Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 541Soru →

A retail company wants to track and record all API activity and user actions across its AWS account for compliance auditing. The company needs to know which user initiated an action, the time of the event, and the IP address from which the request was made. Which AWS service should the company use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is the AWS service that enables auditing, security monitoring, and operational troubleshooting by recording API actions and console operations. It captures details such as the identity of the caller, the request time, and the source IP address.

Adım Adım Çözüm

1
Identify the primary requirement of the scenario.
The requirement is to log and audit user actions and API calls (who did what, when, and from where) across the entire AWS account.
This establishes the need for an auditing service rather than performance monitoring or vulnerability assessment.
2
Evaluate the capabilities of the available AWS security services.
AWS CloudTrail records API history and user activity, which directly matches the auditing and compliance need. Amazon CloudWatch is for metrics/logs, Amazon GuardDuty is for threat detection, and Amazon Inspector is for vulnerability scanning.
Choosing the service that specifically handles user event and API auditing ensures the correct alignment of AWS services.

Anahtar Kavram

AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging actions taken by a user, role, or an AWS service.
Soru 542Soru →

A company is hosting a secure web application on Amazon EC2 instances located in a public subnet. To implement a defense-in-depth strategy, the network team uses both Security Groups and Network Access Control Lists (Network ACLs). External clients must be allowed to access the application over HTTPS (port 443), while all other inbound traffic must be blocked. Which two configurations are required to allow this traffic to flow successfully to and from the instances?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0.; Add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.

Cevap

Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0, and add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.
To allow external HTTPS traffic to reach the EC2 instances and return successfully, two levels of evaluation must be satisfied. First, at the instance level, the stateful Security Group must permit inbound traffic on TCP port 443. Because it is stateful, the return traffic is automatically allowed. Second, at the subnet level, the stateless Network ACL must permit both the inbound request on TCP port 443 and the outbound response. Since the client establishes the connection, the response traffic travels back to the client's ephemeral port range (typically 1024–65535), which must be explicitly permitted by an outbound rule in the Network ACL.

Adım Adım Çözüm

1
Identify the security components and their levels of operation.
Security Groups operate at the instance/network interface level, while Network ACLs operate at the subnet level.
Understanding the boundaries is necessary to apply the rules to the correct resource type.
2
Analyze the statefulness of the Security Group for the inbound request.
Since Security Groups are stateful, adding an inbound rule for TCP port 443 from any source (0.0.0.0/0) is sufficient to allow both the request and the automated response traffic.
Stateful firewalls track connections and automatically allow return traffic.
3
Analyze the statelessness of the Network ACL for the response traffic.
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. In addition to allowing inbound TCP 443, an outbound rule must be configured to allow traffic returning to the client's ephemeral ports (1024–65535).
Stateless firewalls do not track connection states, so return traffic must be explicitly allowed.

Anahtar Kavram

The difference between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level).
Tahmini Süre:2m 0s
Soru 543Soru →

A news publishing website experiences unpredictable spikes in website traffic when major stories break, but has very low traffic during normal hours. By hosting their application on AWS, the publisher can dynamically provision compute resources to handle traffic surges and automatically terminate those resources when traffic subsides. Which concept of cloud economics does this scenario directly illustrate?

Cevabı ve açıklamayı göster

Cevap: The cost benefits of elasticity

Cevap

The cost benefits of elasticity
The correct answer is correct because elasticity allows an organization to dynamically adjust resource capacity to match shifting demand. This ensures that they only pay for what they use, minimizing costs during periods of low traffic while maintaining performance during surges.

Adım Adım Çözüm

1
Analyze the organization's resource utilization pattern in the scenario.
The news publisher experiences fluctuating, unpredictable website traffic with high peaks and low valleys.
Understanding the demand pattern helps determine which cloud economic principle applies to resource management.
2
Identify the AWS mechanism that allows resources to dynamically scale up and down to match this demand.
Elasticity allows resources to be added when demand increases and removed when demand decreases, ensuring costs scale directly with usage.
This mechanism aligns resource provisioning with consumption, which minimizes waste and optimizes costs.

Anahtar Kavram

Elasticity and cost optimization in cloud economics
Tahmini Süre:45s
Soru 544Soru →

A company is migrating its retail application to AWS. To ensure reliability, the architecture team designs the application components to communicate using Amazon Simple Queue Service (SQS) so they can run independently. Additionally, they configure the system to automatically scale compute resources up or down in response to changing traffic. Which of the following AWS Cloud design principles are being demonstrated in this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Loose coupling; Elasticity

Cevap

The correct principles are loose coupling and elasticity.
The correct principles are loose coupling, because components are designed to run independently using message queuing, and elasticity, because compute resources dynamically scale in and out based on traffic.

Adım Adım Çözüm

1
Analyze the communication mechanism of the components.
The components communicate via Amazon SQS and run independently, which indicates they are decoupled.
This is a direct application of the loose coupling principle.
2
Analyze how compute resources are scaled.
Compute resources automatically scale up or down based on traffic, matching capacity to demand.
This is a direct application of the elasticity principle.

Anahtar Kavram

AWS Cloud Design Principles: Loose Coupling and Elasticity
Soru 545Soru →

A cloud administrator wants to configure network security for a new application deployment in a Virtual Private Cloud (VPC). Which TWO of the following statements correctly describe the behavior and boundaries of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Groups are stateful (automatically allowing return traffic), whereas Network ACLs are stateless (requiring explicit inbound and outbound rules).; Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.

Cevap

Security Groups are stateful, whereas Network ACLs are stateless; and Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
Security Groups operate at the instance level (specifically elastic network interfaces) and are stateful, automatically allowing return traffic. Network ACLs operate at the subnet level and are stateless, requiring separate inbound and outbound rules to permit return traffic.

Adım Adım Çözüm

1
Analyze the stateful vs. stateless nature of the two security services.
Security Groups are stateful, meaning they track connections and automatically allow returning traffic. Network ACLs are stateless, meaning they process inbound and outbound traffic independently.
This helps identify which rules need to be configured for traffic flow.
2
Determine where Security Groups and Network ACLs are applied in the network hierarchy.
Security Groups are applied to elastic network interfaces (instance level), while Network ACLs are associated with subnets (subnet level).
This defines the boundary of control for each security layer.

Anahtar Kavram

The operational level and connection tracking state of Security Groups and Network ACLs.
Soru 546Soru →

A logistics company is migrating its package tracking application to the AWS Cloud. The development team plans to replace their self-managed database running on a virtual machine with Amazon DynamoDB. Additionally, they will insert an Amazon Simple Queue Service (Amazon SQS) queue between the tracking intake system and the data processing backend. Which of the following are design principles of the AWS Cloud that this architecture implements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Loose coupling; Services, not servers

Cevap

The architecture implements the principles of loose coupling and services, not servers.
The correct principles are loose coupling and services, not servers. Introducing Amazon SQS separates components so they can operate independently (loose coupling). Shifting from self-managed databases on virtual machines to DynamoDB reduces the operational burden of managing server infrastructure (services, not servers).

Adım Adım Çözüm

1
Analyze the architectural changes in the scenario.
The scenario describes introducing Amazon SQS between system components and replacing a self-managed database on a virtual machine with Amazon DynamoDB.
This helps break down the scenario into distinct AWS architectural adjustments.
2
Map the introduction of Amazon SQS to an AWS design principle.
Amazon SQS acts as an asynchronous message queue that separates the ingestion and processing layers, implementing loose coupling.
By decoupling components, a failure or spike in demand in one area does not directly cause a failure in the other.
3
Map the use of Amazon DynamoDB to an AWS design principle.
Amazon DynamoDB is a managed NoSQL database service that eliminates the need to manage database servers, implementing services, not servers.
Using managed services allows the team to focus on application development rather than database infrastructure management.

Anahtar Kavram

Identify design principles of the AWS Cloud, specifically loose coupling and services, not servers.
Tahmini Süre:1m 30s
Soru 547Soru →

A business analyst needs temporary access to run a weekly report on billing data in the AWS Management Console. To follow the principle of least privilege and avoid managing long-term credentials, which approach should the administrator use?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM role with the necessary billing permissions for the analyst to assume temporarily.

Cevap

Configure an IAM role with the necessary billing permissions for the analyst to assume temporarily.
Configuring an IAM role is the correct approach because roles provide temporary security credentials and do not require sharing or managing long-term access keys.

Adım Adım Çözüm

1
Identify the access requirement, which is temporary and should not rely on long-term credentials.
This eliminates options that require creating permanent IAM user credentials or sharing root account credentials.
Minimizing long-term credentials reduces the risk of credential exposure.
2
Select the AWS IAM entity designed to grant temporary permissions.
An IAM role is chosen as it provides temporary credentials that expire automatically.
IAM roles allow users or services to assume specific permissions for a limited duration without needing long-term access keys.

Anahtar Kavram

AWS IAM Roles and Temporary Credentials
Tahmini Süre:45s
Soru 548Soru →

A media streaming company wants to implement network-level monitoring and real-time security alerts for its virtual private cloud (VPC) environment. The company has two requirements:

1. Capture detailed information about the IP traffic going to and from network interfaces in the VPC to audit security group rule effectiveness.
2. Create automated alarms that notify the security operations team if there is a sudden spike in unauthorized connection attempts (such as HTTP 403 errors or failed SSH attempts).

Which combination of AWS features or services should the company configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: VPC Flow Logs; Amazon CloudWatch

Cevap

VPC Flow Logs and Amazon CloudWatch
VPC Flow Logs is designed to capture IP traffic information going to and from network interfaces in a VPC, which allows the company to audit security group rules. Amazon CloudWatch is used to collect metrics, monitor logs, and trigger automated alarms when specific thresholds (such as unauthorized connection spikes) are exceeded.

Adım Adım Çözüm

1
Analyze the first requirement: capturing IP traffic going to and from network interfaces in the VPC.
VPC Flow Logs is identified as the feature that captures detailed IP traffic details for network interfaces.
This is a native VPC feature specifically designed for network flow logging.
2
Analyze the second requirement: creating automated alarms based on metric thresholds and log events.
Amazon CloudWatch is identified as the service for collecting metrics, monitoring logs, and configuring alarms.
CloudWatch provides log monitoring (CloudWatch Logs) and automated alerting (CloudWatch Alarms) for custom operational thresholds.

Anahtar Kavram

Differentiating between network traffic logging (VPC Flow Logs) and resource monitoring/alerting (Amazon CloudWatch) versus API auditing (AWS CloudTrail) and vulnerability scanning (Amazon Inspector).
Soru 549Soru →

A company plans to deploy a containerized microservices application on AWS. The development team wants to focus on running their containers and wishes to avoid provisioning, patching, or managing any underlying virtual servers. Which AWS compute option meets these requirements with the lowest operational overhead?

Cevabı ve açıklamayı göster

Cevap: AWS Fargate

Cevap

AWS Fargate
AWS Fargate is a serverless compute engine for containers. It allows you to run containerized applications without needing to provision, configure, scale, or patch physical or virtual servers, meeting the requirement of lowest operational overhead.

Adım Adım Çözüm

1
Identify the workload format and administrative requirements.
The application is containerized, and the development team wants to avoid managing, patching, or provisioning the underlying virtual servers.
This establishes the constraints of low operational overhead and serverless container execution.
2
Compare AWS compute services designed for containerized workloads.
AWS Fargate provides a serverless model where AWS manages the underlying server infrastructure, whereas EC2 and Lightsail require direct OS management and scaling configuration.
This ensures selection of the compute option that minimizes server administration.

Anahtar Kavram

Serverless container compute engine
Soru 550Soru →

A logistics analytics startup wants to minimize its monthly operational costs while running complex routing simulations. The company's IT manager notices that AWS can offer lower pay-as-you-go pricing for storage and compute services than the startup could ever negotiate with hardware vendors on its own. Which benefit of the AWS Cloud is directly demonstrated by this lower pricing capability?

Cevabı ve açıklamayı göster

Cevap: Benefit from massive economies of scale

Cevap

Benefit from massive economies of scale
The correct option is correct because AWS aggregates usage from hundreds of thousands of customers, enabling it to achieve massive economies of scale and pass those savings on to customers in the form of lower, pay-as-you-go pricing.

Adım Adım Çözüm

1
Analyze the scenario details regarding pricing and negotiations.
The startup benefits from lower pay-as-you-go pricing that they could not negotiate individually due to their size.
Identifying the core mechanism of the pricing benefit is key to mapping it to the correct AWS Cloud benefit.
2
Compare the scenario with the definition of AWS Cloud benefits.
AWS aggregates usage from hundreds of thousands of customers to achieve massive economies of scale, passing the savings to customers in the form of lower pay-as-you-go prices.
This matches the definition of 'Benefit from massive economies of scale'.

Anahtar Kavram

Massive economies of scale allow AWS to lower pay-as-you-go pricing by aggregating customer usage.
Tahmini Süre:1m 0s
Soru 551Soru →

A gaming studio needs to implement a security logging and monitoring strategy for its multiplayer game backend. The studio has two primary requirements: first, it must track and audit all administrative API operations and configuration changes across its AWS account for compliance purposes; second, it must monitor compute instance performance metrics (such as CPU usage) and trigger real-time alerts when threshold limits are exceeded. Which of the following AWS services should the gaming studio use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to record and audit API activity and resource configuration modifications; Amazon CloudWatch to monitor resource performance metrics and configure alarm notifications

Cevap

AWS CloudTrail to audit API activity and Amazon CloudWatch to monitor resource performance metrics and alarms.
AWS CloudTrail records administrative API actions and modifications, which satisfies the audit requirement. Amazon CloudWatch collects and tracks resource metrics like CPU utilization and can trigger alarm alerts when custom thresholds are crossed, satisfying the monitoring requirement.

Adım Adım Çözüm

1
Identify the AWS service responsible for capturing and recording administrative API operations.
AWS CloudTrail is identified as the service that logs AWS API calls and resource modifications for auditing.
Auditing API calls and configuration changes is a native capability of AWS CloudTrail.
2
Identify the AWS service responsible for gathering resource metrics and triggering notifications based on thresholds.
Amazon CloudWatch is identified as the service that monitors performance metrics and manages alarms.
CloudWatch is the standard service for collecting compute metrics and sending real-time alerts.

Anahtar Kavram

AWS CloudTrail is utilized for auditing user actions and administrative API calls, while Amazon CloudWatch is used to monitor performance metrics and configure real-time alerts.
Soru 552Soru →

A financial services company is deploying a database workload using Amazon Relational Database Service (Amazon RDS). Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Cevabı ve açıklamayı göster

Cevap: Configuring database-level user accounts and security group rules to restrict network access to the database instance

Cevap

Configuring database-level user accounts and security group rules to restrict network access to the database instance
The correct answer is configuring database-level user accounts and security group rules. Under the AWS Shared Responsibility Model for managed services like Amazon RDS, AWS manages the operating system, database engine patching, and the physical infrastructure. The customer remains responsible for securing data access, configuring database-level permissions, and setting up network access control via security groups.

Adım Adım Çözüm

1
Analyze the deployment model of the service mentioned in the scenario.
Amazon RDS is a managed database service (Platform as a Service / PaaS model).
Under the Shared Responsibility Model, AWS manages more of the operational stack for managed services compared to Infrastructure as a Service (IaaS) like Amazon EC2.
2
Determine the boundary of responsibility for Amazon RDS.
AWS is responsible for patching the guest operating system, database engine patching, and managing physical hardware. The customer is responsible for data encryption, database access permissions, and network access configuration (security groups).
AWS manages the platform, but the customer retains ownership and control of their data, access settings, and network rules.
3
Evaluate the given options against this boundary.
Configuring database-level user accounts and security group rules is a customer task, while OS patching, hardware replacement, and data center security are AWS tasks.
This identifies the correct task that falls on the customer's side of the boundary.

Anahtar Kavram

AWS Shared Responsibility Model for Managed Services
Soru 553Soru →

A global streaming platform is designing its user authentication service on AWS. The architect deploys the application across three Availability Zones behind an Application Load Balancer, and configures the database with multi-Availability Zone replication. Furthermore, the client application is designed to gracefully degrade by using cached authentication tokens locally if the backend service becomes temporarily unreachable. Which AWS Cloud design principle is primarily demonstrated by this architecture?

Cevabı ve açıklamayı göster

Cevap: Design for failure

Cevap

Design for failure
The architecture demonstrates 'Design for failure' by ensuring that if a single Availability Zone, database instance, or backend service fails, the system automatically redirects traffic, replicates data, and uses client-side caching to maintain availability and user experience.

Adım Adım Çözüm

1
Analyze the architecture components described in the scenario
The scenario includes deploying instances across three Availability Zones, utilizing an Application Load Balancer, configuring database replication, and implementing client-side caching for graceful degradation.
Understanding the components helps identify the architectural goals, which are high availability, redundancy, and resilience against outages.
2
Map the technical goals of these components to AWS Cloud design principles
Deploying across multiple zones and replicating databases ensures that the system handles infrastructure outages automatically, while client caching ensures the application continues working during backend failures. This is a direct implementation of expecting and planning for failures.
This step connects the real-world scenario to the specific core design principle: design for failure.

Anahtar Kavram

Design for failure
Tahmini Süre:1m 30s
Soru 554Soru →

A smart agriculture startup is deploying IoT soil sensors that upload environmental telemetry data to AWS. The startup's compliance team requires a detailed ledger of who accessed or modified the AWS resources hosting this telemetry, while their operations team needs real-time alerts if telemetry ingestion metrics drop below a certain threshold. Which AWS services should the startup implement to meet both the auditing and operational alerting requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to audit the resource access history, and Amazon CloudWatch to monitor metrics and trigger alerts when ingestion drops.

Cevap

AWS CloudTrail to audit the resource access history, and Amazon CloudWatch to monitor metrics and trigger alerts when ingestion drops.
The correct answer properly pairs AWS CloudTrail (the primary audit logging service for recording user access and API activity) with Amazon CloudWatch (the monitoring service used to collect metrics and configure real-time alarms).

Adım Adım Çözüm

1
Identify the AWS service required for compliance auditing and tracking user and API activities.
AWS CloudTrail is chosen because it logs, continuously monitors, and retains account activity related to actions across your AWS infrastructure.
Compliance teams require a chronological audit ledger of API activity and resource access.
2
Identify the AWS service required for monitoring performance telemetry and triggering alarms based on metric thresholds.
Amazon CloudWatch is chosen because it monitors operational metrics, displays dashboards, and configures alarms.
Operations teams need real-time alerts when metric values drop below defined ingestion thresholds.

Anahtar Kavram

Distinguishing between AWS CloudTrail for user activity auditing and Amazon CloudWatch for resource metric monitoring and alerting.
Soru 555Soru →

A healthcare startup is preparing for an external audit to verify compliance with HIPAA and SOC standards for its platform hosted on AWS. Which of the following actions should the startup take to meet these compliance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download official AWS compliance documents, such as SOC reports, using AWS Artifact.; Accept the Business Associate Addendum (BAA) with AWS using AWS Artifact.

Cevap

Downloading official AWS compliance documents (such as SOC reports) using AWS Artifact, and accepting the Business Associate Addendum (BAA) with AWS using AWS Artifact.
The correct options are downloading AWS compliance documents like SOC reports through AWS Artifact, and accepting the Business Associate Addendum (BAA) using AWS Artifact. AWS Artifact serves as the direct portal for accessing compliance documentation and formalizing agreements required for regulatory frameworks like HIPAA.

Adım Adım Çözüm

1
Identify the service used to retrieve compliance reports and accept regulatory agreements.
AWS Artifact is the central portal for downloading SOC reports and accepting the Business Associate Addendum (BAA).
This directly addresses both the SOC audit readiness and the HIPAA agreement requirement.
2
Differentiate customer security tasks from AWS infrastructure security tasks.
Physical host patching and security logs are managed by AWS and documented in Artifact reports, whereas customer-side auditing is logged by CloudTrail but not blocked by it.
This rules out tasks related to physical infrastructure patching and incorrect auditing service capabilities.

Anahtar Kavram

Using AWS Artifact for compliance report retrieval and agreement management under the Shared Responsibility Model.
Soru 556Soru →

An organization wants to configure secure access to its AWS resources. They need to grant an application running on an Amazon EC2 instance access to an Amazon S3 bucket, and they need to configure access for a new team of system administrators. Which of the following AWS Identity and Access Management (IAM) practices should the organization implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucket; Create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attached

Cevap

Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucket, and create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attached.
The correct practices are to associate an IAM role with the EC2 instance, allowing the application to securely obtain temporary credentials to access the S3 bucket, and to create individual IAM users inside an IAM group for the system administrators to manage their administrative access centrally and securely.

Adım Adım Çözüm

1
Analyze the access requirement for the application on the EC2 instance.
The application needs access to an S3 bucket. The secure way to provide access to AWS services from an EC2 instance is by using IAM roles, which provide temporary security credentials.
This avoids hardcoding or storing long-term credentials like access keys on the instance.
2
Analyze the access requirement for the new team of system administrators.
Administrators require credentials to perform daily management tasks. Best practices dictate creating individual IAM users for accountability and placing them in an IAM group with the required administrative policies.
This facilitates easier permission management and ensures individual actions can be audited.
3
Evaluate the distractors based on security and shared responsibility principles.
Using the root account, sharing user credentials, and expecting AWS to manage customer permissions are violations of security best practices and the Shared Responsibility Model.
The root user must not be used for daily tasks, credential sharing ruins auditability, and access management is a customer responsibility.

Anahtar Kavram

AWS IAM Best Practices and Access Control
Soru 557Soru →

A gaming startup is launching a new multiplayer game on AWS. To ensure security compliance and operational stability, the startup needs to accomplish two tasks: first, they must log and audit all administrative API operations and user activity within their AWS account; second, they must monitor system performance metrics (such as CPU utilization of their virtual servers) and receive alerts if performance drops. Which TWO AWS services should the startup implement to meet these requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to log and track API activities and user actions across the AWS account.; Amazon CloudWatch to collect performance metrics, monitor logs, and trigger automated alerts.

Cevap

The startup should use AWS CloudTrail to log and track API activities, and Amazon CloudWatch to collect performance metrics and trigger alerts.
AWS CloudTrail records and tracks user actions and API calls made within the AWS account, which is crucial for compliance and security auditing. Amazon CloudWatch collects and tracks metrics, monitors log files, and sets alarms, which is essential for performance monitoring and operational alerts.

Adım Adım Çözüm

1
Identify the service needed to log and audit administrative API operations and user activity.
AWS CloudTrail is selected because it acts as a flight recorder for AWS accounts, capturing all API activity and changes.
This directly fulfills the first requirement of auditing account activity.
2
Identify the service needed to monitor system performance metrics and trigger alerts.
Amazon CloudWatch is selected because it gathers operational data, logs, and metrics (like CPU usage) and can trigger alarms.
This directly fulfills the second requirement of performance monitoring and alerting.

Anahtar Kavram

Monitoring, logging, and auditing are split between auditing user activity (AWS CloudTrail) and monitoring system/resource performance (Amazon CloudWatch).
Soru 558Soru →

A logistics and supply chain company is planning to migrate its inventory tracking system to the AWS Cloud. The company wants to leverage the core benefits of cloud computing to improve its global operations and cost structure. Which of the following are recognized benefits of the AWS Cloud? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Benefiting from massive economies of scale, which leads to lower pay-as-you-go pricing.; Going global in minutes by easily deploying the application in multiple regions around the world.

Cevap

The correct benefits of the AWS Cloud are benefiting from massive economies of scale and going global in minutes.
The correct options represent two of the six core benefits of AWS Cloud: benefiting from massive economies of scale (which lowers usage costs due to high volume) and going global in minutes (which enables rapid deployment across multiple regions).

Adım Adım Çözüm

1
Identify the six core benefits of AWS Cloud from official documentation.
The six benefits are: trade capital expense for variable expense, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running and maintaining data centers, and go global in minutes.
This establishes the criteria for evaluating the choices.
2
Compare the provided options against the identified six core benefits.
The options describing 'benefiting from massive economies of scale' and 'going global in minutes' match the list. The other options describe the reverse of cloud benefits or misrepresent security responsibilities.
This isolates the correct options and flags the incorrect options.

Anahtar Kavram

Benefits of the AWS Cloud
Tahmini Süre:1m 0s
Soru 559Soru →

Under the AWS shared responsibility model, a company wants to ensure that its data is encrypted at rest. Which two tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring server-side encryption on Amazon S3 buckets; Managing access policies for AWS Key Management Service (AWS KMS) keys

Cevap

Configuring server-side encryption on Amazon S3 buckets and managing access policies for AWS Key Management Service (AWS KMS) keys.
The tasks of configuring server-side encryption on Amazon S3 buckets and managing access policies for AWS KMS keys are correct because they represent configuration and access control decisions within the customer's AWS account. Under the AWS Shared Responsibility Model, the customer is responsible for configuring security options 'in' the cloud.

Adım Adım Çözüm

1
Determine which aspects of data protection are physical or infrastructure-related.
Physical security, disk replacement, and HSM firmware updates are managed by AWS.
AWS is responsible for security 'of' the cloud, which includes physical data centers, host operating systems, virtualization layers, and physical hardware.
2
Determine which aspects of data protection are configuration or access-related.
Enabling encryption on data storage resources and defining key access permissions are customer responsibilities.
Under the shared responsibility model, the customer is responsible for security 'in' the cloud, which includes data classification, resource configuration, and identity and access management.

Anahtar Kavram

Shared Responsibility Model for Data Protection
Soru 560Soru →

Polaris Energy needs to migrate its on-premises legacy forecasting application to AWS within a very tight deadline of two weeks due to an upcoming data center lease expiration. The application's architecture is complex, and the IT team does not have the time or resources to make any code or configuration changes. Which of the following migration strategies should Polaris Energy use to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Rehosting

Cevap

Rehosting
Rehosting (commonly referred to as 'lift-and-shift') is the migration strategy that involves moving applications to the AWS Cloud without modifying their code or configuration. It is the fastest strategy to execute, making it ideal for tight timelines such as an upcoming data center lease expiration.

Adım Adım Çözüm

1
Analyze the business and technical constraints of the migration scenario.
The migration has two main constraints: a tight two-week deadline driven by a lease expiration, and a requirement to make zero code or configuration changes.
Understanding constraints narrows down the options among the 6 Rs migration strategies.
2
Evaluate the 6 Rs migration strategies against these constraints.
Rehosting, also known as lift-and-shift, allows moving applications to AWS without modification, making it the most suitable strategy to meet the tight deadline.
Selecting the strategy that minimizes effort, risk, and time.

Anahtar Kavram

AWS Cloud Migration Strategies (6 Rs)
ÖncekiSayfa 28 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin