Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 681Soru →

A ridesharing service processes real-time driver and passenger location data on AWS. The security department wants to establish automated threat detection that monitors their AWS accounts for anomalous behavior, such as API activity from unrecognized IP addresses, compromised credentials, or EC2 instances communicating with malicious IP addresses. The service must analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs. Which AWS service meets these needs?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify issues like compromised credentials or EC2 instances communicating with known malicious hosts.

Adım Adım Çözüm

1
Identify the key security objective in the scenario.
The goal is active threat detection, credential monitoring, and detecting malicious command-and-control communication from EC2 instances.
Determining the primary security goal helps narrow down the appropriate AWS security services.
2
Analyze the log data sources requested for analysis.
The required sources are AWS CloudTrail events, VPC Flow Logs, and DNS logs.
Specific security tools ingest different log sources; only Amazon GuardDuty automatically parses these three specific sources for threat intelligence.
3
Eliminate inappropriate options.
Amazon Inspector is ruled out as it focuses on vulnerability scanning rather than live threat monitoring. AWS CloudTrail is ruled out as it logs actions but does not perform analysis. AWS Shield is ruled out as it handles external DDoS protection.
This confirms that only one service fulfills all threat detection and source analysis requirements.

Anahtar Kavram

Amazon GuardDuty is an intelligent threat detection service that analyzes multiple AWS log sources (CloudTrail, VPC Flow Logs, DNS logs) to identify malicious activity and unauthorized behavior.
Soru 682Soru →

A company is developing a mobile application and needs a fully managed database service to store user session data. The application requires a key-value NoSQL database that can deliver single-digit millisecond response times at any scale. Which AWS service should the company select for this workload?

Cevabı ve açıklamayı göster

Cevap: Amazon DynamoDB

Cevap

Amazon DynamoDB
Amazon DynamoDB is a fully managed, serverless NoSQL database service that provides fast, predictable, single-digit millisecond performance at any scale, aligning perfectly with the key-value store and performance requirements.

Adım Adım Çözüm

1
Analyze the application requirements.
The workload requires a fully managed database, key-value NoSQL storage, and single-digit millisecond latency at any scale.
This helps filter out services that are relational, self-managed, or designed for analytical workloads.
2
Evaluate the database services against the requirements.
Amazon DynamoDB is the only fully managed NoSQL key-value database that natively offers single-digit millisecond latencies.
Amazon RDS and Amazon Redshift are relational/analytical, and hosting on Amazon EC2 is self-managed rather than fully managed.

Anahtar Kavram

AWS managed NoSQL database services
Soru 683Soru →

A media streaming company is preparing for a security compliance review. The audit team needs to verify which IAM identity made the API calls to modify the configuration of an Amazon S3 bucket containing sensitive customer billing data. At the same time, the security team wants to set up automated threat detection to identify potential unauthorized activity or compromised credentials in their AWS environment. Which combination of AWS services should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail to audit the API calls, and Amazon GuardDuty for threat detection

Cevap

AWS CloudTrail to audit the API calls, and Amazon GuardDuty for threat detection
AWS CloudTrail logs, continuously monitors, and retains account activity related to actions taken across your AWS infrastructure, satisfying the requirement to audit IAM identity actions on S3 buckets. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, satisfying the requirement to identify potential threat vectors like compromised credentials.

Adım Adım Çözüm

1
Identify the service required to track and audit configuration modifications and API actions.
AWS CloudTrail is chosen because it specifically logs, continuously monitors, and retains account activity related to actions taken across your AWS infrastructure.
Auditing access records and verifying which IAM identity performed an operation requires API auditing capabilities.
2
Identify the service required for active, automated threat detection and identifying compromised credentials.
Amazon GuardDuty is selected as it uses machine learning and threat intelligence to detect malicious behavior and unauthorized activities in AWS accounts.
Vulnerability scanners do not monitor live account activity for anomalies like compromised credentials; dedicated threat detection is required.

Anahtar Kavram

Differentiating security monitoring, API logging, and threat detection services in AWS
Soru 684Soru →

A game development studio is deploying dedicated multiplayer game servers on Amazon Elastic Compute Cloud (Amazon EC2). According to the AWS Shared Responsibility Model, which two operational security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Patching the guest operating system of the game server instances; Configuring the guest operating system firewalls on the EC2 instances

Cevap

The customer is responsible for patching the guest operating system of the game server instances and configuring the guest operating system firewalls on the EC2 instances.
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS) model. In this setup, the customer maintains control of the guest operating system, which includes the responsibility to apply OS patches and configure software firewalls within the instances. AWS handles the physical infrastructure and the virtualization layer.

Adım Adım Çözüm

1
Identify the service type and model boundary in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer maintains full control over the guest operating system, network configurations, and data.
Determining whether the service is IaaS, PaaS, or SaaS helps establish where the boundary between customer and AWS responsibility lies.
2
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS secures the global infrastructure, physical hardware, and virtualization layers. The customer secures their data, operating systems, and network access controls.
Categorizing tasks using this distinction helps identify which responsibilities belong to the customer.

Anahtar Kavram

Shared Responsibility Model for IaaS Services
Soru 685Soru →

A global logistics firm is migrating its package tracking system to the AWS Cloud. In the current on-premises architecture, a single database server and a single application server are tightly coupled. During peak shipping periods, database write bottlenecks cause the front-end portal to become completely unresponsive, resulting in lost transaction details. To improve system resilience and ensure messages are not lost, which of the following strategies align with the AWS Cloud design principles of loose coupling and designing for failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Introduce Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates before writing them to the database.; Deploy application instances across multiple Availability Zones behind an Elastic Load Balancer.

Cevap

Introducing Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates before writing them to the database, and deploying application instances across multiple Availability Zones behind an Elastic Load Balancer.
The correct strategies are introducing Amazon Simple Queue Service (Amazon SQS) to buffer incoming tracking updates, which implements loose coupling, and deploying application instances across multiple Availability Zones behind an Elastic Load Balancer, which implements designing for failure.

Adım Adım Çözüm

1
Analyze the current architectural bottlenecks and issues.
The current application is tightly coupled and lacks fault tolerance, meaning database overload crashes the entire system and causes data loss.
Identifying these failures points to the need for design principles that decouple services and create redundancy.
2
Select a solution that provides loose coupling to prevent database writes from directly impacting the frontend.
Using Amazon SQS allows message buffering, ensuring that frontend tracking updates are stored reliably even if the database database write speed lags.
Message queuing isolates components, allowing them to fail or scale independently.
3
Select a solution that designs for failure to ensure high availability.
Using Multi-AZ deployments with an Elastic Load Balancer ensures that if an instance or an entire zone fails, the system automatically redirects traffic to healthy resources.
Distributing resources across isolated infrastructure zones mitigates single points of failure.

Anahtar Kavram

AWS Cloud design principles state that loose coupling reduces interdependencies so that a failure in one component does not cascade, while designing for failure ensures system components have redundancy to survive infrastructure outages.
Tahmini Süre:1m 30s
Soru 686Soru →

A municipal public transit authority is migrating its ticketing database and web applications to the AWS Cloud. During an audit, the compliance officer asks who is responsible for configuring firewall rules (such as security groups) to protect the applications, and how the authority can verify AWS's physical infrastructure compliance. Which of the following statements correctly identifies the responsibility mapping and the service needed to retrieve the necessary AWS compliance reports?

Cevabı ve açıklamayı göster

Cevap: The customer is responsible for configuring security groups; AWS compliance documents are retrieved using AWS Artifact.

Cevap

The customer is responsible for configuring security groups, and AWS compliance documents are retrieved using AWS Artifact.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes defining firewall rules via security groups. To download AWS's official compliance documentation (like ISO and PCI certifications), the customer must use AWS Artifact, which is the central portal for these agreements and reports.

Adım Adım Çözüm

1
Identify the security group configuration responsibility within the Shared Responsibility Model.
Customers are responsible for security 'in' the cloud, which includes configuring guest operating systems, network access control lists, and security groups.
AWS manages the global infrastructure, while the customer controls their resources and access configurations.
2
Identify the AWS service dedicated to providing compliance reports and agreements.
AWS Artifact provides on-demand access to AWS security and compliance reports (such as SOC and PCI reports) and online agreements.
Other services like CloudTrail or Trusted Advisor serve different auditing or optimization functions.

Anahtar Kavram

Understanding compliance reports retrieval and the Shared Responsibility Model boundaries.
Tahmini Süre:1m 0s
Soru 687Soru →

Aegis Insurance Group is preparing to migrate its legacy on-premises IT portfolio to the AWS Cloud. During the portfolio discovery phase, the migration team identifies two distinct systems:

- System 1: A core underwriting application that will be completely rewritten to utilize a cloud-native, serverless architecture with AWS Lambda and Amazon DynamoDB.
- System 2: An old, redundant testing environment that is no longer used by any business unit and has no regulatory data retention requirements.

Which of the following migration strategies represent the correct approach for these systems? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Refactoring System 1 to transition to a serverless architecture; Retiring System 2 since it is no longer required

Cevap

The correct strategies are Refactoring for System 1 and Retiring for System 2.
Refactoring (or Re-architecting) is chosen when an application needs to be rebuilt from scratch to utilize cloud-native features, such as serverless compute and managed databases, which aligns with System 1. Retiring involves decommissioning applications and assets that are no longer useful or needed, which applies to the redundant test environment in System 2.

Adım Adım Çözüm

1
Analyze the requirement for System 1.
System 1 is a core application being completely rewritten to use serverless services (AWS Lambda and Amazon DynamoDB) to achieve cloud-native scale. This architectural modification represents the Refactoring/Re-architecting strategy.
Identifying the correct strategy requires evaluating how much of the application architecture and code will be modified during migration.
2
Analyze the requirement for System 2.
System 2 is a redundant, unused testing environment with no compliance or data retention requirements. Decommissioning these assets represents the Retiring strategy.
Identifying assets that are no longer needed prevents unnecessary migration costs and efforts.
3
Select the correct combination of strategies.
The correct strategies are Refactoring for System 1 and Retiring for System 2.
These choices align with the 6 Rs framework definitions.

Anahtar Kavram

AWS Cloud Migration Strategies (6 Rs)
Tahmini Süre:1m 35s
Soru 688Soru →

A smart agriculture startup processes high-resolution satellite imagery to predict crop yields. The company runs massive image-processing workloads for just one week at the end of each harvest season, requiring thousands of virtual compute instances. Throughout the rest of the year, they only run a small, low-traffic web dashboard. Additionally, because they do not have to buy, install, or maintain physical servers in a local facility, their engineering team focuses solely on developing machine learning models. Which two advantages of the AWS Cloud are directly demonstrated in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Stop guessing capacity; Stop spending money running and maintaining data centers

Cevap

The advantages are stopping guessing capacity and stopping spending money running and maintaining data centers.
The correct answers are the benefits of stopping guessing capacity and stopping spending money running and maintaining data centers. The company avoids guessing capacity by dynamically scaling virtual instances to handle peak workload during the harvest season and scaling down afterward. They also avoid data center maintenance costs by not owning or maintaining physical servers, which lets them focus on development.

Adım Adım Çözüm

1
Analyze the workload characteristics mentioned in the scenario.
The workload requires massive computing power (thousands of cores) for only one week per quarter, and very little power for the rest of the year.
Understanding the dynamic nature of the workload helps identify the capacity benefit.
2
Identify the AWS benefit related to these workload characteristics.
This aligns with 'Stop guessing capacity', as the company does not need to pre-purchase hardware for peak times.
Matching the scenario's workload flexibility with the AWS Cloud benefit of elastic capacity.
3
Analyze the operational characteristics regarding physical hardware.
The company does not have to buy, install, or maintain physical servers in a local facility.
Understanding the lack of physical server management requirements.
4
Identify the AWS benefit related to physical hardware management.
This aligns with 'Stop spending money running and maintaining data centers', allowing engineering teams to focus on core product delivery.
Matching the lack of physical facility management with the AWS Cloud benefit of offloading data center maintenance.

Anahtar Kavram

Define the benefits of the AWS Cloud
Soru 689Soru →

A company wants to deploy a legacy server application on AWS that requires full administrative (root) access to the guest operating system to perform custom software configurations. Which AWS compute service meets this requirement?

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic Compute Cloud (Amazon EC2)

Cevap

Amazon Elastic Compute Cloud (Amazon EC2)
Amazon Elastic Compute Cloud (Amazon EC2) provides resizable virtual servers (instances) in the cloud. As an Infrastructure as a Service (IaaS) offering, it gives the customer full administrative control (root or Administrator access) over the guest operating system, which is required to install custom configurations, drivers, or proprietary software packages.

Adım Adım Çözüm

1
Analyze the workload requirements
The application is a legacy server application that requires complete control (root/administrative access) over the guest operating system to configure custom software.
Identifying the constraints and level of access needed helps filter out serverless or fully managed services where OS access is restricted.
2
Compare AWS compute options based on the shared responsibility model and control level
Amazon EC2 is an Infrastructure as a Service (IaaS) offering that provides virtual machines with complete administrative control of the operating system. Serverless options like AWS Lambda and AWS Fargate do not allow OS-level access.
Matching the control requirement to the correct AWS service level of responsibility determines that Amazon EC2 is the correct choice.

Anahtar Kavram

AWS compute services offer different levels of management and control. Amazon EC2 provides full access and administrative control over the virtual server's operating system, whereas serverless compute options like AWS Lambda and AWS Fargate abstract the operating system layer from the user.
Tahmini Süre:45s
Soru 690Soru →

An organization runs automated database backup scripts on its on-premises servers. These scripts need to upload backups to an Amazon S3 bucket. To comply with security best practices, the organization wants to avoid storing long-term access keys on the physical servers. Which IAM solution should the organization implement to grant these scripts secure, temporary access?

Cevabı ve açıklamayı göster

Cevap: AWS IAM Roles Anywhere

Cevap

AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is the correct solution because it allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to authenticate and obtain temporary AWS credentials by assuming an IAM role. This eliminates the security risk of storing long-term AWS access keys on physical infrastructure.

Adım Adım Çözüm

1
Identify the requirements: the workload runs on-premises, needs access to Amazon S3, and must not store long-term access keys.
Conclude that standard IAM roles cannot be directly assumed by on-premises servers without a secure mechanism to authenticate them.
On-premises servers do not have access to the AWS Instance Metadata Service, which automatically distributes credentials to AWS-native resources.
2
Evaluate AWS services designed for hybrid security integration.
Determine that AWS IAM Roles Anywhere is the designated feature that allows external workloads to exchange X.509 digital certificates for temporary AWS credentials.
This establishes trust between the on-premises environment and AWS to provision short-term security credentials dynamically without storing long-term access keys.

Anahtar Kavram

AWS IAM Roles Anywhere provides temporary security credentials for workloads outside of AWS.
Soru 691Soru →

A boutique video production agency needs to expand its storage capacity for raw footage. Instead of purchasing expensive new physical storage hardware that requires upfront funding, the agency decides to use Amazon S3, allowing them to pay only for the storage they use on a monthly basis. Which concept of cloud economics does this spending shift demonstrate?

Cevabı ve açıklamayı göster

Cevap: Trading capital expenses (CapEx) for variable operating expenses (OpEx)

Cevap

Trading capital expenses (CapEx) for variable operating expenses (OpEx)
The correct answer is trading capital expenses (CapEx) for variable operating expenses (OpEx). Capital expenses refer to upfront investments in physical assets like servers and storage arrays. By migrating to Amazon S3, the boutique video production agency avoids these upfront costs and instead pays a variable operating expense based on their actual monthly consumption.

Adım Adım Çözüm

1
Analyze the business decision made by the boutique video production agency.
The agency is choosing not to purchase physical hardware upfront and instead paying monthly for storage resources actually used.
To classify the change in the company's financial model.
2
Map the spending models to cloud economic concepts.
Buying physical hardware represents a capital expense (CapEx), whereas paying monthly for consumption represents an operating expense (OpEx).
To determine which cloud economics concept describes shifting from upfront physical purchases to consumption-based pricing.

Anahtar Kavram

Trading Capital Expenses for Variable Expenses (CapEx vs OpEx)
Tahmini Süre:45s
Soru 692Soru →

A startup is designing a web application. The application requires a fully managed relational database to run complex SQL queries and transactional updates. Additionally, the startup wants to deploy an in-memory database to cache frequent query results and reduce database latency. Which TWO AWS services should the startup select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Relational Database Service (Amazon RDS); Amazon ElastiCache

Cevap

Amazon Relational Database Service (Amazon RDS) and Amazon ElastiCache
Amazon Relational Database Service (Amazon RDS) provides a managed relational database service suitable for SQL transactional workloads. Amazon ElastiCache provides an in-memory caching layer that helps reduce application latency by caching frequent query results.

Adım Adım Çözüm

1
Analyze the first requirement: a fully managed database for relational queries and SQL transactions.
Amazon Relational Database Service (Amazon RDS) matches this requirement as it is a relational database engine supporting SQL.
Relational databases are designed for SQL transactions.
2
Analyze the second requirement: an in-memory database to cache queries and reduce latency.
Amazon ElastiCache matches this requirement because it acts as an in-memory database/caching layer.
ElastiCache provides low-latency caching capabilities.

Anahtar Kavram

AWS database services selection based on transaction and cache requirements
Soru 693Soru →

A newly hired cloud administrator needs to perform daily operational tasks in the AWS Management Console, such as configuring network settings and managing Amazon S3 buckets. Which AWS security best practice should be followed to grant these permissions?

Cevabı ve açıklamayı göster

Cevap: Create an individual IAM user with the necessary permissions for the administrator's daily tasks.

Cevap

Create an individual IAM user with the necessary permissions for the administrator's daily tasks.
Creating an individual IAM user for daily tasks aligns with the AWS best practice of maintaining separate identities for auditing and applying the principle of least privilege, while avoiding the use of the root user.

Adım Adım Çözüm

1
Analyze the operational requirements.
A new internal administrator needs persistent access to the AWS Management Console to perform everyday administrative tasks such as configuring networks and S3.
Understanding the identity type and access frequency helps determine the correct IAM entity to use.
2
Apply AWS security best practices for identity management.
The AWS account root user should not be used for daily tasks. Instead, an individual IAM user should be created with standard administrator permissions mapped to their specific identity.
This establishes individual accountability, supports the principle of least privilege, and protects the root account.

Anahtar Kavram

AWS IAM Best Practices - Avoiding Root User and Using Individual IAM Users
Tahmini Süre:45s
Soru 694Soru →

A company is refactoring a monolithic application into a microservices architecture on AWS. They need to select database solutions for two new microservices: a product inventory service that requires complex table joins, strict schema enforcement, and automatic storage scaling up to 128 TiB; and a gaming leaderboard service that requires sub-millisecond response times for retrieving simple key-value player scores. Which of the following AWS database services should the company select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Aurora to support the product inventory service; Amazon ElastiCache to support the gaming leaderboard service

Cevap

Amazon Aurora should be selected to support the product inventory service, and Amazon ElastiCache should be selected to support the gaming leaderboard service.
The correct services are Amazon Aurora and Amazon ElastiCache. Amazon Aurora is a cloud-native relational database service that supports complex joins, schema enforcement, and automatically scales its storage up to 128 TiB. Amazon ElastiCache is an in-memory key-value data store that provides the sub-millisecond latency required for high-throughput gaming leaderboards.

Adım Adım Çözüm

1
Analyze the requirements for the first microservice (product inventory).
The microservice requires a relational database (complex joins, schema enforcement) with automated storage scaling up to 128 TiB.
This points directly to Amazon Aurora, which automatically provisions storage in increments up to 128 TiB and supports relational database engines.
2
Analyze the requirements for the second microservice (gaming leaderboard).
The microservice requires an in-memory database capable of delivering sub-millisecond response times for simple key-value store operations.
This matches Amazon ElastiCache, which is designed for sub-millisecond in-memory caching and session/leaderboard store workloads.
3
Evaluate the design architecture principles.
The system must remain decoupled to align with microservices best practices, meaning separate databases are preferred over a single monolithic database.
Choosing separate managed databases ensures fault tolerance and operational efficiency.

Anahtar Kavram

Selecting the appropriate AWS database service based on workload characteristics (relational vs. non-relational vs. in-memory) and adhering to cloud architecture design principles (loose coupling, managed services).
Soru 695Soru →

A company has two new requirements for its cloud workloads. First, they need to host a legacy database application that requires custom operating system kernel modifications and administrative root access. Second, they need to quickly deploy a simple web application using a pre-configured LAMP stack with a predictable, flat-rate monthly pricing structure. Which two AWS compute services should the company select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon EC2; Amazon Lightsail

Cevap

Amazon EC2 and Amazon Lightsail
Amazon Elastic Compute Cloud (Amazon EC2) provides full virtual machine control, allowing users to modify OS configurations and install custom kernels. Amazon Lightsail provides pre-configured application packages (such as LAMP) under a simple, predictable monthly pricing model.

Adım Adım Çözüm

1
Analyze the first requirement: host a legacy database requiring custom operating system kernel modifications and root access.
This requires Infrastructure as a Service (IaaS) where the user has full administrative control over the virtual machine's OS. Amazon EC2 meets this requirement.
Managed or serverless services (such as AWS Fargate or AWS Lambda) abstract the operating system and do not allow custom kernel modifications.
2
Analyze the second requirement: deploy a simple web application using a pre-configured LAMP stack with predictable, flat-rate monthly pricing.
Amazon Lightsail is designed specifically for simple, low-cost application hosting with bundled resources (compute, storage, databases) and predictable monthly plans. It supports one-click pre-configured stacks like LAMP.
While Amazon EC2 could host this, it does not offer flat-rate pricing out-of-the-box, and other options like AWS Lambda require refactoring the application to fit a serverless model.

Anahtar Kavram

Selecting appropriate AWS compute services based on OS access, management overhead, and pricing models.
Soru 696Soru →

A SaaS provider hosts its web application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement automated tools to accomplish two tasks:
1. Continually scan the EC2 instances and container images for software vulnerabilities and unintended network exposure.
2. Monitor AWS account activity and network traffic to detect anomalous behavior, potential unauthorized access, and malicious threats.

Which two AWS services should the company use to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty should be used to scan for software vulnerabilities and detect malicious threats, respectively.
Amazon Inspector automatically and continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network exposure. Amazon GuardDuty provides continuous threat detection by monitoring AWS account activity and network traffic to identify potential malicious activity.

Adım Adım Çözüm

1
Identify the service responsible for scanning EC2 instances and ECR container images for software vulnerabilities and network exposure.
Amazon Inspector performs vulnerability scanning on Amazon EC2 instances and Amazon ECR images.
This meets the first requirement of detecting software vulnerabilities and unintended network exposure.
2
Identify the service responsible for monitoring AWS account activity and network traffic to detect anomalous or malicious behavior.
Amazon GuardDuty provides continuous threat detection by analyzing events and log data.
This meets the second requirement of detecting threats, unauthorized access, and malicious activity.

Anahtar Kavram

AWS threat detection and vulnerability management services
Tahmini Süre:1m 30s
Soru 697Soru →

A media broadcasting company is preparing for an annual governance review of its cloud-based video archiving system. The governance team needs to acquire official AWS ISO 27001 certification documents and clarify how the security of AWS's physical infrastructure is validated. Which two of the following options represent correct actions or concepts that meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Retrieve the AWS ISO 27001 certification report directly from AWS Artifact.; Rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.

Cevap

To meet the governance requirements, the company should retrieve the AWS ISO 27001 certification report directly from AWS Artifact, and rely on AWS compliance reports for physical infrastructure security, as AWS is responsible for security of the cloud.
Retrieving the AWS ISO 27001 certification report directly from AWS Artifact is correct because AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports. Relying on AWS compliance reports for physical infrastructure security is correct because, under the Shared Responsibility Model, AWS is responsible for security of the cloud (the physical infrastructure), and customers verify this inheritance through these reports.

Adım Adım Çözüm

1
Identify where to retrieve official AWS compliance documents.
AWS Artifact is identified as the portal providing on-demand access to AWS security and compliance reports (such as SOC and ISO certifications).
This resolves the requirement of acquiring the official AWS ISO 27001 certification.
2
Determine the boundary of security responsibility for physical infrastructure under the Shared Responsibility Model.
Under the model, AWS is responsible for security 'of' the cloud, which includes the physical infrastructure of data centers.
This clarifies how physical security is validated without needing custom audits.

Anahtar Kavram

AWS compliance reports retrieval via AWS Artifact and boundaries of physical security under the Shared Responsibility Model.
Soru 698Soru →

A company needs to host a legacy database application on AWS. The application requires administrative (root) access to the underlying operating system and custom kernel configuration changes. Which AWS compute service should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon EC2

Cevap

Amazon EC2
Amazon EC2 (Elastic Compute Cloud) provides virtual servers in the cloud where customers have full control over the guest operating system. This allows customers to log in with administrative (root) privileges, install custom software, and perform kernel modifications.

Adım Adım Çözüm

1
Analyze the workload requirements
The application requires root/administrative access to the operating system and custom kernel configuration changes.
This determines the level of control and responsibility the customer needs over the compute infrastructure.
2
Evaluate AWS compute services based on control level
Amazon EC2 provides complete control over the guest operating system, whereas serverless options like AWS Lambda and AWS Fargate abstract the OS. Elastic Beanstalk is a platform for deployment rather than a low-level compute resource provider.
Matching the administrative control requirements to the appropriate AWS Shared Responsibility model tier identifies the correct service.

Anahtar Kavram

AWS Compute Services
Tahmini Süre:45s
Soru 699Soru →

A system administrator needs to run a quick command from a local terminal to list all active Amazon EC2 instances in an AWS account. Which of the following is the most appropriate tool to use for this task?

Cevabı ve açıklamayı göster

Cevap: AWS Command Line Interface (AWS CLI)

Cevap

AWS Command Line Interface (AWS CLI)
The AWS Command Line Interface (AWS CLI) is the tool designed to enable direct interaction with AWS services using commands in a command-line shell (such as bash or zsh), making it the most suitable tool for executing quick commands from a local terminal.

Adım Adım Çözüm

1
Identify that the requirement is to run a command directly from a local terminal shell.
Limits the tool selection to command-line interfaces rather than graphical web interfaces or coding libraries.
Terminal execution requires a command-line interface tool.
2
Select the tool designed for quick, direct command execution and administrative scripting in a terminal.
The AWS Command Line Interface (AWS CLI) is selected.
The AWS CLI is explicitly built to control AWS services from the terminal using simple commands.

Anahtar Kavram

AWS Command Line Interface (AWS CLI)
Soru 700Soru →

Vanguard Logistics plans to migrate its legacy on-premises route optimization application to the AWS Cloud. The application currently runs on an outdated, unsupported Linux distribution. To minimize migration time while improving operational support, the company decides to migrate the application to Amazon EC2 instances running a modern, supported Amazon Linux operating system without modifying the core application code. Which cloud migration strategy is Vanguard Logistics using?

Cevabı ve açıklamayı göster

Cevap: Replatforming

Cevap

Replatforming
Replatforming (also known as lift-tinker-and-shift) is correct because the company is making a minor optimization—upgrading the underlying operating system to a supported version—without changing the core architecture or code of the application.

Adım Adım Çözüm

1
Analyze the migration scenario details
The application code remains unchanged, but the underlying operating system is upgraded to a supported version during the migration.
This establishes that the migration involves some modification at the platform level (operating system upgrade) but no modification to the core application code.
2
Map the observed changes to the 6 Rs migration strategies
Upgrading the operating system without changing the core application code is classified as Replatforming (lift-tinker-and-shift).
Rehosting preserves the operating system environment as-is, whereas Replatforming allows small changes (like OS or runtime upgrades) to meet platform compatibility and support requirements without full re-architecting.

Anahtar Kavram

Identifying AWS migration strategies (6 Rs), specifically distinguishing between Rehosting and Replatforming
ÖncekiSayfa 35 / 74Sonraki