cryptographic hardware controlled entirely by the customer, which points directly to AWS CloudHSM.
AWS CloudHSM is a dedicated HSM service that gives the customer exclusive administrative control.
2
Analyze the encryption requirements for the application logs stored in Amazon S3.
The requirement specifies a fully managed service where AWS manages the hardware, but the customer controls key policies and rotation. This aligns with AWS KMS customer managed keys.
AWS KMS customer managed keys are managed by the customer but run on AWS-managed multi-tenant HSM infrastructure.
3
Select the correct combination of AWS services that fulfill both conditions.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys.
This combination successfully meets both dedicated and fully-managed encryption needs.

Key Concept

Selecting appropriate AWS services (AWS KMS vs. AWS CloudHSM) based on multi-tenant versus single-tenant encryption hardware requirements under the shared responsibility model.
Question 7Question

A community theater company plans to migrate its ticketing platform to AWS. The platform receives extremely high volumes of traffic during the first hour of ticket releases for major shows, but experiences negligible traffic during the rest of the month. The theater needs to avoid paying for idle infrastructure and eliminate upfront server procurement costs.

Which two AWS cloud economics concepts or benefits should the theater leverage to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replacing upfront capital expenses with variable operational expenses; Leveraging elasticity to dynamically adjust resource capacity to match actual demand

Answer

The theater company should replace upfront capital expenses with variable operational expenses, and leverage elasticity to dynamically adjust resource capacity to match actual demand.
The correct options identify two core AWS cloud economics benefits: shifting upfront capital expenses (CapEx) to variable operational expenses (OpEx), and using elasticity to scale resources dynamically. By trading capital expenses for operational expenses, the theater avoids upfront server purchasing costs. By leveraging elasticity, the ticketing system dynamically provisions resources to handle the sudden burst of ticket buyers and downscales during idle periods to prevent wasted expenditures.

Step-by-Step Solution

1
Analyze the financial constraint of avoiding upfront server procurement costs.
Trading upfront hardware costs for variable billing maps to the concept of shifting capital expenses (CapEx) to operational expenses (OpEx).
AWS allows businesses to pay as they go rather than buying hardware before using it.
2
Analyze the operational constraint of handling high traffic surges while minimizing idle resource costs.
Scaling resources up and down to match demand maps to the concept of elasticity.
Elasticity prevents paying for unused, running infrastructure during periods of low activity.

Key Concept

AWS Cloud Economics (CapEx to OpEx shift and Elasticity)
Estimated Time:1m 0s
Question 8Question

NovaSprout Organics, a distributor of organic produce, is migrating its operations to the AWS Cloud. The IT department has finalized plans for two distinct workloads:

1. The company's core inventory tracking database will be moved to Amazon RDS to eliminate the administrative burden of backups and patching, while keeping the database engine and application code unchanged.
2. The legacy customer relationship management (CRM) system, which is complex and expensive to maintain on-premises, will be decommissioned in favor of a cloud-based CRM software-as-a-service (SaaS) application.

Which two migration strategies are being utilized by NovaSprout Organics? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Replatforming; Repurchasing

Answer

Replatforming and Repurchasing are the migration strategies utilized in this scenario.
Replatforming is the correct strategy for the database migration because the company is moving the database to a managed service (Amazon RDS) to reduce administrative overhead while keeping the application code unchanged. Repurchasing is the correct strategy for the CRM system because the company is decommissioning its legacy on-premises system and replacing it with a third-party Software as a Service (SaaS) application.

Step-by-Step Solution

1
Analyze the database migration: The workload is moved to Amazon RDS (a managed database service) to reduce administrative tasks, but the engine and code remain unchanged.
Identify this as Replatforming (lift-tinker-and-shift), which involves optimizing a workload during migration without rewriting application code.
To classify the first workload's migration strategy.
2
Analyze the CRM system migration: The legacy system is decommissioned and replaced by a third-party CRM Software-as-a-Service (SaaS) product.
Identify this as Repurchasing (drop-and-shop), which involves moving to a different product, typically a SaaS platform.
To classify the second workload's migration strategy.
3
Select the two options that correspond to the identified strategies.
Select the options representing Replatforming and Repurchasing.
To provide the final correct answer keys.

Key Concept

Identifying cloud migration strategies (the 6 Rs), specifically Replatforming and Repurchasing.
Estimated Time:1m 30s
Question 9Question

A logistics company, RouteLogix, runs a fleet management application that processes vehicle telemetry. The application requires high compute capacity to run route optimization algorithms for 4 hours every morning. During the rest of the day, the system only requires minimal resources to receive and store GPS location pings. The company's management wants to understand the economic impact of migrating this workload from their on-premises data center to AWS. Which of the following describe the financial benefits of this migration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The company can eliminate cost overhead from idle compute capacity by dynamically scaling resources down when the optimization algorithms are not running.; The company shifts from upfront capital expenditures (CapEx) for physical server procurement to variable operating expenditures (OpEx) based on actual compute usage.

Answer

The correct options are the statements describing how the company can eliminate cost overhead from idle compute capacity by dynamically scaling resources down, and how the company shifts from upfront capital expenditures (CapEx) to variable operating expenditures (OpEx).
The correct answer identifies the fundamental cloud economic principles of elasticity and shifting CapEx to OpEx. By utilizing elasticity, the company stops paying for idle compute capacity during the 20 hours of low daily utilization. Additionally, paying for AWS resources on-demand shifts upfront capital investments in physical hardware to operational expenses based on actual usage.

Step-by-Step Solution

1
Analyze the workload requirements of RouteLogix.
The workload has a high requirement for 4 hours and minimal requirements for the remaining 20 hours.
Identifying the variability of the workload helps determine the relevance of elasticity and compute demand matching.
2
Evaluate the financial transition from on-premises to AWS.
On-premises requires buying physical hardware for peak capacity (CapEx), leading to idle resources. AWS allows pay-as-you-go billing (OpEx) and dynamic resource scaling (elasticity).
This matches the target economic principles: shifting CapEx to OpEx and maximizing savings through elasticity.

Key Concept

Understand concepts of cloud economics (CapEx to OpEx shift and the financial benefit of elasticity)
Estimated Time:1m 30s
Question 10Question

A logistics company manages separate AWS accounts for its shipping, tracking, and warehousing divisions. The finance department wants to simplify its payment process and lower overall costs.

Which of the following are benefits of combining these accounts under a single organization using AWS Organizations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Receiving a combined bill for all member accounts instead of separate invoices for each division; Aggregating resource usage across all linked accounts to meet thresholds for volume tier discounts

Answer

Consolidating payments into a single combined invoice and aggregating usage to qualify for volume tier discounts are both key benefits of consolidated billing in AWS Organizations.
Consolidated billing under AWS Organizations provides two primary financial benefits: it combines the billing of multiple member accounts into a single management account invoice (simplifying payment processing), and it aggregates the resource usage of all member accounts to help the company qualify for volume pricing discounts (such as tiered rates for storage or data transfer).

Step-by-Step Solution

1
Analyze the company's requirement to simplify payments and reduce costs across multiple AWS accounts.
The requirement points to features of consolidated billing and AWS Organizations.
AWS Organizations allows linking multiple accounts to centralize billing and administration.
2
Identify which options describe valid benefits of consolidated billing in AWS Organizations.
Receiving one combined invoice simplifies payments, and aggregating usage across accounts helps qualify for volume-based pricing discounts.
These are direct, documented features designed to reduce administrative overhead and cost.
3
Evaluate the distractors to ensure they describe incorrect features or security models.
AWS Organizations does not automatically sync IAM users, root users cannot be deleted, and AWS retains sole responsibility for physical hardware.
Verifying the invalid options ensures that only the two correct answers are selected.

Key Concept

Unified billing and AWS Organizations benefits, specifically combined invoicing and aggregated volume pricing.
Estimated Time:1m 0s
Question 11Question

A medical research company is designing a new cloud architecture on AWS to handle two distinct processing tasks:

1. A batch processing job that performs genome sequencing simulations. This job must run on a custom Linux distribution with a modified kernel and runs continuously for several days.
2. An image processing task that automatically runs whenever a patient uploads a medical scan to an Amazon S3 bucket. The execution time is less than a minute, and uploads occur sporadically throughout the day.

Which two AWS compute services should the company use to support these workloads? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic Compute Cloud (Amazon EC2); AWS Lambda

Answer

Amazon Elastic Compute Cloud (Amazon EC2) and AWS Lambda are the correct selections.
Amazon Elastic Compute Cloud (Amazon EC2) is correct because it provides full administrative access and allows running custom operating system kernels, which is required for the genome sequencing simulations. AWS Lambda is correct because it is a serverless, event-driven service that automatically runs code in response to Amazon S3 uploads and scales dynamically.

Step-by-Step Solution

1
Analyze the first requirement: genome sequencing simulations running on a custom Linux distribution with a modified kernel for several days.
Identify that this requires full control over the operating system and kernel-level customization, which is uniquely supported by virtual machines.
Managed or serverless services do not allow modification of the underlying operating system kernel.
2
Analyze the second requirement: image processing running sporadically in response to Amazon S3 uploads, executing in under a minute.
Identify that this requires an event-driven, serverless compute service that runs code only when triggered.
A serverless service provides a cost-effective, scalable, and zero-administration solution for short-lived, event-driven tasks.

Key Concept

Selecting appropriate AWS compute services based on operating system control requirements and execution patterns (continuous vs. event-driven).
Question 12Question

An enterprise retail organization is preparing to deploy an e-commerce platform on AWS. The design includes running application containers on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate launch type across two AWS Regions, storing structured product catalogs in Amazon Aurora, and storing media assets in Amazon Simple Storage Service (Amazon S3). Before deploying any services or writing code, the cloud financial operations team must estimate the monthly costs for this hypothetical infrastructure.

Which of the following actions should the team perform to model and estimate these projected costs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the AWS Pricing Calculator to input the estimated container count, vCPU/memory requirements, database storage size, and data transfer volumes between regions to generate a monthly cost estimate.; Configure different groups of services and resource estimates in the AWS Pricing Calculator to compare the cost differences of deploying the architecture across multiple AWS Regions.

Answer

To estimate these projected costs, the team should use the AWS Pricing Calculator to input the estimated resource specifications (such as container count, vCPU/memory, database size, and data transfer volumes) and configure service groups to compare costs across different AWS Regions.
The AWS Pricing Calculator is the primary tool for estimating the cost of AWS services before they are deployed. It allows users to create cost estimates for hypothetical architectures by specifying configurations such as the number of ECS containers, Fargate vCPU/memory requirements, database storage size, and S3 storage classes. It also supports grouping resources to compare costs across different AWS Regions or deployment configurations, helping teams make informed architectural decisions based on projected expenses.

Step-by-Step Solution

1
Identify the requirements of the scenario, which is estimating the monthly costs of a hypothetical, pre-deployment multi-region application architecture.
The scenario requires a planning and cost estimation tool for future configurations rather than tracking actual historical spending.
Since no resources have been deployed yet, tools that track existing resources cannot be used.
2
Evaluate the capabilities of the AWS Pricing Calculator for the scenario.
The AWS Pricing Calculator can model hypothetical workloads, including Amazon ECS, AWS Fargate, Amazon Aurora, and Amazon S3 across multiple regions, allowing the team to estimate monthly costs and compare different region configurations.
This directly aligns with the need to generate pre-deployment cost projections based on custom resource settings.
3
Differentiate the AWS Pricing Calculator from post-deployment billing and monitoring tools like AWS Cost Explorer and the AWS Cost & Usage Report, and verify economic principles.
Eliminate options suggesting the use of historical monitoring or reporting tools, as well as capital expense planning for physical hardware.
Post-deployment tools require active resources to generate data, and AWS operates on an operating expense (OpEx) model rather than a capital expense (CapEx) hardware purchasing model.

Key Concept

Estimating pre-deployment costs of hypothetical workloads using the AWS Pricing Calculator.
Estimated Time:2m 30s
Question 13Question

A fitness technology company is launching a new health-tracking application that collects workout data from smartwatches. To handle unpredictable traffic spikes during morning workouts and prevent data loss if a processing server fails, the development team wants to implement core AWS Cloud design principles. Which two of the following architectural strategies represent the correct application of these design principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon Simple Queue Service (Amazon SQS) to buffer incoming metrics and decouple the data ingestion layer from the backend processing servers.; Configure Amazon EC2 Auto Scaling to dynamically adjust the number of instances based on real-time application load.

Answer

Deploying Amazon Simple Queue Service (Amazon SQS) to buffer incoming metrics and decouple layers, and configuring Amazon EC2 Auto Scaling to dynamically adjust instance count.
Deploying Amazon SQS to buffer incoming metrics decouples the ingestion layer from the processing backend, adhering to the principle of loose coupling and ensuring that data is not lost if backend servers fail. Configuring Amazon EC2 Auto Scaling allows the system to scale out or in dynamically in response to workload demands, adhering to the principle of elasticity.

Step-by-Step Solution

1
Analyze the business and technical requirements of the fitness tracking application, which include handling unpredictable traffic spikes and preventing data loss during server failures.
Identified the need for elasticity to handle traffic spikes and loose coupling/design for failure to prevent data loss.
Aligns the application scenario with core AWS design principles.
2
Evaluate the architectural options against AWS design principles.
Determined that using Amazon SQS to buffer metrics decouple components (loose coupling), and Amazon EC2 Auto Scaling to dynamically scale compute capacity (elasticity), directly address the requirements.
Identifies the correct cloud architecture practices.

Key Concept

AWS Cloud design principles such as loose coupling, design for failure, and elasticity enable resilient, scalable, and cost-effective cloud architectures.
Question 14Question

A retail company is migrating its customer database to Amazon RDS for PostgreSQL to reduce administrative overhead. Which two of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model?

Select all that apply

Show answer & explanation

Answer: Managing database user accounts, permissions, and access controls within the database engine; Configuring database security groups to control incoming network traffic to the RDS instance

Answer

Managing database user accounts, permissions, and access controls within the database engine, as well as configuring database security groups to control incoming network traffic to the RDS instance, are both responsibilities of the customer.
For managed services like Amazon RDS, AWS manages the host operating system, patching, and physical infrastructure. The customer remains responsible for configuration tasks within the database engine (such as user accounts, roles, and privileges) and controlling network access to the database instance using database security groups.

Step-by-Step Solution

1
Identify the type of service being deployed.
Amazon RDS is a managed database service (PaaS).
The boundary of responsibility shifts depending on whether the service is IaaS (like EC2) or PaaS (like RDS).
2
Determine the split of responsibilities for Amazon RDS.
AWS handles physical security, infrastructure, operating system maintenance, and database patching. The customer handles database configuration, database-level security groups, data encryption, and user access management.
This determines which options represent customer tasks rather than AWS tasks.
3
Evaluate the choices based on the determined responsibilities.
Managing database user accounts/permissions and configuring database security groups are customer tasks. Operating system patching, physical storage drive replacement, and retrieving raw physical facility logs are AWS tasks.
This confirms the correct options.

Key Concept

Under the AWS Shared Responsibility Model for managed database services (RDS), AWS manages the infrastructure, OS patching, and physical hardware, while the customer manages database access, application configuration, and network security groups.
Estimated Time:1m 30s
Question 15Question

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.; Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.

Answer

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Key Concept

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Question 16Question

A global online learning platform hosts virtual classrooms on Amazon EC2 instances and stores course materials in Amazon S3 buckets. The security team needs to implement a solution that continuously scans their EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they must identify potential security threats across their AWS accounts, such as cryptocurrency mining or brute-force attacks, using machine learning and threat intelligence. Which combination of AWS services will address these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Inspector; Amazon GuardDuty

Answer

Amazon Inspector and Amazon GuardDuty
Amazon Inspector and Amazon GuardDuty together fulfill both security objectives. Amazon Inspector acts as a static and dynamic vulnerability scanner for EC2 instances and ECR container images to locate software flaws. Amazon GuardDuty acts as an intelligent threat detector that analyzes active telemetry logs to identify operational and account-level security threats in real time.

Step-by-Step Solution

1
Analyze the requirement for scanning EC2 instances for software vulnerabilities and network reachability issues.
Identify Amazon Inspector as the designated AWS service for automated host vulnerability assessment.
Amazon Inspector automatically discovers EC2 instances and scans them against a database of known vulnerabilities (CVEs) and evaluates network exposure configurations.
2
Analyze the requirement for detecting active threats, suspicious API calls, cryptomining, and brute-force attempts across the AWS account.
Identify Amazon GuardDuty as the primary intelligent threat detection service.
Amazon GuardDuty processes logs (such as VPC Flow Logs, CloudTrail, and DNS logs) using threat intelligence and machine learning to flag abnormal or malicious activity.

Key Concept

Vulnerability scanning of virtual servers versus intelligent, log-based cloud threat detection.
Question 17Question

A retail company is auditing its AWS account to align with AWS Identity and Access Management (IAM) security best practices. Currently, developers use shared credentials for daily administrative tasks, and multi-factor authentication (MFA) is not enabled on the account. Which of the following actions should the company perform to secure their environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only specific tasks that require root credentials.; Configure AWS IAM Identity Center to delegate daily administrative access to developers using temporary security credentials.

Answer

To secure the AWS environment, the company should enable multi-factor authentication (MFA) on the AWS account root user and restrict its use, and configure AWS IAM Identity Center to delegate daily administrative access using temporary credentials.
The correct actions are to enable multi-factor authentication (MFA) on the root user to secure the account, and to set up AWS IAM Identity Center to manage developer access. This ensures that developers use temporary, unique credentials for daily operations instead of sharing permanent administrative access.

Step-by-Step Solution

1
Identify root user credentials security requirements.
Determine that the root user should have MFA enabled and must not be used for daily operations.
Root user credentials have complete administrative access across the entire account and represent a high security risk if compromised.
2
Analyze credential management for daily developer operations.
Determine that developers should use temporary credentials managed via AWS IAM Identity Center rather than permanent or shared keys.
Using temporary credentials minimizes the risk of credential leakage and aligns with the principle of least privilege.

Key Concept

Implementing IAM best practices including securing the root account with MFA and utilizing temporary credentials via identity federation or IAM Identity Center.
Estimated Time:1m 0s
Question 18Question

A media company is planning to migrate its application portfolio to the AWS Cloud and wants to minimize implementation time and effort. Which TWO migration strategies should the company use to migrate its workloads with either zero changes to the underlying code, or only minor optimizations to use managed services without changing the core application architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehosting; Replatforming

Answer

The correct strategies are Rehosting and Replatforming.
The correct strategies are Rehosting and Replatforming. Rehosting, often called 'lift-and-shift', moves the application directly to the cloud without modifying its architecture or code. Replatforming, or 'lift-tinker-and-shift', introduces minor optimizations to take advantage of managed services (such as migrating a database to Amazon RDS) without altering the application's core architecture.

Step-by-Step Solution

1
Analyze the migration requirements in the scenario.
The company wants to migrate workloads with either zero changes to code or only minor optimizations to use managed services, without altering the core application architecture.
This establishes the constraints of the migration, ruling out strategies that require code rewriting or vendor changes.
2
Evaluate the 6 Rs migration strategies against these requirements.
Rehosting ('lift-and-shift') requires no changes. Replatforming ('lift-tinker-and-shift') involves only minor optimizations (like adopting managed services) without changing the core architecture. Refactoring requires re-architecting/code changes, Repurchasing changes the application to a new product (SaaS), and Retaining leaves the application on-premises.
To select the two correct strategies that fit the criteria.

Key Concept

Cloud migration strategies (the 6 Rs), specifically Rehosting and Replatforming, which minimize changes to code and architecture during migration.
Estimated Time:45s
Question 19Question

A startup is building a new mobile application backend on AWS. The startup wants to focus on writing code and minimizing infrastructure management while automatically handling fluctuating user demands. Which two of the following design decisions align with AWS cloud design principles to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the application code on AWS Lambda to run without provisioning or managing servers; Configure Amazon EC2 Auto Scaling to automatically adjust compute capacity based on live traffic

Answer

Deploying the application code on AWS Lambda to run without provisioning servers and configuring Amazon EC2 Auto Scaling to adjust capacity based on traffic are the correct answers.
The correct options are deploying application code on AWS Lambda and configuring Amazon EC2 Auto Scaling. AWS Lambda aligns with the 'services, not servers' design principle by eliminating server management tasks, while Auto Scaling aligns with the 'elasticity' principle by matching resource capacity to demand dynamically.

Step-by-Step Solution

1
Analyze the scenario requirements: minimize infrastructure management overhead and automatically handle fluctuating demand.
Identified two primary design goals: adopting managed services ('services, not servers') and utilizing dynamic scaling ('elasticity').
This sets the target criteria for the correct options.
2
Evaluate the option regarding running serverless code.
AWS Lambda is a serverless service that aligns with the 'services, not servers' principle, removing the need to manage infrastructure.
This matches the goal of minimizing server management overhead.
3
Evaluate the option regarding automatic scaling.
Amazon EC2 Auto Scaling dynamically scales resources, which aligns with 'elasticity'.
This matches the goal of automatically handling fluctuating user demands.

Key Concept

AWS Cloud design principles including 'services, not servers' and 'elasticity'.
Question 20Question

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with permissions to read the database and attach it to the EC2 instance.; Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.

Answer

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Step-by-Step Solution

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Key Concept

Identity and Access Management (IAM) Best Practices
Page 1 / 35Next