Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 601Soru →

Which AWS compute service configuration is the most appropriate for each of the following business workload scenarios? Match the workload scenario on the left with the correct AWS compute service on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A containerized image rendering task that requires installation of custom GPU device drivers on the host operating system.
A short-lived, event-driven ETL data processing function that is triggered sporadically by Amazon S3 uploads and finishes within 10 minutes.
A containerized web API service with highly variable traffic where the team wants serverless container orchestration without managing virtual machines.
A simple monolithic legacy application that needs persistent local block storage and a static IP, managed by a team with minimal cloud expertise.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches are: the containerized image rendering task requiring custom GPU host drivers matches Amazon ECS with EC2 launch type; the short-lived event-driven S3 ETL function matches AWS Lambda; the serverless containerized web API matches AWS Fargate; and the simple monolithic legacy application matches Amazon Lightsail.
Matching each workload with the appropriate compute option ensures efficient resource utilization and architectural alignment: AWS Lambda is optimal for serverless, short-running, event-driven functions; Amazon ECS with EC2 launch type is required when containers need underlying host access or custom drivers; AWS Fargate is ideal for containerized applications where server management is not wanted; and Amazon Lightsail provides a simplified, low-overhead environment for monolithic applications.

Adım Adım Çözüm

1
Analyze host OS configuration requirements for containerized workloads.
The image rendering workload requires installing custom GPU drivers directly on the host OS. This requires full access to the underlying infrastructure, pointing to Amazon ECS with EC2 launch type.
Serverless options like AWS Fargate do not allow host OS access or custom driver installations on host virtual machines.
2
Evaluate execution time limits and trigger patterns for event-driven compute tasks.
The ETL task runs sporadically in response to S3 uploads and finishes within 10 minutes. This fits within AWS Lambda's 15-minute runtime limit.
AWS Lambda is designed for ephemeral, event-driven code execution and eliminates the cost of idle servers between runs.
3
Determine container deployment architecture when host VM management is not wanted.
The web API requires container orchestration without virtual machine management, pointing to AWS Fargate.
AWS Fargate operates as a serverless engine for ECS, removing the need to provision, scale, or patch EC2 instances.
4
Identify the best option for simple, predictable VPS hosting with minimal cloud expertise.
The monolithic legacy application requiring a simple VM environment, static IP, and persistent local storage points to Amazon Lightsail.
Amazon Lightsail packages compute, storage, databases, and networking into easy-to-manage VPS blueprints at a predictable price point.

Anahtar Kavram

Selecting the appropriate AWS compute service (EC2, ECS, Lambda, Fargate, Lightsail) based on administrative control needs, serverless management requirements, execution time, and workload complexity.
Tahmini Süre:2m 30s
Soru 602Soru →

An online tutoring company is migrating its student portal to AWS to reduce overall infrastructure costs. Which TWO of the following statements correctly describe the economic benefits of this migration?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replacing upfront capital expenses with variable operating expenses that scale with usage; Paying only for the resources that are actually consumed, reducing waste from idle capacity

Cevap

The correct options are the statements explaining that migrating to AWS replaces upfront capital expenses with variable operating expenses, and that you pay only for the resources that are actually consumed, which reduces waste from idle capacity.
Migrating to AWS provides significant economic benefits by replacing upfront capital expenses (such as purchasing physical hardware) with variable operating expenses that are paid based on usage. Furthermore, AWS enables a pay-as-you-go model where organizations pay only for the resources they consume, eliminating the waste associated with paying for idle, overprovisioned capacity.

Adım Adım Çözüm

1
Understand the shift in expense models during a cloud migration.
Identify that migrating to AWS shifts costs from CapEx (upfront capital expenses) to OpEx (variable operating expenses).
This is a fundamental concept of cloud economics where you pay as you go instead of investing in physical data centers upfront.
2
Understand how AWS pricing models handle resource utilization.
Identify that pay-as-you-go pricing and elasticity prevent paying for idle, overprovisioned resources.
Elasticity allows resources to grow and shrink with demand, ensuring you only pay for what you actually use.

Anahtar Kavram

AWS cloud economics allows organizations to replace upfront capital expenses (CapEx) with variable operating expenses (OpEx) and reduce waste by paying only for active resource consumption rather than idle capacity.
Soru 603Soru →

A financial technology firm wants to enhance its operational visibility and security auditing on AWS. The operations team needs to collect and search log files generated by their application running on Amazon EC2 instances, and trigger automated alerts when system errors are detected. Simultaneously, the security team needs to audit all administrative API requests made to AWS resources to identify which user made specific configuration changes. Which AWS services should the firm implement to fulfill these two requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail; Amazon CloudWatch

Cevap

AWS CloudTrail and Amazon CloudWatch
The firm should implement AWS CloudTrail and Amazon CloudWatch. AWS CloudTrail is designed to record API calls and user activity across the AWS infrastructure, providing a complete audit trail of who made changes to resources. Amazon CloudWatch, combined with the CloudWatch agent on EC2 instances, is used to collect, monitor, and search application log files, as well as set up metrics and alarms to notify the operations team of system errors in real time.

Adım Adım Çözüm

1
Analyze the security auditing requirement to track who made specific configuration changes.
Identify that AWS CloudTrail records API calls, user actions, and resource changes.
This satisfies the requirement to audit administrative actions and trace user activity.
2
Analyze the operational logging requirement to collect application logs from EC2 and trigger alerts on errors.
Identify that Amazon CloudWatch (and CloudWatch Logs) can collect application logs via an agent and create metric filters for alarms.
This fulfills the need for real-time application log monitoring and automated alerting.
3
Evaluate the incorrect options against the requirements.
Rule out Amazon GuardDuty, Amazon Inspector, and AWS Shield as they focus on threat detection, vulnerability scanning, and DDoS protection respectively, rather than general logging and API auditing.
Eliminating distractors ensures a precise and correct selection of the two monitoring services.

Anahtar Kavram

AWS CloudTrail is used for auditing AWS API calls and user activity (governance and compliance), while Amazon CloudWatch is used for performance monitoring, application log collection, and metric-based alerting.
Tahmini Süre:1m 30s
Soru 604Soru →

A financial services company needs to investigate an incident where a critical Amazon RDS database instance was unexpectedly deleted. The security team must identify the specific IAM user who initiated the deletion, the exact time of the API call, and the source IP address of the request. Which AWS service should the security team use to retrieve this historical record of API activity?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail

Cevap

AWS CloudTrail
AWS CloudTrail is designed to record API calls and user interactions across AWS infrastructure. It provides detailed records of who made a request, from where, and at what time, which is essential for security auditing and forensic analysis.

Adım Adım Çözüm

1
Identify the goal of the security team, which is to audit API activity to determine who deleted an Amazon RDS database instance, when the action occurred, and from what source IP.
The team needs a service that logs and indexes administrative activity and management console operations.
This is an auditing and compliance task focused on tracking user actions and API usage.
2
Compare the capabilities of available AWS logging and monitoring services to find the one that tracks API calls.
AWS CloudTrail records management events, showing user identities, API calls, timestamps, and source IP addresses.
Selecting the service specifically designed for tracking account-wide API operations ensures the team can retrieve the required history.

Anahtar Kavram

AWS CloudTrail is the primary service for auditing and recording AWS API activity, tracking user actions, console logins, and service operations.
Tahmini Süre:1m 0s
Soru 605Soru →

A logistics company is migrating its application to Amazon EC2 instances. The security team needs to implement a logging and monitoring strategy that addresses two requirements: First, they must monitor application-specific log files generated on the EC2 instances for pattern matches and automatically notify administrators if error rates spike. Second, they must continuously analyze AWS API calls and network activity to detect potential security threats, such as compromised credentials or communication with known malicious IP addresses. Which TWO AWS services should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon CloudWatch to monitor application log files for error patterns and trigger notifications using alarms; Amazon GuardDuty to continuously analyze API events and network logs to identify threat patterns and compromised credentials

Cevap

The logistics company should implement Amazon CloudWatch and Amazon GuardDuty.
The correct services are Amazon CloudWatch and Amazon GuardDuty. Amazon CloudWatch collects and monitors log files from resources like EC2 instances using metric filters, allowing administrators to configure alarms and notifications. Amazon GuardDuty uses intelligent threat detection to analyze data sources like CloudTrail logs and VPC Flow Logs to detect malicious activity and compromised credentials.

Adım Adım Çözüm

1
Identify the service required to monitor application log files and alert on error thresholds.
Amazon CloudWatch is selected because it collects log files, allows pattern matching via metric filters, and triggers notifications through CloudWatch Alarms.
This satisfies the requirement to monitor EC2 application log files for error rate spikes and notify administrators.
2
Identify the service required to continuously analyze AWS API calls and network activity for active security threats.
Amazon GuardDuty is selected because it is an intelligent threat detection service that analyzes logs (such as CloudTrail and VPC Flow Logs) to identify anomalies and compromised credentials.
This satisfies the requirement to detect security threats like compromised credentials and communication with malicious IPs.

Anahtar Kavram

AWS security logging, monitoring, and threat detection services
Soru 606Soru →

A digital music streaming platform wants to eliminate the upfront costs of purchasing physical servers and infrastructure hardware. Instead, they want to pay for computing resources only as they are consumed. Which benefit of the AWS Cloud describes this financial model?

Cevabı ve açıklamayı göster

Cevap: Trade capital expense for variable expense

Cevap

Trade capital expense for variable expense
The correct answer is to trade capital expense for variable expense. By using AWS, the music streaming platform does not need to invest in physical data centers and hardware (capital expense) before launching. Instead, they pay for the cloud resources they consume as a variable operational expense.

Adım Adım Çözüm

1
Analyze the business scenario described in the question stem.
The digital music streaming platform wants to avoid upfront infrastructure costs (purchasing physical servers) and instead pay for computing resources dynamically as they are consumed.
Understanding the core requirement allows mapping it to the correct AWS Cloud benefit.
2
Map the financial requirement to the official AWS Cloud benefits.
Upfront infrastructure investments represent capital expenses (CapEx), while paying only for consumed resources represents a variable operating expense (OpEx). Under the AWS Cloud model, customers trade capital expense for variable expense.
This identifies the correct AWS benefit definition corresponding to the scenario.

Anahtar Kavram

Trading capital expense for variable expense allows businesses to pay only for resources consumed rather than investing heavily in physical data centers and servers before knowing how they will be used.
Tahmini Süre:45s
Soru 607Soru →

A company wants to integrate a third-party security auditing application that runs on an external, non-AWS platform. The application requires read-only access to the company's AWS resource configurations. Which of the following is the AWS-recommended best practice to grant this access securely?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.

Cevap

Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.
Creating an IAM role with a trust policy is the secure and recommended way to grant access to third-party accounts or external applications. It allows the external service to temporarily assume the role and access the necessary resources, ensuring that no long-term credentials (like passwords or access keys) are shared or stored externally.

Adım Adım Çözüm

1
Analyze the access requirement
The external third-party application requires read-only access to AWS resource configurations without introducing permanent credential risks.
Security best practices dictate minimizing permanent credential exposure and using temporary access methods.
2
Evaluate role-based access vs user-based access
IAM roles provide temporary credentials using security token services, whereas IAM users use long-term credentials.
An IAM role is designed for cross-account or external service access delegation without exposing long-term keys.
3
Select the correct AWS recommendation
Create an IAM role with a trust relationship defining who can assume the role, and apply a permission policy containing read-only access.
This implements the principle of least privilege and avoids sharing permanent credentials.

Anahtar Kavram

Delegating AWS resource access to third-party applications using temporary credentials via IAM roles.
Soru 608Soru →

A logistics company is migrating its supply chain database to AWS. The compliance team needs to verify how regulatory compliance is managed under the AWS Shared Responsibility Model. Which of the following compliance-related activities is the sole responsibility of AWS?

Cevabı ve açıklamayı göster

Cevap: Maintaining the physical security and environmental controls of the data centers hosting the database.

Cevap

Maintaining the physical security and environmental controls of the data centers hosting the database.
AWS is responsible for security 'of' the cloud, which includes protecting the physical infrastructure (hardware, software, networking, and facilities) that runs all of the services offered in the AWS Cloud.

Adım Adım Çözüm

1
Analyze the requirements under the AWS Shared Responsibility Model.
Identify that AWS is responsible for security 'of' the cloud, while the customer is responsible for security 'in' the cloud.
This establishes the framework to classify which compliance task belongs to which party.
2
Evaluate the options to identify which task belongs to AWS's infrastructure management.
Determine that physical security and environmental controls of data centers are managed solely by AWS, whereas operating systems, report downloads, and logging configurations are managed by the customer.
This isolates the correct option showing the AWS-managed compliance control.

Anahtar Kavram

Shared Responsibility Model for Compliance
Soru 609Soru →

A startup is deploying a new web application and needs to select the appropriate AWS compute services. They require one service to host a legacy database that demands custom operating system configurations, and a second service to execute a short-lived image resizing script whenever files are uploaded to storage, without managing any server infrastructure. Which of the following AWS compute services should the startup select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon EC2; AWS Lambda

Cevap

The startup should select Amazon EC2 to host the legacy database requiring custom operating system configurations, and AWS Lambda to run the serverless image-resizing script.
Amazon EC2 is the correct choice for the legacy database because it provides full administrative control over the guest operating system, which is required for custom configurations. AWS Lambda is the correct choice for the resizing script because it is a serverless, event-driven compute service that runs code without provisioning or managing servers.

Adım Adım Çözüm

1
Analyze the requirement for hosting a legacy database requiring custom operating system configurations.
Identify Amazon EC2 as the service that offers virtual servers with full administrative access (root/Administrator) to the operating system.
Custom OS-level configurations require an Infrastructure as a Service (IaaS) model like Amazon EC2.
2
Analyze the requirement for running a short-lived image resizing script without managing servers.
Identify AWS Lambda as the serverless, event-driven compute service that runs code in response to triggers like storage uploads.
Running temporary scripts without managing infrastructure is the primary use case of AWS Lambda.

Anahtar Kavram

Matching specific workload requirements to the appropriate AWS compute options based on the level of control and management overhead.
Soru 610Soru →

An enterprise is planning to deploy and manage a multi-tier web application across multiple AWS environments including development, testing, and production. The operations team requires a method that enables them to define the entire infrastructure configuration as code, track changes in a centralized version control repository, perform peer reviews on configuration updates, and automatically detect when resources have been manually altered outside of the deployment pipeline. Which AWS service or tool should the team use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudFormation

Cevap

AWS CloudFormation
AWS CloudFormation is the correct option because it is designed specifically for Infrastructure as Code (IaC). It uses declarative templates to provision resources in a consistent, repeatable manner across development, test, and production environments. Because these templates are files (YAML or JSON), they can be checked into a version control system like Git, enabling team members to conduct code reviews on infrastructure changes. Furthermore, CloudFormation includes a native Drift Detection feature that identifies when resources in a stack have been modified outside of the CloudFormation template, meeting the requirement to detect manual alterations.

Adım Adım Çözüm

1
Analyze the business and technical requirements of the scenario.
The scenario requires defining infrastructure as code (IaC), version control integration, peer review processes, multi-environment consistency, and automated detection of manual changes (configuration drift).
This establishes the criteria for evaluating the available AWS deployment and operating methods.
2
Evaluate the capabilities of AWS CloudFormation against the criteria.
AWS CloudFormation allows declarative templates (JSON or YAML) to be versioned in Git, supports peer review workflows, ensures consistent environment replication, and features native Drift Detection.
CloudFormation is the primary AWS service purpose-built for provisioning infrastructure resources using code.
3
Evaluate the other options (AWS CLI, AWS SDK, and AWS Management Console).
The AWS CLI and SDK are imperative tools that require custom scripting or programming to manage state and lack native drift detection. The AWS Management Console is web-based and manual, which fails the automation and version control requirements.
Identifying the limitations of alternative interfaces confirms that declarative IaC is the correct architectural choice.
4
Synthesize the evaluation to select the best option.
AWS CloudFormation is the only solution that natively satisfies all the requirements of declarative infrastructure as code, multi-account consistency, and automatic drift detection.
A complete matching of requirements to service features yields the correct choice.

Anahtar Kavram

Infrastructure as Code and drift detection using AWS CloudFormation compared to manual or programmatic scripting methods.
Soru 611Soru →

A healthcare analytics company is migrating its data warehousing workloads to Amazon Redshift to perform complex queries on patient data. According to the AWS Shared Responsibility Model, which two of the following security and operational tasks are the responsibility of the customer?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Managing database user accounts, cluster-level security groups, and database-level permissions; Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)

Cevap

Managing database user accounts, cluster-level security groups, and database-level permissions; Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)
Under the AWS Shared Responsibility Model for managed services like Amazon Redshift, the customer is responsible for security 'in' the cloud, which includes managing database user access, permissions, cluster security groups, and data protection settings such as enabling encryption at rest using AWS Key Management Service (AWS KMS) keys.

Adım Adım Çözüm

1
Identify the AWS service type and deployment model.
Amazon Redshift is a fully managed data warehouse service (PaaS/managed database), which automatically abstracts the physical hosting and operating system layers from the customer.
Understanding the service type determines where the boundary lies between customer and AWS responsibilities under the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities (security 'in' the cloud) for managed database services.
The customer controls identity and access management (creating database users, granting permissions) and configurations like cluster-level security groups and database encryption using customer-managed keys.
Even in managed services, data security, authorization, and firewall rules at the service level remain customer duties.
3
Evaluate the AWS-side responsibilities (security 'of' the cloud) and filter out incorrect options.
AWS handles OS patching, hardware replacement, and physical security. Thus, managing physical data centers, patching cluster node operating systems, and configuring internal cluster networking are AWS responsibilities.
AWS manages the infrastructure layer for all cloud deployments, particularly for managed and containerized services.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Soru 612Soru →

A company is configuring a Virtual Private Cloud (VPC) to host a new application. The security administrator wants to implement a defense-in-depth strategy by combining instance-level firewall protection with subnet-level firewall protection. Which of the following statements correctly describe the characteristics of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Groups are stateful firewalls that control traffic at the instance level.; Network ACLs are stateless firewalls that control traffic at the subnet level.

Cevap

The correct answers are the statements that state Security Groups are stateful firewalls operating at the instance level, and Network ACLs are stateless firewalls operating at the subnet level.
Security Groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. They are stateful, meaning any allowed inbound traffic is automatically allowed to exit. Network ACLs act as a firewall for associated subnets, controlling traffic entering and leaving the subnet. They are stateless, meaning return traffic must be explicitly allowed by a corresponding rule.

Adım Adım Çözüm

1
Analyze the configuration and characteristics of Security Groups.
Identify that Security Groups are applied at the instance level (e.g., to elastic network interfaces) and are stateful.
This helps verify the correct statements regarding Security Groups.
2
Analyze the configuration and characteristics of Network ACLs.
Identify that Network ACLs are applied at the subnet boundary and are stateless.
This helps verify the correct statements regarding Network ACLs.
3
Review the Shared Responsibility Model regarding firewall rule configuration.
Confirm that configuring security rules is a customer responsibility, ruling out options that shift this responsibility to AWS.
This eliminates incorrect distractors regarding operational responsibilities.

Anahtar Kavram

Stateful Security Groups vs. Stateless Network ACLs
Tahmini Süre:1m 0s
Soru 613Soru →

A company's security team needs to define a custom set of permissions for their database administrators. The policy must be reusable across multiple IAM groups, support version history, and allow for easy rollbacks if a change causes issues. Which type of IAM policy should the security team implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Customer managed policy

Cevap

Customer managed policy
Customer managed policies are standalone policies created and managed by the customer. They can be attached to multiple IAM groups, support up to five versions for rollback capability, and allow full customization of permissions.

Adım Adım Çözüm

1
Analyze the requirements for the custom policy: it must be reusable across multiple groups, support version control, and allow rollbacks.
Identified that the policy must be a standalone resource managed by the customer, rather than an inline policy or a policy controlled by AWS.
Standalone policies permit reuse, and customer-created policies allow custom configurations and versions.
2
Evaluate policy options against these requirements: customer managed policies offer version history and multi-entity attachment.
Confirmed that customer managed policies fit all requirements perfectly, whereas inline policies lack reuse and AWS managed policies lack customization/version control.
To choose the correct best practice for managing customized permission sets at scale.

Anahtar Kavram

AWS IAM Policy Types
Tahmini Süre:1m 0s
Soru 614Soru →

A digital marketing agency needs to implement security measures for its AWS infrastructure. The agency wants to continuously monitor its AWS accounts for unauthorized behavior and malicious activity. Additionally, they need to scan their Amazon Elastic Container Registry (Amazon ECR) container images for software vulnerabilities. Which two AWS services should the agency use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty; Amazon Inspector

Cevap

Amazon GuardDuty and Amazon Inspector are the correct services. Amazon GuardDuty provides continuous threat detection by analyzing logs for malicious behavior, while Amazon Inspector scans container images in Amazon ECR for software vulnerabilities.
Amazon GuardDuty and Amazon Inspector are the appropriate AWS services for threat detection and vulnerability management. Amazon GuardDuty monitors the AWS environment for threats, whereas Amazon Inspector evaluates container images for known software vulnerabilities.

Adım Adım Çözüm

1
Identify the service needed for continuous monitoring of AWS accounts for unauthorized behavior and malicious activity.
Amazon GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to detect malicious activity across accounts.
This matches the threat detection requirement of the agency.
2
Identify the service needed to scan Amazon ECR container images for software vulnerabilities.
Amazon Inspector automatically scans container images stored in Amazon ECR for known vulnerabilities.
This matches the vulnerability management requirement of the agency.

Anahtar Kavram

AWS threat detection and vulnerability management services
Soru 615Soru →

An organization is setting up access controls for a new application developer who needs to manage Amazon S3 buckets and Amazon EC2 instances. Which of the following is the AWS-recommended method to configure this access?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user for the developer and attach policy permissions that grant only the required access.

Cevap

Create an individual IAM user for the developer and attach policy permissions that grant only the required access.
Creating a dedicated IAM user and applying the principle of least privilege ensures that the developer has a unique identity and only the permissions required to do their job, which aligns with AWS security best practices.

Adım Adım Çözüm

1
Determine the entity type needed for a human operator who requires long-term credentials to access the AWS Management Console.
An IAM user is the correct choice because IAM users represent individuals who require permanent credentials.
This establishes accountability and follows the design pattern for human operators.
2
Determine the appropriate permissions configuration based on AWS security standards.
Apply the principle of least privilege by attaching a policy that only grants access to S3 and EC2.
This minimizes security risks by preventing the developer from accessing unrelated services or sensitive actions.

Anahtar Kavram

Best practices for AWS Identity and Access Management (IAM), including using IAM users for human operators, practicing least privilege, and avoiding root user usage.
Tahmini Süre:45s
Soru 616Soru →

A company is planning to migrate two separate workloads to AWS. The first workload is a legacy enterprise application that requires specific operating system kernel modifications. The second workload is a containerized microservice API that needs to run on a serverless infrastructure without the overhead of provisioning or managing virtual machines. Which two AWS compute services should the company select to host these workloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic Compute Cloud (Amazon EC2); AWS Fargate

Cevap

Amazon Elastic Compute Cloud (Amazon EC2) and AWS Fargate
Amazon Elastic Compute Cloud (Amazon EC2) is correct because it provides virtual machines with full administrative (root) control, enabling the operating system kernel modifications required by the legacy workload. AWS Fargate is correct because it is a serverless compute engine that allows containerized applications to run without the user needing to provision or manage the underlying virtual servers.

Adım Adım Çözüm

1
Analyze the requirements for the first workload.
The legacy enterprise application needs OS-level access to perform kernel modifications.
Since standard serverless or managed container platforms restrict access to the underlying OS and kernel, Amazon EC2 is required as it provides full administrative control (root access) over the virtual machines.
2
Analyze the requirements for the second workload.
The containerized microservice API must run in a serverless environment without the need to manage underlying servers.
AWS Fargate acts as a serverless compute engine for containers, abstracting away the server management and provisioning layer while running standard containerized workloads.

Anahtar Kavram

Selecting appropriate AWS compute services based on OS control and server management requirements
Tahmini Süre:1m 30s
Soru 617Soru →

A healthcare technology company is migrating its legacy billing and reporting system to the AWS Cloud. The system currently processes patient invoices and generates compliance reports. The invoicing process must run continuously without interrupting the reporting system, and the reporting system only needs resources during the first week of every month when reports are compiled. Which two architectural practices should the company adopt to align with AWS Cloud design principles? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implement Amazon Simple Queue Service (Amazon SQS) to decouple the invoicing and reporting components, ensuring that a failure in report generation does not affect invoicing.; Use Amazon EC2 instances that are provisioned on demand to run the monthly reporting jobs and terminated immediately after the work is complete.

Cevap

The company should implement Amazon Simple Queue Service (Amazon SQS) to decouple the invoicing and reporting components, and use Amazon EC2 instances that are provisioned on demand to run the monthly reporting jobs and terminated immediately after the work is complete.
Decoupling the invoicing and reporting components using Amazon Simple Queue Service (Amazon SQS) ensures that if the reporting service experiences issues, invoicing remains unaffected, fulfilling the loose coupling and design for failure principles. Additionally, provisioning Amazon EC2 instances on demand and terminating them once report generation is complete aligns with the principle of treating resources as disposable rather than static infrastructure.

Adım Adım Çözüm

1
Analyze the requirements for loose coupling.
The invoicing process must not be interrupted by the reporting system, which requires decoupling them using a queueing service like Amazon SQS so that their lifecycles are independent.
This implements the 'loose coupling' and 'design for failure' principles.
2
Analyze the requirements for periodic resource utilization.
The reporting system only needs compute resources during the first week of the month, meaning compute resources should be created on demand and terminated when finished.
This implements the 'disposable resources' principle rather than keeping idle servers running constantly.

Anahtar Kavram

AWS Cloud design principles including loose coupling, design for failure, and disposable resources.
Tahmini Süre:1m 30s
Soru 618Soru →

A company is implementing a data protection policy for its applications running on AWS. The security team needs to understand the division of responsibility for data protection under the AWS Shared Responsibility Model.

Which of the following are responsibilities of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Encrypting customer data at rest within AWS storage services; Configuring SSL/TLS for encrypting data in transit

Cevap

Under the AWS Shared Responsibility Model, the customer is responsible for encrypting customer data at rest within AWS storage services and configuring SSL/TLS for encrypting data in transit.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. This includes protecting their own data, which requires them to configure encryption at rest within AWS storage services and establish SSL/TLS encryption for data in transit.

Adım Adım Çözüm

1
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS manages security of the cloud (infrastructure, hardware, physical security). The customer manages security in the cloud (data, configurations, access control).
This division defines the boundary of responsibilities under the AWS Shared Responsibility Model.
2
Classify the given options into customer or AWS responsibilities.
Encrypting data at rest and configuring SSL/TLS for data in transit are security configurations within the customer's guest environment. Physical security and hardware disposal are infrastructure tasks managed by AWS.
Identifying who controls the configuration helps correctly attribute the responsibility.

Anahtar Kavram

Under the AWS Shared Responsibility Model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. The customer is responsible for managing their data (including encryption options), classified as security 'in' the cloud.
Soru 619Soru →

An online education platform needs to implement a security and monitoring strategy for its AWS environment. The security team must meet two primary requirements: first, they must keep a complete history of all API calls made within their AWS account for auditing purposes; second, they need to continuously monitor their AWS accounts and workloads for malicious activity and unauthorized behavior, such as potential cryptocurrency mining. Which AWS services should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail; Amazon GuardDuty

Cevap

The company should use AWS CloudTrail to record the history of API calls, and Amazon GuardDuty to monitor the account and workloads for malicious behavior like cryptocurrency mining.
AWS CloudTrail is designed to record API calls and user activity for security auditing. Amazon GuardDuty is a threat detection service that continuously monitors accounts and workloads for malicious activity, such as unauthorized access or cryptocurrency mining.

Adım Adım Çözüm

1
Identify the service that records AWS API calls and user activity.
AWS CloudTrail is identified as the audit log provider.
The requirement is to keep a history of all API calls for auditing purposes.
2
Identify the service that performs intelligent threat detection and workload monitoring.
Amazon GuardDuty is identified as the threat detection service.
The requirement is to monitor for malicious activities and unauthorized behaviors like cryptocurrency mining.
3
Verify that the incorrect services are ruled out based on their use cases.
Amazon CloudWatch and Amazon Inspector are ruled out.
CloudWatch is for performance monitoring and Inspector is for vulnerability scanning.

Anahtar Kavram

Distinguishing between audit trails, active threat detection, and operational monitoring in AWS.
Soru 620Soru →

A logistics startup is launching a new delivery tracking application. To keep initial costs low, the startup decides to host the application on AWS to avoid buying physical servers and instead pay a variable monthly rate based on their actual resource consumption. Which of the following terms describes this financial transition?

Cevabı ve açıklamayı göster

Cevap: A shift from capital expenses (CapEx) to operating expenses (OpEx)

Cevap

A shift from capital expenses (CapEx) to operating expenses (OpEx)
The correct answer is the option stating a shift from capital expenses (CapEx) to operating expenses (OpEx). By choosing to host the application on AWS rather than purchasing physical hardware, the startup avoids upfront capital expenses and instead pays a variable monthly cost based on usage, which is classified as an operating expense.

Adım Adım Çözüm

1
Analyze the financial characteristics of the startup's on-premises option.
Buying physical servers requires significant upfront money, which represents capital expenses (CapEx).
To understand the starting point of the financial transition.
2
Analyze the financial characteristics of the AWS cloud option.
Paying a variable monthly rate based on actual resource consumption represents operating expenses (OpEx).
To understand the destination point of the financial transition.
3
Combine the analyses to determine the direction of the transition.
The transition goes from capital expenses (CapEx) to operating expenses (OpEx).
To identify the correct concept that matches the scenario.

Anahtar Kavram

Shifting from upfront capital expenses (CapEx) to variable operating expenses (OpEx) is a major economic benefit of the AWS Cloud.
ÖncekiSayfa 31 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin