Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 21Soru →

A healthcare organization is migrating its digital health record system to AWS. The system must remain available even if a physical data center experiences a complete power outage. The architecture team deploys the application servers across three Availability Zones behind an Application Load Balancer, and configures a Multi-AZ deployment for their database. Which design principle of the AWS Cloud does this architectural strategy directly implement?

Cevabı ve açıklamayı göster

Cevap: Design for failure

Cevap

Design for failure
The correct answer is design for failure. This principle assumes that any component can and will fail over time. To mitigate this, architectures must be designed to avoid single points of failure by distributing resources across multiple physical locations (Availability Zones) and deploying redundant database instances to achieve high availability and fault tolerance.

Adım Adım Çözüm

1
Analyze the technical requirements of the scenario.
The healthcare organization requires continuous system availability and resilience against physical data center outages.
Identifying the primary operational constraint helps map the architecture to the correct cloud design principle.
2
Evaluate the architectural components chosen for the solution.
The architecture utilizes three Availability Zones and a Multi-AZ database setup to eliminate single points of physical infrastructure failure.
Understanding how the components function helps determine which design principle they embody.
3
Match the architectural strategy to the core AWS Cloud design principles.
Deploying redundant resources across multiple Availability Zones to survive hardware or site failures directly aligns with the principle of designing for failure.
This confirms that the design assumes failure at any level and implements redundancy to prevent service interruption.

Anahtar Kavram

Designing for failure on AWS involves building architectures that assume any component can fail. By utilizing multiple Availability Zones and database replication, workloads remain operational despite localized infrastructure disruptions.
Soru 22Soru →

A retail company is migrating its customer database to Amazon RDS for PostgreSQL to reduce administrative overhead. Which two of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Managing database user accounts, permissions, and access controls within the database engine; Configuring database security groups to control incoming network traffic to the RDS instance

Cevap

Managing database user accounts, permissions, and access controls within the database engine, as well as configuring database security groups to control incoming network traffic to the RDS instance, are both responsibilities of the customer.
For managed services like Amazon RDS, AWS manages the host operating system, patching, and physical infrastructure. The customer remains responsible for configuration tasks within the database engine (such as user accounts, roles, and privileges) and controlling network access to the database instance using database security groups.

Adım Adım Çözüm

1
Identify the type of service being deployed.
Amazon RDS is a managed database service (PaaS).
The boundary of responsibility shifts depending on whether the service is IaaS (like EC2) or PaaS (like RDS).
2
Determine the split of responsibilities for Amazon RDS.
AWS handles physical security, infrastructure, operating system maintenance, and database patching. The customer handles database configuration, database-level security groups, data encryption, and user access management.
This determines which options represent customer tasks rather than AWS tasks.
3
Evaluate the choices based on the determined responsibilities.
Managing database user accounts/permissions and configuring database security groups are customer tasks. Operating system patching, physical storage drive replacement, and retrieving raw physical facility logs are AWS tasks.
This confirms the correct options.

Anahtar Kavram

Under the AWS Shared Responsibility Model for managed database services (RDS), AWS manages the infrastructure, OS patching, and physical hardware, while the customer manages database access, application configuration, and network security groups.
Tahmini Süre:1m 30s
Soru 23Soru →

A retail company wants to implement a system on AWS that processes customer product reviews. The system must detect the sentiment of the reviews, translate non-English reviews to English, and save the results. The team wants to deploy this solution with the lowest possible operational overhead, avoiding tasks like operating system patching, capacity provisioning, and software installation. Which of the following designs best adheres to the AWS Cloud design principle of 'services not servers' to accomplish this goal?

Cevabı ve açıklamayı göster

Cevap: Ingesting reviews via Amazon API Gateway, processing them using AWS Lambda functions that call Amazon Comprehend and Amazon Translate, and storing the final data in Amazon DynamoDB.

Cevap

Ingesting reviews via Amazon API Gateway, processing them using AWS Lambda functions that call Amazon Comprehend and Amazon Translate, and storing the final data in Amazon DynamoDB.
The correct design uses Amazon API Gateway, AWS Lambda, Amazon Comprehend, Amazon Translate, and Amazon DynamoDB. Each of these is a serverless or fully managed service. With this architecture, AWS handles server provisioning, operating system patching, scaling, and high availability, which completely removes the operational burden of managing servers from the customer.

Adım Adım Çözüm

1
Analyze the requirement to minimize operational overhead, specifically avoiding operating system patching, capacity provisioning, and software installation.
Identify that the solution must avoid using virtual servers (Amazon EC2) that require manual administrative management.
The 'services not servers' principle guides architects to use fully managed services and serverless technologies to offload operational responsibility to AWS.
2
Evaluate the proposed architectural designs to see which one utilizes fully managed, serverless services instead of managing virtual instances.
The design using Amazon API Gateway, AWS Lambda, Amazon Comprehend, Amazon Translate, and Amazon DynamoDB relies entirely on serverless services.
Each of these services is fully managed by AWS, requiring no server provisioning, OS maintenance, or manual scaling configurations from the customer.
3
Verify that the alternative options rely on virtual servers (Amazon EC2) and explain why they do not meet the 'services not servers' principle.
Designs involving EC2 instances (whether scaled automatically, running on a single large instance, or using patch automation) still require the customer to manage the operating system and capacity.
This establishes that the serverless architecture is the correct choice because it completely removes the need to manage servers.

Anahtar Kavram

The AWS Cloud design principle of 'services not servers' guides architects to use fully managed and serverless services to minimize operational overhead and focus on application logic rather than infrastructure maintenance.
Soru 24Soru →

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.; Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.

Cevap

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Adım Adım Çözüm

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Anahtar Kavram

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Soru 25Soru →

A global online learning platform hosts virtual classrooms on Amazon EC2 instances and stores course materials in Amazon S3 buckets. The security team needs to implement a solution that continuously scans their EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they must identify potential security threats across their AWS accounts, such as cryptocurrency mining or brute-force attacks, using machine learning and threat intelligence. Which combination of AWS services will address these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty
Amazon Inspector and Amazon GuardDuty together fulfill both security objectives. Amazon Inspector acts as a static and dynamic vulnerability scanner for EC2 instances and ECR container images to locate software flaws. Amazon GuardDuty acts as an intelligent threat detector that analyzes active telemetry logs to identify operational and account-level security threats in real time.

Adım Adım Çözüm

1
Analyze the requirement for scanning EC2 instances for software vulnerabilities and network reachability issues.
Identify Amazon Inspector as the designated AWS service for automated host vulnerability assessment.
Amazon Inspector automatically discovers EC2 instances and scans them against a database of known vulnerabilities (CVEs) and evaluates network exposure configurations.
2
Analyze the requirement for detecting active threats, suspicious API calls, cryptomining, and brute-force attempts across the AWS account.
Identify Amazon GuardDuty as the primary intelligent threat detection service.
Amazon GuardDuty processes logs (such as VPC Flow Logs, CloudTrail, and DNS logs) using threat intelligence and machine learning to flag abnormal or malicious activity.

Anahtar Kavram

Vulnerability scanning of virtual servers versus intelligent, log-based cloud threat detection.
Soru 26Soru →

A retail company is auditing its AWS account to align with AWS Identity and Access Management (IAM) security best practices. Currently, developers use shared credentials for daily administrative tasks, and multi-factor authentication (MFA) is not enabled on the account. Which of the following actions should the company perform to secure their environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only specific tasks that require root credentials.; Configure AWS IAM Identity Center to delegate daily administrative access to developers using temporary security credentials.

Cevap

To secure the AWS environment, the company should enable multi-factor authentication (MFA) on the AWS account root user and restrict its use, and configure AWS IAM Identity Center to delegate daily administrative access using temporary credentials.
The correct actions are to enable multi-factor authentication (MFA) on the root user to secure the account, and to set up AWS IAM Identity Center to manage developer access. This ensures that developers use temporary, unique credentials for daily operations instead of sharing permanent administrative access.

Adım Adım Çözüm

1
Identify root user credentials security requirements.
Determine that the root user should have MFA enabled and must not be used for daily operations.
Root user credentials have complete administrative access across the entire account and represent a high security risk if compromised.
2
Analyze credential management for daily developer operations.
Determine that developers should use temporary credentials managed via AWS IAM Identity Center rather than permanent or shared keys.
Using temporary credentials minimizes the risk of credential leakage and aligns with the principle of least privilege.

Anahtar Kavram

Implementing IAM best practices including securing the root account with MFA and utilizing temporary credentials via identity federation or IAM Identity Center.
Tahmini Süre:1m 0s
Soru 27Soru →

A digital publishing company wants to migrate its legacy on-premises email marketing tool to a modern, cloud-based software-as-a-service (SaaS) solution available in AWS Marketplace. Which migration strategy does this change represent?

Cevabı ve açıklamayı göster

Cevap: Repurchasing

Cevap

Repurchasing
The correct answer is the strategy of moving to a different product, typically a software-as-a-service (SaaS) model. When a company abandons their legacy on-premises tool to adopt a SaaS solution (such as one found in AWS Marketplace), they are utilizing the Repurchasing migration strategy.

Adım Adım Çözüm

1
Identify the migration requirement described in the scenario.
The company wants to move from an on-premises marketing tool to a ready-made SaaS solution in AWS Marketplace.
Understanding the target state helps match it to one of the 6 Rs of migration.
2
Evaluate the 6 Rs migration strategies against a transition to a SaaS platform.
Replacing a legacy self-managed system with a software-as-a-service (SaaS) platform corresponds to the Repurchasing strategy.
Repurchasing is defined as moving to a different product, typically a cloud-hosted commercial software package or SaaS.

Anahtar Kavram

AWS Migration Strategies (6 Rs) - Repurchasing
Soru 28Soru →

A logistics company containerizes its shipment tracking application and deploys it on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring security group rules to control traffic to and from the container tasks

Cevap

Configuring security group rules to control traffic to and from the container tasks
The configuration of security groups to control inbound and outbound traffic to the container tasks is a customer responsibility. Even though AWS Fargate abstracts the underlying host servers and operating system, the customer retains control and responsibility over network-level access control to their own workloads.

Adım Adım Çözüm

1
Analyze the service type and deployment model
AWS Fargate is a serverless compute engine for containers, which falls under a managed service model where the underlying host operating system and hardware are managed by AWS.
Identifying the service category helps determine the boundary line between the customer's security 'in' the cloud and AWS's security 'of' the cloud.
2
Differentiate between customer and AWS responsibilities for this service
AWS manages physical security, host patching, and hardware. The customer manages application code, container images, IAM roles, and network security configuration (security groups) for the tasks.
This allows us to isolate which configuration task is still controlled by the customer in a serverless container environment.

Anahtar Kavram

Shared Responsibility Model for Serverless Container Services
Soru 29Soru →

A media company is planning to migrate its application portfolio to the AWS Cloud and wants to minimize implementation time and effort. Which TWO migration strategies should the company use to migrate its workloads with either zero changes to the underlying code, or only minor optimizations to use managed services without changing the core application architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting; Replatforming

Cevap

The correct strategies are Rehosting and Replatforming.
The correct strategies are Rehosting and Replatforming. Rehosting, often called 'lift-and-shift', moves the application directly to the cloud without modifying its architecture or code. Replatforming, or 'lift-tinker-and-shift', introduces minor optimizations to take advantage of managed services (such as migrating a database to Amazon RDS) without altering the application's core architecture.

Adım Adım Çözüm

1
Analyze the migration requirements in the scenario.
The company wants to migrate workloads with either zero changes to code or only minor optimizations to use managed services, without altering the core application architecture.
This establishes the constraints of the migration, ruling out strategies that require code rewriting or vendor changes.
2
Evaluate the 6 Rs migration strategies against these requirements.
Rehosting ('lift-and-shift') requires no changes. Replatforming ('lift-tinker-and-shift') involves only minor optimizations (like adopting managed services) without changing the core architecture. Refactoring requires re-architecting/code changes, Repurchasing changes the application to a new product (SaaS), and Retaining leaves the application on-premises.
To select the two correct strategies that fit the criteria.

Anahtar Kavram

Cloud migration strategies (the 6 Rs), specifically Rehosting and Replatforming, which minimize changes to code and architecture during migration.
Tahmini Süre:45s
Soru 30Soru →

A startup is building a new mobile application backend on AWS. The startup wants to focus on writing code and minimizing infrastructure management while automatically handling fluctuating user demands. Which two of the following design decisions align with AWS cloud design principles to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the application code on AWS Lambda to run without provisioning or managing servers; Configure Amazon EC2 Auto Scaling to automatically adjust compute capacity based on live traffic

Cevap

Deploying the application code on AWS Lambda to run without provisioning servers and configuring Amazon EC2 Auto Scaling to adjust capacity based on traffic are the correct answers.
The correct options are deploying application code on AWS Lambda and configuring Amazon EC2 Auto Scaling. AWS Lambda aligns with the 'services, not servers' design principle by eliminating server management tasks, while Auto Scaling aligns with the 'elasticity' principle by matching resource capacity to demand dynamically.

Adım Adım Çözüm

1
Analyze the scenario requirements: minimize infrastructure management overhead and automatically handle fluctuating demand.
Identified two primary design goals: adopting managed services ('services, not servers') and utilizing dynamic scaling ('elasticity').
This sets the target criteria for the correct options.
2
Evaluate the option regarding running serverless code.
AWS Lambda is a serverless service that aligns with the 'services, not servers' principle, removing the need to manage infrastructure.
This matches the goal of minimizing server management overhead.
3
Evaluate the option regarding automatic scaling.
Amazon EC2 Auto Scaling dynamically scales resources, which aligns with 'elasticity'.
This matches the goal of automatically handling fluctuating user demands.

Anahtar Kavram

AWS Cloud design principles including 'services, not servers' and 'elasticity'.
Soru 31Soru →

An insurance firm is migrating its claims processing system to AWS. The system consists of a web portal, a document generation service, and a document archiving service. Currently, the web portal calls the document generation and archiving services synchronously. If the archiving service is temporarily unavailable, the entire claim submission fails. How should the firm redesign the application on AWS to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Redesign the system to communicate asynchronously using Amazon Simple Queue Service (Amazon SQS), decoupling the web portal from downstream processing.

Cevap

Redesign the system to communicate asynchronously using Amazon Simple Queue Service (Amazon SQS), decoupling the web portal from downstream processing.
Decoupling components using an asynchronous message queue like Amazon Simple Queue Service (Amazon SQS) is a core AWS design principle (loose coupling). It allows the web portal to queue requests and continue responding to users even if downstream services (like document generation or archiving) are experiencing latency or are temporarily offline.

Adım Adım Çözüm

1
Analyze the current system architecture and identify dependencies.
The web portal has synchronous, tight coupling with the document generation and archiving services, making it vulnerable to downstream failures.
To solve the reliability issue, we must identify where the tight coupling is causing cascading failures.
2
Apply AWS design principles to decouple the components.
An asynchronous communication mechanism, such as a message queue, is selected to buffer requests.
Decoupling ensures that a failure or slowdown in downstream services does not immediately impact the web portal's availability.
3
Select the appropriate AWS service for queueing and asynchronous processing.
Amazon Simple Queue Service (Amazon SQS) is integrated between the web portal and the downstream services.
SQS provides a fully managed, scalable message queue that allows components to scale and fail independently without losing data.

Anahtar Kavram

Loose coupling
Tahmini Süre:1m 30s
Soru 32Soru →

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with permissions to read the database and attach it to the EC2 instance.; Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.

Cevap

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Adım Adım Çözüm

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Anahtar Kavram

Identity and Access Management (IAM) Best Practices
Soru 33Soru →

A medical device manufacturer is deploying an IoT monitoring system on AWS. The quality assurance team must retrieve official AWS compliance reports, such as ISO certificates, to complete their regulatory filing. Which AWS service provides on-demand access to these security and compliance reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is a self-service portal that provides customers with direct access to AWS compliance documentation. This includes Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and various ISO certifications required by regulators and auditors.

Adım Adım Çözüm

1
Identify the requirement to retrieve third-party compliance reports and certifications (such as ISO certificates) for AWS infrastructure.
The requirement points to AWS compliance and governance documentation.
AWS manages the security of the cloud and provides audit reports to customers to prove compliance.
2
Determine which AWS service acts as the central portal for these compliance documents.
AWS Artifact is identified as the dedicated self-service portal for downloading these reports on demand.
Other services like Systems Manager, GuardDuty, or CloudTrail are used for resource management, threat detection, or API logging rather than document retrieval.

Anahtar Kavram

AWS Artifact provides on-demand access to AWS compliance reports and agreements.
Tahmini Süre:1m 0s
Soru 34Soru →

A fintech startup is deploying a public-facing REST API using Amazon API Gateway to expose financial transaction data. The API must be secured against unauthorized access, and all data transit must be encrypted. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers

Cevap

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers
Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers is the correct answer because managing identity and access management (IAM) permissions, authentication, and authorization policies for the application's APIs falls under the customer's responsibility for securing their data 'in' the cloud.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon API Gateway is a fully managed (Platform-as-a-Service/Serverless) AWS service.
Managed services shift infrastructure-level maintenance tasks from the customer to AWS.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for a managed service.
AWS handles the physical security, underlying operating systems, and patching. The customer remains responsible for securing data, configuring resource policies, and managing user access.
This determines which task the customer must execute directly to secure their API.
3
Evaluate the choices to find the customer-managed task.
Configuring user pools or Lambda authorizers controls access to the application data, which is 'in' the cloud and thus the customer's responsibility.
API access control is managed at the application layer by the customer.

Anahtar Kavram

Under the AWS Shared Responsibility Model, for managed services like Amazon API Gateway, AWS handles physical security, OS patching, and network infrastructure, while the customer is responsible for application-level security, including client-side encryption, access control (authentication/authorization), and resource configuration.
Soru 35Soru →

A company is building a batch processing solution for genetic sequencing data. The application requires direct access to GPU hardware, a customized Linux kernel with specific compliance patches, and runs jobs that can take up to 4 hours to complete. The workload is highly unpredictable, and the company wants to minimize costs by ensuring resources are only active during processing. Which AWS compute option best meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon EC2 instances in an Auto Scaling group utilizing Spot Instances

Cevap

Amazon EC2 instances in an Auto Scaling group utilizing Spot Instances
Amazon EC2 is the correct choice because it provides virtual machines where the customer has full root access, enabling the use of custom kernels and direct GPU mapping. Since the job runs for 4 hours, it exceeds Lambda's limits. EC2 Auto Scaling allows the group to scale to zero instances to minimize costs, and Spot Instances offer deep discounts suitable for batch jobs.

Adım Adım Çözüm

1
Analyze the workload duration requirement.
The job takes up to 4 hours, which immediately rules out serverless functions like AWS Lambda due to their 15-minute execution limit.
Compute options must support long-running execution windows.
2
Evaluate operating system and hardware requirements.
The requirement for custom kernel compliance patches and direct GPU access rules out serverless container options like AWS Fargate, which abstract away the host OS and kernel management.
Administrative control over the OS kernel is a shared responsibility aspect that requires full virtual machine control (EC2).
3
Assess cost-optimization and scalability requirements.
Amazon EC2 Auto Scaling groups can scale to zero instances when no work is present, and utilizing Spot Instances matches the unpredictable, batch-processing nature of genetic sequencing at a highly discounted rate.
Minimizing idle costs requires dynamic scaling and leverage of excess AWS capacity pricing.

Anahtar Kavram

AWS Compute Service Selection based on compliance, hardware access, execution duration, and cost optimization
Soru 36Soru →

A system administrator needs to perform two tasks: first, they want to deploy and update a collection of AWS resources in a repeatable way using templates; second, they need to run interactive queries and administrative commands directly from their local terminal. Which two AWS tools should the administrator use to perform these tasks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudFormation; AWS Command Line Interface (AWS CLI)

Cevap

AWS CloudFormation and AWS Command Line Interface (AWS CLI)
AWS CloudFormation allows administrators to define and provision AWS infrastructure using declarative templates, ensuring repeatable deployments. The AWS Command Line Interface (AWS CLI) allows users to run interactive administrative commands and query resources directly from their local terminal shell.

Adım Adım Çözüm

1
Identify the tool required for repeatable infrastructure deployment using templates.
AWS CloudFormation is the service designed for deploying resources via infrastructure as code templates.
It allows declaring resource state in templates and deploying them reliably.
2
Identify the tool required to run interactive commands and queries from a local terminal.
AWS Command Line Interface (AWS CLI) is the tool that enables running commands directly from a terminal shell.
It allows shell-based management and interactive querying of AWS resources.

Anahtar Kavram

Deployment and management tools in AWS including AWS CloudFormation for Infrastructure as Code and the AWS CLI for terminal-based operations.
Tahmini Süre:1m 0s
Soru 37Soru →

A financial startup is planning to deploy its multi-tier application infrastructure on AWS. The startup has the following requirements:
1. The infrastructure must be defined as declarative templates that are version-controlled and can be repeated across development, testing, and production environments with zero manual intervention.
2. The application's custom Python code must programmatically interact with Amazon S3 to upload reports and write transactions to an Amazon DynamoDB table.

Which two AWS deployment and management methods or tools should the startup use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudFormation to define and provision the infrastructure resources using template files; AWS SDK for Python (Boto3) to integrate programmatic AWS service calls directly inside the application code

Cevap

The correct options are the one indicating AWS CloudFormation to define and provision the infrastructure resources using templates, and the one indicating AWS SDK for Python (Boto3) to integrate programmatic service calls.
AWS CloudFormation is correct because it provides a template-based JSON/YAML declarative model to manage and version-control infrastructure as code, satisfying the requirement for zero manual intervention and repeatability. The AWS SDK for Python (Boto3) is correct because it provides native programming libraries to interact programmatically with AWS services (S3 and DynamoDB) from within custom application code.

Adım Adım Çözüm

1
Analyze the first requirement: deploying infrastructure using declarative templates that are version-controlled and repeatable across environments with zero manual intervention.
Identify AWS CloudFormation as the service designed for infrastructure as code (IaC) that meets these exact needs.
AWS CloudFormation allows developers to write JSON or YAML templates to provision resources consistently.
2
Analyze the second requirement: enabling custom Python code to programmatically interact with Amazon S3 and Amazon DynamoDB.
Identify the AWS SDK for Python (Boto3) as the programmatic API interface for custom application integration.
AWS SDKs are designed for applications to make API calls to AWS services, whereas the CLI and Console are intended for administrative and manual tasks respectively.

Anahtar Kavram

AWS CloudFormation is used for infrastructure as code to deploy repeatable environments, while the AWS SDK is used for writing custom code that programmatically interacts with AWS services.
Tahmini Süre:2m 0s
Soru 38Soru →

A research institute manages high-performance simulation applications running on a fleet of Amazon EC2 instances. The institute's security audit team requires a tool that can continuously scan the operating systems of these instances for known software vulnerabilities and analyze network paths to identify unintended exposure to the internet. Which AWS service is designed to perform these automated vulnerability assessments?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector is the correct service because it automatically evaluates Amazon EC2 instances for software vulnerabilities and unintended network path exposure.
Amazon Inspector is designed to automatically discover and scan Amazon EC2 instances, container images, and AWS Lambda functions for software vulnerabilities (like CVEs) and unintended network exposure.

Adım Adım Çözüm

1
Analyze the core requirement of finding an AWS service that performs automated security assessments, scans for software vulnerabilities, and analyzes network paths on Amazon EC2 instances.
The target service must support host-level operating system scanning and network exposure analysis.
This distinguishes between services that monitor active API threats and those that audit static configuration and patching status.
2
Evaluate the capabilities of Amazon Inspector against other security services.
Amazon Inspector is the only service that performs automated vulnerability scans on host software and checks network accessibility, whereas GuardDuty is for active threat detection, CloudTrail is for auditing API events, and Shield is for DDoS protection.
Identifying the distinct functionality of each option ensures the selection of the correct service.

Anahtar Kavram

Continuous vulnerability assessment and network reachability analysis using Amazon Inspector.
Tahmini Süre:1m 0s
Soru 39Soru →

A smart-home technology company is migrating its device telemetry processing system to the AWS Cloud. The workload experiences significant demand fluctuations, with peak traffic occurring in the morning and evening, and near-zero activity overnight. Which of the following describe the primary cloud economic benefits of this migration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The capability to dynamically scale resources to match actual hourly demand, minimizing cost during low-activity periods.; The transition from upfront capital expenditures (CapEx) to variable operating expenditures (OpEx) linked directly to resource consumption.

Cevap

The correct answers are the capability to dynamically scale resources to match actual hourly demand, and the transition from upfront capital expenditures (CapEx) to variable operating expenditures (OpEx).
The correct options reflect the main economic benefits of AWS: elasticity and cost model shifting. Elasticity enables scaling resources up or down dynamically to prevent over-provisioning costs during off-peak hours. The cost shift changes the spending structure from capital expenses (CapEx) to operating expenses (OpEx), allowing the company to pay only for active resources.

Adım Adım Çözüm

1
Analyze the workload's resource usage pattern over a 24-hour cycle.
The workload has high peaks during morning/evening and near-zero usage overnight, highlighting a need for resource elasticity.
Determining the workload's variability helps identify how cloud elasticity avoids the cost of idle on-premises hardware.
2
Evaluate the financial implications of shifting infrastructure from an on-premises data center to the pay-as-you-go cloud model.
The company moves from buying physical servers upfront (CapEx) to paying monthly based on consumption (OpEx).
Trading upfront capital expense for variable operational expense is a core economic advantage of the AWS Cloud.

Anahtar Kavram

Understanding cloud economics principles, particularly the cost benefits of elasticity and the shift from capital expenses (CapEx) to operational expenses (OpEx).
Soru 40Soru →

An online gaming portal manages player matchmaking and game lobby orchestration. The current architecture relies on a single monolithic server to run the matchmaking logic, store active session states, and send notification emails to players when a match is found. During peak tournament events, the system struggles to handle the load, resulting in delayed notifications and failed match setups. To align with AWS Cloud design principles, which of the following architectural changes should the portal implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Amazon DynamoDB to externalize session state, allowing the matchmaking compute components to operate statelessly and scale independently.; Migrate the email notification subsystem to Amazon Simple Notification Service (Amazon SNS), leveraging a managed service instead of maintaining custom mail server software.

Cevap

The portal should implement using Amazon DynamoDB to externalize session state for stateless compute scaling and migrating the email notification subsystem to Amazon Simple Notification Service (Amazon SNS) to leverage managed services.
The correct architecture uses Amazon DynamoDB to store matchmaking session data externally, allowing the application tier to operate statelessly and scale horizontally (implementing loose coupling). It also utilizes Amazon SNS as a managed messaging service to handle notifications, removing the operational burden of managing a dedicated mail server (implementing services not servers).

Adım Adım Çözüm

1
Analyze the bottlenecks in the monolithic setup, specifically state storage (local memory) and custom notification management.
Identify that statefulness prevents scaling and managing a custom email server adds unnecessary operational overhead.
AWS design principles advocate for stateless applications and offloading server management to managed services.
2
Select options that replace stateful components with external state stores and custom application code with managed services.
Amazon DynamoDB externalizes state (loose coupling), and Amazon SNS replaces custom notification infrastructure (services not servers).
This aligns the architecture with the core AWS design principles of loose coupling and utilizing managed services.

Anahtar Kavram

AWS Cloud Design Principles
ÖncekiSayfa 2 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin