Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 461Soru →

A health-tech company hosts its patient management portal on Amazon EC2 instances. The security team needs a service that can continuously monitor the AWS environment for potential security threats, such as command-and-control (C2) activity, unauthorized API calls, and brute-force attacks on the instances. Which AWS service is designed to perform this type of intelligent threat detection?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection by continuously monitoring logs (such as VPC Flow Logs, AWS CloudTrail management events, and DNS logs) using machine learning and threat intelligence to identify suspicious activities like brute-force attacks and command-and-control communication.

Adım Adım Çözüm

1
Analyze the business and security requirements in the scenario.
The company needs continuous, intelligent threat detection to identify malicious activities like command-and-control activity, brute-force attacks, and unauthorized API calls within their AWS environment.
Identifying the target behavior (active threat detection) helps narrow down the appropriate AWS security service category.
2
Evaluate the capabilities of the proposed AWS security services.
Amazon GuardDuty uses threat intelligence feeds and machine learning to detect anomalies and unauthorized activities across AWS accounts and workloads, matching all specified requirements.
This step distinguishes active log-based threat detection (GuardDuty) from package vulnerability scanning (Inspector) or API logging (CloudTrail).

Anahtar Kavram

Active threat detection and monitoring on AWS
Tahmini Süre:1m 0s
Soru 462Soru →

A media streaming company is preparing to share its compliance posture with new business partners. The company needs to retrieve official AWS security compliance documents, such as Service Organization Control (SOC) reports, to demonstrate the security of the AWS infrastructure. Which AWS service or portal provides on-demand access to these reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact
AWS Artifact provides on-demand access to AWS security and compliance reports, such as Service Organization Control (SOC) and Payment Card Industry (PCI) reports.

Adım Adım Çözüm

1
Identify the core business requirement.
The requirement is to retrieve official AWS security compliance documents (such as SOC reports) to share with partners.
This establishes the scope of the search to AWS compliance and governance tools.
2
Determine the AWS service designed for compliance reports.
AWS Artifact is the dedicated, self-service portal for on-demand access to AWS security and compliance reports and agreements.
This matches the requirement for downloading SOC reports directly.

Anahtar Kavram

AWS Compliance and Governance
Soru 463Soru →

A retail company deploys its online storefront using AWS Elastic Beanstalk. Under the AWS Shared Responsibility Model, which two of the following security-related tasks are the responsibility of the customer?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Securing the application code and data uploaded to the environment; Configuring Identity and Access Management (IAM) user permissions for accessing the environment

Cevap

Securing the application code and data uploaded to the environment, and configuring Identity and Access Management (IAM) user permissions for accessing the environment.
In the Platform as a Service (PaaS) model represented by AWS Elastic Beanstalk, the customer is responsible for configuring access policies (IAM) and securing the application code and data they upload. AWS manages and maintains the infrastructure, virtualization layer, guest operating system, and the application runtime platform.

Adım Adım Çözüm

1
Identify the service model of the AWS service described.
AWS Elastic Beanstalk is identified as a Platform as a Service (PaaS) model.
The shared responsibility boundary shifts depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
2
Differentiate between the customer's responsibility and AWS's responsibility for a PaaS service.
AWS manages the guest operating system, platform patching (such as Java or Node.js runtimes), virtualization layer, and physical infrastructure. The customer remains responsible for application code, configuration settings, data security, and identity/access control.
This step determines which tasks fall under customer ownership ('security in the cloud') versus AWS ownership ('security of the cloud') for managed services.
3
Select the two customer responsibilities from the options provided.
The tasks of securing the application code and data, as well as configuring IAM permissions, are selected.
These match the customer's operational responsibilities in a Platform as a Service (PaaS) deployment.

Anahtar Kavram

Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Platform as a Service (PaaS) offerings like AWS Elastic Beanstalk, AWS takes on more responsibility by managing the guest OS, runtime software, and physical security. The customer remains responsible for securing their code, protecting their data, and controlling user access via IAM.
Soru 464Soru →

A healthcare provider must ensure that all administrative actions performed in their AWS Cloud environment are recorded for regulatory compliance. They need to track when a user logs in, which resources were modified, and the source IP address of the request. Which AWS service is designed to record and log these API transactions?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is designed specifically to track, log, and audit user activity and API calls across the AWS infrastructure. It provides detailed records of who made the request, when, and from what IP address, which meets compliance requirements.

Adım Adım Çözüm

1
Identify the key requirement in the scenario.
The healthcare provider needs to record all administrative actions, track user logins, resource modifications, and log the source IP addresses of the requests for regulatory compliance.
This establishes the core need for API logging and activity auditing.
2
Evaluate the capabilities of the AWS services listed in the options.
AWS CloudTrail records and logs AWS API transactions and user actions. Amazon CloudWatch focuses on operational metrics and system logs. Amazon GuardDuty focuses on threat detection. AWS Trusted Advisor provides optimization recommendations.
Matching the requirements to the correct service's primary function ensures the correct selection.
3
Verify which service provides the necessary activity history.
AWS CloudTrail is the specific service designed to log API transactions and user activity for auditing and compliance.
This confirms the correct option based on AWS services documentation.

Anahtar Kavram

AWS CloudTrail is the primary service used to log, monitor, and retain account activity related to actions across your AWS infrastructure, enabling operational auditing and compliance verification.
Soru 465Soru →

A software-as-a-service (SaaS) company providing human resources platform services is undergoing an external SOC 2 Type II audit. The audit team requires documentation verifying the security and compliance of the AWS physical infrastructure, and confirmation of how the SaaS company manages encryption keys for its application data. Which of the following actions should the company take to meet these audit requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download the AWS SOC 2 report directly from AWS Artifact to provide to the auditors; Manage customer-managed encryption keys for application data using AWS Key Management Service (AWS KMS)

Cevap

To meet these requirements, the company should download the AWS SOC 2 report directly from AWS Artifact to verify AWS infrastructure compliance, and manage application data encryption keys using AWS Key Management Service (AWS KMS) to fulfill their responsibility under the Shared Responsibility Model.
The correct options are downloading the AWS SOC 2 report from AWS Artifact and managing encryption keys using AWS Key Management Service (AWS KMS). AWS Artifact provides on-demand access to security and compliance reports (such as SOC and PCI reports) which verify the compliance of AWS physical infrastructure. Additionally, under the Shared Responsibility Model, the customer is responsible for data protection, which includes configuring encryption and managing keys using AWS KMS.

Adım Adım Çözüm

1
Identify the service for retrieving AWS compliance reports
Determine that AWS Artifact is the self-service portal to download reports like SOC 2 to prove AWS physical infrastructure compliance.
Auditors require third-party verification of the infrastructure managed by AWS.
2
Determine the tool and responsibility for data encryption key management
Identify that managing keys for data encryption is a customer responsibility under the Shared Responsibility Model, which is implemented using AWS Key Management Service (AWS KMS).
The customer is responsible for data protection and encryption in the cloud.

Anahtar Kavram

AWS Compliance and Governance and the Shared Responsibility Model
Tahmini Süre:1m 30s
Soru 466Soru →

A financial services firm wants to audit user activity in its AWS account to ensure compliance. They need to keep a complete record of all API transactions, and they also want to receive real-time notifications if anyone attempts to modify security group rules. Which combination of AWS services should the company implement to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to log and track API calls across the account.; Amazon CloudWatch Alarms to monitor log events and send alerts for security group changes.

Cevap

To audit all API transactions and receive real-time notifications for security group changes, the company should configure AWS CloudTrail to log API activity and use Amazon CloudWatch Alarms to monitor the logs and trigger alerts.
Deploying AWS CloudTrail allows the company to log, continuously monitor, and retain account activity related to actions across their AWS infrastructure. To receive real-time notifications for modifications to security group rules, the company can deliver CloudTrail logs to Amazon CloudWatch Logs and configure Amazon CloudWatch Alarms to trigger alerts based on specific log patterns.

Adım Adım Çözüm

1
Identify the service responsible for auditing and logging AWS API actions.
AWS CloudTrail is identified as the service that records API calls, user activity, and resource changes across the AWS infrastructure.
Tracking user activity and API transaction history is a core capability of AWS CloudTrail.
2
Determine how to monitor logs and trigger notifications for specific events like security group modifications.
Amazon CloudWatch Logs can receive CloudTrail logs, and CloudWatch Alarms can trigger alerts (such as via Amazon SNS) based on metric filters for security group modification events.
Amazon CloudWatch is designed for real-time monitoring and alerting based on log patterns and resource metrics.

Anahtar Kavram

AWS CloudTrail is used for auditing and tracking API activity, while Amazon CloudWatch is used for monitoring resource performance, logs, and setting up alarms.
Soru 467Soru →

A company is designing a new web application in the AWS Cloud and wants to ensure that the architecture is modular and resilient to component outages. Which two of the following are design principles of the AWS Cloud that support this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Design for failure; Loose coupling

Cevap

The correct principles are designing for failure and loose coupling.
The correct options are designing for failure and loose coupling. Designing for failure ensures that systems remain functional even if individual components experience outages. Loose coupling minimizes dependencies between components, which prevents failures in one component from causing cascading failures across the entire system.

Adım Adım Çözüm

1
Identify the goal of the scenario
The company wants to build an application that is modular (loosely integrated) and resilient (can survive component failures).
Understanding requirements helps select the relevant cloud design principles.
2
Evaluate the design principles of the AWS Cloud against the requirements
Designing for failure ensures resiliency by planning for component outages. Loose coupling ensures modularity by minimizing dependencies between components.
This step directly maps the business objectives to AWS Cloud architectural best practices.

Anahtar Kavram

AWS Cloud Design Principles (Loose Coupling and Design for Failure)
Soru 468Soru →

An online travel agency wants to improve its security posture on AWS. The company needs to implement a solution that continuously monitors its AWS accounts for malicious activity or unauthorized access, and it also needs to automate security assessments of its Amazon EC2 instances to identify software vulnerabilities. Which two AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty; Amazon Inspector

Cevap

Amazon GuardDuty and Amazon Inspector are the correct services because Amazon GuardDuty provides intelligent threat detection through continuous log analysis, while Amazon Inspector automates vulnerability scanning for host systems and software dependencies.
Amazon GuardDuty and Amazon Inspector are correct. Amazon GuardDuty continuously monitors AWS accounts and workloads for threats and malicious activity using machine learning. Amazon Inspector automatically assesses Amazon EC2 instances for software vulnerabilities and unintended network exposure.

Adım Adım Çözüm

1
Identify the requirement for continuous threat detection and unauthorized behavior monitoring.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to analyze logs and detect malicious activity.
GuardDuty is the primary AWS service for active threat detection across accounts.
2
Identify the requirement for automated security assessments and software vulnerability scanning of Amazon EC2 instances.
Amazon Inspector is selected as it scans workloads (such as EC2 instances) for software packages vulnerabilities and network reachability issues.
Inspector is the primary AWS service for host-level vulnerability scanning.

Anahtar Kavram

AWS Threat Detection and Vulnerability Management Services
Soru 469Soru →

A genomic research institute stores patient DNA sequencing data in Amazon S3 and runs analysis workloads on Amazon EC2. The institute's compliance guidelines state that:
1. The cryptographic keys used for encrypting the data at rest must be managed on dedicated, single-tenant hardware security modules (HSMs) where the customer has sole control over cryptographic web users and key policies.
2. All data in transit between the EC2 instances and the S3 buckets must be encrypted using Transport Layer Security (TLS).

Which of the following implementation details are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement.; The customer is responsible for configuring bucket policies that enforce HTTPS (TLS) connections to secure data in transit to Amazon S3.

Cevap

The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement, and the customer is responsible for configuring S3 bucket policies that enforce HTTPS (TLS) connections to secure data in transit.
The correct implementation requires AWS CloudHSM because it is a dedicated, single-tenant HSM service that gives the customer exclusive cryptographic control over keys and users. Additionally, under the Shared Responsibility Model, configuring bucket policies to enforce TLS for data in transit is a customer-side responsibility.

Adım Adım Çözüm

1
Analyze the at-rest encryption requirements for single-tenant, dedicated HSM hardware.
Determine that AWS Key Management Service (AWS KMS) is a shared, multi-tenant service and does not meet this requirement, whereas AWS CloudHSM provides dedicated single-tenant HSM instances.
This isolates the correct key management service required for compliance.
2
Analyze the in-transit encryption requirement under the Shared Responsibility Model.
Recognize that while AWS provides the network infrastructure and endpoints, the customer must configure their applications and S3 bucket policies to require HTTPS/TLS.
This establishes correct ownership of configurations for data in transit.

Anahtar Kavram

Understanding the difference between multi-tenant AWS KMS and single-tenant AWS CloudHSM, and mapping the customer's responsibility for configuring encryption in transit under the AWS Shared Responsibility Model.
Soru 470Soru →

A security analyst needs to determine which IAM user made a specific API call to delete an Amazon S3 bucket last week. Which AWS service should the analyst use to retrieve this API history?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is the AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user actions, allowing security teams to pinpoint who made a call, when it occurred, and from which IP address.

Adım Adım Çözüm

1
Identify the core requirement of the scenario.
The requirement is to trace user identity and API actions (specifically the deletion of an S3 bucket).
This is an auditing and compliance task that requires access to API transaction logs.
2
Evaluate the capabilities of the primary logging and monitoring services in AWS.
AWS CloudTrail is the dedicated service that records API activity, whereas Amazon CloudWatch monitors metrics/operational logs, Amazon GuardDuty performs threat analysis, and OS-level logging is a customer responsibility.
Matching the requirement with the correct service leads to AWS CloudTrail as the correct tool.

Anahtar Kavram

API Auditing and User Activity Tracking
Tahmini Süre:45s
Soru 471Soru →

A financial technology company must comply with a strict regulatory standard requiring that cryptographic keys used to encrypt transactional data at rest be stored in dedicated, single-tenant hardware security modules (HSMs) where the customer retains exclusive administrative control over the HSM partitions. Which of the following options represents the correct service selection and distribution of responsibility under the AWS Shared Responsibility Model?

Cevabı ve açıklamayı göster

Cevap: AWS CloudHSM; the customer is responsible for managing the HSM users, keys, and cryptographic partitions, while AWS manages the physical hardware maintenance and network availability of the HSM appliance.

Cevap

AWS CloudHSM is the correct service selection because it provides dedicated, single-tenant HSMs with customer administrative control over the partition. Under this model, the customer is responsible for managing HSM users, keys, and cryptographic configurations, while AWS handles the physical hardware maintenance, network provisioning, and appliance availability.
The correct option correctly identifies AWS CloudHSM as the service that provides dedicated, single-tenant HSM appliances under the customer's exclusive control. It also correctly defines the shared responsibility boundaries where the customer manages the logical aspects (HSM users, keys, partitions) and AWS manages the physical and infrastructure aspects (hardware maintenance and network availability of the appliance).

Adım Adım Çözüm

1
Analyze the compliance requirement for encryption key storage
The requirement specifies dedicated, single-tenant hardware security modules (HSMs) with exclusive customer control over the cryptographic partitions.
To choose between AWS Key Management Service (KMS) and AWS CloudHSM.
2
Evaluate AWS KMS against the requirement
AWS KMS is a managed, multi-tenant service. Even with customer managed keys, the underlying HSMs are shared across multiple tenants. Thus, KMS does not meet the dedicated, single-tenant requirement.
To eliminate KMS-based options.
3
Evaluate AWS CloudHSM against the requirement
AWS CloudHSM provides dedicated, single-tenant HSM instances within the customer's VPC, meeting the compliance requirement.
To confirm AWS CloudHSM as the correct service selection.
4
Determine the distribution of responsibility for AWS CloudHSM
AWS manages physical security, hardware maintenance, network connectivity, and the appliance OS/firmware. The customer manages HSM users, key generation, and partition administration.
To select the correct option that accurately represents the Shared Responsibility Model for AWS CloudHSM.

Anahtar Kavram

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for cryptographic key storage
Soru 472Soru →

A regional food delivery platform wants to focus its engineering resources on developing its proprietary dispatch algorithm rather than managing physical server racks, power supplies, and cooling systems. Additionally, the platform experiences massive, brief spikes in order volume during lunch and dinner hours, and wants to dynamically scale its infrastructure to avoid paying for idle resources during off-peak times. Which two of the following AWS Cloud benefits directly align with this company's goals?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Stop spending money running and maintaining data centers; Stop guessing capacity

Cevap

The correct options are stopping the expenditure of money on running and maintaining data centers, and stopping the guessing of capacity.
The correct options are stopping the expenditure of money on running and maintaining data centers, and stopping the guessing of capacity. The platform's desire to focus on its dispatch algorithm instead of managing physical racks, power, and cooling matches the benefit of letting AWS handle data center maintenance. Its need to scale dynamically during meal-time spikes without paying for idle resources matches the benefit of not having to guess capacity limits.

Adım Adım Çözüm

1
Analyze the company's requirement to focus on development instead of physical hardware management.
This maps directly to the AWS benefit of stopping the expenditure of money on running and maintaining data centers, as AWS takes care of the physical infrastructure.
To identify which cloud benefit eliminates the need for managing physical hardware assets.
2
Analyze the company's requirement to handle brief spikes in order volume without paying for idle resources.
This maps directly to the AWS benefit of stopping the guessing of capacity, since resources can scale elastically according to real-time demand.
To identify which cloud benefit prevents under-provisioning or over-provisioning during peak traffic intervals.

Anahtar Kavram

Identifying the six core benefits of the AWS Cloud based on specific business scenarios.
Soru 473Soru →

A renewable energy company operates a fleet of Amazon EC2 instances to monitor wind turbine telemetry and stores its deployment packages in Amazon Elastic Container Registry (Amazon ECR). The company needs to implement a solution that continuously scans its container images and virtual machines for software vulnerabilities, while also monitoring its AWS accounts for potential unauthorized behavior and DNS data exfiltration attempts.

Which of the following AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty
The correct services are Amazon Inspector and Amazon GuardDuty. Amazon Inspector is designed for vulnerability management, scanning EC2 instances and container images for software vulnerabilities. Amazon GuardDuty is an intelligent threat detection service that monitors logs to identify malicious activity such as DNS data exfiltration.

Adım Adım Çözüm

1
Analyze the requirement for scanning EC2 virtual machines and ECR container images for software vulnerabilities.
Identify Amazon Inspector as the service that automates software vulnerability management for these resources.
Amazon Inspector specifically performs package and software vulnerability scanning on host instances and registry containers.
2
Analyze the requirement for continuous threat detection and monitoring for unauthorized behavior and DNS exfiltration.
Identify Amazon GuardDuty as the service providing intelligent threat detection.
Amazon GuardDuty analyzes VPC Flow Logs, DNS logs, and other sources to detect malicious operations and exfiltration attempts.
3
Evaluate the remaining options to ensure they do not meet the primary goals.
Eliminate Amazon Macie, AWS CloudTrail, and Amazon CloudWatch as they do not scan hosts for software vulnerabilities or perform active threat detection.
These services focus on sensitive data discovery in S3, API call logging, and performance monitoring respectively.

Anahtar Kavram

Differentiating vulnerability management (Amazon Inspector) from threat detection (Amazon GuardDuty) and other AWS security and logging services.
Soru 474Soru →

An organization needs to grant a new database administrator the necessary permissions to manage Amazon RDS resources on a daily basis. Which of the following actions aligns with the AWS-recommended best practice for securing this access?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.

Cevap

Create an individual IAM user with the minimum required permissions to manage Amazon RDS resources.
The correct action is to create an individual IAM user with the minimum required permissions. This aligns with the principle of least privilege by ensuring the database administrator only has access to Amazon RDS, and ensures accountability by using a unique identity rather than sharing credentials.

Adım Adım Çözüm

1
Identify the entity requiring access.
A human database administrator requires daily access to the AWS Management Console.
Understanding the type of identity helps determine the appropriate access mechanism.
2
Apply the principle of least privilege and root account safety best practices.
Create an individual IAM user and assign only the permissions needed to manage RDS, while avoiding the use or sharing of the root account.
Ensures administrative accountability and limits access to only the necessary services.

Anahtar Kavram

AWS IAM Best Practices for User Access Control
Tahmini Süre:45s
Soru 475Soru →

A telehealth startup is launching a patient consultation portal. Instead of purchasing physical servers and securing dedicated data center space upfront, the company decides to host the application on AWS and pay only for the virtual resources it uses each month. Which of the following benefits of the AWS Cloud is directly demonstrated by this business decision?

Cevabı ve açıklamayı göster

Cevap: Trading fixed expense for variable expense

Cevap

Trading fixed expense for variable expense is the core economic benefit demonstrated because the company avoids upfront infrastructure investment and pays only for what they consume monthly.
Trading fixed expense for variable expense is correct because AWS allows customers to pay only for the computing resources they actually consume, eliminating the need to invest in physical servers and data centers before knowing how they will be used.

Adım Adım Çözüm

1
Analyze the financial requirements of the startup in the scenario.
The startup wants to avoid upfront costs for physical servers and data centers, choosing instead to pay monthly based on resource usage.
Identifying the shift from fixed upfront hardware costs to flexible recurring costs defines the financial transition.
2
Match the transition to the defined benefits of the AWS Cloud.
Paying for resources as they are consumed on-demand aligns with the cloud benefit of trading fixed expense for variable expense.
Connecting the business decision directly to official AWS Cloud benefits guarantees a correct conceptual match.

Anahtar Kavram

Trading fixed expense for variable expense
Tahmini Süre:45s
Soru 476Soru →

A financial services company uses Amazon Simple Storage Service (Amazon S3) to store sensitive customer transaction records. Under the AWS Shared Responsibility Model, which of the following tasks is the customer responsible for performing?

Cevabı ve açıklamayı göster

Cevap: Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records

Cevap

Configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, to restrict access to the stored transaction records
The task of configuring access controls, such as bucket policies and Identity and Access Management (IAM) policies, represents security 'in' the cloud. Because the customer owns the data stored in the S3 bucket, they are solely responsible for determining who can access that data and configuring the permissions accordingly.

Adım Adım Çözüm

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (PaaS/storage service) where AWS manages the underlying infrastructure, operating systems, and physical security.
Understanding the service type determines where the boundary between customer and AWS responsibility lies.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
Security 'of' the cloud includes hardware, virtualization, and physical facilities, which AWS manages. Security 'in' the cloud includes customer data, access management, and resource configuration, which the customer manages.
This distinction allows mapping of operational tasks to the correct owner.
3
Evaluate the choices based on the determined boundaries.
Upgrading host OS, physical security, and obtaining infrastructure compliance certifications belong to AWS. Configuring bucket policies and IAM permissions is a customer configuration task to protect their own data.
Applying the model boundaries helps isolate the correct customer responsibility.

Anahtar Kavram

AWS Shared Responsibility Model for Managed Services (Amazon S3)
Soru 477Soru →

An AWS cloud practitioner is configuring network security within a Virtual Private Cloud (VPC). To ensure proper network isolation, they need to identify the operational differences between Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.; Network Access Control Lists (Network ACLs) are stateless, meaning that return traffic must be explicitly allowed by rules in both directions.

Cevap

Security groups are stateful, meaning return traffic is automatically allowed; and Network Access Control Lists (Network ACLs) are stateless, meaning return traffic must be explicitly allowed in both directions.
The correct options are the statements indicating that Security Groups are stateful and Network Access Control Lists (Network ACLs) are stateless. In AWS, Security Groups automatically allow return traffic for any established connection, while Network ACLs require explicit inbound and outbound rules to permit traffic in both directions.

Adım Adım Çözüm

1
Analyze the stateful behavior of Security Groups.
Confirm that Security Groups automatically track connection state and allow return traffic without needing explicit outbound rules.
This is a fundamental concept of Security Groups operating as an instance-level firewall.
2
Analyze the stateless behavior of Network ACLs.
Confirm that Network ACLs do not track connection state, meaning inbound and outbound rules must be configured separately to allow round-trip communication.
This is a fundamental concept of Network ACLs operating as a subnet-level firewall.
3
Evaluate the remaining options for layer of operation and responsibility mappings.
Identify that Security Groups operate at the instance level (not subnet level), Network ACLs operate at the subnet level (not instance level), and physical security is the responsibility of AWS (not the customer).
This helps rule out incorrect options based on common AWS CCP security misconceptions.

Anahtar Kavram

The operational differences between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Tahmini Süre:45s
Soru 478Soru →

A global logistics firm currently hosts its fleet-management application in an on-premises data center. The application experiences massive, unpredictable traffic spikes during holiday shopping seasons, but remains largely idle during the rest of the year. The company plans to migrate this application to AWS. Which two of the following options describe how the economics of the AWS Cloud will help the company optimize its infrastructure costs?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Shifting from a capital expense (CapEx) model with high upfront hardware costs to a variable operating expense (OpEx) model.; Leveraging cloud elasticity to automatically scale resources down during off-peak times, thereby eliminating expenses for idle capacity.

Cevap

The logistics company optimizes its costs on AWS by shifting from upfront capital expenses to variable operating expenses, and by using elasticity to scale down resources during periods of low activity to avoid paying for idle infrastructure.
Shifting from capital expenses to variable operating expenses allows the company to pay only for the resources they consume rather than making large upfront investments. Additionally, leveraging cloud elasticity allows resources to scale down during low-activity periods, which eliminates costs associated with idle on-premises hardware.

Adım Adım Çözüm

1
Analyze the financial impact of the cloud migration model.
Identify that AWS allows companies to trade capital expenses (upfront hardware investments) for variable operating expenses (paying for what is used).
This matches the AWS Cloud value proposition of shifting from CapEx to OpEx.
2
Evaluate how the company handles variable traffic and peak capacity.
Identify that AWS elasticity allows the application to dynamically scale down when traffic is low, avoiding costs for idle resources.
Elasticity aligns infrastructure supply with real-time demand, minimizing cost waste.

Anahtar Kavram

Cloud economics benefits such as the shift from CapEx to OpEx and the cost optimization enabled by resource elasticity.
Soru 479Soru →

A healthcare provider is designing a patient registration portal on AWS. To prevent patient registrations from failing when the backend database is offline for scheduled maintenance, the architect decides to insert a message queue between the front-end registration portal and the database. Which AWS Cloud design principle is best illustrated by this architectural decision?

Cevabı ve açıklamayı göster

Cevap: Loose coupling

Cevap

Loose coupling
Loose coupling is the design principle demonstrated by placing a buffer, like a message queue, between components. This ensures that the front-end registration portal remains responsive to users even if the backend database is temporarily offline, as the queue stores the messages until the database is ready to process them.

Adım Adım Çözüm

1
Analyze the requirement to keep the front-end intake operational during database downtime.
The front-end must not have a direct, synchronous dependency on the database service.
A synchronous dependency causes the entire system to fail if one component is down.
2
Evaluate the role of the message queue in the architecture.
The queue acts as an asynchronous buffer, allowing the portal to save registrations to the queue and proceed without waiting for a database write.
This isolates the two layers from each other's operational status.
3
Identify the corresponding AWS Cloud design principle.
Designing components to interact with minimal dependencies is known as loose coupling.
Loose coupling ensures fault isolation and independent scalability.

Anahtar Kavram

Loose coupling reduces interdependencies between components, so that a failure or maintenance event in one service does not cascade to others.
Tahmini Süre:1m 0s
Soru 480Soru →

A developer deploys a web application on an Amazon EC2 instance and updates its security group to permit inbound traffic on port 80. Although no outbound rules are modified, the instance can successfully return response traffic to the clients. Which characteristic of security groups explains why this outbound traffic is allowed?

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.

Cevap

Security groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound.
Security groups are stateful, which means that any rule permitting inbound traffic automatically permits the corresponding outbound response traffic, regardless of the outbound rules configured.

Adım Adım Çözüm

1
Analyze the resource and rules configuration.
The application runs on an Amazon EC2 instance with an inbound security group rule allowing port 80 traffic.
This establishes that inbound traffic is authorized.
2
Determine the stateful nature of the security firewall.
Since security groups operate at the instance level and are stateful, allowing inbound traffic automatically permits the corresponding outbound response traffic.
Stateful firewalls track the connection state and allow return traffic without requiring matching outbound rules.

Anahtar Kavram

Security groups are stateful firewalls that control inbound and outbound traffic at the Amazon EC2 instance level, automatically allowing return traffic.
ÖncekiSayfa 24 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin