All practice questions

755 questions

All types1,473 Multiple choice755 Multiple select693 Matching25

A startup is deploying a critical database on AWS and is evaluating options for high availability and disaster recovery. The database must be resilient to localized physical events such as fires, earthquakes, or power grid failures in a metropolitan area, but the data must not leave the host country due to legal compliance. A developer suggests deploying a primary database instance in one AWS Region and a read replica in a different AWS Region within the same country, while another suggestion is to deploy the database across multiple Availability Zones within a single AWS Region. Which of the following statements correctly evaluates these proposals in the context of AWS Global Infrastructure design principles?

Deploying across multiple Regions is required to protect against localized physical events like fires or power outages, because all Availability Zones within a single Region share the same physical data center facilities and utility connections.

Deploying a read replica in an Edge Location in a different city provides the best low-latency failover and disaster recovery, as Edge Locations are fully functional regional data centers designed to host primary database workloads.

Deploying across multiple Availability Zones in a single Region provides protection against localized physical events because Availability Zones are physically separated, isolated locations with independent power, cooling, and network connectivity, whereas deploying across different Regions introduces higher latency and is typically used for broader geographic disaster recovery.

Deploying across multiple Availability Zones does not guarantee data residency within the host country, as Availability Zones within a single Region are often located in different neighboring countries to maximize geographic separation.

Show answer & explanation

Answer: Deploying across multiple Availability Zones in a single Region provides protection against localized physical events because Availability Zones are physically separated, isolated locations with independent power, cooling, and network connectivity, whereas deploying across different Regions introduces higher latency and is typically used for broader geographic disaster recovery.

Answer

Deploying across multiple Availability Zones in a single Region provides high availability and fault tolerance against localized physical events because each Availability Zone is a physically isolated location with independent power, cooling, and networking. Because they are in the same Region, they are close enough to allow low-latency synchronous replication, while remaining in the same country to satisfy data residency regulations.

Step-by-Step Solution

Analyze the requirement for resilience against localized physical events within a metropolitan area.

Identify that the system requires physical isolation with independent power, cooling, and network infrastructure.

This ensures that a localized failure (like a power outage or fire) in one facility does not cause a secondary failure in another facility.

Evaluate the physical separation of AWS Availability Zones (AZs).

Confirm that AZs are physically isolated locations within an AWS Region, engineered to be fault-isolated.

Deploying the database across multiple AZs meets the localized resilience requirement without crossing regional boundaries.

Evaluate the requirement for data residency within the host country.

Verify that an AWS Region is situated within a single country's borders, and its AZs are located in the same country.

This guarantees that data stays within the national borders, fulfilling the compliance requirement.

Compare the AZ deployment with cross-Region and Edge Location options.

Determine that cross-Region deployment increases latency and is for disaster recovery, while Edge Locations cannot run databases.

This validates that the multi-AZ single-Region approach is the only proposal that satisfies all constraints.

Key Concept

Physical isolation and logical boundaries of AWS Regions, Availability Zones, and Edge Locations.

Question 2Question →

A university research department is transitioning its scientific simulation workloads to AWS. These workloads run for approximately $12$ hours at the end of each month, requiring $64$ high-performance compute nodes. The rest of the month, the department only requires a single low-power server to host their results archive. The IT director is evaluating the economic impact of this migration compared to their legacy on-premises hardware.

Which of the following describes the most cost-effective provisioning strategy that illustrates the economic benefit of cloud elasticity for this workload?

Deploying

64

On-Demand Instances only for the

12

hours the simulations run and terminating them immediately afterward, while running a single low-power instance continuously.

Purchasing a

3

-year Reserved Instance contract for

64

instances to guarantee that compute capacity is permanently available and reserved for the monthly simulation runs.

Capitalizing the virtual hardware costs upfront as a capital expense (CapEx) to establish a baseline of

64

active instances, then converting the idle capacity into operating expenses (OpEx) when they are not in use.

Statically provisioning

64

instances to remain active throughout the entire month to ensure the system has the scalability to handle the peak, which represents the AWS definition of elasticity.

Show answer & explanation

Answer: Deploying $64$ On-Demand Instances only for the $12$ hours the simulations run and terminating them immediately afterward, while running a single low-power instance continuously.

Answer

Deploying

64

On-Demand Instances only for the

12

hours the simulations run and terminating them immediately afterward, while running a single low-power instance continuously.

The correct answer demonstrates elasticity by running the high-performance compute nodes only when active (

12

hours a month) and terminating them when finished. This ensures the university only pays for what it uses, avoiding the cost of idle servers.

Step-by-Step Solution

Analyze the workload's resource usage pattern over time.

The workload has a highly fluctuating demand pattern: it requires

64

compute nodes for only

12

hours per month (approx.

1.6\%

of the month) and just a single node for the remaining

98.4\%

of the time.

Identifying the demand pattern is necessary to choose between static provisioning and elastic, dynamic provisioning.

Evaluate the economic feasibility of AWS pricing models for the intermittent portion of the workload.

Using On-Demand instances for the

64

simulation nodes costs only for the

12

hours of actual use, whereas Reserved Instances or static provisioning would charge for the entire month regardless of utilization.

This step determines how to minimize waste for resources that are idle most of the month.

Formulate a hybrid provisioning strategy that matches the workload segments.

Run a single low-power instance continuously for the archive, and spin up

64

On-Demand instances only when the monthly simulation runs, terminating them immediately upon completion.

This strategy leverages cloud elasticity to optimize cost by dynamically aligning compute supply with workload demand.

Key Concept

Cloud elasticity vs. static provisioning, and the pay-as-you-go consumption model.

Estimated Time:2m 0s

Question 3Question →

A government contractor is deploying an application on AWS that handles classified public safety records. Compliance regulations mandate that all data at rest must be encrypted using cryptographic keys stored inside dedicated, single-tenant hardware security modules (HSMs) that are physically and logically isolated. Which option correctly identifies the AWS service that meets this requirement and the customer's responsibility for that service under the AWS Shared Responsibility Model?

AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.

AWS Key Management Service (AWS KMS); the customer is responsible for managing the physical security and climate control of the hardware security modules.

AWS CloudHSM; the customer is responsible for performing firmware updates, physical hardware maintenance, and patching the appliance operating system.

AWS Key Management Service (AWS KMS); the customer is responsible for configuring logical partitions and key policies directly on the physical hardware security modules.

Show answer & explanation

Answer: AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.

Answer

AWS CloudHSM; the customer is responsible for managing users, keys, and cryptographic partitions on the dedicated HSM instance.

AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud. It provides dedicated, single-tenant HSM instances under the customer's direct control. Under the AWS Shared Responsibility Model, AWS manages physical security, hardware provisioning, and network connectivity, while the customer maintains sole control over the cryptographic keys, partitions, and user management.

Step-by-Step Solution

Identify the key residency and tenancy requirement.

The requirements mandate dedicated, single-tenant hardware security modules (HSMs), which points to AWS CloudHSM instead of AWS Key Management Service (AWS KMS) which uses shared, multi-tenant HSMs.

AWS CloudHSM provides dedicated HSM instances, whereas AWS KMS is a multi-tenant service.

Determine the shared responsibility model boundary for the chosen service.

For AWS CloudHSM, AWS manages hardware provisioning, physical security, and high availability, while the customer manages HSM partitions, cryptographic users, and key generation.

To satisfy the compliance requirements, the customer must maintain exclusive administrative control over the keys and users on the single-tenant HSM.

Key Concept

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for dedicated cryptography.

Estimated Time:1m 0s

Question 4Question →

A multinational company uses AWS Organizations with consolidated billing to manage its multiple departmental AWS accounts. The finance department notices that underutilized Amazon EC2 Reserved Instances (RIs) purchased by the marketing team's account are automatically applying discounts to EC2 instances running in the development team's account. To track budgets more accurately, the company wants to ensure that RI discounts are only applied to the specific account that purchased them. Which of the following actions should the AWS Organizations administrator take to achieve this?

Apply a Service Control Policy (SCP) to the Root organizational unit that denies Reserved Instance discount sharing across accounts.

Configure an IAM policy in the development account to reject billing discounts from external accounts.

Turn off Reserved Instance (RI) discount sharing in the Billing Preferences section of the organization's management account.

Convert the consolidated organization's billing profile from an Operating Expense (OpEx) model to a Capital Expense (CapEx) model to stop the automated distribution of billing discounts.

Show answer & explanation

Answer: Turn off Reserved Instance (RI) discount sharing in the Billing Preferences section of the organization's management account.

Answer

Turn off Reserved Instance (RI) discount sharing in the Billing Preferences section of the organization's management account.

By default, Reserved Instance (RI) and Savings Plans discounts are shared among all accounts under consolidated billing in AWS Organizations. The administrator can disable RI discount sharing for some or all of the member accounts in the Billing Preferences section of the management account.

Step-by-Step Solution

Identify the default billing behavior of AWS Organizations regarding Reserved Instances.

By default, Reserved Instance (RI) discounts are shared across all accounts within the organization's consolidated billing family.

To understand why the development account is currently receiving the marketing account's RI discounts.

Evaluate the console or settings required to modify this default sharing behavior.

The discount sharing preference is a billing administration setting found in the Billing Preferences section of the AWS Billing console.

To determine where the sharing behavior can be configured and disabled.

Identify the account with authorization to change billing preferences.

Only the management (payer) account has the authority to disable RI discount sharing for the member accounts.

To isolate the control point for consolidated billing features.

Key Concept

Disabling Reserved Instance and Savings Plans discount sharing via Billing Preferences in AWS Organizations.

Question 5Question →

A software-as-a-service (SaaS) company manages separate AWS accounts for its development, staging, and production environments. The finance team wants to receive a single monthly invoice for all accounts and benefit from aggregated volume pricing discounts for storage. At the same time, the security team must prevent users in the development accounts from deleting Amazon S3 buckets, even if those users have administrator permissions within their local accounts. Which of the following solutions should the company implement?

AWS Organizations with billing-only features enabled, combined with VPC Peering connections between all member accounts to share pricing tiers.

Individual AWS accounts linked using AWS Billing Conductor, with an IAM policy configured directly by the AWS account root user of each member account.

AWS Organizations with consolidated billing enabled, and a Service Control Policy applied to the development accounts.

AWS Billing and Cost Management console linked to AWS IAM Identity Center, with the AWS Shared Responsibility Model configured to prevent bucket deletion.

Show answer & explanation

Answer: AWS Organizations with consolidated billing enabled, and a Service Control Policy applied to the development accounts.

Answer

AWS Organizations with consolidated billing enabled, and a Service Control Policy applied to the development accounts.

AWS Organizations allows organizations to centrally manage billing and permissions across multiple AWS accounts. Enabling consolidated billing generates a single monthly invoice for the management account and aggregates usage across all member accounts to qualify for volume pricing discounts. Furthermore, Service Control Policies (SCPs) can be applied to organizational units or specific member accounts to restrict maximum permissions—such as preventing S3 bucket deletion—which overrides even administrative permissions within those member accounts.

Step-by-Step Solution

Identify the mechanism for combining multiple AWS accounts into a single invoice and sharing pricing tiers.

AWS Organizations consolidated billing features allow multiple member accounts to be billed under a single management account, automatically aggregating usage to qualify for higher volume discounts (e.g., S3 storage tiers).

This addresses the finance team's requirement for a single invoice and cost optimization.

Identify the mechanism for enforcing resource-level restriction policies across member accounts.

Service Control Policies (SCPs) in AWS Organizations can specify maximum permission boundaries for member accounts, including blocking actions like S3 bucket deletion.

This addresses the security team's requirement to restrict actions centrally, even for administrative users in the member accounts.

Key Concept

Consolidated Billing and AWS Organizations

Estimated Time:1m 30s

Question 6Question →

A retail organization plans to deploy a third-party firewall appliance as an Amazon Machine Image (AMI) on Amazon EC2. The organization decides to subscribe to the appliance through AWS Marketplace. How are the billing and software maintenance responsibilities structured for this deployment?

Both the software subscription fee and the EC2 instance infrastructure charges are billed together through the organization's AWS account, while the organization remains responsible for configuring and patching the firewall software.

The software subscription fee is billed through the AWS account, but AWS automatically assumes responsibility for configuring, updating, and patching the third-party software on the EC2 instance.

The software subscription requires a one-time upfront capital expense (CapEx) paid directly to the software vendor, while the EC2 infrastructure charges are billed monthly as operating expenses (OpEx) through AWS.

The software licensing fee is billed directly by the third-party software vendor under a separate billing system, while only the underlying EC2 infrastructure charges appear on the AWS bill.

Show answer & explanation

Answer: Both the software subscription fee and the EC2 instance infrastructure charges are billed together through the organization's AWS account, while the organization remains responsible for configuring and patching the firewall software.

Answer

AWS Marketplace consolidates the billing for third-party software subscriptions directly onto the customer's AWS bill alongside their AWS infrastructure usage (such as EC2 instance charges). However, purchasing through AWS Marketplace does not alter the Shared Responsibility Model. Because the software is deployed as an Amazon Machine Image (AMI) on the customer's EC2 instances, the customer is still responsible for configuring, patching, and maintaining the software and the operating system.

Step-by-Step Solution

Analyze the procurement method for the third-party software subscription.

Purchasing through AWS Marketplace aggregates the software subscription charges onto the customer's AWS bill.

This determines how the licensing fee is collected and processed.

Identify the infrastructure pricing for the underlying Amazon EC2 instance.

The infrastructure consumption charges for running the EC2 instance are billed to the customer's AWS bill.

This establishes that both software and hardware compute resources are consolidated into one billing stream.

Apply the AWS Shared Responsibility Model to the deployed Amazon Machine Image (AMI).

Since the software runs as an AMI within the customer's virtual private cloud (VPC), the customer holds the responsibility for guest operating system patching and software configuration.

This clarifies the maintenance boundary between the cloud provider and the customer.

Key Concept

AWS Marketplace Billing Integration and the Shared Responsibility Model

Estimated Time:1m 0s

Question 7Question →

A healthcare startup wants to rapidly test and deploy a new patient wellness application. In the cloud, the company can provision compute resources in minutes to run experiments and launch the app, compared to waiting weeks for physical hardware procurement in an on-premises data center. Which benefit of the AWS Cloud does this scenario represent?

Trade fixed expense for variable expense

Stop guessing capacity

Deploy systems using tightly coupled monolithic architectures

Increase speed and agility

Show answer & explanation

Answer: Increase speed and agility

Answer

The correct answer is the option stating that the scenario represents increasing speed and agility.

The scenario highlights the ability to provision compute resources in minutes to run experiments and launch an application, rather than waiting weeks for physical hardware. This capability directly defines the benefit of increasing speed and agility by making resources instantly available to developers.

Step-by-Step Solution

Identify the key operational capability described in the scenario.

The healthcare company is spinning up compute resources in minutes instead of waiting weeks for physical hardware procurement.

This establishes that the primary benefit highlighted is the speed of resource acquisition and deployment.

Map this capability to one of the six benefits of the AWS Cloud.

Reducing resource provisioning time from weeks to minutes aligns directly with the benefit of increasing speed and agility.

Agility in the cloud refers to the speed at which developers can access resources, which accelerates innovation and experimentation.

Key Concept

Increase speed and agility as a benefit of the AWS Cloud

Estimated Time:45s

Question 8Question →

A healthcare organization is migrating its digital health record system to AWS. The system must remain available even if a physical data center experiences a complete power outage. The architecture team deploys the application servers across three Availability Zones behind an Application Load Balancer, and configures a Multi-AZ deployment for their database. Which design principle of the AWS Cloud does this architectural strategy directly implement?

Elasticity

Design for failure

Loose coupling

Scalability

Show answer & explanation

Answer: Design for failure

Answer

Design for failure

The correct answer is design for failure. This principle assumes that any component can and will fail over time. To mitigate this, architectures must be designed to avoid single points of failure by distributing resources across multiple physical locations (Availability Zones) and deploying redundant database instances to achieve high availability and fault tolerance.

Step-by-Step Solution

Analyze the technical requirements of the scenario.

The healthcare organization requires continuous system availability and resilience against physical data center outages.

Identifying the primary operational constraint helps map the architecture to the correct cloud design principle.

Evaluate the architectural components chosen for the solution.

The architecture utilizes three Availability Zones and a Multi-AZ database setup to eliminate single points of physical infrastructure failure.

Understanding how the components function helps determine which design principle they embody.

Match the architectural strategy to the core AWS Cloud design principles.

Deploying redundant resources across multiple Availability Zones to survive hardware or site failures directly aligns with the principle of designing for failure.

This confirms that the design assumes failure at any level and implements redundancy to prevent service interruption.

Key Concept

Designing for failure on AWS involves building architectures that assume any component can fail. By utilizing multiple Availability Zones and database replication, workloads remain operational despite localized infrastructure disruptions.

Question 9Question →

A retail company wants to implement a system on AWS that processes customer product reviews. The system must detect the sentiment of the reviews, translate non-English reviews to English, and save the results. The team wants to deploy this solution with the lowest possible operational overhead, avoiding tasks like operating system patching, capacity provisioning, and software installation. Which of the following designs best adheres to the AWS Cloud design principle of 'services not servers' to accomplish this goal?

Ingesting reviews via Amazon API Gateway, processing them using AWS Lambda functions that call Amazon Comprehend and Amazon Translate, and storing the final data in Amazon DynamoDB.

Deploying a single, high-capacity Amazon EC2 instance that runs a web server, a custom natural language processing library, a translation database, and a local PostgreSQL database.

Deploying the application as a monolithic service across a fleet of Amazon EC2 instances managed by an Auto Scaling group, using Amazon CloudWatch metrics to scale the instances in and out based on processing demand.

Provisioning dedicated Amazon EC2 instances pre-configured with AWS-managed machine learning software, and configuring AWS Systems Manager to automate the operating system patching on these instances.

Show answer & explanation

Answer: Ingesting reviews via Amazon API Gateway, processing them using AWS Lambda functions that call Amazon Comprehend and Amazon Translate, and storing the final data in Amazon DynamoDB.

Answer

Ingesting reviews via Amazon API Gateway, processing them using AWS Lambda functions that call Amazon Comprehend and Amazon Translate, and storing the final data in Amazon DynamoDB.

The correct design uses Amazon API Gateway, AWS Lambda, Amazon Comprehend, Amazon Translate, and Amazon DynamoDB. Each of these is a serverless or fully managed service. With this architecture, AWS handles server provisioning, operating system patching, scaling, and high availability, which completely removes the operational burden of managing servers from the customer.

Step-by-Step Solution

Analyze the requirement to minimize operational overhead, specifically avoiding operating system patching, capacity provisioning, and software installation.

Identify that the solution must avoid using virtual servers (Amazon EC2) that require manual administrative management.

The 'services not servers' principle guides architects to use fully managed services and serverless technologies to offload operational responsibility to AWS.

Evaluate the proposed architectural designs to see which one utilizes fully managed, serverless services instead of managing virtual instances.

The design using Amazon API Gateway, AWS Lambda, Amazon Comprehend, Amazon Translate, and Amazon DynamoDB relies entirely on serverless services.

Each of these services is fully managed by AWS, requiring no server provisioning, OS maintenance, or manual scaling configurations from the customer.

Verify that the alternative options rely on virtual servers (Amazon EC2) and explain why they do not meet the 'services not servers' principle.

Designs involving EC2 instances (whether scaled automatically, running on a single large instance, or using patch automation) still require the customer to manage the operating system and capacity.

This establishes that the serverless architecture is the correct choice because it completely removes the need to manage servers.

Key Concept

The AWS Cloud design principle of 'services not servers' guides architects to use fully managed and serverless services to minimize operational overhead and focus on application logic rather than infrastructure maintenance.

Question 10Question →

A digital publishing company wants to migrate its legacy on-premises email marketing tool to a modern, cloud-based software-as-a-service (SaaS) solution available in AWS Marketplace. Which migration strategy does this change represent?

Repurchasing

Rehosting

Replatforming

Refactoring

Show answer & explanation

Answer: Repurchasing

Answer

Repurchasing

The correct answer is the strategy of moving to a different product, typically a software-as-a-service (SaaS) model. When a company abandons their legacy on-premises tool to adopt a SaaS solution (such as one found in AWS Marketplace), they are utilizing the Repurchasing migration strategy.

Step-by-Step Solution

Identify the migration requirement described in the scenario.

The company wants to move from an on-premises marketing tool to a ready-made SaaS solution in AWS Marketplace.

Understanding the target state helps match it to one of the 6 Rs of migration.

Evaluate the 6 Rs migration strategies against a transition to a SaaS platform.

Replacing a legacy self-managed system with a software-as-a-service (SaaS) platform corresponds to the Repurchasing strategy.

Repurchasing is defined as moving to a different product, typically a cloud-hosted commercial software package or SaaS.

Key Concept

AWS Migration Strategies (6 Rs) - Repurchasing

Question 11Question →

A logistics company containerizes its shipment tracking application and deploys it on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Applying security updates and operating system patches to the container host instances

Configuring security group rules to control traffic to and from the container tasks

Managing the physical security controls of the data centers hosting the container infrastructure

Replacing faulty physical servers that support the container orchestration service

Show answer & explanation

Answer: Configuring security group rules to control traffic to and from the container tasks

Answer

Configuring security group rules to control traffic to and from the container tasks

The configuration of security groups to control inbound and outbound traffic to the container tasks is a customer responsibility. Even though AWS Fargate abstracts the underlying host servers and operating system, the customer retains control and responsibility over network-level access control to their own workloads.

Step-by-Step Solution

Analyze the service type and deployment model

AWS Fargate is a serverless compute engine for containers, which falls under a managed service model where the underlying host operating system and hardware are managed by AWS.

Identifying the service category helps determine the boundary line between the customer's security 'in' the cloud and AWS's security 'of' the cloud.

Differentiate between customer and AWS responsibilities for this service

AWS manages physical security, host patching, and hardware. The customer manages application code, container images, IAM roles, and network security configuration (security groups) for the tasks.

This allows us to isolate which configuration task is still controlled by the customer in a serverless container environment.

Key Concept

Shared Responsibility Model for Serverless Container Services

Question 12Question →

An insurance firm is migrating its claims processing system to AWS. The system consists of a web portal, a document generation service, and a document archiving service. Currently, the web portal calls the document generation and archiving services synchronously. If the archiving service is temporarily unavailable, the entire claim submission fails. How should the firm redesign the application on AWS to resolve this issue?

Consolidate the web portal, document generation, and document archiving services into a single monolithic application deployed on a single Amazon EC2 instance.

Increase the size of the web portal's Amazon EC2 instances to handle the additional connection load and wait times when downstream services fail.

Redesign the system to communicate asynchronously using Amazon Simple Queue Service (Amazon SQS), decoupling the web portal from downstream processing.

Configure the web portal to trigger synchronous execution of all services inside a single database transaction across multiple Availability Zones.

Show answer & explanation

Answer: Redesign the system to communicate asynchronously using Amazon Simple Queue Service (Amazon SQS), decoupling the web portal from downstream processing.

Answer

Redesign the system to communicate asynchronously using Amazon Simple Queue Service (Amazon SQS), decoupling the web portal from downstream processing.

Decoupling components using an asynchronous message queue like Amazon Simple Queue Service (Amazon SQS) is a core AWS design principle (loose coupling). It allows the web portal to queue requests and continue responding to users even if downstream services (like document generation or archiving) are experiencing latency or are temporarily offline.

Step-by-Step Solution

Analyze the current system architecture and identify dependencies.

The web portal has synchronous, tight coupling with the document generation and archiving services, making it vulnerable to downstream failures.

To solve the reliability issue, we must identify where the tight coupling is causing cascading failures.

Apply AWS design principles to decouple the components.

An asynchronous communication mechanism, such as a message queue, is selected to buffer requests.

Decoupling ensures that a failure or slowdown in downstream services does not immediately impact the web portal's availability.

Select the appropriate AWS service for queueing and asynchronous processing.

Amazon Simple Queue Service (Amazon SQS) is integrated between the web portal and the downstream services.

SQS provides a fully managed, scalable message queue that allows components to scale and fail independently without losing data.

Key Concept

Loose coupling

Estimated Time:1m 30s

Question 13Question →

A medical device manufacturer is deploying an IoT monitoring system on AWS. The quality assurance team must retrieve official AWS compliance reports, such as ISO certificates, to complete their regulatory filing. Which AWS service provides on-demand access to these security and compliance reports?

AWS Artifact

AWS Systems Manager

Amazon GuardDuty

AWS CloudTrail

Show answer & explanation

Answer: AWS Artifact

Answer

AWS Artifact

AWS Artifact is a self-service portal that provides customers with direct access to AWS compliance documentation. This includes Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and various ISO certifications required by regulators and auditors.

Step-by-Step Solution

Identify the requirement to retrieve third-party compliance reports and certifications (such as ISO certificates) for AWS infrastructure.

The requirement points to AWS compliance and governance documentation.

AWS manages the security of the cloud and provides audit reports to customers to prove compliance.

Determine which AWS service acts as the central portal for these compliance documents.

AWS Artifact is identified as the dedicated self-service portal for downloading these reports on demand.

Other services like Systems Manager, GuardDuty, or CloudTrail are used for resource management, threat detection, or API logging rather than document retrieval.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and agreements.

Estimated Time:1m 0s

Question 14Question →

A fintech startup is deploying a public-facing REST API using Amazon API Gateway to expose financial transaction data. The API must be secured against unauthorized access, and all data transit must be encrypted. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Applying operating system and security patches to the underlying compute instances hosting API Gateway

Creating stateful Security Groups directly on the API Gateway endpoints to block malicious traffic at the network level

Conducting physical audits of the AWS data centers to verify compliance with financial industry standards

Show answer & explanation

Answer: Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Answer

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers is the correct answer because managing identity and access management (IAM) permissions, authentication, and authorization policies for the application's APIs falls under the customer's responsibility for securing their data 'in' the cloud.

Step-by-Step Solution

Identify the AWS service type in the scenario.

Amazon API Gateway is a fully managed (Platform-as-a-Service/Serverless) AWS service.

Managed services shift infrastructure-level maintenance tasks from the customer to AWS.

Differentiate between security 'of' the cloud and security 'in' the cloud for a managed service.

AWS handles the physical security, underlying operating systems, and patching. The customer remains responsible for securing data, configuring resource policies, and managing user access.

This determines which task the customer must execute directly to secure their API.

Evaluate the choices to find the customer-managed task.

Configuring user pools or Lambda authorizers controls access to the application data, which is 'in' the cloud and thus the customer's responsibility.

API access control is managed at the application layer by the customer.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon API Gateway, AWS handles physical security, OS patching, and network infrastructure, while the customer is responsible for application-level security, including client-side encryption, access control (authentication/authorization), and resource configuration.

Question 15Question →

A company is building a batch processing solution for genetic sequencing data. The application requires direct access to GPU hardware, a customized Linux kernel with specific compliance patches, and runs jobs that can take up to 4 hours to complete. The workload is highly unpredictable, and the company wants to minimize costs by ensuring resources are only active during processing. Which AWS compute option best meets these requirements?

AWS Lambda functions triggered by Amazon S3 events

Amazon EC2 instances in an Auto Scaling group utilizing Spot Instances

AWS Fargate tasks running on Amazon ECS

Amazon Lightsail container services with pre-configured stacks

Show answer & explanation

Answer: Amazon EC2 instances in an Auto Scaling group utilizing Spot Instances

Answer

Amazon EC2 instances in an Auto Scaling group utilizing Spot Instances

Amazon EC2 is the correct choice because it provides virtual machines where the customer has full root access, enabling the use of custom kernels and direct GPU mapping. Since the job runs for 4 hours, it exceeds Lambda's limits. EC2 Auto Scaling allows the group to scale to zero instances to minimize costs, and Spot Instances offer deep discounts suitable for batch jobs.

Step-by-Step Solution

Analyze the workload duration requirement.

The job takes up to 4 hours, which immediately rules out serverless functions like AWS Lambda due to their 15-minute execution limit.

Compute options must support long-running execution windows.

Evaluate operating system and hardware requirements.

The requirement for custom kernel compliance patches and direct GPU access rules out serverless container options like AWS Fargate, which abstract away the host OS and kernel management.

Administrative control over the OS kernel is a shared responsibility aspect that requires full virtual machine control (EC2).

Assess cost-optimization and scalability requirements.

Amazon EC2 Auto Scaling groups can scale to zero instances when no work is present, and utilizing Spot Instances matches the unpredictable, batch-processing nature of genetic sequencing at a highly discounted rate.

Minimizing idle costs requires dynamic scaling and leverage of excess AWS capacity pricing.

Key Concept

AWS Compute Service Selection based on compliance, hardware access, execution duration, and cost optimization

Question 16Question →

A research institute manages high-performance simulation applications running on a fleet of Amazon EC2 instances. The institute's security audit team requires a tool that can continuously scan the operating systems of these instances for known software vulnerabilities and analyze network paths to identify unintended exposure to the internet. Which AWS service is designed to perform these automated vulnerability assessments?

AWS CloudTrail

Amazon Inspector

Amazon GuardDuty

AWS Shield

Show answer & explanation

Answer: Amazon Inspector

Answer

Amazon Inspector is the correct service because it automatically evaluates Amazon EC2 instances for software vulnerabilities and unintended network path exposure.

Amazon Inspector is designed to automatically discover and scan Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities (like CVEs) and unintended network exposure.

Step-by-Step Solution

Analyze the core requirement of finding an AWS service that performs automated security assessments, scans for software vulnerabilities, and analyzes network paths on Amazon EC2 instances.

The target service must support host-level operating system scanning and network exposure analysis.

This distinguishes between services that monitor active API threats and those that audit static configuration and patching status.

Evaluate the capabilities of Amazon Inspector against other security services.

Amazon Inspector is the only service that performs automated vulnerability scans on host software and checks network accessibility, whereas GuardDuty is for active threat detection, CloudTrail is for auditing API events, and Shield is for DDoS protection.

Identifying the distinct functionality of each option ensures the selection of the correct service.

Key Concept

Continuous vulnerability assessment and network reachability analysis using Amazon Inspector.

Estimated Time:1m 0s

Question 17Question →

A digital art auction platform hosts live virtual auctions once a week for exactly one hour. During this hour, user traffic increases five-fold, while the platform remains mostly idle for the rest of the week. Under their traditional on-premises model, the company had to purchase and configure high-end servers to handle this short weekly peak, which resulted in low resource utilization. By migrating to AWS, the company can automatically scale their resources up during the auction hour and scale down afterwards. Which AWS Cloud benefit is most directly demonstrated by this transition?

Trading variable expense for capital expense

Stop guessing capacity

Prioritizing vertical scalability to eliminate the need for elasticity

Implementing a monolithic design to simplify service coordination

Show answer & explanation

Answer: Stop guessing capacity

Answer

Stop guessing capacity

The correct answer is the option focusing on stopping capacity guesswork. Under an on-premises model, organizations often must provision resources based on maximum predicted peak demand, leading to idle capacity and wasted costs. AWS eliminates this by allowing systems to automatically scale up and down to match actual demand in real-time.

Step-by-Step Solution

Analyze the business scenario and identify the infrastructure challenges.

The company has highly variable traffic (a short weekly peak) and suffers from low resource utilization because they pre-provisioned physical hardware to meet that peak.

Understanding the current challenge is essential to mapping it to the correct AWS Cloud benefit.

Compare the transition to AWS features (automatic scaling up/down) with the six benefits of the AWS Cloud.

Automatically scaling resources to match demand instead of pre-purchasing peak capacity aligns with the benefit of 'Stop guessing capacity'.

This directly maps the solution to the correct cloud benefit, which addresses the inefficiency of over-provisioning.

Key Concept

Stop guessing capacity

Question 18Question →

A financial institution needs to retain historical transaction logs to meet regulatory compliance requirements. These logs are rarely accessed but must be kept secure for seven years. The institution can tolerate a retrieval time of 12 hours for any requested log. Which AWS storage service is the most cost-effective choice for this storage requirement?

Amazon EBS

Amazon EFS

Amazon S3 Glacier Deep Archive

Amazon EC2 Instance Store

Show answer & explanation

Answer: Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Glacier Deep Archive is the most cost-effective choice because it is specifically designed for long-term archival storage with retrieval times of up to 12 hours.

Amazon S3 Glacier Deep Archive is the correct choice because it is AWS's lowest-cost storage class, specifically optimized for archiving data that is rarely accessed and can tolerate retrieval times of up to 12 hours.

Step-by-Step Solution

Analyze the workload requirements: long-term retention (7 years), rare access, high tolerance for retrieval latency (12 hours), and a primary focus on cost optimization.

The requirements point toward an archival storage solution rather than active performance-focused storage.

Identifying the data access patterns and latency tolerance helps narrow down the service class.

Compare the features and pricing of the available storage classes and services.

Amazon S3 Glacier Deep Archive provides the lowest storage cost on AWS with standard retrieval times within 12 hours.

This step determines the exact service that matches the cost-efficiency and retrieval-time requirements.

Key Concept

Selecting the appropriate AWS storage service based on access patterns, durability, retention length, and cost constraints.

Estimated Time:45s

Question 19Question →

A company is migrating a legacy retail web application to AWS. The application uses a traditional relational database that requires complex SQL transactional queries and table joins. The company wants a fully managed solution that reduces administrative tasks such as hardware provisioning, database setup, patching, and backups, while separating the database tier from the application tier to ensure high availability. Which database solution should the company choose?

Amazon RDS

Amazon DynamoDB

A self-managed database hosted on a single Amazon EC2 instance

A single Amazon EC2 instance running both the database engine and the web application server

Show answer & explanation

Answer: Amazon RDS

Answer

Amazon RDS

Amazon RDS is the correct choice because it is a managed relational database service that supports SQL queries and table joins while automating database administration tasks such as backups, software patching, and hardware scaling.

Step-by-Step Solution

Analyze the application's database requirements

The application requires a relational database that supports complex SQL queries and table joins.

This rules out non-relational database services such as key-value stores.

Evaluate the management and operational overhead requirements

The company wants a fully managed service to reduce administrative tasks like patching and backups.

This rules out self-managed options like hosting database engines directly on Amazon EC2 instances.

Select the appropriate managed AWS database service

Amazon RDS provides a fully managed relational database platform that automates provisioning, patching, and backups while separating the database from the application tier.

It matches both the relational nature of the workload and the requirement for reduced administrative overhead.

Key Concept

AWS managed relational database service selection versus self-managed or NoSQL alternatives.

Estimated Time:1m 30s

Question 20Question →

An administrator needs to perform a one-time audit of the security group configurations for several Amazon EC2 instances. The administrator wants to visually review the inbound and outbound traffic rules through an interactive graphical interface in a web browser without writing scripts or using command-line commands. Which AWS tool or interface should the administrator use to meet these requirements?

AWS Management Console

AWS Command Line Interface (AWS CLI)

AWS Software Development Kit (AWS SDK)

AWS CloudFormation

Show answer & explanation

Answer: AWS Management Console

Answer

AWS Management Console

The AWS Management Console is a web-based portal that provides a graphical user interface (GUI) for managing AWS resources. It is the most appropriate tool for an administrator who needs to visually inspect security group rules in a web browser without writing code or executing shell commands.

Step-by-Step Solution

Analyze the requirements: the task is a one-time audit, requires a visual review of configurations (security group rules), must use a graphical web browser interface, and must avoid scripting or command-line commands.

Identified that the interface must be web-based, graphical, manual, and require no programming or terminal input.

This filters out tools that rely on scripting, coding, or text-based command execution.

Evaluate the available AWS interaction methods against these criteria: AWS Management Console is a web graphical user interface; AWS CLI is a command-line tool; AWS SDK is for programmatic code; AWS CloudFormation is for template-based infrastructure provisioning.

AWS Management Console is the only option that fits the requirement for an interactive graphical web interface for manual tasks.

Matching the user requirement to the correct AWS tool ensures operational efficiency for the specific task type.

Key Concept

AWS Management Console is the primary web-based graphical user interface used to access and manage AWS resources manually.

Page 1 / 38Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept