Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 281Soru →

A company needs to perform automated security assessments on its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which AWS service should the company use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector
Amazon Inspector is the correct service because it provides automated security assessments that scan Amazon EC2 instances, container images, and Lambda functions for known software vulnerabilities and unintended network reachability.

Adım Adım Çözüm

1
Identify the core requirement of the scenario: the company needs to perform automated security assessments on Amazon EC2 instances to find software vulnerabilities and unintended network exposure.
The requirement is focused on host-level vulnerability scanning and network exposure checks.
This narrows down the potential services to those that inspect the internal state of EC2 instances and network paths.
2
Evaluate the functions of the available AWS security services to find the correct match.
Amazon Inspector is identified as the service designed specifically for automated vulnerability management and scanning of EC2 workloads, whereas the other options focus on threat detection, API logging, or DDoS protection.
Selecting the service that matches the host-level vulnerability scanning definition ensures compliance with AWS best practices.

Anahtar Kavram

Amazon Inspector is the primary AWS service for automated vulnerability scanning of EC2 instances, container images, and Lambda functions.
Tahmini Süre:45s
Soru 282Soru →

OceanGlide Maritime, a shipping logistics provider, is planning to migrate its on-premises infrastructure to the AWS Cloud. The migration team has identified two initial workloads to migrate:

1. A proprietary port scheduling application that runs on a legacy operating system. The team needs to move this workload to AWS quickly with zero code modifications to allow the immediate decommissioning of their physical server.
2. An on-premises commercial database engine. The team wants to migrate this database to a managed service in AWS (specifically Amazon RDS) to reduce licensing fees and offload operating system patching and backups, without changing the core database schema or application logic.

Which of the following migration strategies should the company select for these two workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting for the port scheduling application; Replatforming for the commercial database system

Cevap

Rehosting is correct for the port scheduling application, and Replatforming is correct for the commercial database system.
The correct options are Rehosting for the port scheduling application and Replatforming for the commercial database system. Rehosting (lift-and-shift) is appropriate because the legacy port scheduling application needs to be moved quickly with zero changes. Replatforming (lift-tinker-and-shift) is appropriate because the database is moving to a managed service (Amazon RDS) to reduce maintenance tasks (patching and backups) and database licensing costs, without core architectural changes.

Adım Adım Çözüm

1
Analyze the requirements for the legacy port scheduling application.
The application must be moved quickly with zero modifications to allow decommissioning of physical hardware. This matches Rehosting (lift-and-shift).
Rehosting allows rapid migration of workloads to the cloud without modifying the application code or configuration.
2
Analyze the requirements for the commercial database system.
The database must migrate to a managed service (Amazon RDS) to reduce licensing fees and administrative tasks (patching/backups) without changing the database schema or application logic. This matches Replatforming (lift-tinker-and-shift).
Replatforming involves modifying the hosting environment (e.g., moving from self-managed servers to managed Amazon RDS) to gain cloud efficiency without altering the core codebase.

Anahtar Kavram

Identifying AWS Cloud migration strategies (the 6 Rs), focusing on the distinction between Rehosting (lift-and-shift) and Replatforming (lift-tinker-and-shift).
Tahmini Süre:1m 30s
Soru 283Soru →

A startup is setting up its first AWS account to host a web application. The company's IT lead needs to perform daily operations, such as creating Amazon EC2 instances and configuring Amazon S3 buckets. Which AWS security best practice should the IT lead follow to manage these daily administrative tasks?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.

Cevap

Create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities.
The correct answer is to create an individual IAM user with administrative permissions, enable multi-factor authentication, and use this user for daily activities. This aligns with the AWS best practice of protecting the root user credentials and ensuring that administrative tasks are performed by authenticated IAM identities.

Adım Adım Çözüm

1
Identify the requirement for administrative daily access in a newly created AWS account.
Identified that the IT lead needs administrative privileges to create instances and configure S3 buckets.
Ensures the correct level of access is provisioned for daily operations.
2
Evaluate access options against AWS security best practices.
Determined that using the AWS account root user is discouraged for daily activities, while IAM roles cannot be used as permanent direct login identities.
Prevents credential exposure and aligns with organizational security standards.
3
Select the best practice approach of using an administrative IAM user with multi-factor authentication (MFA) enabled.
Secure administrative operations are established while keeping root user credentials protected.
Minimizes security risks and complies with the principle of least privilege.

Anahtar Kavram

AWS Account Root User and IAM Identity Best Practices
Soru 284Soru →

A retail startup is migrating its customer database and file sharing system to AWS. The company wants to minimize the administrative effort required to maintain infrastructure, and ensure that virtual servers can be easily replaced and automated if they become unhealthy. Which TWO AWS Cloud design principles support these goals? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilize managed services instead of managing physical or virtual servers to reduce maintenance overhead; Treat computing resources as temporary and disposable by automating their deployment and replacement

Cevap

Utilizing managed services instead of managing physical or virtual servers, and treating computing resources as temporary and disposable by automating their deployment and replacement.
The correct options are to utilize managed services instead of managing physical or virtual servers, and to treat computing resources as temporary and disposable by automating their deployment and replacement. Using managed services reduces the administrative burden of running virtual servers (supporting the 'services, not servers' principle). Treating resources as disposable ensures that unhealthy systems can be replaced instantly through automation rather than manual troubleshooting.

Adım Adım Çözüm

1
Analyze the requirements from the scenario: reducing administration overhead and ensuring easy, automated replacement of unhealthy servers.
Identified the need for managed services to minimize administration and automated, disposable resources to handle unhealthy servers.
This helps map the business requirements to specific AWS Cloud design principles.
2
Evaluate the design principles of the AWS Cloud to see which ones match these requirements.
The principle 'services, not servers' supports reducing server management, and the principle 'disposable resources' supports using automation to replace servers.
This identifies the correct architectural choices.

Anahtar Kavram

AWS Cloud design principles focus on automation, managed services, and treating servers as disposable rather than permanent fixtures.
Tahmini Süre:1m 0s
Soru 285Soru →

A digital media startup is developing a mobile photo-sharing application that requires millions of end-users to upload images directly to a private Amazon S3 bucket. Which of the following approaches aligns with AWS Identity and Access Management (IAM) best practices for granting access to these users?

Cevabı ve açıklamayı göster

Cevap: Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.

Cevap

Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.
The correct option is to configure web identity federation using Amazon Cognito. According to AWS IAM best practices, mobile application users should authenticate against an identity provider (such as Amazon Cognito, Google, or Apple) and exchange their identity token for temporary AWS security credentials. These temporary credentials have limited permissions and automatically expire, removing the need to distribute long-term AWS credentials.

Adım Adım Çözüm

1
Analyze the access requirement for external mobile application users who do not have AWS accounts.
Identify that creating individual IAM users for millions of end-users is unmanageable and violates security practices.
IAM users are designed for internal employees, administrators, or application services, not for transient public application consumers.
2
Evaluate how to secure client-side resource uploads without storing permanent credentials in the client application.
Determine that temporary security credentials derived from an IAM role are required.
Temporary credentials expire automatically and do not require hardcoding secrets in the client application.
3
Select the appropriate service for external identity federation.
Choose Amazon Cognito web identity federation.
Amazon Cognito acts as an identity broker, allowing users to sign in via social or enterprise identity providers and exchange their login tokens for temporary AWS credentials.

Anahtar Kavram

Identity Federation and Temporary Security Credentials
Tahmini Süre:2m 0s
Soru 286Soru →

An online event ticketing platform experiences massive, unpredictable traffic surges when tickets for major concerts go on sale. To prevent site crashes on-premises, the company had to buy and deploy excess hardware in advance, which then sat underutilized for the rest of the year. Additionally, purchasing these physical servers required significant upfront funding.

Which two benefits of the AWS Cloud directly address this company's challenges? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Stop guessing capacity; Trade capital expense for variable expense

Cevap

The ticketing platform can address its challenges by trading capital expense for variable expense and stopping guessing capacity.
The correct benefits are stopping guessing capacity and trading capital expense for variable expense. By leveraging AWS, the ticketing platform eliminates the need to pay large upfront capital costs for servers (trading capital expense for variable expense) and no longer needs to keep idle hardware running just to handle potential traffic surges (stopping guessing capacity) because resources can scale dynamically.

Adım Adım Çözüm

1
Analyze the financial and operational pain points described in the scenario.
The company faces two primary issues: significant upfront funding for physical server purchases, and underutilized hardware because they must over-provision to handle unpredictable peaks.
Understanding the specific challenges allows mapping them to the corresponding AWS Cloud benefits.
2
Evaluate the financial pain point against the AWS economic benefits.
Paying upfront for physical servers represents a capital expense. Transitioning to a model where they pay only for what they consume maps to the benefit of trading capital expense for variable expense.
Shifting from CapEx to OpEx reduces upfront risk and cash flow constraints.
3
Evaluate the capacity planning challenge against the AWS operational benefits.
Maintaining idle servers to handle traffic spikes is resolved by stopping guessing capacity. AWS allows automatic scaling to meet real-time demand, removing the need for manual pre-provisioning.
Elastic provisioning ensures applications remain available during spikes without paying for idle resources during off-peak times.

Anahtar Kavram

Understanding the 6 Advantages of Cloud Computing, focusing on trading capital expense for variable expense and stopping guessing capacity.
Tahmini Süre:1m 30s
Soru 287Soru →

An automotive manufacturer is designing a telematics system to gather diagnostic data from 10,00010,000 connected test vehicles. The data transmission is highly irregular, peaking during daily test runs and dropping to zero overnight. The company wants to avoid purchasing dedicated physical servers that would remain idle during non-test hours, preferring a model where they pay only for the compute resources consumed during active tests. Which benefit of the AWS Cloud is directly demonstrated by this approach?

Cevabı ve açıklamayı göster

Cevap: Trading capital expense for variable expense

Cevap

Trading capital expense for variable expense
The correct answer is trading capital expense for variable expense. By choosing to pay only for the compute resources consumed during active tests rather than buying physical servers in advance, the automotive manufacturer avoids capital expenditures (CapEx) and adopts a pay-as-you-go variable expense (OpEx) model.

Adım Adım Çözüm

1
Analyze the business requirements in the scenario.
The company wants to avoid upfront purchases of physical servers (capital expense) for irregular workloads and instead pay only for resources consumed during active periods (variable expense).
Understanding the customer's financial and technical constraints is key to mapping them to the correct AWS Cloud benefit.
2
Evaluate the AWS Cloud benefits against the identified requirements.
The practice of paying only for consumed compute resources rather than investing in physical infrastructure aligns with the benefit of 'trading capital expense for variable expense'.
AWS defines this benefit as paying only when you consume computing resources and paying only for how much you consume, rather than investing heavily in data centers and servers up front.

Anahtar Kavram

AWS Cloud Benefit: Trading capital expense for variable expense
Soru 288Soru →

An online retail company is auditing its cloud deployment to verify compliance with industry security standards. Under the AWS shared responsibility model, which of the following operational tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Patching the guest operating system and configuring security groups on Amazon EC2 instances

Cevap

Patching the guest operating system and configuring security groups on Amazon EC2 instances
The task of patching the guest operating system and configuring security groups on Amazon EC2 instances is a customer responsibility under the shared responsibility model. Because customers launch and manage their own EC2 instances, they have full control over the guest operating system and its network access control settings, making it security 'in' the cloud.

Adım Adım Çözüm

1
Identify the boundary of responsibility under the AWS Shared Responsibility Model.
AWS is responsible for security 'of' the cloud (infrastructure, physical security, virtualization), while the customer is responsible for security 'in' the cloud (data, guest OS, network configuration).
This distinction determines which operational task belongs to the customer.
2
Evaluate the options against the customer responsibility boundary.
Managing guest operating systems and local firewall configurations (security groups) on EC2 instances falls under security 'in' the cloud.
Because the customer has direct control and access to the guest OS of EC2 instances, AWS cannot manage these configurations for them.

Anahtar Kavram

Shared Responsibility Model for Compliance
Tahmini Süre:45s
Soru 289Soru →

A global logistics company is designing a real-time package tracking system on AWS. The system needs to process millions of location updates daily, with traffic spiking significantly during peak holiday seasons. The system must remain operational even if the database layer becomes temporarily unavailable. Which of the following design decisions align with AWS Cloud design principles to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon SQS queues between the ingestion service and the database layer to decouple the components.; Use Amazon EC2 Auto Scaling to automatically adjust the ingestion tier based on incoming traffic volume.

Cevap

Deploying Amazon SQS queues to decouple the ingestion and database tiers, and using Amazon EC2 Auto Scaling to dynamically adjust resources based on demand, are the correct design decisions.
The correct options are using message queues to decouple systems and using auto-scaling to match resource capacity to demand. Placing a message queue between components achieves loose coupling, meaning a failure in the database does not disrupt the ingestion service. Auto-scaling allows the application to automatically scale out during peak periods and scale in during low usage, achieving elasticity.

Adım Adım Çözüm

1
Analyze the requirements for decoupling and operational resilience when the database is unavailable.
Decoupling components using a message queue allows the ingestion tier to continue processing updates even if the database is down.
This implements the loose coupling design principle.
2
Analyze the requirement for handling varying volumes of traffic and holiday spikes efficiently.
Implementing Amazon EC2 Auto Scaling allows the compute tier to scale dynamically with demand.
This implements the elasticity design principle, ensuring resources are only provisioned when needed.

Anahtar Kavram

AWS Cloud design principles: Loose Coupling and Elasticity
Soru 290Soru →

A logistics company is deploying a tracking application on a fleet of Amazon EC2 instances that requires access to a private Amazon DynamoDB table. Additionally, an external audit team needs temporary access to view the company's billing dashboards for a period of one week. Which of the following configurations should the administrator implement to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with DynamoDB access permissions and associate it with the EC2 instances using an instance profile.; Create an IAM role with billing read-only permissions that the external audit team can assume temporarily.

Cevap

The correct configurations are to create an IAM role with DynamoDB access permissions for the EC2 instances, and to create an IAM role with billing read-only permissions that the external audit team can assume temporarily.
Creating an IAM role with DynamoDB access permissions and associating it with the EC2 instances allows the application to dynamically retrieve temporary credentials. Creating a separate IAM role with billing read-only permissions allows the external audit team to assume the role temporarily for the duration of the audit without possessing permanent user accounts.

Adım Adım Çözüm

1
Evaluate the requirement for applications running on EC2 instances to access DynamoDB.
AWS security best practice dictates using IAM roles (attached via instance profiles) for application authentication rather than hardcoded long-lived credentials.
This prevents credentials leakage and automatically rotates temporary security credentials.
2
Evaluate the requirement to grant temporary access to external auditors for viewing billing dashboards.
Creating a dedicated IAM role for the third-party auditors to temporarily assume meets the security requirement.
This adheres to the principle of least privilege and avoids the need to share permanent root credentials or create long-term IAM users.

Anahtar Kavram

AWS Identity and Access Management (IAM) Roles and Access Control Best Practices
Tahmini Süre:1m 30s
Soru 291Soru →

A human resources software provider hosting its applications on AWS is undergoing an external compliance audit. The provider must officially accept a global Data Processing Addendum (DPA) with AWS and obtain the official ISO 27001 certification report for the underlying AWS data center infrastructure. Which AWS service should the provider use to satisfy both of these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact is the correct service because it serves as the central resource for retrieving AWS compliance reports and managing compliance agreements.
The correct option is AWS Artifact. AWS Artifact contains two main sections: AWS Artifact Reports, which provides on-demand downloads of AWS security and compliance reports (such as ISO certifications and SOC reports), and AWS Artifact Agreements, which allows customers to review and accept agreements (such as the Data Processing Addendum) on behalf of their AWS accounts.

Adım Adım Çözüm

1
Identify the primary requirement: retrieving official AWS compliance documentation (ISO 27001 certification) and accepting a legal agreement (Data Processing Addendum) with AWS.
Recognize that these are standard compliance tasks involving AWS-managed infrastructure audits and terms of service.
AWS manages and audits its own physical infrastructure, providing these reports and agreements to customers for their compliance verification.
2
Evaluate the capabilities of AWS Artifact.
AWS Artifact Reports provides the ISO certification, and AWS Artifact Agreements allows accepting the Data Processing Addendum.
AWS Artifact is specifically designed as the self-service portal for compliance-related documents and agreements.

Anahtar Kavram

AWS Artifact is the self-service portal that provides on-demand access to AWS compliance reports and allows customers to accept agreements with AWS.
Soru 292Soru →

A cloud administrator needs to grant the same read-only permissions to ten new security analysts. Which AWS Identity and Access Management (IAM) feature should the administrator use to manage and apply these permissions to all ten analysts at once?

Cevabı ve açıklamayı göster

Cevap: IAM User Groups

Cevap

IAM User Groups
IAM User Groups allow administrators to specify permissions for a collection of users. This makes it easy to manage permissions for multiple users at once, ensuring consistency and adhering to AWS best practices.

Adım Adım Çözüm

1
Identify the goal: granting the same set of permissions to a collective set of individual IAM users (ten security analysts).
Determine that individual policy attachments are inefficient and error-prone.
Grouping users simplifies administrative overhead.
2
Evaluate the available IAM features for managing permissions for multiple users collectively.
Identify that IAM User Groups are designed specifically to attach permission policies to multiple users simultaneously.
IAM User Groups promote the best practice of managing permissions at the group level rather than the user level.

Anahtar Kavram

IAM User Groups are collections of IAM users that allow administrators to specify and manage permissions for multiple users easily.
Soru 293Soru →

A healthcare provider uses Amazon Simple Storage Service (Amazon S3) to store encrypted patient records. During a security audit, it is discovered that a bucket policy was improperly configured, allowing public read access to the records. Under the AWS Shared Responsibility Model, which of the following statements correctly identifies the party responsible for this configuration error and the reason?

Cevabı ve açıklamayı göster

Cevap: The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.

Cevap

The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.
The correct answer states that the customer is responsible for configuring access control, bucket policies, and identity management. S3 is a managed object storage service, but under the AWS Shared Responsibility Model, the customer is always responsible for data access permissions and configuration (security 'in' the cloud).

Adım Adım Çözüm

1
Analyze the service type and resource configuration described in the scenario.
The scenario involves Amazon S3 bucket policy configuration, which controls access to data stored in S3.
Identifying the resource and setting helps determine where it falls under the Shared Responsibility Model.
2
Determine the boundary between security 'of' the cloud and security 'in' the cloud.
AWS manages security 'of' the cloud (infrastructure, physical security, virtualization layer). The customer manages security 'in' the cloud (data classification, identity and access management, and configuration of resource policies).
Differentiating these boundaries shows that configuring S3 bucket access policies is a customer responsibility.

Anahtar Kavram

Under the AWS Shared Responsibility Model, customers are responsible for configuring access controls and bucket policies for data stored in Amazon S3 (security 'in' the cloud), while AWS manages the underlying storage infrastructure (security 'of' the cloud).
Soru 294Soru →

An indie game development studio is launching a new multiplayer game. The studio wants its engineers to focus entirely on writing game code and designing player experiences, rather than spending time on racking, stacking, and powering physical servers. Which benefit of the AWS Cloud is directly demonstrated by this approach?

Cevabı ve açıklamayı göster

Cevap: Stop spending money running and maintaining data centers

Cevap

Stop spending money running and maintaining data centers
The option describing 'Stop spending money running and maintaining data centers' is correct because AWS handles the physical infrastructure, power, cooling, and hardware maintenance, allowing the game studio to focus on their application code and customer experience.

Adım Adım Çözüm

1
Analyze the business scenario and identify the core operational challenge.
The game studio wants to avoid the physical work of racking, stacking, cabling, and powering physical servers.
This physical infrastructure work represents the overhead of managing a physical data center.
2
Map the operational challenge to one of the six benefits of the AWS Cloud.
By using AWS, the studio offloads the management of physical infrastructure to AWS, which directly aligns with the benefit of not spending money running and maintaining data centers.
AWS manages the physical infrastructure, freeing up engineering resources to focus on business-differentiating tasks.

Anahtar Kavram

AWS Cloud Benefit: Stop spending money running and maintaining data centers
Soru 295Soru →

A media streaming company is deploying a serverless image processing pipeline using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Writing and securing the application code run within the Lambda functions; Managing the IAM execution roles and access policies assigned to the Lambda functions

Cevap

The customer is responsible for writing and securing the application code run within the Lambda functions and managing the IAM execution roles and access policies assigned to the Lambda functions.
For serverless services like AWS Lambda, AWS manages the entire underlying execution environment, including the physical infrastructure, virtualization layer, operating system, and runtime. The customer retains control and responsibility for the application code written and deployed, as well as the Identity and Access Management (IAM) configurations, such as the execution roles that grant the function permissions to interact with other AWS resources.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
AWS Lambda is a serverless (managed) service.
The customer's responsibilities vary depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Serverless.
2
Apply the Shared Responsibility Model boundaries for serverless services.
AWS manages the physical infrastructure, virtualization, host operating system, and runtime. The customer manages application code, data, and access configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices against these boundaries.
Writing secure code and configuring IAM execution roles are customer responsibilities, whereas OS/runtime patching, physical security, and virtualization maintenance are AWS responsibilities.
This identifies the two correct customer-managed security actions.

Anahtar Kavram

Shared Responsibility Model for Serverless Services
Soru 296Soru →

A smart home IoT provider experiences significant daily fluctuations in data processing demands as users interact with their devices primarily during morning and evening hours. Additionally, the company runs a heavy data aggregation job once per month that lasts for 24 hours. The engineering team is transitioning this workload from an on-premises data center to AWS to optimize costs. Which of the following strategies represent correct applications of AWS cloud economics to minimize operational costs for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilizing EC2 Auto Scaling to automatically scale compute capacity in response to the daily morning and evening IoT traffic spikes, paying only for the resources consumed.; Using On-Demand or Spot Instances for the 24-hour monthly data aggregation job, rather than purchasing Reserved Instances that would remain idle for the rest of the month.

Cevap

The correct strategies are utilizing EC2 Auto Scaling to dynamically adjust to daily traffic spikes, and using On-Demand or Spot Instances for the monthly 24-hour aggregation job.
The correct strategies align resource costs with usage patterns. Using Auto Scaling ensures the company only pays for active compute capacity during morning and evening IoT spikes. Similarly, using On-Demand or Spot Instances for the short 24-hour monthly workload avoids the continuous cost of Reserved Instances, which would otherwise sit idle for the vast majority of the month.

Adım Adım Çözüm

1
Analyze the workload characteristics
Two distinct workloads exist: a daily fluctuating IoT workload with morning/evening peaks, and an intermittent 24-hour monthly workload.
Different workload patterns require different cost-optimization strategies in cloud economics.
2
Evaluate the daily fluctuating workload strategy
Elasticity is the best approach. Dynamic scaling matches resource supply with demand, avoiding overprovisioning costs.
Auto Scaling allows the company to transition from a fixed capacity model to a variable pay-as-you-go model.
3
Evaluate the monthly 24-hour workload strategy
On-Demand or Spot Instances are best because they only incur costs for the 24 hours of execution, whereas Reserved Instances would charge for unused hours.
Reserved Instances are designed for continuous, steady-state workloads (high utilization), not intermittent tasks.
4
Identify the correct choices
Selecting Auto Scaling for daily demand and On-Demand/Spot for the monthly job optimizes TCO.
These choices align with the pay-as-you-go pricing model and elastic resource provisioning.

Anahtar Kavram

Cloud economics principles emphasizing the shift from Capital Expenses (CapEx) to Operating Expenses (OpEx), leveraging elasticity to align resource supply with demand, and selecting correct pricing models based on workload utilization patterns.
Soru 297Soru →

A startup is designing a secure architecture on AWS. The security team wants to implement a solution that continuously monitors the AWS environment for unauthorized behavior, such as unusual API calls or potential database attacks. Additionally, they need to run automated scans on their container images to check for known software vulnerabilities before deployment. Which AWS services should the startup use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty; Amazon Inspector

Cevap

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection, while Amazon Inspector provides automated vulnerability scanning for container images.
Amazon GuardDuty is the correct choice for threat detection because it continuously monitors log sources for malicious or unauthorized activities. Amazon Inspector is the correct choice for vulnerability management because it automatedly scans container images in Amazon ECR for software vulnerabilities.

Adım Adım Çözüm

1
Identify the service responsible for continuous monitoring and active threat detection in the AWS environment.
Amazon GuardDuty is identified as the service that monitors logs (like CloudTrail and VPC Flow Logs) to detect unauthorized behavior and threats.
The requirement specifies the need to continuously monitor the AWS environment for unauthorized behavior.
2
Identify the service responsible for automated software vulnerability scanning of container images.
Amazon Inspector is identified as the service that scans container images in Amazon ECR for known vulnerabilities.
The requirement specifies the need to run automated scans on container images for software vulnerabilities.

Anahtar Kavram

AWS threat detection and vulnerability management services
Tahmini Süre:1m 0s
Soru 298Soru →

A gaming company, PixelQuest Games, wants to migrate its multiplayer matchmaking system to the AWS Cloud. The current matchmaking system is a monolithic application that suffers from scaling bottlenecks during peak tournament hours. To achieve dynamic scalability and high cost-efficiency, the company decides to split the monolith into microservices and rewrite the application code to run on serverless services such as AWS Lambda and Amazon DynamoDB. Which migration strategy is PixelQuest Games implementing?

Cevabı ve açıklamayı göster

Cevap: Refactoring

Cevap

Refactoring
Refactoring (or Re-architecting) is the correct answer because PixelQuest Games is modifying the architecture by splitting a monolithic application into microservices and rewriting the code to utilize cloud-native, serverless components. This strategy is chosen to meet business requirements for scalability and cost-efficiency that cannot be achieved with the existing architecture.

Adım Adım Çözüm

1
Analyze the business requirements and the architectural changes being made to the matchmaking application.
The company is breaking a monolithic application into microservices and rewriting the code to run on serverless services like AWS Lambda and Amazon DynamoDB.
Identifying the scope of changes helps determine which of the 6 Rs migration strategies is being applied.
2
Map these changes to the defined AWS migration strategies.
Modifying, re-architecting, or rewriting code to use cloud-native features such as serverless technology is defined as Refactoring (also known as Re-architecting).
This differentiates Refactoring from other strategies that do not involve code or architectural changes.

Anahtar Kavram

Cloud migration strategies (the 6 Rs), specifically Refactoring / Re-architecting.
Soru 299Soru →

A company needs to grant programmatic access to an external third-party Software-as-a-Service (SaaS) monitoring tool to read configuration metrics from their AWS account. The SaaS tool does not run on AWS infrastructure. According to AWS Identity and Access Management (IAM) best practices, which configuration should the administrator implement to grant this access?

Cevabı ve açıklamayı göster

Cevap: Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.

Cevap

Configure a cross-account IAM role with a trust policy that allows the third-party AWS account to assume the role, requiring an external ID.
The correct option outlines the standard AWS security recommendation for granting third-party access. By configuring a cross-account IAM role, the third-party tool can obtain temporary security credentials to perform API actions. Requiring an external ID is a vital security best practice that prevents the 'confused deputy' problem in multi-tenant integrations.

Adım Adım Çözüm

1
Analyze the access requirement for an external SaaS tool that does not run on AWS infrastructure.
The tool requires programmatic access to AWS APIs from outside the company's AWS environment.
Understanding the caller's origin is necessary to choose between identity federation, IAM users, or cross-account roles.
2
Evaluate the credentials policy for third-party access.
Using temporary credentials via IAM roles is identified as the secure, recommended method instead of sharing static, long-term access keys.
IAM roles allow the external entity to assume permissions dynamically, eliminating the need to store and rotate permanent access keys.
3
Define the relationship using a cross-account role with an external ID.
A trust relationship is configured between the customer account and the SaaS provider account, utilizing an external ID to mitigate the confused deputy vulnerability.
This establishes secure delegation of access specifically tailored for multi-tenant third-party SaaS integrations.

Anahtar Kavram

Cross-account IAM delegation and external ID best practices for third-party integrations
Soru 300Soru →

A retail company, Nova Retail, is planning the migration of its legacy inventory database to the AWS Cloud. Currently, the database is hosted on-premises on a virtual machine, and the operations team spends substantial effort on operating system patching, backups, and storage provisioning. To reduce this administrative burden, Nova Retail decides to migrate the database to Amazon Relational Database Service (Amazon RDS) for Oracle, keeping the database engine and the application code unchanged. Which migration strategy is Nova Retail executing for this database?

Cevabı ve açıklamayı göster

Cevap: Replatforming

Cevap

Replatforming
The correct strategy is replatforming because the company is making a platform optimization—moving from a self-managed database to the fully managed Amazon RDS platform to reduce administrative tasks like patching and backups—while keeping the application code and database engine unchanged.

Adım Adım Çözüm

1
Analyze the migration target and changes being made.
The target is Amazon RDS for Oracle, and the core application code and database engine remain unchanged.
Identifying the scope of changes helps distinguish between Rehost (no changes/EC2), Replatform (managed services/RDS), and Refactor (code changes).
2
Determine the cloud service model shift.
The database is moving from a self-managed environment (on-premises VM) to a fully managed service (Amazon RDS).
Moving to a managed service to reduce administrative tasks (like patching and backups) without changing the core application structure constitutes a platform optimization (tinkering).
3
Map the optimization to the 6 Rs migration strategies.
Since optimization is achieved by switching the platform to Amazon RDS without modifying application code, this is classified as Replatforming.
This matches the definition of Replatforming, which focuses on shifting to managed services to gain cloud benefits without re-architecting.

Anahtar Kavram

Identifying migration strategies (specifically Replatforming) when moving to managed services
ÖncekiSayfa 15 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin