Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 421Soru →

An educational technology (EdTech) company is launching a new online learning platform. The platform experiences high traffic during school exams and very low traffic during holidays. The company wants to leverage the AWS Cloud to handle these traffic variations efficiently while minimizing costs. Which two of the following are benefits of the AWS Cloud that directly address this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Stop guessing capacity; Trade fixed expense for variable expense

Cevap

The benefits of stopping guessing capacity and trading fixed expense for variable expense
The correct benefits are stopping guessing capacity and trading fixed expense for variable expense. Stopping guessing capacity allows the e-learning platform to scale dynamically as traffic spikes or drops. Trading fixed expense for variable expense means the company only pays for active usage during exam seasons rather than paying upfront for servers that sit idle during school holidays.

Adım Adım Çözüm

1
Analyze the scenario details, focusing on fluctuating traffic (high during exams, low during holidays) and the desire to optimize costs.
Identify that the solution must support scaling resources up and down dynamically based on demand, and changing the billing model to only pay for active consumption.
This links the scenario needs directly to AWS Cloud benefits.
2
Evaluate which AWS Cloud benefits address dynamic scaling.
'Stop guessing capacity' is the direct benefit representing elasticity, allowing automatic scaling in response to traffic changes.
Elasticity eliminates the need to overprovision hardware for peak periods.
3
Evaluate which AWS Cloud benefits address the payment structure.
'Trade fixed expense for variable expense' allows paying only for what is consumed.
This replaces capital expenses (CapEx) with operational expenses (OpEx).

Anahtar Kavram

Benefits of AWS Cloud (Elasticity and Cost Optimization)
Soru 422Soru →

A mobile game studio wants to launch weekly experimental feature trials to gather player feedback. In their traditional on-premises environment, developers must wait several weeks for the IT department to procure and configure new physical server hardware for each test. By migrating to the AWS Cloud, the studio can now launch and terminate virtual servers in minutes, significantly reducing the cost and time required for experimentation.

Which benefit of the AWS Cloud is directly demonstrated by this scenario?

Cevabı ve açıklamayı göster

Cevap: Increase speed and agility

Cevap

Increase speed and agility
The correct answer is the option stating 'Increase speed and agility'. In a cloud computing environment, new IT resources are just a click away, which reduces the time it takes to make those resources available to developers from weeks to minutes. This dramatically increases agility for the organization, as the cost and time to experiment and develop are significantly lower.

Adım Adım Çözüm

1
Analyze the business scenario described in the stem.
The game studio is transitioning from a weeks-long hardware procurement process to launching and terminating virtual servers within minutes to run experiments.
Understanding the core problem (slow provisioning vs. fast provisioning) helps map it to the correct AWS Cloud benefit.
2
Compare the scenario characteristics with the definition of 'Increase speed and agility' in AWS.
AWS defines 'Increase speed and agility' as having IT resources only a click away, reducing the time to make those resources available to developers from weeks to minutes, which lowers the cost and time to experiment.
This matches the scenario's focus on rapid provisioning for experimentation and development.

Anahtar Kavram

AWS Cloud Benefit: Increase speed and agility
Tahmini Süre:1m 0s
Soru 423Soru →

A retail corporation is migrating its point-of-sale systems to AWS and needs to ensure compliance with industry security regulations. Under the AWS Shared Responsibility Model, which of the following compliance-related tasks is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Enforcing password complexity policies and multi-factor authentication for application developers

Cevap

Enforcing password complexity policies and multi-factor authentication for application developers
Under the Shared Responsibility Model, the customer is responsible for security and compliance 'in' the cloud. This includes customer-side configurations such as Identity and Access Management (IAM), which encompasses enforcing password complexity policies and enabling multi-factor authentication (MFA) for users.

Adım Adım Çözüm

1
Analyze the scenario to identify the compliance requirement under the AWS Shared Responsibility Model.
The scenario requires identifying a task that falls under customer responsibility ('security in the cloud') rather than AWS responsibility ('security of the cloud').
This establishes the boundary between customer-managed tasks and AWS-managed infrastructure tasks.
2
Evaluate the choices to distinguish between configuration tasks managed by the customer and infrastructure/physical security tasks managed by AWS.
Managing user credentials and IAM access policies (such as password policies and MFA) is a customer responsibility, while physical security, hypervisor patching, and data center compliance are AWS responsibilities.
This identifies the correct task that the customer must perform to satisfy the compliance audit.

Anahtar Kavram

Under the AWS Shared Responsibility Model, compliance is a shared effort. AWS is responsible for the security 'of' the cloud (physical infrastructure, hardware, virtualization layer), while the customer is responsible for security 'in' the cloud (customer data, identity and access management, guest operating systems, and application configurations).
Tahmini Süre:1m 30s
Soru 424Soru →

A multi-department enterprise has hired an external consulting firm to perform a security audit of their AWS environment. The auditors require read-only access to various AWS resources for a limited duration of two weeks. Which of the following is the AWS-recommended best practice to grant this external firm access to the enterprise's AWS account?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.

Cevap

Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.
The correct option outlines the practice of creating an IAM role. An IAM role allows the external firm to assume the role using their own AWS account credentials, obtaining temporary security credentials for the duration of the audit without requiring the enterprise to share long-term access keys.

Adım Adım Çözüm

1
Identify the requirement for secure, temporary, and cross-account access for an external auditing firm.
The solution must provide limited-duration access without sharing permanent credentials.
Sharing permanent access keys or root user credentials violates AWS security standards.
2
Evaluate AWS IAM mechanisms for cross-account delegation.
An IAM role with a trust policy is identified as the optimal tool for cross-account access.
IAM roles leverage security token services to issue temporary security credentials, ensuring security and compliance.

Anahtar Kavram

Cross-account access delegation using IAM roles
Soru 425Soru →

A healthcare technology company deploys microservices using AWS Lambda and container images stored in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement a solution that automatically scans these container images and Lambda functions for software vulnerabilities, and assesses the Lambda functions for unintended network exposure. Which AWS service should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector

Cevap

Amazon Inspector
Amazon Inspector is the AWS service designed to automatically and continuously scan workloads—specifically Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions—for software vulnerabilities (such as Common Vulnerabilities and Exposures, or CVEs) and unintended network path exposure. This directly addresses the requirement to scan container images and Lambda functions.

Adım Adım Çözüm

1
Analyze the business and technical requirements of the scenario.
The company needs automated scanning of container images in Amazon ECR and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.
Understanding the target resource types (ECR and Lambda) and the activity (vulnerability scanning and network exposure analysis) narrows down the appropriate AWS security services.
2
Evaluate the capabilities of Amazon Inspector.
Amazon Inspector is designed specifically to scan EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and network reachability.
This matches the exact requirements specified in the scenario.
3
Differentiate Amazon Inspector from threat detection and logging services.
Amazon GuardDuty provides threat detection (not vulnerability scanning), AWS CloudTrail provides API logging, and AWS Support does not automate application-level vulnerability scanning.
Verifying that the other choices do not perform the requested vulnerability scanning tasks ensures the selection of the correct service.

Anahtar Kavram

Vulnerability scanning of container images and Lambda functions using Amazon Inspector
Soru 426Soru →

A global logistics and maritime transport enterprise is expanding its shipment tracking application to customers in Asia, Europe, and South America. Historically, this expansion would require the company's IT staff to negotiate real estate leases for colocation facilities, purchase physical servers, and manage local power infrastructure in each region. By migrating to AWS, the company can deploy its application across multiple global locations with a few clicks and redirect its engineering resources from server maintenance to logistics software innovation.

Which two AWS Cloud benefits are directly demonstrated in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Go global in minutes; Stop spending money running and maintaining data centers

Cevap

The correct answers are the benefits of going global in minutes and stopping spending money running and maintaining data centers.
The correct options are the benefits of going global in minutes and stopping spending money running and maintaining data centers. The global deployment across multiple continents with minimal effort illustrates going global in minutes. Getting rid of physical server procurement, leasing, and power management demonstrates stopping spending money running and maintaining data centers.

Adım Adım Çözüm

1
Identify the geographic aspects of the deployment described in the scenario.
The tracking application is deployed across Asia, Europe, and South America with a few clicks.
This maps directly to the benefit of going global in minutes.
2
Identify the infrastructure management shifts described in the scenario.
The company stops managing physical server racks, power infrastructure, and real estate leases.
This maps directly to stopping spending money running and maintaining data centers, allowing engineers to focus on business innovation.

Anahtar Kavram

The six benefits of AWS Cloud, focusing on global deployment capabilities and the outsourcing of physical data center management.
Soru 427Soru →

A retail company needs to track and audit all user activity and API calls within their AWS account for security compliance. They want to identify which specific user modified a security group rule or deleted an Amazon S3 bucket. Which AWS service should the company use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is the correct choice because it records actions taken by a user, role, or AWS service. It provides a detailed history of API calls, including who made the call, when it was made, and from which IP address, which meets the company's compliance requirements.

Adım Adım Çözüm

1
Identify the core requirement of the scenario: tracking and auditing all user actions and API calls (e.g., resource modification or deletion).
The requirement is for audit trails of API activity.
This helps narrow down the services that record activity versus those that monitor performance or detect threats.
2
Compare the capabilities of the options relative to logging API actions.
AWS CloudTrail is specifically designed for governance, compliance, and operational auditing of AWS account activity.
Selecting the service that logs AWS API calls ensures compliance and security visibility.

Anahtar Kavram

AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging user activity and API calls.
Tahmini Süre:45s
Soru 428Soru →

An e-commerce company is deploying containerized microservices using AWS Fargate. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring security groups to control inbound and outbound network traffic to the containers; Defining Identity and Access Management (IAM) roles and access policies for the containerized applications

Cevap

The customer is responsible for configuring security groups to control network traffic and defining IAM roles and access policies for the applications. AWS is responsible for physical security, infrastructure auditing, and patching the host operating system.
Under the AWS Shared Responsibility Model, for container services like AWS Fargate, AWS manages the underlying physical infrastructure, virtualization layer, and host operating system. The customer remains responsible for application-level settings, container configuration, network access controls such as security groups, and identity and access management (IAM) permissions for their container tasks.

Adım Adım Çözüm

1
Determine the service type and boundaries.
AWS Fargate is a serverless container platform where AWS manages the underlying host infrastructure and OS.
Identifying the service type helps delineate between infrastructure management (AWS) and application/logical configuration (customer).
2
Select tasks aligned with customer responsibility.
Configuring security groups and setting IAM policies.
Customers are always responsible for access controls, application settings, and firewall configurations 'in' the cloud.

Anahtar Kavram

Shared Responsibility Model for managed container services (AWS Fargate)
Soru 429Soru →

A digital publishing organization is optimizing its content delivery platform. The organization plans to replace its self-managed caching clusters with a fully managed caching service. Additionally, they plan to use infrastructure templates to automatically deploy identical, short-lived staging environments that are destroyed after testing is complete.

Which of the following design principles are demonstrated by these architectural choices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Leveraging managed services to reduce the operational overhead of server administration; Defining infrastructure as disposable resources that can be easily recreated using automation

Cevap

Leveraging managed services to reduce operational overhead, and defining infrastructure as disposable resources that can be easily recreated using automation.
The correct architectural choices demonstrate utilizing managed services to remove server administration tasks and implementing disposable resources via automated infrastructure templates.

Adım Adım Çözüm

1
Analyze the first architectural change: replacing self-managed caching clusters with a fully managed caching service.
Identified the design principle of prioritizing managed services over running and managing servers directly, which lowers operational administration.
This shows shift of operational responsibility to AWS.
2
Analyze the second architectural change: using templates to deploy identical, short-lived staging environments that are destroyed after testing.
Identified the design principle of treating resources as disposable assets that can be easily created and destroyed through automation.
This prevents configuration drift and avoids paying for idle resources.

Anahtar Kavram

AWS Cloud design principles focus on automating infrastructure deployment as disposable assets and leveraging managed services to shift operational burdens.
Soru 430Soru →

A software company is configuring permissions for its new AWS environment. The IT administrator needs to manage access for ten developers who require the same set of permissions, and also grant an application running on Amazon Elastic Container Service (Amazon ECS) access to an Amazon DynamoDB table. Which of the following actions represent AWS security best practices to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM user group, attach the required permissions policy to it, and add the developers to the group.; Create an IAM role with the necessary permissions policy and associate it with the ECS task definition.

Cevap

Create an IAM user group, attach the required permissions policy to it, and add the developers to the group; and create an IAM role with the necessary permissions policy and associate it with the ECS task definition.
The correct options are to create an IAM user group for the developers and to associate an IAM role with the ECS task definition. Grouping users with similar permissions requirements simplifies access management and ensures consistency. Using IAM roles for applications running on AWS services like ECS provides temporary security credentials dynamically, eliminating the need to hardcode or manage long-term keys.

Adım Adım Çözüm

1
Identify the user access requirement for the ten developers who need identical permissions.
Determine that creating an IAM user group and adding the developers to it is the AWS-recommended method to manage collective permissions.
Attaching policies to a group instead of individual users reduces administrative overhead and ensures consistent policy enforcement.
2
Identify the access requirement for the application running on Amazon ECS to access DynamoDB.
Determine that associating an IAM role with the ECS task definition is the secure way to grant permissions to services.
IAM roles provide temporary security credentials, avoiding the risk of hardcoding or exposing long-term access keys.

Anahtar Kavram

AWS IAM best practices including user groups for organizing user permissions and IAM roles for granting temporary credentials to services and applications.
Soru 431Soru →

A logistics company runs its tracking application using containerized microservices on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. To maintain a robust security posture, the company needs to define the boundaries of the AWS Shared Responsibility Model for this serverless container environment.

Which of the following security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Patching the software and dependencies running inside the application container images; Configuring security groups to control inbound and outbound network traffic to the ECS tasks

Cevap

The customer is responsible for patching software and dependencies inside the application container images and configuring security groups to control inbound and outbound network traffic to the ECS tasks.
Under the AWS Shared Responsibility Model, serverless services like AWS Fargate shift host management responsibilities to AWS. The customer remains responsible for securing container contents (such as application code and package dependencies) and defining task-level firewall rules (such as security groups).

Adım Adım Çözüm

1
Identify the AWS service type and launch model used in the scenario.
The application runs on Amazon ECS with the AWS Fargate launch type, which is a serverless compute engine for containers.
This determines that the virtualization layer and underlying host operating system are fully managed by AWS.
2
Differentiate between customer responsibilities (security in the cloud) and AWS responsibilities (security of the cloud) for serverless container workloads.
The customer manages application code, data, container images, and network access rules (security groups). AWS manages physical facilities, host hardware, the host OS, and the hypervisor.
Correctly allocating tasks prevents security gaps and mapping errors on the exam.

Anahtar Kavram

Shared Responsibility Model for Serverless Container Services
Soru 432Soru →

A company is establishing its AWS environment and needs to define its identity and access management strategy. The security team must ensure that application servers running on Amazon EC2 can securely access files in Amazon S3, and that emergency administrative actions can be performed securely if primary identity systems fail. Which two AWS Identity and Access Management (IAM) best practices should the company implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate an IAM role with the EC2 instances using an instance profile, allowing the application to use temporary security credentials.; Configure the AWS account root user with multi-factor authentication (MFA), secure its login credentials, and use it only for tasks that explicitly require root permissions.

Cevap

The correct practices are to associate an IAM role with the EC2 instances using an instance profile and to configure the AWS account root user with multi-factor authentication (MFA) while securing its credentials for emergency-only use.
Associating an IAM role with an EC2 instance provides temporary security credentials dynamically, eliminating the need to store long-term access keys. Additionally, securing the AWS account root user with MFA and restricting its usage to emergency-only tasks is a fundamental AWS security best practice.

Adım Adım Çözüm

1
Determine the secure method for applications running on Amazon EC2 to access other AWS services like Amazon S3.
Identify that AWS recommends attaching an IAM role to the EC2 instances using an instance profile to provide temporary credentials.
This avoids hardcoding or storing permanent AWS access keys on the instance, reducing credential exposure risk.
2
Determine the security recommendations for the AWS account root user.
Identify that the root user should have MFA enabled and be reserved only for tasks requiring root privileges, while regular administrative tasks should be performed by IAM identities.
Securing the root user protects the highest-privileged credentials in the AWS account from misuse or compromise.
3
Analyze and eliminate incorrect options based on security best practices.
Eliminate choices recommending permanent access keys, root credential sharing, or using Service Control Policies to grant direct S3 permissions.
These practices either compromise security or misapply the purpose of AWS Organizations and IAM components.

Anahtar Kavram

AWS IAM Best Practices for EC2 access and Root User Security
Soru 433Soru →

An online retail company is preparing for its annual security audit. The internal compliance team needs to access and download official AWS security and compliance documents, such as SOC reports and ISO certifications, to verify the security posture of the AWS infrastructure. Which AWS service or portal provides on-demand access to these compliance reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact is the central resource for compliance-related information. It provides on-demand access to AWS security and compliance reports (such as SOC, ISO, and PCI reports) and allows customers to accept agreements with AWS.

Adım Adım Çözüm

1
Identify the core requirement of the retail company.
The company needs to download official AWS compliance documents, including SOC reports and ISO certifications.
This is a compliance auditing task rather than account activity logging or security threat monitoring.
2
Determine which AWS service acts as the central repository for compliance documentation.
AWS Artifact is the designated portal where customers can download AWS compliance reports and sign agreements.
AWS Artifact provides on-demand access to these reports at no additional cost.

Anahtar Kavram

AWS Artifact is the self-service portal that provides on-demand access to AWS compliance reports, such as Service Organization Control (SOC) and Payment Card Industry (PCI) reports, as well as agreements.
Soru 434Soru →

An online media company notices that its monthly AWS billing rates for data storage have periodically decreased over time, even though the company's own storage usage has remained constant. AWS is able to pass these savings on to customers due to the aggregated usage of hundreds of thousands of customers. Which benefit of the AWS Cloud does this scenario describe?

Cevabı ve açıklamayı göster

Cevap: Benefit from massive economies of scale

Cevap

Benefit from massive economies of scale
The correct answer is the option indicating that the customer benefits from massive economies of scale. Because AWS aggregates usage from hundreds of thousands of customers, it can achieve higher economies of scale. This scale translates into savings that AWS passes back to customers in the form of lower pay-as-you-go prices.

Adım Adım Çözüm

1
Analyze the business scenario described in the question stem.
The scenario focuses on general price drops passed down to customers because of AWS's aggregate usage from hundreds of thousands of customers.
To identify which cloud benefit allows AWS to offer lower unit rates as its customer base grows.
2
Compare the scenario details with the definition of AWS Cloud benefits.
The concept of passing savings from high-volume operations down to individual customers aligns exactly with 'Benefit from massive economies of scale'.
To select the correct option that matches the identified cloud benefit.

Anahtar Kavram

Benefit from massive economies of scale
Tahmini Süre:45s
Soru 435Soru →

Veloce Automotive is migrating its infrastructure to the AWS Cloud. The migration team has identified two workloads:

1. A third-party inventory system that will be replaced by purchasing a software-as-a-service (SaaS) application from the AWS Marketplace.
2. A critical legacy web server that must be moved to Amazon EC2 immediately with zero modifications to the application code or configuration.

Which two AWS migration strategies describe the paths chosen for these workloads?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Repurchasing; Rehosting

Cevap

Repurchasing and Rehosting are the correct strategies.
Repurchasing is the correct strategy for the third-party inventory system because it is replaced by buying a Software-as-a-Service (SaaS) application. Rehosting is correct for the legacy web server because the server is moved to Amazon EC2 as-is with no modifications, which represents a lift-and-shift approach.

Adım Adım Çözüm

1
Analyze the requirement for the first workload: replacing a COTS system with a SaaS application from the AWS Marketplace.
This is identified as the Repurchasing strategy.
Repurchasing involves dropping the existing software license and purchasing a SaaS-based version of the tool.
2
Analyze the requirement for the second workload: moving a legacy web server to EC2 with zero modifications.
This is identified as the Rehosting strategy.
Rehosting, or lift-and-shift, involves migrating workloads directly to the cloud without modifying code or configuration.

Anahtar Kavram

AWS Cloud Migration Strategies (6 Rs)
Tahmini Süre:1m 0s
Soru 436Soru →

A logistics provider runs a custom inventory application on a fleet of Amazon EC2 instances. The provider wants to implement automated checks to identify known software package vulnerabilities and unintended network exposure on these instances. According to the AWS Shared Responsibility Model, which statement correctly identifies the party responsible for configuring these checks, and the AWS service that should be utilized?

Cevabı ve açıklamayı göster

Cevap: The customer is responsible for securing their guest operating systems and applications, and they should use Amazon Inspector to perform the vulnerability scans.

Cevap

The customer is responsible for securing their guest operating systems and applications, and they should configure Amazon Inspector to perform software package vulnerability and network exposure scans.
The correct option correctly identifies that under the AWS Shared Responsibility Model, the customer is responsible for the guest operating system and applications running on Amazon EC2. It also correctly specifies Amazon Inspector as the designated AWS service for scanning EC2 instances for software vulnerabilities and unintended network path exposure.

Adım Adım Çözüm

1
Determine the boundary of responsibility for Amazon EC2 instances under the AWS Shared Responsibility Model.
Since EC2 is an Infrastructure as a Service (IaaS) offering, the customer retains control over the guest operating system, application stack, and security configurations. Therefore, the customer, not AWS, is responsible for vulnerability scanning and patching of the OS and applications.
This step eliminates options that incorrectly shift the guest OS security and vulnerability scanning responsibility to AWS.
2
Identify the AWS service specifically designed for software package vulnerability scanning and network exposure checks on EC2 instances.
Amazon Inspector is the service that automates vulnerability management by scanning EC2 instances, Amazon ECR container images, and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network path exposures.
This step distinguishes Amazon Inspector from other security services like Amazon GuardDuty (which does active threat detection) and AWS CloudTrail (which does API logging).

Anahtar Kavram

Vulnerability scanning on Amazon EC2 falls under the customer's side of the Shared Responsibility Model and is performed using Amazon Inspector.
Tahmini Süre:1m 30s
Soru 437Soru →

A healthcare provider plans to migrate its legacy patient database to Amazon RDS for MySQL. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring database user permissions and access control lists within the MySQL database engine

Cevap

Configuring database user permissions and access control lists within the MySQL database engine
Under the AWS Shared Responsibility Model for managed services such as Amazon RDS, AWS is responsible for the security of the cloud. This includes physical data center security, host operating system patching, and hardware maintenance. The customer remains responsible for security in the cloud, which includes data classification, encryption settings, database user authentication, and managing granular privileges within the database itself.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon RDS is a managed database service (Platform as a Service / Database as a Service).
Defining the service model helps establish the boundary between customer and AWS responsibilities.
2
Differentiate between infrastructure management and data/access management tasks.
Tasks like physical hardware maintenance, host OS patching, and physical security belong to AWS. Database-level user permissions and data access control belong to the customer.
Applying the Shared Responsibility Model principles enables selection of the correct customer task.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 438Soru →

PixelForge Studios is planning to migrate its operations to the AWS Cloud. The IT team has categorized two of their workloads for migration:

First, they will replace their self-managed on-premises human resources (HR) application with a third-party Software-as-a-Service (SaaS) solution available on the AWS Marketplace.

Second, they will move their web application's underlying MySQL database to Amazon Relational Database Service (Amazon RDS) to eliminate database administration tasks, while leaving the application code unchanged.

Which two of the following AWS Cloud migration strategies describe these plans? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Repurchasing; Replatforming

Cevap

The correct strategies are Repurchasing and Replatforming.
The correct strategies are Repurchasing and Replatforming. Replacing the legacy HR application with a third-party Software-as-a-Service (SaaS) solution corresponds to a Repurchasing strategy (sometimes referred to as drop-and-shop). Moving the database to a managed service like Amazon Relational Database Service (Amazon RDS) to eliminate database administration tasks while keeping the core application code intact represents a Replatforming strategy (also known as lift-tinker-and-shift).

Adım Adım Çözüm

1
Analyze the first migration workload: replacing the on-premises HR application with a third-party SaaS solution on AWS Marketplace.
Identify this as the Repurchasing strategy, which involves transitioning to a different product or platform (often SaaS) and purchasing licenses.
The defining characteristic of Repurchasing is moving from a self-managed product to a SaaS model.
2
Analyze the second migration workload: moving the MySQL database to Amazon RDS to reduce management overhead without altering application code.
Identify this as the Replatforming strategy, where minor optimizations are made to leverage cloud-managed services without redesigning the core application architecture.
Migrating a database to a managed service like Amazon RDS without modifying code is a classic replatforming scenario.

Anahtar Kavram

AWS Cloud Migration strategies (6 Rs)
Tahmini Süre:1m 30s
Soru 439Soru →

A logistics enterprise is migrating its supply chain systems to AWS and must verify that the AWS infrastructure aligns with global security standards. The compliance team needs to access AWS's independent third-party audit reports and accept online agreements to meet regulatory requirements. Which of the following actions should the team perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download AWS security and compliance documents, such as SOC and ISO reports, directly from AWS Artifact.; Accept AWS compliance agreements, such as Business Associate Addendums (BAAs), within the AWS Artifact portal.

Cevap

To obtain AWS compliance documentation and verify compliance, the team must download security reports directly from AWS Artifact and accept compliance agreements in the AWS Artifact portal.
The correct options are downloading compliance documents from AWS Artifact and accepting compliance agreements directly within the AWS Artifact portal. AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance reports and select online agreements.

Adım Adım Çözüm

1
Navigate to the AWS Artifact service in the AWS Management Console to find the self-service compliance reports.
Access to on-demand reports such as Service Organization Control (SOC) and International Organization for Standardization (ISO) certifications.
AWS Artifact is the primary portal for customers to access AWS compliance documentation.
2
Open the AWS Artifact Agreements section to review and accept regulatory agreements required for the workload.
Acceptance of online agreements such as the Business Associate Addendum (BAA) directly inside the console.
AWS Artifact allows customers to review and accept agreements that apply to their AWS accounts to meet regulatory compliance requirements.

Anahtar Kavram

AWS Artifact is the central self-service repository for retrieving AWS compliance reports and managing compliance agreements.
Soru 440Soru →

A fintech startup is deploying a digital wallet application. The environment consists of Amazon EC2 instances running payment processing software and containerized microservices hosted on Amazon Elastic Container Registry (Amazon ECR). The security team requires a solution to automatically scan these instances and container images for software vulnerabilities, and to continuously analyze log sources like VPC Flow Logs and CloudTrail events to detect malicious activity or unauthorized behavior. Which AWS services should the startup use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

The correct services are Amazon Inspector and Amazon GuardDuty.
Amazon Inspector satisfies the requirement to scan Amazon EC2 instances and Amazon ECR container images for software vulnerabilities. Amazon GuardDuty satisfies the requirement to continuously monitor log sources like VPC Flow Logs and AWS CloudTrail events for active threats and malicious activity.

Adım Adım Çözüm

1
Analyze the requirement for vulnerability scanning of Amazon EC2 instances and Amazon ECR container images.
Amazon Inspector is identified as the AWS service that automates software vulnerability and network exposure scans for these resources.
Inspector has native integration to scan EC2 instances and ECR repositories.
2
Analyze the requirement for continuous monitoring and threat detection of malicious activity using logs (VPC Flow Logs, CloudTrail, DNS).
Amazon GuardDuty is identified as the service that performs intelligent threat detection using these log sources.
GuardDuty uses machine learning and threat intelligence feeds to detect anomalies and unauthorized behavior in AWS accounts.
3
Evaluate and eliminate incorrect services based on their primary functions.
AWS CloudTrail, Amazon CloudWatch, and Amazon Macie are excluded as they do not perform the requested combination of host vulnerability scanning and broad threat detection.
CloudTrail is for API logging, CloudWatch is for performance monitoring and basic log management, and Macie is restricted to finding sensitive data within S3 buckets.

Anahtar Kavram

Identifying the respective purposes of Amazon Inspector for vulnerability scanning and Amazon GuardDuty for threat detection, while distinguishing them from logging, monitoring, and data privacy services.
ÖncekiSayfa 22 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin