Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 761Soru →

A company is transitioning from manual infrastructure administration to automated, code-based operations. They want to accomplish two specific tasks: first, they need to write a shell script to automate the creation of Amazon S3 buckets from their local command line; second, they need to build a custom application in Python that programmatically uploads files to those buckets. Which two of the following AWS deployment and operating methods should the company use?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS Command Line Interface (AWS CLI); AWS Software Development Kits (AWS SDKs)

Cevap

The correct methods are the AWS Command Line Interface (AWS CLI) and AWS Software Development Kits (AWS SDKs).
The AWS Command Line Interface (AWS CLI) enables terminal-based automation and scripting, which is ideal for the shell script requirement. AWS Software Development Kits (AWS SDKs) provide language-specific libraries that allow custom application code to interact programmatically with AWS resources, matching the Python application requirement.

Adım Adım Çözüm

1
Analyze the first requirement: automating bucket creation via a shell script from the local command line.
Identify that the AWS Command Line Interface (AWS CLI) is the correct tool for terminal-based scripting.
The AWS CLI is specifically designed to execute commands and script operations directly from a terminal.
2
Analyze the second requirement: building a custom Python application to programmatically upload files.
Identify that AWS Software Development Kits (AWS SDKs) are the correct tools for application code integration.
AWS SDKs provide libraries in various programming languages (such as Boto3 for Python) to allow application code to interact programmatically with AWS services.

Anahtar Kavram

Methods of Deploying and Operating in AWS
Tahmini Süre:45s
Soru 762Soru →

A healthcare provider is deploying a patient record application on AWS that requires a relational database to support complex SQL join queries across multiple tables. The system must automatically scale storage up to 128 TiB, provide high availability with data replicated across multiple Availability Zones, and ensure that AWS automatically manages database engine patching and underlying hardware maintenance. Additionally, the provider needs to configure database-level user permissions to comply with health data regulations. Which database solution should the provider implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Aurora

Cevap

Amazon Aurora is the correct service because it is a managed relational database that scales storage automatically, provides native multi-AZ high availability, offloads engine patching and hardware management to AWS, and allows the customer to retain responsibility for database-level user permissions.
Amazon Aurora is a fully managed relational database service that supports complex SQL joins, scales storage up to 128 TiB, and provides high availability. Since it is fully managed, AWS handles the undifferentiated heavy lifting of hardware maintenance and database engine patching, while the customer remains responsible for database-level user access controls.

Adım Adım Çözüm

1
Analyze the database schema and query requirements.
The application requires a relational database that supports complex SQL joins across multiple tables.
This rules out non-relational database services that do not natively support SQL joins.
2
Evaluate the management and patching requirements under the Shared Responsibility Model.
AWS must manage database engine patching and underlying hardware maintenance, while the customer manages database-level user permissions.
This aligns with the Shared Responsibility Model for managed database services, eliminating self-managed EC2 options where the customer is responsible for OS/engine patching.
3
Assess the scalability and high availability requirements.
The database must scale up to 128 TiB and replicate data across multiple Availability Zones automatically.
Amazon Aurora meets these specific scaling limits and replicates data across three Availability Zones by default, making it the correct service.

Anahtar Kavram

AWS Shared Responsibility Model for Database Services and Relational vs. Non-Relational database selection
Soru 763Soru →

A healthcare technology company is hosting its web application on Amazon EC2. The company's compliance team requires a continuous audit trail of all API operations and configuration changes made to AWS resources by users and services. Simultaneously, the operations team needs to monitor the CPU utilization of the EC2 instances and receive automated notifications if utilization exceeds 80%. Which of the following AWS services should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS CloudTrail; Amazon CloudWatch

Cevap

AWS CloudTrail and Amazon CloudWatch should be used to record API activity and monitor performance metrics, respectively.
AWS CloudTrail meets the first requirement by tracking and recording user API history and configuration changes for auditing and compliance. Amazon CloudWatch meets the second requirement by gathering performance metrics such as EC2 CPU utilization and generating alarms when thresholds are crossed.

Adım Adım Çözüm

1
Identify the service required for compliance auditing and tracking user API activities.
AWS CloudTrail is selected because it records a history of API calls, user logins, and configuration changes within the AWS account.
The compliance team needs a continuous audit trail of all API operations and resource changes.
2
Identify the service required to track performance metrics (CPU utilization) and send alerts.
Amazon CloudWatch is selected because it monitors metrics and allows users to set up alarms and notifications when threshold limits are exceeded.
The operations team needs to monitor CPU utilization on EC2 instances and receive alerts if it exceeds 80%.

Anahtar Kavram

Understanding the distinct roles of AWS logging and monitoring services, specifically distinguishing between API auditing (CloudTrail) and operational metric monitoring (CloudWatch).
Tahmini Süre:1m 0s
Soru 764Soru →

A digital advertising company is building a real-time bidding platform. The platform must process millions of ad impression events per second, where each event payload has a highly variable schema with different metadata fields depending on the ad network. The platform needs to retrieve user profile preferences with single-digit millisecond latency using a unique visitor ID to serve targeted ads, and the storage tier must automatically scale throughput to handle fluctuating daily traffic patterns. Which AWS database service should the company select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon DynamoDB

Cevap

Amazon DynamoDB is the correct choice because it is a managed NoSQL database that offers schema flexibility, single-digit millisecond response times, and automatic throughput scaling for key-value lookups.
Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. It is designed to handle document and key-value data structures, which easily accommodates the highly variable metadata payloads in the scenario. Additionally, its ability to scale storage and throughput automatically while maintaining single-digit millisecond latency makes it the perfect fit for real-time bidding workloads.

Adım Adım Çözüm

1
Analyze the data structure requirements.
The requirement specifies a highly variable schema with different metadata fields, which points to a NoSQL (non-relational) document or key-value store rather than a relational database.
Relational databases require a rigid, predefined schema, which makes storing variable metadata payloads inefficient.
2
Analyze the latency and access pattern requirements.
The application needs to retrieve data using a unique visitor ID (key-value lookup) with single-digit millisecond latency.
DynamoDB is optimized for key-value lookups and consistently delivers single-digit millisecond latency at any scale.
3
Analyze the scaling and operational requirements.
The database must handle millions of events per second and automatically scale throughput up and down to match fluctuating traffic.
DynamoDB is fully managed and features auto-scaling capabilities for both read and write capacity, adjusting to traffic spikes without administrative overhead.

Anahtar Kavram

Selecting the appropriate AWS database service based on data structure, access patterns, and latency requirements.
Soru 765Soru →

A startup is hosting a payment processing application on EC2 instances. To secure the environment, they must satisfy two conditions: block traffic from specific external IP addresses at the subnet boundary, and allow HTTPS traffic to the instances such that return traffic is allowed automatically without explicit outbound rules. Which combination of actions should the startup perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses.; Add an inbound allow rule for port 443 to the Security Group associated with the instances.

Cevap

Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses, and add an inbound allow rule for port 443 to the Security Group associated with the instances.
The correct actions are to configure a deny rule on the subnet's Network Access Control List (NACL) and an inbound allow rule on the EC2 instances' Security Group. NACLs operate at the subnet boundary and allow explicit deny rules, which meets the requirement of blocking specific malicious IP addresses before they reach the hosts. Security Groups operate at the instance level and are stateful, meaning any permitted inbound connection on port 443 automatically permits the corresponding outbound response traffic without requiring a separate outbound rule.

Adım Adım Çözüm

1
Analyze the requirement to block traffic from specific external IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, making them suitable for this requirement.
Security Groups do not support explicit deny rules and operate at the instance level, not the subnet level.
2
Analyze the requirement to allow HTTPS traffic to the instances such that return traffic is allowed automatically.
Identify that Security Groups are stateful and operate at the instance level. An inbound rule allowing port 443 automatically permits the return outbound traffic.
NACLs are stateless and require explicit outbound rules to permit return traffic, which violates the requirement for automatic return traffic.

Anahtar Kavram

Understanding the difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level).
Tahmini Süre:1m 30s
Soru 766Soru →

A startup's systems administrator needs to perform a set of tasks: launching a new Amazon EC2 instance, configuring an IAM group for developers, modifying the contact information of the AWS account, and closing an unused AWS account. According to AWS security principles, which of these tasks must be performed by logging in as the AWS account root user?

Cevabı ve açıklamayı göster

Cevap: Modifying the primary account contact information and closing the unused AWS account

Cevap

Modifying the primary account contact information and closing the unused AWS account
The correct option correctly identifies that modifying primary account contact information and closing an AWS account are among the few restricted tasks that require logging in as the AWS account root user. AWS recommends protecting the root user credentials and using them only for these specific actions.

Adım Adım Çözüm

1
Analyze the administrative tasks to determine if they are daily operations or critical account lifecycle actions.
Launching EC2 instances and configuring IAM groups are identified as standard daily administrative tasks, while closing the account and changing primary contact information are account-level operations.
This separation helps identify where the principle of least privilege and root user protection rules apply.
2
Evaluate the permissions and capabilities of IAM identities (users, groups, and roles) versus the root user.
Daily administrative tasks can be fully managed using IAM policies attached to IAM users or groups. Account closure and primary credential/contact modifications are restricted exclusively to the root user.
AWS security best practices dictate that the root user should not be used for daily tasks, but is required for specific, high-risk account management tasks.
3
Verify if the task can be delegated to AWS Support under the Shared Responsibility Model.
AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud, which includes account configurations and management. Thus, AWS Support cannot perform these tasks.
This confirms that the customer must perform these actions themselves using the appropriate account credentials.

Anahtar Kavram

AWS Root User vs IAM administrative users and roles
Tahmini Süre:1m 0s
Soru 767Soru →

A developer is deploying a backend database within an Amazon VPC and needs to restrict access so that only the application tier can communicate with it. The developer wants a security control that operates at the instance level and automatically allows return traffic for any established inbound connection. Which AWS security feature should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Security groups

Cevap

Security groups
The correct answer is security groups. Security groups act as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. They are stateful, which means that if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Similarly, if inbound traffic is allowed, return outbound traffic is automatically allowed.

Adım Adım Çözüm

1
Identify the level of security control required by the scenario.
The scenario requires an instance-level firewall rather than a subnet-level control.
This narrows the choice down to security groups, as network ACLs operate at the subnet level.
2
Determine the statefulness behavior of the required control.
The firewall must automatically allow outbound return traffic for any established inbound connection, which is the definition of stateful behavior.
Security groups are stateful and automatically permit return traffic, satisfying both the instance-level and stateful requirements.

Anahtar Kavram

Security groups are stateful, instance-level firewalls in Amazon VPC, whereas Network ACLs are stateless, subnet-level firewalls.
Soru 768Soru →

A company is planning to migrate its on-premises relational database to AWS. The database administration team wants to maintain the existing relational schema and SQL query compatibility, while offloading routine database management tasks such as software patching, database backups, and hardware scaling to AWS. Which AWS database service should the company select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon RDS

Cevap

Amazon RDS
Amazon RDS is a fully managed relational database service that allows companies to run popular relational engines (like Oracle, PostgreSQL, and MySQL) while AWS handles infrastructure patching, database engine updates, backups, and scale configuration.

Adım Adım Çözüm

1
Determine the required database model based on the business constraints.
The database must support relational schemas and SQL query compatibility.
This rules out non-relational databases and in-memory caches.
2
Assess the operational requirements and database type.
The workload is transactional, and administrative tasks like software patching and backups must be managed by AWS.
This rules out analytical data warehouses and points to Amazon RDS, which is a fully managed relational database service.

Anahtar Kavram

Relational Database Migration to Managed AWS Services
Tahmini Süre:1m 0s
Soru 769Soru →

An enterprise is planning to deploy two different applications on AWS:

* A batch processing workload for machine learning model training that is highly fault-tolerant, can be paused and resumed, and must run at the absolute lowest cost.
* A containerized web API that experiences unpredictable traffic spikes, where the operations team wants to focus on container deployment without provisioning or managing any underlying servers.

Which combination of AWS compute solutions will fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon EC2 Spot Instances to run the batch processing workload; AWS Fargate to run the containerized web API

Cevap

The company should use Amazon EC2 Spot Instances for the batch processing workload to minimize costs, and AWS Fargate to run the containerized web API without server management.
The correct options are the ones recommending Amazon EC2 Spot Instances and AWS Fargate. Amazon EC2 Spot Instances leverage spare capacity for significant cost savings on workloads that can tolerate interruption, while AWS Fargate provides a serverless compute engine for containers, eliminating the administrative overhead of managing underlying virtual machines.

Adım Adım Çözüm

1
Analyze the batch processing workload requirements (fault-tolerant, can be paused/resumed, lowest cost).
Amazon EC2 Spot Instances are identified as the ideal pricing model due to steep discounts and tolerance for interruption.
Spot Instances offer up to 90% savings for workloads that can be interrupted.
2
Analyze the containerized web API requirements (container-based, unpredictable traffic, no server management).
AWS Fargate is identified as the container execution environment.
Fargate provides serverless compute for containers, removing the need to manage EC2 instances.

Anahtar Kavram

Selecting appropriate AWS compute services and pricing models based on workload characteristics.
Tahmini Süre:2m 0s
Soru 770Soru →

A digital marketing firm is hosting a data analytics application on AWS and has chosen to deploy its relational database using Amazon Relational Database Service (Amazon RDS). According to the AWS Shared Responsibility Model, which operational security task is the sole responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring network access rules using security groups and managing database user permissions.

Cevap

Configuring network access rules using security groups and managing database user permissions.
The option concerning security groups and user permissions is correct. Under the AWS Shared Responsibility Model, Amazon RDS is a managed service. While AWS is responsible for security 'of' the cloud (including database patching, physical infrastructure, and host OS maintenance), the customer remains responsible for security 'in' the cloud, which includes configuring database network access using security groups and managing database-level user accounts and authorization.

Adım Adım Çözüm

1
Identify the AWS service type being used in the scenario.
Amazon RDS is an AWS managed database service (Platform-as-a-Service/PaaS).
The level of customer responsibility under the Shared Responsibility Model varies depending on whether the service is Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), or Software-as-a-Service (SaaS).
2
Determine the boundary of responsibility for Amazon RDS.
AWS manages the operating system, database patching, backups, physical infrastructure, and hardware. The customer manages database access control, network access configurations (security groups), and data encryption.
Since RDS is a managed service, AWS abstracts the underlying OS and hardware, shifting those security responsibilities from the customer to AWS.
3
Evaluate the choices against the customer's responsibilities for Amazon RDS.
Configuring security groups and user access is a customer responsibility. Operating system patching, physical hardware maintenance, and data center security logs are AWS responsibilities.
This isolates the correct task that falls on the customer under security 'in' the cloud.

Anahtar Kavram

Shared Responsibility Model for Managed Services (PaaS)
Soru 771Soru →

A mobile gaming startup is launching a multiplayer game and wants to avoid the large upfront costs of purchasing physical servers. Instead, they want to pay only for the server capacity they use during active gaming sessions. Which two of the following cloud economic concepts directly support this strategy? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Shifting from upfront capital expenses (CapEx) to variable operating expenses (OpEx); Paying for services on a variable, pay-as-you-go basis

Cevap

Shifting from upfront capital expenses (CapEx) to variable operating expenses (OpEx) and paying for services on a variable, pay-as-you-go basis are the concepts that support this strategy.
Shifting from capital expenditures to operating expenditures eliminates upfront infrastructure costs, while a pay-as-you-go model ensures the organization only pays for the active resources it consumes.

Adım Adım Çözüm

1
Identify the startup's goal of avoiding upfront hardware costs and paying only for consumed capacity.
The goal requires a shift from capital expenses (CapEx) to operating expenses (OpEx).
CapEx involves upfront hardware purchases, whereas OpEx involves pay-as-you-go operating costs.
2
Select the cloud economics concepts that align with paying only for active capacity.
A variable, pay-as-you-go model and shifting to OpEx match the requirements.
These models ensure costs scale dynamically with usage rather than requiring flat upfront fees.

Anahtar Kavram

Understand concepts of cloud economics
Soru 772Soru →

A mobile food delivery startup is preparing to launch its service in a new metropolitan area. The company wants to deploy its application infrastructure without making upfront investments in hardware, choosing instead to pay variable operating expenses based on the volume of customer orders processed. Which benefit of the AWS Cloud is this startup utilizing?

Cevabı ve açıklamayı göster

Cevap: Trade capital expense for variable expense

Cevap

Trading capital expense for variable expense allows the startup to avoid upfront hardware investments and pay variable operating expenses based on actual resource usage.
Trading capital expense for variable expense is correct because it allows businesses to pay only for the resources they consume rather than investing heavily in physical data centers and servers before knowing how they will be used.

Adım Adım Çözüm

1
Analyze the business requirements in the scenario.
The startup wants to avoid upfront investments in hardware and pay operating expenses based on usage.
This establishes the financial focus of the scenario.
2
Compare the requirements against the six benefits of the AWS Cloud.
Trading capital expense (CapEx) for variable expense (OpEx) directly matches the goal of eliminating upfront hardware payments in favor of utility-based billing.
To identify which cloud benefit specifically addresses this financial transition.

Anahtar Kavram

Trading capital expense for variable expense is a key cloud benefit where customers pay only for resources consumed, avoiding large upfront physical hardware costs.
Tahmini Süre:1m 0s
Soru 773Soru →

A software development company is designing a new cloud-native application and establishing its deployment and operating procedures on AWS. The company has the following technical requirements:

1. The entire multi-tier application infrastructure must be defined as code in a single YAML template to allow for automated, repeatable deployments across different environments.
2. The application code (written in Python) running on an Amazon EC2 instance must programmatically and securely access files in an Amazon S3 bucket without using permanent, hardcoded access keys.

Which combination of AWS tools, services, or features is most appropriate to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS CloudFormation to deploy the infrastructure templates, and the AWS SDK within the Python code while assigning an IAM Role to the EC2 instance

Cevap

Use AWS CloudFormation to deploy the infrastructure templates, and the AWS SDK within the Python code while assigning an IAM Role to the EC2 instance.
The correct option correctly pairs AWS CloudFormation (the standard declarative service for Infrastructure as Code using templates) with the AWS SDK (the primary tool for programmatic integration in application code) and assigns an IAM Role to the EC2 instance to dynamically supply secure, temporary credentials.

Adım Adım Çözüm

1
Identify the deployment tool requirement
AWS CloudFormation is chosen because it uses template files (JSON/YAML) to model and provision AWS infrastructure repeatedly and consistently.
The requirement specifies defining infrastructure as code in a YAML template.
2
Identify the operating method for programmatic S3 access
The AWS SDK (Software Development Kit) is selected for the Python application logic.
The requirement specifies that application code (Python) must programmatically interact with Amazon S3.
3
Determine the secure credential mechanism for EC2 to S3 access
Assign an IAM Role to the EC2 instance to provide temporary credentials.
The requirement explicitly forbids permanent hardcoded access keys.

Anahtar Kavram

Methods of Deploying and Operating in AWS
Tahmini Süre:2m 0s
Soru 774Soru →

A startup is deploying a web application on AWS. They need a storage option to act as a persistent boot volume for their Amazon EC2 instances, and another storage option to serve as a shared file storage that multiple EC2 instances can mount and access simultaneously.

Which two AWS storage services should the startup select?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic Block Store (Amazon EBS); Amazon Elastic File System (Amazon EFS)

Cevap

Amazon Elastic Block Store (Amazon EBS) and Amazon Elastic File System (Amazon EFS)
Amazon Elastic Block Store (Amazon EBS) is the correct choice for the persistent boot volume because it provides durable, block-level storage volumes that persist independently of the EC2 instance lifetime. Amazon Elastic File System (Amazon EFS) is the correct choice for shared file storage because it provides a serverless file system that can be mounted by multiple EC2 instances at the same time using the NFS protocol.

Adım Adım Çözüm

1
Identify the requirement for a persistent boot volume for Amazon EC2 instances.
Amazon EBS is selected because it provides persistent, block-level storage volumes suitable for EC2 boot volumes.
EC2 instances require block storage for their operating systems, and this storage must persist across instance stops and starts.
2
Identify the requirement for a shared file storage system that can be mounted by multiple EC2 instances simultaneously.
Amazon EFS is selected because it supports the Network File System (NFS) protocol, allowing concurrent access from multiple EC2 instances.
Multiple instances need to read and write to the same shared directory structure at the same time.

Anahtar Kavram

Differentiating between AWS block, file, and object storage services based on access patterns and persistence requirements.
Tahmini Süre:1m 0s
Soru 775Soru →

A financial services company needs to run a daily data reconciliation batch job. The job is packaged as a container image, takes approximately 18 minutes to complete, and requires 2 vCPUs and 4 GB of memory. The workload is highly unpredictable in terms of when the source files arrive, but it must start immediately upon file upload. The company wants to minimize operational overhead and avoid paying for any idle compute resources. Which AWS compute service or configuration should the company select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic Container Service (Amazon ECS) with AWS Fargate

Cevap

Amazon Elastic Container Service (Amazon ECS) with AWS Fargate
The correct option is the container service with a serverless launch type. This service allows running containerized applications without provisioning or managing virtual machines, eliminating administrative tasks like OS patching. Since it has no 15-minute runtime limitation, it easily supports the 18-minute workload while billing only for the precise vCPU and memory resources consumed during execution.

Adım Adım Çözüm

1
Analyze the workload requirements and constraints.
The workload is containerized, requires 2 vCPUs and 4 GB of memory, runs for 18 minutes, is triggered by unpredictable file uploads, and requires minimal operational overhead with no payment for idle resources.
Identifying these parameters helps filter out AWS compute services that do not support containerization, have short execution limits, or require server management.
2
Evaluate serverless options against the execution time limit.
AWS Lambda is ruled out because its maximum execution duration is 15 minutes, whereas this workload takes 18 minutes.
AWS Lambda is serverless but has strict runtime constraints that make it unsuitable for longer-running batch jobs.
3
Evaluate the remaining options based on operational overhead and pricing structure.
Amazon EC2 introduces operational overhead (OS patching and scaling management). Amazon Lightsail charges a flat monthly fee, leading to idle costs. Amazon ECS with AWS Fargate runs containers serverlessly, supports runs longer than 15 minutes, and bills only for active container runtime.
Comparing management responsibilities and cost efficiency identifies the solution that best fits the company's constraints.

Anahtar Kavram

Selecting appropriate AWS compute services based on operational overhead, runtime limits, and cost optimization
Soru 776Soru →

A cloud practitioner is planning the network security layout for an Amazon VPC. Which two of the following statements correctly describe the characteristics of security groups and Network Access Control Lists (NACLs)?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, meaning return traffic is automatically allowed regardless of outbound rules.; Network ACLs operate at the subnet level and act as a firewall for controlling traffic entering and leaving one or more subnets.

Cevap

Security groups are stateful (inbound allowed traffic automatically allows return traffic) and Network ACLs operate at the subnet level as a firewall.
The correct options are that security groups are stateful (allowing return traffic automatically) and Network ACLs operate at the subnet boundary as firewalls. These represent the standard configuration and operational boundaries for VPC network security.

Adım Adım Çözüm

1
Analyze the characteristics of security groups.
Identify that security groups operate at the instance level and are stateful, which means they automatically allow return traffic.
This helps evaluate the options regarding security group scope and statefulness.
2
Analyze the characteristics of Network Access Control Lists (NACLs).
Identify that Network ACLs operate at the subnet level and are stateless, requiring explicit rules for both inbound and outbound traffic.
This helps evaluate the options regarding Network ACL scope and statefulness.
3
Evaluate the option related to the Shared Responsibility Model.
Recognize that network configuration, including security groups and NACL rules, is a customer responsibility.
This eliminates the distractor proposing that AWS manages these custom rules.

Anahtar Kavram

Understanding the difference between stateful security groups (instance-level) and stateless Network ACLs (subnet-level), and the customer responsibility for network security configuration.
Soru 777Soru →

An automotive telemetry platform processes data from millions of connected vehicles and stores it in AWS. The security operations team needs to continuously monitor the AWS accounts and containerized workloads for threats such as cryptocurrency mining, credential exfiltration, and communication with malicious IP addresses. Which AWS service should the platform team use to perform this intelligent threat detection?

Cevabı ve açıklamayı göster

Cevap: Amazon GuardDuty

Cevap

Amazon GuardDuty is the correct AWS service to perform continuous, intelligent threat detection by monitoring activities such as potential cryptocurrency mining, compromised credentials, and unauthorized communications.
Amazon GuardDuty is a continuous security monitoring service that analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS query logs. It uses threat intelligence feeds and machine learning to identify anomalous and malicious activities within the AWS environment, such as communication with command-and-control servers or cryptocurrency mining.

Adım Adım Çözüm

1
Analyze the operational requirements of the security team.
The platform requires intelligent, continuous threat detection targeting behaviors like cryptocurrency mining, credential exfiltration, and malicious IP communications.
Distinguishing between vulnerability scanning (proactive software analysis) and active threat detection (reactive/behavioral log analysis) is critical to selecting the correct AWS service.
2
Map the requirements to the correct AWS security service.
Amazon GuardDuty continuously analyzes data sources including CloudTrail events, VPC Flow Logs, and DNS logs to identify malicious activities and anomalies. The other services listed perform vulnerability assessment (Amazon Inspector), auditing (AWS CloudTrail), or DDoS mitigation (AWS Shield).
Aligning AWS service capabilities with the scenario's functional demands identifies the correct solution.

Anahtar Kavram

Continuous Threat Detection and Anomaly Monitoring
Soru 778Soru →

A media company needs to store legacy video assets that are rarely accessed but must be preserved for long-term historical records. The company is willing to accept a retrieval time of several hours in exchange for the lowest possible storage cost. Which AWS storage service is the most suitable for this use case?

Cevabı ve açıklamayı göster

Cevap: Amazon S3 Glacier

Cevap

Amazon S3 Glacier
Amazon S3 Glacier is designed specifically for long-term data archiving and backup. It offers highly durable storage at extremely low costs, matching the requirement of a service that accommodates retrieval times of several hours in exchange for lower costs.

Adım Adım Çözüm

1
Identify the primary storage requirements in the scenario.
The scenario requires long-term archival storage for rarely accessed files, where retrieval latency of several hours is acceptable in exchange for minimized costs.
Understanding the latency, access frequency, and cost requirements is necessary to determine the appropriate storage class.
2
Evaluate the storage services against the identified requirements.
Amazon S3 Glacier provides secure, durable, and extremely low-cost storage optimized for rarely accessed archives with retrieval windows of several hours. Other options like EBS, EFS, and Instance Store are designed for active, low-latency block or file access and are significantly more expensive.
Comparing service capabilities allows selection of the most cost-effective and suitable solution.

Anahtar Kavram

Amazon S3 Glacier is a cost-effective storage class optimized for data archiving and long-term backup where retrieval times of minutes to hours are acceptable.
Tahmini Süre:45s
Soru 779Soru →

A financial services company needs to process transaction logs that are uploaded to an Amazon S3 bucket throughout the day. Each processing job is short-lived, taking less than two minutes to complete, and the volume of logs fluctuates unpredictably. The company wants a serverless solution that only incurs costs when the processing code is running. Which AWS compute service should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: AWS Lambda

Cevap

AWS Lambda is the most appropriate service because it is serverless, automatically scales in response to S3 upload events, and only bills for the compute time used while processing the files.
AWS Lambda is designed for short-lived, event-driven workloads. It integrates directly with Amazon S3 to run code in response to file uploads, scales automatically to handle fluctuating volumes, and does not charge for idle time, meeting all requirements.

Adım Adım Çözüm

1
Analyze the workload characteristics
The tasks are event-driven (triggered by Amazon S3 uploads), short-lived (taking under two minutes), and have unpredictable volumes.
Understanding the execution duration, execution trigger, and utilization pattern is critical for selecting the correct cloud compute service.
2
Compare AWS compute service models against requirements
AWS Lambda fits the serverless, event-driven pattern perfectly, automatically scaling and charging only per millisecond of execution without any server management overhead.
Matching workload needs to AWS service capabilities ensures optimal cost and operational efficiency.

Anahtar Kavram

AWS Lambda is an event-driven, serverless compute service that enables running code without provisioning or managing servers, scaling automatically, and charging only for the compute time consumed.
Soru 780Soru →

A financial services firm is building a real-time portfolio management platform on AWS. The platform has two distinct database requirements: First, a persistent storage tier for user transaction history that requires complex multi-table SQL joins, strict ACID compliance, and the ability to scale read capacity automatically across multiple Availability Zones. Second, a caching layer to store frequently accessed market stock prices that requires sub-millisecond response times to handle massive spikes in read requests. Which combination of AWS database services best meets these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Aurora; Amazon ElastiCache

Cevap

The correct services are Amazon Aurora and Amazon ElastiCache.
The correct services are Amazon Aurora and Amazon ElastiCache. Amazon Aurora provides a fully managed relational database that scales storage automatically and supports up to 15 low-latency read replicas across multiple Availability Zones, which matches the transactional consistency and read scaling requirements. Amazon ElastiCache provides an in-memory cache with sub-millisecond latency, which is ideal for caching the highly dynamic stock prices.

Adım Adım Çözüm

1
Analyze the database requirements for the persistent storage tier.
The transactional history tier requires complex SQL joins, ACID compliance, and automatic read capacity scaling.
This matches the features of Amazon Aurora, a fully managed relational database designed for high-performance transactional workloads.
2
Analyze the database requirements for the caching layer.
The stock price cache requires sub-millisecond response times to handle high read volumes.
This matches Amazon ElastiCache, which is an in-memory data store designed specifically for sub-millisecond caching.
3
Evaluate the remaining options against the architectural and security requirements.
Amazon DynamoDB (NoSQL), Amazon Redshift (analytical data warehouse), and the misconfigured Amazon RDS option (incorrect shared responsibility assignment) do not meet the criteria.
This eliminates the incorrect distractors and confirms Amazon Aurora and Amazon ElastiCache as the correct combination.

Anahtar Kavram

AWS Managed Database and Caching Services selection based on architectural requirements and the Shared Responsibility Model.
Tahmini Süre:2m 0s
ÖncekiSayfa 39 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin