Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 581Soru →

A smart agriculture startup builds an IoT telemetry ingestion pipeline. The company utilizes Amazon API Gateway and AWS Lambda to process incoming data from sensors, allowing them to run code without managing virtual machines. Additionally, the development team uses scripts to dynamically launch duplicate testing environments that are destroyed immediately after validation. Which two AWS Cloud design principles are directly demonstrated by this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Services, not servers; Disposable resources

Cevap

The correct principles are Services, not servers and Disposable resources.
The startup uses managed serverless solutions (Amazon API Gateway and AWS Lambda) to offload operational management, demonstrating the principle of 'Services, not servers'. Additionally, they treat their testing environments as temporary, automated setups that are terminated when no longer needed, illustrating the principle of 'Disposable resources'.

Adım Adım Çözüm

1
Analyze the usage of Amazon API Gateway and AWS Lambda.
These are fully managed services that run code without requiring the user to provision or manage servers, which maps to the 'Services, not servers' design principle.
Identifying how serverless components reduce infrastructure overhead is the first key aspect of the scenario.
2
Analyze the process of spinning up and destroying temporary environments.
This indicates that environments are treated as temporary assets created and destroyed dynamically, which maps to the 'Disposable resources' design principle.
Identifying how the lifecycle of testing environments is managed aligns with treating infrastructure as disposable.
3
Evaluate the remaining options against the scenario and AWS design principles.
Tight coupling, vertical scaling for elasticity, and over-provisioning are either architectural anti-patterns or incorrect definitions of cloud benefits.
Eliminating distractors ensures that the correct two options are selected.

Anahtar Kavram

AWS Cloud design principles focus on architectural best practices such as adopting managed services (services, not servers) and using automation to deploy temporary environments (disposable resources).
Soru 582Soru →

A financial technology (fintech) startup needs to quickly deploy new experimental payment features to stay ahead of competitors. Historically, procuring and configuring physical servers in their on-premises environment for developer testing took several weeks. By migrating to AWS, the developers can now provision virtual servers and databases within minutes, allowing them to iterate and run tests immediately. Which AWS Cloud benefit is directly demonstrated by this change in operational speed?

Cevabı ve açıklamayı göster

Cevap: Increase speed and agility

Cevap

Increase speed and agility
The correct answer is the option stating 'Increase speed and agility'. In a cloud computing environment, new IT resources are only a click away, which means that you reduce the time it takes to make those resources available to your developers from weeks to just minutes. This dramatically increases speed and agility for the organization, because the cost and time it takes to experiment and develop is significantly lower.

Adım Adım Çözüm

1
Analyze the scenario details, focusing on the change from taking weeks to procure and configure servers to provisioning virtual servers and databases within minutes.
The organization reduced provisioning time from weeks to minutes to support developer experimentation.
Understanding the specific operational improvement helps map it to the correct AWS Cloud benefit.
2
Compare the reduction of resource provisioning times from weeks to minutes with the definitions of the six AWS Cloud benefits.
Reducing time-to-market and enabling rapid experimentation matches the benefit of increasing speed and agility.
Speed and agility specifically address how quickly resources can be made available to developers to foster innovation and reduce the cost of experimentation.

Anahtar Kavram

The core concept being tested is the six benefits of the AWS Cloud, specifically focusing on how cloud computing reduces provisioning latency from weeks to minutes, which increases speed and agility for developers and organizations.
Soru 583Soru →

A small retail business is deploying a new online storefront using Amazon Lightsail virtual private servers. Under the AWS Shared Responsibility Model, which two security-related tasks are the responsibility of the customer? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Upgrading and patching the guest operating system installed on the instances; Configuring the instance-level firewall rules to control inbound and outbound network traffic

Cevap

The customer is responsible for upgrading and patching the guest operating system installed on the instances, as well as configuring the instance-level firewall rules to control inbound and outbound network traffic.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For virtual private servers like Amazon Lightsail, the customer has control over the guest operating system and the local network configurations. Therefore, patching the guest operating system and configuring the firewall rules to control traffic are both customer responsibilities.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario
Amazon Lightsail is an Infrastructure as a Service (IaaS) resource.
Different service types (IaaS vs. PaaS vs. SaaS/Managed) shift the shared responsibility boundary between AWS and the customer.
2
Determine the customer's responsibility boundary for IaaS resources
For IaaS resources, the customer is responsible for the guest operating system, application software, data configuration, and local network settings (firewalls).
Since the customer maintains administrative access to the OS and network settings, security 'in' the cloud at these layers is their responsibility.
3
Determine the AWS responsibility boundary
AWS is responsible for physical hardware, data centers, virtualization software (hypervisor), and core infrastructure services.
AWS manages the global infrastructure and physical assets that host customer services (security 'of' the cloud).

Anahtar Kavram

The division of security duties between AWS (security of the cloud) and the customer (security in the cloud) under the AWS Shared Responsibility Model, specifically for IaaS/VPS platforms.
Soru 584Soru →

A business is deploying its first application in a Virtual Private Cloud (VPC) and needs to configure basic network security controls. The administrator wants to use both Security Groups and Network Access Control Lists (Network ACLs) to secure their resources.

Which TWO statements correctly describe the characteristics of these security resources?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, which means return traffic is automatically allowed.; Network Access Control Lists (Network ACLs) are stateless, which means return traffic must be explicitly allowed by an outbound rule.

Cevap

The correct statements are that Security groups are stateful (automatically allowing return traffic) and Network Access Control Lists (Network ACLs) are stateless (requiring explicit outbound rules for return traffic).
Security groups are stateful, meaning they automatically track connections and allow response traffic to flow back without needing a corresponding outbound rule. Conversely, Network Access Control Lists (Network ACLs) are stateless, meaning they do not track connection states, so any return traffic must be explicitly allowed by an outbound rule.

Adım Adım Çözüm

1
Analyze the traffic tracking behavior of Security Groups.
Security Groups are stateful. Once a connection is established inbound, outbound return traffic is automatically permitted.
To determine which network security controls automatically allow return traffic.
2
Analyze the traffic tracking behavior of Network ACLs.
Network ACLs are stateless. Rules must be defined for both inbound and outbound traffic to allow return communication.
To verify how Network ACLs evaluate traffic in both directions.
3
Analyze the boundaries where Security Groups and Network ACLs operate.
Security Groups operate at the instance level (specifically the Elastic Network Interface), while Network ACLs operate at the subnet level.
To reject options that confuse the boundary levels of these security controls.

Anahtar Kavram

Stateful vs. Stateless network firewalls and their operating levels (instance vs. subnet) in AWS VPC.
Tahmini Süre:1m 0s
Soru 585Soru →

Match each AWS compute service with the description that best represents its primary use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Amazon EC2
AWS Lambda
Amazon Lightsail

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Amazon EC2 matches the description of resizable virtual servers with operating system control; AWS Lambda matches the serverless compute service description; Amazon Lightsail matches the preconfigured virtual private server description.
Amazon EC2 is matched with resizable virtual servers because it provides scalable Infrastructure as a Service. AWS Lambda is matched with serverless compute because it is event-driven and eliminates server management. Amazon Lightsail is matched with virtual private servers because it provides all-in-one simple VPS hosting.

Adım Adım Çözüm

1
Analyze Amazon EC2 characteristics.
Amazon EC2 allows users to boot virtual machine instances with complete control over the guest OS, mapping it to the description of resizable virtual servers.
EC2 stands for Elastic Compute Cloud, which is AWS's core Infrastructure as a Service (IaaS) virtual machine offering.
2
Analyze AWS Lambda characteristics.
AWS Lambda runs functions in response to events (like S3 uploads or HTTP requests) without requiring any server provisioning or management, matching it to the serverless compute description.
Lambda is the foundation of serverless architectures on AWS.
3
Analyze Amazon Lightsail characteristics.
Amazon Lightsail simplifies the deployment of small web applications by bundling compute, storage, and networking into a single virtual private server product, matching it to the VPS description.
Lightsail is tailored for developers needing a quick, simple VPS without the complexity of full EC2 configurations.

Anahtar Kavram

Identifying AWS compute services by their core management model and typical workload patterns.
Tahmini Süre:1m 0s
Soru 586Soru →

NovaHealth Solutions is migrating its legacy application portfolio to the AWS Cloud. During the assessment phase, the IT team identifies a highly customized mainframe billing application that has tight dependencies on local mainframe hardware. Because a modern replacement is not available and rewriting the application is not currently feasible, the company decides to keep this workload running on-premises in its current state. Which cloud migration strategy is NovaHealth Solutions using for this specific application?

Cevabı ve açıklamayı göster

Cevap: Retaining

Cevap

Retaining
The correct answer is Retaining. The Retaining strategy involves keeping workloads in their source environment (on-premises) when there is no clear business case or technical feasibility to migrate them immediately.

Adım Adım Çözüm

1
Analyze the migration scenario and identify the decision made for the mainframe billing application.
The application has tight hardware dependencies, cannot be easily rewritten, and the company decides to keep it on-premises in its current state.
Identifying the target state of the workload helps map it to the correct migration strategy.
2
Match the decision to keep the application on-premises to one of the 6 Rs migration strategies.
The decision to keep the workload in its current environment without moving it to the cloud is defined as the Retaining (re-visit) strategy.
This aligns with the AWS definition of Retaining, where workloads are kept on-premises for now.

Anahtar Kavram

Retaining migration strategy
Soru 587Soru →

A digital healthcare company hosts a patient portal on AWS and must meet strict regulatory compliance requirements for security monitoring and auditing. The compliance and operations teams define three specific requirements:
1. Every API call made by IAM users or AWS services must be recorded, stored securely, and cryptographically validated to ensure the integrity of the audit logs.
2. System administrators must receive real-time alerts if application-level logs on Amazon EC2 instances show a sudden spike in specific error codes.
3. The environment must be continuously analyzed for malicious activity, such as instances scanning for open ports or communicating with known malicious IP addresses.

Which of the following configurations should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS CloudTrail with log file integrity validation enabled to record and verify account-wide API calls, and deploy the Amazon CloudWatch agent on EC2 instances to stream application logs to CloudWatch Logs for metric filtering and alerting.; Enable Amazon GuardDuty to continuously analyze VPC Flow Logs, CloudTrail management events, and DNS logs in order to detect and alert on threat patterns and unauthorized communications.

Cevap

The correct configurations are the ones utilizing AWS CloudTrail for API auditing and log validation, CloudWatch Logs for EC2 log streaming and alerting, and Amazon GuardDuty for threat detection.
The correct configuration combines AWS CloudTrail and Amazon CloudWatch Logs to address API auditing and application error alerting respectively, and uses Amazon GuardDuty for active threat monitoring. AWS CloudTrail provides log file integrity validation to ensure compliance logs remain unaltered, and the CloudWatch agent is used to export application logs to CloudWatch Logs for alerting. Amazon GuardDuty consumes sources like VPC Flow Logs, DNS logs, and CloudTrail events to identify threats like malicious IP communication and port scanning.

Adım Adım Çözüm

1
Identify the service responsible for recording and validating account-wide API calls.
AWS CloudTrail is identified as the service that records API activity and offers log file integrity validation.
This satisfies the first requirement of cryptographically validating all AWS API calls for audit trail integrity.
2
Determine the mechanism for collecting application logs from EC2 instances and triggering real-time alerts on error patterns.
Deploying the CloudWatch agent on EC2 instances allows log streaming to CloudWatch Logs, where metric filters and CloudWatch Alarms handle threshold alerts.
This satisfies the second requirement of alerting system administrators on EC2 application log errors.
3
Determine the service designed to continuously detect threats and malicious behaviors like port scanning or communicating with bad IPs.
Amazon GuardDuty is selected as it continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events for threat detection.
This satisfies the third requirement of intelligent threat analysis and anomalous behavior detection.
4
Synthesize the findings to select the two options that correctly configure these services.
One option correctly pairs CloudTrail and CloudWatch Logs, while another correctly selects Amazon GuardDuty.
This matches the target requirements exactly while avoiding the services that are either misconfigured or mapped to wrong responsibilities.

Anahtar Kavram

AWS security logging, monitoring, and auditing services (CloudTrail, CloudWatch, GuardDuty) and their operational differences.
Soru 588Soru →

A cloud practitioner is reviewing different workload requirements to select the most appropriate AWS compute services. Match each application scenario to the AWS compute service that best meets its requirements.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A simple virtual private server (VPS) package with a pre-configured LAMP stack to host a personal blog.
A short-running background job triggered by file uploads to an Amazon S3 bucket that must scale automatically to zero.
A legacy commercial database application requiring custom OS kernel modifications and administrative root access.
A containerized application that needs to be deployed without provisioning, configuring, or scaling physical virtual machines.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Amazon Lightsail matches simple VPS hosting; AWS Lambda matches event-driven S3-triggered tasks; Amazon EC2 matches applications needing OS root access; AWS Fargate matches running containers without managing virtual machines.
Each requirement is mapped to its optimal AWS compute service based on the degree of management control and architecture: Amazon Lightsail for simple VPS, AWS Lambda for event-driven functions, Amazon EC2 for full OS access, and AWS Fargate for serverless container deployment.

Adım Adım Çözüm

1
Analyze the virtual private server requirement.
Amazon Lightsail is selected.
Lightsail provides all-in-one VPS bundles with pre-configured software.
2
Analyze the S3-triggered, scale-to-zero function requirement.
AWS Lambda is selected.
Lambda automatically scales and charges only for execution time.
3
Analyze the OS-level customization and root access requirement.
Amazon EC2 is selected.
EC2 provides full virtual machine control, including administrative access.
4
Analyze the container hosting without server management requirement.
AWS Fargate is selected.
Fargate removes the operational overhead of provisioning EC2 instances for containers.

Anahtar Kavram

AWS Compute Service Selection
Tahmini Süre:1m 30s
Soru 589Soru →

A local dental clinic is migrating its patient scheduling system from an on-premises server room to the AWS Cloud. Instead of purchasing physical servers upfront, the clinic will now pay a variable monthly fee based on the resources they consume. Which of the following options describes this shift in financial expenditure?

Cevabı ve açıklamayı göster

Cevap: A shift from Capital Expenses (CapEx) to Operating Expenses (OpEx)

Cevap

A shift from Capital Expenses (CapEx) to Operating Expenses (OpEx)
The correct answer describes a shift from Capital Expenses (CapEx) to Operating Expenses (OpEx). On-premises data centers require significant capital investment upfront to purchase physical servers and networking gear (CapEx). Moving to a cloud model like AWS allows organizations to pay only for what they use on a variable, recurring basis, which is classified as an operational expense (OpEx).

Adım Adım Çözüm

1
Identify the financial model of the current state.
The clinic is purchasing physical servers upfront, which represents a capital expenditure (CapEx).
CapEx refers to money spent by a business to acquire, maintain, and upgrade physical assets such as property, buildings, or equipment.
2
Identify the financial model of the target cloud state.
The clinic will pay a variable monthly fee based on consumed resources, which represents an operating expenditure (OpEx).
OpEx represents the day-to-day expenses that a company incurs to keep its business running, such as utility bills or pay-as-you-go cloud services.
3
Determine the direction of the transition.
The transition moves from upfront capital costs to variable operating costs.
This is a shift from CapEx to OpEx.

Anahtar Kavram

Cloud economics: CapEx vs. OpEx shift
Soru 590Soru →

A logistics company wants to track activity across its AWS infrastructure. The operations team needs to:
1. Audit all user actions and API calls to identify who deleted an Amazon S3 bucket.
2. Monitor system performance metrics, such as CPU utilization of Amazon EC2 instances, and trigger alarms if they exceed normal thresholds.

Which AWS services should the company use to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail; Amazon CloudWatch

Cevap

AWS CloudTrail and Amazon CloudWatch
The correct services are AWS CloudTrail and Amazon CloudWatch. AWS CloudTrail tracks and logs user activity and API transactions across AWS infrastructure, which satisfies the requirement to audit S3 bucket deletions. Amazon CloudWatch collects and tracks metrics, monitors log files, and sets alarms, which satisfies the requirement to monitor EC2 CPU utilization and trigger alerts.

Adım Adım Çözüm

1
Identify the service needed to audit user actions and API activity, such as identifying who deleted an Amazon S3 bucket.
AWS CloudTrail records a history of API calls and user actions, fulfilling the auditing requirement.
CloudTrail is the primary service for tracking account activity and API usage.
2
Identify the service needed to monitor operational performance metrics (like CPU usage) and configure alarms.
Amazon CloudWatch collects performance metrics and allows the configuration of alarms when thresholds are crossed, fulfilling the monitoring requirement.
CloudWatch is the core service for application and resource monitoring on AWS.

Anahtar Kavram

Distinguishing between AWS CloudTrail for API/user auditing and Amazon CloudWatch for performance monitoring and alerting.
Tahmini Süre:1m 0s
Soru 591Soru →

A financial services company needs to process daily transaction log files uploaded sporadically to Amazon S3. Each file requires intensive computational analysis that takes approximately 18 minutes to complete. To optimize costs and operations, the company wants a serverless compute option that charges them only for the exact resource duration consumed during processing and eliminates the overhead of managing operating systems or scaling virtual servers. Which AWS compute service is the most appropriate for this workload?

Cevabı ve açıklamayı göster

Cevap: AWS Fargate

Cevap

AWS Fargate is the most appropriate compute service for this workload because it provides serverless container execution with no 15-minute limit, removing the operational overhead of managing servers while charging only for the resources consumed during the 18-minute run.
AWS Fargate is the correct choice because it is a serverless compute engine that allows containerized applications to run without provisioning or managing virtual machines. It has no 15-minute execution limit, which allows it to easily accommodate the 18-minute log processing task while maintaining a serverless, pay-per-use consumption model.

Adım Adım Çözüm

1
Analyze the workload characteristics and constraints.
The workload is triggered sporadically, runs for 18 minutes, and requires a serverless model (no management of virtual machines) with pay-per-use pricing.
This helps narrow down the compute options by ruling out non-serverless services and services with strict runtime limitations.
2
Evaluate AWS Lambda against the 18-minute runtime requirement.
AWS Lambda is ruled out because it has a maximum execution time limit of 15 minutes, meaning the 18-minute processing job would time out.
Understanding the limits of serverless services is essential for proper compute selection.
3
Evaluate Amazon EC2 and Amazon Lightsail against the operational overhead and pricing requirements.
Both EC2 and Lightsail are ruled out because they require managing virtual machine configurations, operating systems, and do not natively offer a pay-per-execution serverless model.
This eliminates options that introduce unnecessary operational management overhead.
4
Verify AWS Fargate capabilities.
AWS Fargate runs containers serverlessly, does not have a 15-minute runtime timeout, manages the underlying infrastructure automatically, and charges only for the resources used during the active task duration.
This confirms AWS Fargate meets all the requirements of the scenario.

Anahtar Kavram

Selecting the appropriate AWS compute service based on workload duration, management overhead, and serverless requirements.
Soru 592Soru →

A retail company wants to secure its AWS infrastructure by auditing all API activities and setting up real-time monitoring for unauthorized access attempts. The security team needs to track who made API calls to modify security group rules and also detect if any Amazon EC2 instances are communicating with known malicious IP addresses.

Which AWS services should the company implement to meet these security requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to track and audit all API operations and console actions.; Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.

Cevap

AWS CloudTrail to track and audit all API operations and console actions, and Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.
The correct options are the statements describing AWS CloudTrail and Amazon GuardDuty. AWS CloudTrail is the primary service for auditing, security monitoring, and operational troubleshooting of AWS API activity, making it the correct choice for tracking who modified security groups. Amazon GuardDuty uses intelligent threat detection to continuously monitor for malicious behavior, including identifying when EC2 instances communicate with known malicious IP addresses.

Adım Adım Çözüm

1
Identify the requirement for tracking and auditing API actions (who modified security group rules).
AWS CloudTrail is identified as the service designed to record API calls and user activity across the AWS account.
This directly addresses the requirement of keeping an audit history of configuration changes.
2
Identify the requirement for detecting instances communicating with malicious IP addresses.
Amazon GuardDuty is selected as the intelligent threat detection service that analyzes network logs to detect known malicious communications.
This directly addresses the requirement of network threat detection and finding active compromises.

Anahtar Kavram

AWS security logging and monitoring services have distinct roles: AWS CloudTrail logs API activity for compliance and auditing, while Amazon GuardDuty acts as an intelligent threat detection service using machine learning and threat intelligence feeds.
Soru 593Soru →

A telehealth startup wants to expand its online patient consultation platform from a single country to a global audience without leasing physical facilities or purchasing server hardware. The startup also needs the ability to deploy its application to patients worldwide with minimal delay. Which of the following benefits of the AWS Cloud directly support this strategy? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Go global in minutes; Stop spending money running and maintaining data centers

Cevap

The correct benefits are 'Go global in minutes' and 'Stop spending money running and maintaining data centers'.
The scenario requires deploying applications worldwide with minimal latency, which is achieved by going global in minutes using AWS infrastructure. It also requires expanding without leasing facilities or purchasing physical hardware, which directly aligns with stopping spending money running and maintaining data centers.

Adım Adım Çözüm

1
Analyze the business scenario described in the stem.
The company needs to expand globally to multiple countries with minimal delay and without purchasing server hardware or leasing facilities.
This establishes the requirements of global expansion and eliminating physical facility management.
2
Evaluate the AWS Cloud benefits that match these requirements.
Deploying globally with low latency maps to 'Go global in minutes', and eliminating physical server and facility management maps to 'Stop spending money running and maintaining data centers'.
This identifies the correct cloud benefits from the list of options.

Anahtar Kavram

Benefits of the AWS Cloud
Soru 594Soru →

A smart home device manufacturer hosts its telemetry processing application on a fleet of Amazon EC2 instances. The security team wants to continuously monitor the AWS environment for potential security threats, such as EC2 instances communicating with known malicious IP addresses or unexpected API calls from unauthorized locations. Which AWS service should the manufacturer use to detect these active threats?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty
The correct service is Amazon GuardDuty. It is an intelligent threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as an EC2 instance communicating with a command-and-control server or anomalous API calls from unauthorized locations.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario requires a service that continuously monitors the AWS environment for active threats, specifically targeting malicious IP communication and unauthorized API calls.
Identifying the target behavior (active threat detection) helps narrow down the service choices.
2
Compare the capabilities of the security services
Amazon GuardDuty provides threat detection by analyzing logs (such as VPC Flow Logs and CloudTrail logs), whereas Amazon Inspector focuses on scanning for software vulnerabilities. AWS CloudTrail and Amazon CloudWatch provide logging and monitoring but lack native intelligent threat intelligence analysis.
This distinguishes between vulnerability scanning (static assessment) and threat detection (runtime analysis).

Anahtar Kavram

Amazon GuardDuty provides intelligent, continuous threat detection and monitoring for AWS workloads, while Amazon Inspector focuses on vulnerability assessment and patch scanning.
Tahmini Süre:1m 0s
Soru 595Soru →

A company is configuring access for two new entities: a monitoring application running on an on-premises server that requires read-only access to Amazon CloudWatch, and a new human administrator who needs full access to manage Amazon EC2 resources. Which IAM identities should the company create to provide secure access for these entities? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An IAM role to provide temporary credentials for the monitoring application; An IAM user to provide access credentials for the human administrator

Cevap

The correct answers are the option to use an IAM role to provide temporary credentials for the monitoring application, and the option to use an IAM user to provide credentials for the human administrator.
The correct options are using an IAM role for the monitoring application and an IAM user for the human administrator. For applications, especially those on-premises, using IAM roles (via AWS IAM Roles Anywhere or federation) allows them to assume temporary credentials, which is a security best practice over using permanent credentials. For human administrators performing daily console tasks, creating dedicated IAM users provides isolated, long-term login credentials with specific policies, adhering to the principle of least privilege.

Adım Adım Çözüm

1
Analyze the requirement for the monitoring application.
The application requires read-only access to Amazon CloudWatch. AWS recommends using IAM roles to provide temporary credentials for applications.
Temporary credentials minimize the security risk of credential leakage compared to long-term access keys.
2
Analyze the requirement for the human administrator.
The human administrator needs full access to Amazon EC2 for daily tasks. AWS recommends creating an IAM user with appropriate permissions for daily activities.
Using the root user for daily tasks violates the principle of least privilege and administrative security best practices.
3
Confirm the selected options.
The correct identities are an IAM role for the application and an IAM user for the human administrator.
These choices align with the AWS recommended practices for managing credentials and user access.

Anahtar Kavram

AWS Identity and Access Management (IAM) entities (Users and Roles) and security best practices.
Soru 596Soru →

A startup is preparing for a security audit and needs to generate a report showing who made specific API requests to modify their Amazon EC2 instances over the last thirty days. Which AWS service should the startup use to retrieve this API transaction history?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail is the service designed to track and log user activity and API calls across AWS infrastructure for auditing and compliance.
AWS CloudTrail is specifically built to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. This service provides a complete history of API calls, including the identity of the API caller, the time of the call, the source IP address, and the request parameters, making it the correct choice for generating an audit report.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario.
The requirement is to retrieve a history of API requests showing who modified Amazon EC2 resources.
This establishes that the solution must focus on administrative tracking, logging, and auditing of API activity.
2
Evaluate the capabilities of the available AWS monitoring and security services.
AWS CloudTrail records user actions and API calls, whereas Amazon CloudWatch monitors performance metrics, Amazon GuardDuty detects security threats, and AWS Trusted Advisor checks configuration best practices.
Choosing the service that specifically records API transaction histories ensures compliance auditing needs are met.

Anahtar Kavram

AWS CloudTrail is used to audit user activity and API calls, while Amazon CloudWatch is used for performance monitoring and operational metrics.
Tahmini Süre:45s
Soru 597Soru →

An online retail company is expanding its operations to new regions and must verify that the underlying AWS infrastructure meets both PCI DSS and ISO 27001 standards. Which of the following actions should the company take to verify AWS compliance and clarify security boundaries? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Download the AWS ISO 27001 certification and PCI DSS compliance packages from AWS Artifact.; Review the AWS Shared Responsibility Model to identify which security controls are managed by AWS and which are the customer's responsibility.

Cevap

To verify compliance and understand security boundaries, the company should download the AWS compliance packages from AWS Artifact and review the AWS Shared Responsibility Model.
Verifying AWS compliance is done by retrieving official audit reports and certifications from AWS Artifact. Understanding security boundaries requires reviewing the AWS Shared Responsibility Model, which defines the security obligations of both AWS and the customer.

Adım Adım Çözüm

1
Identify the AWS tool used to download official compliance reports and certifications.
AWS Artifact provides on-demand access to compliance reports (like PCI DSS and ISO certifications).
The company needs official documentation of AWS's infrastructure compliance for their expansion.
2
Determine how to clarify the division of security obligations between AWS and the company.
The AWS Shared Responsibility Model outlines which controls are the responsibility of AWS (security of the cloud) and which are the customer's responsibility (security in the cloud).
Understanding security boundaries prevents configuration gaps and misalignments during audits.

Anahtar Kavram

AWS Artifact provides compliance reports, while the Shared Responsibility Model defines security boundaries.
Soru 598Soru →

A DevOps team wants to write a shell script to automate the daily starting and stopping of Amazon EC2 instances based on a schedule. The script must parse output in JSON format and run from an administrative machine without requiring a full programming language runtime. Additionally, the team needs to audit who initiated these start/stop actions. Which combination of AWS tool and service best meets these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CLI to script the start/stop actions, and AWS CloudTrail to audit the API calls

Cevap

AWS CLI to script the start/stop actions, and AWS CloudTrail to audit the API calls
The AWS CLI is the optimal tool for executing administrative commands and shell scripts on AWS resources without the overhead of a full programming language runtime. It native-formats command outputs in JSON, which makes parsing straightforward. AWS CloudTrail is the designated AWS service to monitor, log, and audit account API activity, ensuring the team has visibility into who triggered the start and stop API operations.

Adım Adım Çözüm

1
Determine the interface method that supports shell scripting, outputs JSON, and does not require a programming language runtime.
The AWS Command Line Interface (CLI) is selected because it is executed directly from a terminal/shell script and outputs data in JSON format.
This rules out the AWS Management Console (which is a manual graphical interface) and the AWS SDK (which requires installing and configuring programming runtimes like Python or Node.js).
2
Identify the AWS service responsible for capturing and auditing API calls, specifically to track who initiated the start and stop actions.
AWS CloudTrail is chosen because it records all API calls made in the AWS account, including the user, time, and IP address.
This rules out Amazon CloudWatch (which is for monitoring performance metrics and log aggregation) and Amazon GuardDuty (which is for threat detection).

Anahtar Kavram

Selecting the appropriate AWS interface tool (CLI vs. SDK vs. Console) based on execution requirements, and identifying the correct operational monitoring and auditing service (CloudTrail vs. CloudWatch).

Alternatif Yöntem

While a Python script using the AWS SDK (Boto3) could perform this automation, the team specifically required a solution without a programming language runtime environment. Thus, utilizing the AWS CLI within a shell script is the most direct and lightweight path.
Tahmini Süre:2m 0s
Soru 599Soru →

A retail company needs to run a data validation script once per day at midnight. The script typically runs for 8 minutes, processes raw transaction logs from an Amazon S3 bucket, and outputs a summary report. The company wants to minimize costs, pay only for the compute time used, and avoid provisioning or managing any server infrastructure. Which of the following AWS compute services is the most appropriate and cost-effective choice for this workload?

Cevabı ve açıklamayı göster

Cevap: AWS Lambda

Cevap

AWS Lambda is the most appropriate and cost-effective service for this workload.
AWS Lambda is a serverless compute service that runs code in response to events and automatically manages the underlying compute resources. For a short-running daily task (8 minutes), Lambda is highly cost-effective because you pay only for the compute time consumed, with zero cost when the function is idle. It requires no server provisioning or management.

Adım Adım Çözüm

1
Identify the resource requirements and operational constraints of the workload.
The workload runs once daily for 8 minutes (short-lived, periodic), needs to process files in Amazon S3, and requires zero ongoing server management.
Knowing the workload runtime and management constraints helps filter out persistent or high-maintenance compute options.
2
Compare the candidate AWS compute services based on operational overhead and billing granularity.
Amazon EC2 and Amazon Lightsail charge for running virtual machines even when idle, while Amazon ECS on EC2 requires cluster instance management. AWS Lambda runs only when triggered and is serverless.
This identifies the service that satisfies both the serverless requirement and the cost-minimization goal.

Anahtar Kavram

Serverless event-driven compute services in AWS
Tahmini Süre:1m 30s
Soru 600Soru →

A business analyst is configuring an Amazon Simple Storage Service (Amazon S3) bucket to store financial reports. The company requires that all objects in the bucket be encrypted at rest. Under the AWS shared responsibility model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Enabling default encryption on the Amazon S3 bucket

Cevap

Enabling default encryption on the Amazon S3 bucket
Enabling default encryption on the Amazon S3 bucket is correct because the customer is responsible for security 'in' the cloud, which includes configuring data protection features such as encryption settings on S3 buckets. AWS provides the tools, but the customer must enable and configure them.

Adım Adım Çözüm

1
Analyze the requirement under the AWS Shared Responsibility Model for data protection.
Identify that data protection 'in the cloud' (such as configuring encryption settings for S3 buckets) is the customer's responsibility.
AWS protects the infrastructure that runs all of the services offered in the AWS Cloud, while customers are responsible for securing their data within those services.
2
Evaluate the choices to find which action represents a customer configuration task.
The action of enabling default encryption on the S3 bucket is a customer-managed configuration. Other actions like physical security, infrastructure patching, and dedicated hardware maintenance are handled by AWS.
This confirms the correct choice matches customer-side configurations for data protection.

Anahtar Kavram

Under the AWS shared responsibility model, AWS is responsible for security 'of' the cloud (infrastructure, physical security, patching virtualization software), whereas the customer is responsible for security 'in' the cloud (data encryption settings, access controls, configuring resources).
Tahmini Süre:45s
ÖncekiSayfa 30 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin