Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 161Soru →

A multinational enterprise runs a data processing platform with a flat, predictable workload that requires constant compute utilization 24/7. In their on-premises data center, they negotiated maximum bulk discounts for hardware purchases. After migrating this specific workload to AWS without changing its architecture, the finance team observes that the baseline hourly cost of the compute resources is lower than their previous hardware amortization and hosting rates. When presenting these findings to the board, the CFO wants to explain why the baseline unit rate of compute power decreased despite the workload not utilizing cloud elasticity or scaling.

Which benefit of the AWS Cloud should the CFO reference to explain this specific cost reduction?

Cevabı ve açıklamayı göster

Cevap: Benefit from massive economies of scale

Cevap

Benefit from massive economies of scale
The benefit of massive economies of scale explains why AWS can offer lower pay-as-you-go prices than customers can achieve on their own. By aggregating usage from hundreds of thousands of customers, AWS can purchase resources at a scale that translates into lower unit costs for hardware, power, and facilities. This makes compute unit pricing cheaper even for steady-state workloads that do not use elasticity or auto-scaling.

Adım Adım Çözüm

1
Analyze the workload characteristics described in the scenario.
The workload is flat, predictable, and runs at constant utilization 24/7.
This rules out benefits related to dynamic scaling, elasticity, or variations in capacity demand.
2
Identify the primary source of the cost savings observed by the finance team.
The baseline hourly cost of compute resources on AWS is lower than the enterprise's own bulk-discounted hardware amortization and hosting rates.
The saving is a reduction in the unit cost of the infrastructure rather than a change in payment timing or utilization efficiency.
3
Correlate the unit cost savings to the correct AWS Cloud benefit.
AWS aggregates infrastructure usage from hundreds of thousands of customers, allowing it to achieve higher economies of scale and pass those savings to customers as lower pay-as-you-go prices.
This aligns directly with the benefit of massive economies of scale.

Anahtar Kavram

Massive economies of scale in cloud computing allow providers like AWS to achieve lower unit costs through aggregate customer purchasing power, passing the savings to customers as lower pay-as-you-go rates.
Tahmini Süre:3m 0s
Soru 162Soru →

An administrator has created a new AWS account to host a student portal. To align with AWS security best practices, which action should the administrator perform first regarding the AWS account root user?

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.

Cevap

Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.
Enabling multi-factor authentication (MFA) for the root user secures the most privileged identity in the AWS account. Daily administrative tasks should be performed by IAM users with appropriate permissions rather than the root user, following the principle of least privilege.

Adım Adım Çözüm

1
Identify the security requirements for the root user of a new AWS account.
The root user has complete, unrestricted access to all resources and billing, making its protection paramount.
Understanding the privilege level of the root user highlights the need for immediate securing steps (like MFA) and avoiding daily usage.
2
Compare the proposed actions against AWS security best practices.
Creating individual IAM users with limited or administrative rights for daily tasks and securing the root account with MFA is the recommended path.
This setup limits the risk of exposing root credentials and ensures compliance with the principle of least privilege.

Anahtar Kavram

AWS account root user security best practices dictate that the root user should not be used for daily tasks, must be protected by MFA, and daily administration should be delegated to individual IAM users.
Tahmini Süre:1m 0s
Soru 163Soru →

A municipal energy utility provider plans to migrate its legacy customer billing portal to AWS. The portal consists of a Java-based application running on local servers and an on-premises Microsoft SQL Server database. The provider wants to eliminate the administrative burden of patching operating systems, managing database backups, and provisioning hardware, but has strict constraints that prohibit any modifications to the application's core codebase or SQL query structures.

To achieve this, the migration team decides to deploy the Java application code onto AWS Elastic Beanstalk and migrate the database to Amazon RDS for SQL Server.

Which migration strategy is this provider employing?

Cevabı ve açıklamayı göster

Cevap: Replatforming

Cevap

The correct strategy is replatforming, as the company is adopting managed cloud platforms to reduce operational overhead without modifying the core application code.
The correct answer is replatforming. Replatforming (often referred to as 'lift-tinker-and-shift') involves moving applications to the cloud while making minor optimizations to take advantage of cloud benefits—such as adopting managed database services (Amazon RDS) or platform-as-a-service solutions (AWS Elastic Beanstalk) to reduce operational overhead—without changing the core application architecture or code. This aligns perfectly with the provider's goal to eliminate administrative tasks like patching and backups while keeping the codebase intact.

Adım Adım Çözüm

1
Analyze the business requirements and technical constraints of the migration scenario.
The utility provider wants to eliminate administrative tasks (OS patching, database backups) but cannot modify the application's core codebase or database queries.
This establishes the boundary conditions for the migration strategy, eliminating strategies that require code modification (Refactoring) or changing the product entirely (Repurchasing).
2
Evaluate the planned target architecture on AWS.
The provider plans to move the Java application to AWS Elastic Beanstalk and migrate the SQL Server database to Amazon RDS.
This step identifies that the provider is adopting managed platform services rather than simply moving virtual machines to EC2.
3
Classify the migration strategy based on the modifications and target AWS services.
The strategy is identified as Replatforming (lift-tinker-and-shift).
By replacing self-managed infrastructure components with managed services (RDS and Elastic Beanstalk) to optimize operations without changing core application code, the company is executing a replatforming strategy.

Anahtar Kavram

Identifying AWS Migration Strategies (6 Rs)
Tahmini Süre:1m 30s
Soru 164Soru →

A regional hotel chain is migrating its IT workloads to the AWS Cloud. The IT team wants to move its legacy property management system to AWS exactly as-is, without making any modifications to the application code or database configuration, to ensure a fast transition. At the same time, the team has decided to decommission and shut down an outdated guest feedback system that is no longer used.

Which two of the following migration strategies align with the hotel chain's decisions?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting; Retiring

Cevap

Rehosting and Retiring
The correct strategies are Rehosting and Retiring. Rehosting is the process of migrating a workload to AWS exactly as-is to save time and effort. Retiring is the strategy of decommissioning applications that no longer serve a business purpose.

Adım Adım Çözüm

1
Analyze the migration plan for the legacy property management system.
The system is being migrated exactly as-is without any code or configuration changes.
This corresponds to the Rehosting (lift-and-shift) migration strategy.
2
Analyze the plan for the outdated guest feedback system.
The application is no longer useful and is being decommissioned and shut down.
This corresponds to the Retiring migration strategy.

Anahtar Kavram

Identifying AWS Cloud migration strategies (6 Rs)
Soru 165Soru →

A commercial real estate firm plans to migrate its legacy on-premises workloads to the AWS Cloud. The migration team has identified two key workloads for the first phase of migration:

* Workload 1: A property-valuation application running on virtual machines that must be migrated quickly to meet a data center exit deadline, without modifying the application code or configuration.
* Workload 2: A legacy document collaboration system that the firm wants to decommission entirely, replacing it with a fully managed commercial third-party Software-as-a-Service (SaaS) solution.

Which two migration strategies should the firm implement for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting for Workload 1, to quickly migrate the virtual machines to Amazon EC2 without changing application code or configurations.; Repurchasing for Workload 2, to replace the existing collaboration platform with a commercial SaaS solution.

Cevap

The correct migration strategies are Rehosting for Workload 1 and Repurchasing for Workload 2.
The correct strategies are Rehosting for Workload 1 and Repurchasing for Workload 2. Rehosting (often called lift-and-shift) is the best choice for Workload 1 because it allows virtual machines to be migrated directly to Amazon EC2 without code modifications, meeting the tight deadline. Repurchasing (often called drop-and-shop) is the best choice for Workload 2 because it replaces the legacy product with a cloud-hosted commercial third-party SaaS solution.

Adım Adım Çözüm

1
Analyze the requirements for Workload 1.
The requirement is a quick migration of virtual machines without code or configuration changes. This corresponds directly to a Rehosting (lift-and-shift) migration strategy.
Rehosting is chosen when speed is the primary driver and minimal application changes are desired.
2
Analyze the requirements for Workload 2.
The requirement is to decommission the legacy workload entirely and adopt a commercially licensed SaaS replacement. This corresponds directly to a Repurchasing (drop-and-shop) migration strategy.
Repurchasing involves retiring a legacy application and moving to a new third-party product or service.

Anahtar Kavram

Identifying the AWS 6 Rs migration strategies based on business drivers and application requirements.
Soru 166Soru →

A startup is deploying a containerized microservices application using Amazon ECS on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Defining container task settings, including specifying the container images and CPU/memory allocations.; Configuring security groups to control network traffic to the container tasks.

Cevap

The customer is responsible for defining container task settings (such as specifying container images and resource allocations) and configuring security groups to control traffic to the tasks.
Under the AWS Shared Responsibility Model for serverless containers using Amazon ECS on AWS Fargate, AWS manages the underlying infrastructure, physical hosts, and host operating system patching. The customer is responsible for configuring the container task definitions (specifying the image, CPU, and memory) and setting up security groups to control network traffic to the tasks.

Adım Adım Çözüm

1
Identify the AWS service model type.
Amazon ECS on AWS Fargate is a serverless, managed compute service.
Understanding the service model helps determine where the boundary lies between customer and AWS responsibilities.
2
Separate infrastructure management from application and access configuration.
AWS manages physical security, hosts, hypervisors, and operating systems. The customer manages task configuration and access control (security groups).
In serverless container deployments, everything inside the container task definition and its network access rules remains the customer's responsibility.

Anahtar Kavram

Shared Responsibility Model
Tahmini Süre:1m 0s
Soru 167Soru →

A logistics company is containerizing its route-optimization API and deploying it using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team is establishing operational workflows to comply with the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer in this deployment model?

Cevabı ve açıklamayı göster

Cevap: Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.

Cevap

Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.
Under the AWS Shared Responsibility Model for AWS Fargate, AWS manages the physical security, hardware, virtualization hypervisor, and the host operating system. The customer remains fully responsible for everything inside the container, including application code, configuration settings, and patching the packages, libraries, and base operating system files included inside the container image itself.

Adım Adım Çözüm

1
Analyze the service type used in the scenario.
Amazon ECS with AWS Fargate launch type is a container execution environment that abstracts host provisioning and management (a managed/serverless model).
Determining the service type defines the boundary of customer responsibility.
2
Identify the boundary of control for AWS Fargate.
AWS manages the host operating system, hypervisor, and physical infrastructure. The customer retains control of the container definition, IAM policies, and container contents.
Differentiates 'security of the cloud' (AWS) from 'security in the cloud' (customer).
3
Evaluate each option against the customer/AWS boundary.
The container image contents (libraries, OS files in the image) are packaged by the customer, making image patching a customer task. Host OS patching and physical security are AWS tasks. NACLs cannot be applied at the task level.
Pinpoints the correct operational task that belongs to the customer.

Anahtar Kavram

Under the Shared Responsibility Model for AWS Fargate, the customer is responsible for security 'in' the container (such as patching the container image layers and configuration), while AWS is responsible for security 'of' the container host, virtualization, and physical infrastructure.
Tahmini Süre:2m 0s
Soru 168Soru →

A multinational logistics company is evaluating whether to build its own private cloud infrastructure or migrate to AWS. The Chief Financial Officer (CFO) argues that because the company is exceptionally large, it can negotiate hardware discounts directly with server manufacturers that will match the cost-efficiency of AWS. The lead cloud architect explains that AWS aggregates the resource usage of hundreds of thousands of active customers, allowing AWS to achieve a scale of purchasing power and operational efficiency that a single enterprise cannot replicate, resulting in lower pay-as-you-go prices for all customers. Which AWS Cloud benefit is the lead cloud architect describing?

Cevabı ve açıklamayı göster

Cevap: Benefit from massive economies of scale

Cevap

Benefit from massive economies of scale
The correct answer is the option stating 'Benefit from massive economies of scale'. Under this benefit, AWS aggregates the usage of hundreds of thousands of customers, allowing it to achieve higher economies of scale. This translates into lower pay-as-you-go prices for customers, which single enterprises cannot achieve on their own.

Adım Adım Çözüm

1
Analyze the scenario details to identify the core mechanism being described by the lead cloud architect.
The architect highlights that AWS aggregates resource usage from hundreds of thousands of customers to achieve massive purchasing power, resulting in lower pay-as-you-go prices.
Understanding the driver behind the cost reduction is necessary to map it to the correct AWS Cloud benefit.
2
Compare the architect's description against the definitions of the six AWS Cloud benefits.
The concept of aggregating multi-tenant demand to achieve higher purchasing power and lower unit costs maps directly to 'Benefit from massive economies of scale'.
This step ensures we select the benefit that matches the aggregation and cost reduction mechanism rather than general pay-as-you-go structures.
3
Evaluate the distractors to confirm they represent different concepts or misconceptions.
Trading fixed expense for variable expense represents the transition from CapEx to OpEx; stopping guessing capacity represents elasticity; and monolithic architecture is a design anti-pattern. None of these match the scenario's focus.
Verifying distractors eliminates potential ambiguity and confirms the correctness of the chosen option.

Anahtar Kavram

Benefit from massive economies of scale
Soru 169Soru →

A local healthcare provider is setting up access control for its staff in the AWS Cloud. The administrator needs to configure secure access for human users and application services while adhering to AWS Identity and Access Management (IAM) best practices. Which of the following actions represent AWS-recommended IAM security best practices for this setup? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) for all IAM users who have administrative permissions.; Assign IAM roles to application servers that require access to other AWS services instead of using long-term credentials.

Cevap

Enabling multi-factor authentication (MFA) for administrative accounts and assigning IAM roles to application servers needing access to AWS services.
The correct actions are enabling multi-factor authentication (MFA) for accounts with administrative privileges and assigning IAM roles to application servers. MFA provides a critical layer of defense-in-depth, while IAM roles supply temporary, rotating credentials to applications running on AWS, minimizing the threat of credential exposure.

Adım Adım Çözüm

1
Identify the security requirements for human administrative access versus application access in AWS.
Human users require secure administrative access, whereas applications require programmatic access to AWS services.
AWS separates access strategies for identity types to maintain strict credential isolation.
2
Apply the principle of least privilege and credential safety: require multi-factor authentication for administrative users to protect access, and use IAM roles to delegate temporary credentials to application servers.
MFA is configured for admin users, and IAM roles are assigned to the servers hosting the applications.
These steps ensure that administrators are strongly authenticated and that applications do not use hardcoded or permanent keys.

Anahtar Kavram

AWS IAM Security Best Practices
Tahmini Süre:1m 0s
Soru 170Soru →

A logistics enterprise is migrating its route optimization system to AWS. The enterprise wants to avoid paying for idle infrastructure during off-peak hours and needs the capability to deploy the system to new regional distribution centers across Europe and Asia within minutes.

Which of the following AWS Cloud benefits address these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Go global in minutes; Trade fixed expense for variable expense

Cevap

The benefits of going global in minutes and trading fixed expense for variable expense.
The requirements of deploying globally within minutes and avoiding fixed infrastructure expenses align with the AWS benefits of 'Go global in minutes' and 'Trade fixed expense for variable expense'. The former ensures rapid multi-region deployment, while the latter replaces capital expenses (CapEx) with operating expenses (OpEx).

Adım Adım Çözüm

1
Identify the key business requirements in the scenario.
The business needs to avoid upfront costs for idle systems during off-peak hours and quickly deploy systems globally to Europe and Asia.
Understanding the constraints is necessary to map them to specific cloud benefits.
2
Map the requirement of avoiding upfront costs and paying only for consumed resources to the appropriate AWS Cloud benefit.
This maps to 'Trade fixed expense for variable expense' (OpEx vs. CapEx).
AWS charges based on dynamic usage rather than forcing high initial capital expenditures.
3
Map the requirement of rapid multi-region global deployment to the appropriate AWS Cloud benefit.
This maps to 'Go global in minutes'.
AWS infrastructure allows instant deployment across multiple geographic regions to reduce latency.

Anahtar Kavram

Benefits of the AWS Cloud
Soru 171Soru →

A retail company's security team is auditing its AWS environment. An application hosted on Amazon EC2 instances must access a private Amazon S3 bucket to process transaction logs, and an external security consultant requires temporary access to review the IAM configurations. Which TWO of the following options represent AWS-recommended security practices to implement these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the EC2 instances that provides the minimum necessary permissions to access the S3 bucket.; Establish cross-account access by creating an IAM role that the external security consultant can assume.

Cevap

The correct practices are attaching an IAM role to the EC2 instances for secure S3 access and establishing cross-account access using an IAM role for the external consultant.
The recommended approach to secure application workloads on Amazon EC2 is to attach an IAM role, which automatically manages rotation of temporary credentials. To grant secure access to external auditors, companies should set up cross-account access via an IAM role with a trust policy, ensuring that the external partner uses their own account credentials to authenticate.

Adım Adım Çözüm

1
Identify the compute resource security requirements: For Amazon EC2 instances to access other AWS resources like S3, the recommended best practice is to delegate access via IAM roles, which leverage temporary credentials instead of hardcoded long-term keys.
Using IAM roles for EC2 instances removes the need to store long-term keys on the server.
This reduces the risk of credential exposure if the EC2 instance is compromised.
2
Identify the external access requirements: For third-party users or consultants who already have their own AWS accounts, cross-account IAM roles should be configured to allow access without creating local IAM users or sharing credentials.
Establishing cross-account IAM roles allows secure, auditable, and temporary access.
This follows the security principle of identity isolation and avoids sharing credentials or creating unnecessary IAM user profiles.

Anahtar Kavram

AWS IAM Best Practices for EC2 Instances and Cross-Account Access
Soru 172Soru →

An agricultural technology company is planning to migrate its IT portfolio to the AWS Cloud. The migration team has identified two specific workloads for the first phase:

* Workload 1: A weather data analysis tool that runs on standard Linux virtual machines. The company needs to migrate this application to AWS quickly to meet an upcoming data center lease expiration, keeping it exactly as-is with no changes to the application code, database, configuration, or architecture.
* Workload 2: A proprietary soil-sensor data processor. The development team plans to completely rewrite this application from scratch to implement a modern, serverless, microservices-based architecture using AWS Lambda and Amazon DynamoDB.

Which migration strategies should the company select for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting for Workload 1; Refactoring for Workload 2

Cevap

Rehosting for Workload 1 and Refactoring for Workload 2
The correct strategy for the first workload is Rehosting (lift-and-shift) because the workload must be migrated quickly to meet a deadline without any modifications to the code, configuration, or architecture. The correct strategy for the second workload is Refactoring (re-architecting) because the workload is being completely rewritten to utilize cloud-native features like serverless functions (AWS Lambda) and serverless databases (Amazon DynamoDB).

Adım Adım Çözüm

1
Analyze the requirements for Workload 1.
Workload 1 needs to be migrated to AWS quickly with zero changes to code, configuration, or architecture.
This matches the 'Rehosting' (lift-and-shift) migration strategy, where applications are moved to the cloud exactly as-is.
2
Analyze the requirements for Workload 2.
Workload 2 needs to be completely rewritten to adopt a serverless, microservices architecture using AWS Lambda and Amazon DynamoDB.
This matches the 'Refactoring' (re-architecting) strategy, where applications are modified or rewritten to leverage cloud-native features.
3
Identify and eliminate incorrect strategies.
Replatforming is incorrect for Workload 1 because it involves platform optimizations (like moving to managed services), which violates the 'no changes' constraint. Repurchasing is incorrect for Workload 2 because it refers to purchasing a different off-the-shelf product (such as SaaS) instead of custom rewriting. Retaining is incorrect because Workload 2 is actively being migrated and redesigned.
Ensures the correct classification of all migration strategies according to the AWS Cloud Adoption Framework.

Anahtar Kavram

AWS Migration Strategies (the 6 Rs)
Tahmini Süre:2m 0s
Soru 173Soru →

A shipping logistics company is deploying its microservices-based application using containers on AWS Fargate. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring the security groups to control inbound and outbound traffic to the running container tasks; Managing and patching the application code and libraries packaged inside the container images

Cevap

Under the AWS Shared Responsibility Model for AWS Fargate, the customer is responsible for configuring security groups to control network traffic to the container tasks, and managing and patching the application code and libraries packaged inside the container images.
Under the AWS Shared Responsibility Model for managed container services like AWS Fargate, AWS handles the host operating system, virtualization layer, and physical infrastructure security. The customer retains control and responsibility for security 'in' the cloud, which includes configuring network access rules via security groups to restrict traffic to the containers, and managing the security of the container contents, including patching application code and dependencies.

Adım Adım Çözüm

1
Analyze the service type in the scenario
AWS Fargate is a serverless compute engine for containers.
Understanding whether a service is IaaS, PaaS, or serverless/managed determines where the Shared Responsibility Model boundary lies.
2
Differentiate between AWS and customer responsibilities for Fargate
AWS manages the infrastructure layer (physical security, hardware, host OS, virtualization, container runtime). The customer manages the container contents (code, packages) and network access controls (security groups).
This establishes which tasks belong to each party under the model.
3
Evaluate the choices based on the established boundaries
Configuring security groups and patching application code/container images are customer responsibilities. Patching the host OS and managing physical hardware are AWS responsibilities. Accessing compliance documents is done via AWS Artifact, not Amazon Inspector.
This identifies the correct options and eliminates the incorrect distractors.

Anahtar Kavram

Shared Responsibility Model for Serverless Container Services (AWS Fargate)
Soru 174Soru →

A logistics company is migrating a legacy shipment-tracking application to AWS. The current application runs on a single high-capacity server that receives telemetry data, processes it, and updates a database. During peak periods, the server often runs out of memory, causing incoming telemetry data to be lost. The company wants to redesign the application to achieve the following:
1. Ensure telemetry data is never lost, even if downstream processing components fail or are temporarily unavailable.
2. Minimize operational overhead by avoiding the management of virtual servers for the processing and storage layers.
3. Automatically adjust resource capacity to match the volume of incoming data without manual intervention or over-provisioning.

Which architectural design on AWS best applies the cloud design principles of loose coupling, services not servers, and elasticity to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Ingest data using Amazon API Gateway, buffer messages in Amazon Simple Queue Service (SQS) to decouple the components, trigger AWS Lambda functions to process data, and store results in Amazon DynamoDB.

Cevap

Ingest data using Amazon API Gateway, buffer messages in Amazon Simple Queue Service (SQS) to decouple the components, trigger AWS Lambda functions to process data, and store results in Amazon DynamoDB.
The correct architecture uses Amazon SQS to buffer and decouple components (applying loose coupling), uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB (applying services not servers to eliminate server management), and relies on Lambda and DynamoDB's capability to dynamically scale to match demand (applying elasticity).

Adım Adım Çözüm

1
Analyze the requirement for ensuring data is not lost even if components fail or are unavailable.
Identify that the system needs asynchronous decoupling, which is achieved using message queues (Amazon SQS) to implement the 'loose coupling' design principle.
Loose coupling ensures that components can fail or scale independently without causing cascading failures or data loss.
2
Analyze the requirement to minimize operational overhead by avoiding virtual server management.
Select fully managed, serverless services such as Amazon API Gateway, AWS Lambda, and Amazon DynamoDB, applying the 'services, not servers' design principle.
Using managed services shifts the operational burden of provisioning, scaling, and patching physical or virtual servers to AWS.
3
Analyze the requirement to automatically adjust resource capacity to match the volume of incoming data without manual intervention or over-provisioning.
Ensure that the selected compute and database layers support dynamic scaling (elasticity), which AWS Lambda and Amazon DynamoDB naturally provide.
Elasticity allows the system to scale out to handle traffic spikes and scale in during idle times, avoiding both under-provisioning and wasted costs.

Anahtar Kavram

Applying core AWS Cloud design principles including loose coupling, services not servers, and elasticity to build resilient, serverless, and auto-scaling architectures.
Tahmini Süre:3m 0s
Soru 175Soru →

A retail company is planning to migrate its application portfolio to the AWS Cloud. The migration team has analyzed their current workload catalog and identified two specific systems for the initial phase:

1. A customer relationship management (CRM) database running on an on-premises Microsoft SQL Server. The team wants to move this database to Amazon RDS for SQL Server to reduce database administration overhead, without changing the application's underlying code or features.
2. A legacy reporting server that was used by a department that has since been dissolved, meaning the server is no longer used by any business unit.

Which two migration strategies should the company adopt for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replatforming; Retiring

Cevap

The correct strategies are Replatforming and Retiring.
The correct strategies are Replatforming and Retiring. Moving the SQL Server database to Amazon RDS for SQL Server is Replatforming because it optimizes the platform deployment (using managed database administration) without changing the core application logic. Decommissioning the reporting server that is no longer needed is Retiring.

Adım Adım Çözüm

1
Analyze the first workload requirement: Moving an on-premises database to Amazon RDS without modifying application code.
Identify that switching to a managed database service without changing core code is Replatforming (lift-tinker-and-shift).
Replatforming involves optimizing cloud operations by using managed services (like Amazon RDS) without full re-architecting.
2
Analyze the second workload requirement: Decommissioning an unused reporting server from a dissolved department.
Identify that turning off unused servers is Retiring.
Retiring is the strategy used for workloads that are no longer needed and can be turned off.

Anahtar Kavram

AWS Cloud Migration Strategies (6 Rs)
Soru 176Soru →

A healthcare organization is preparing for an external audit to verify HIPAA compliance for its cloud-based medical records application. The application's architecture consists of Amazon Elastic Compute Cloud (Amazon EC2) instances behind an Application Load Balancer, with data stored in an Amazon Aurora MySQL database cluster. To satisfy the audit, the organization must provide documentation of physical data center security, evidence of guest operating system patch compliance, and proof of data-in-transit encryption. Under the AWS Shared Responsibility Model, which combination of actions is the customer responsible for performing to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Retrieving AWS compliance reports from AWS Artifact, applying security patches to the guest operating system of the Amazon EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.

Cevap

The customer is responsible for retrieving AWS compliance reports from AWS Artifact, patching the guest operating system of the EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.
The correct option outlines customer responsibilities: retrieving third-party compliance reports from the self-service AWS Artifact portal, patching the guest operating system of EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer. Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers and the virtualization hypervisor layer), while the customer is responsible for security 'in' the cloud (guest operating systems, load balancer listener certificates, and network traffic protection).

Adım Adım Çözüm

1
Determine the resource-specific patching boundary.
Patching the guest operating system of Amazon EC2 instances is a customer responsibility (IaaS), whereas patching the underlying operating system of Amazon Aurora instances and hypervisors is managed by AWS.
AWS manages physical and virtualization layers, as well as managed database platforms, while customers must secure their own guest OS configurations on IaaS.
2
Identify the proper tool and responsibility for physical security verification.
AWS is responsible for physical data center security. Customers verify this compliance by downloading reports from AWS Artifact, not by requesting raw logs from support or security teams.
AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports.
3
Clarify the network security configuration responsibilities.
Enabling SSL/TLS certificates on the Application Load Balancer is a customer task. Additionally, security groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
AWS provides the load balancing infrastructure, but configuring secure listeners and certificate mapping is an application-level customer responsibility.

Anahtar Kavram

AWS Shared Responsibility Model boundaries across IaaS, PaaS, and compliance tasks
Tahmini Süre:2m 0s
Soru 177Soru →

An organization needs to grant a third-party security auditing application read-only access to review configuration metadata across all AWS resources in their production account. To comply with the AWS Shared Responsibility Model and Identity and Access Management (IAM) security best practices, which configuration should the cloud administrator implement?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.

Cevap

Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.
The correct option outlines the standard AWS security best practice for third-party integrations: creating an IAM role that delegates access using temporary security credentials. The trust policy defines who can assume the role, and the External ID provides an additional security layer (preventing the confused deputy problem) specifically designed for third-party SaaS integrations. The SecurityAudit policy ensures read-only access to resource metadata.

Adım Adım Çözüm

1
Determine the type of identity credential required for third-party SaaS integration.
Identify that an IAM role is required to establish secure cross-account delegation instead of creating a permanent IAM user or sharing root credentials.
Roles use temporary security credentials and are recommended for delegating access to external AWS accounts.
2
Select the appropriate trust mechanism and policy to ensure the principle of least privilege.
Create a trust policy specifying the third-party's AWS Account ID and an External ID, and attach a read-only policy such as SecurityAudit.
An External ID prevents the 'confused deputy' security vulnerability in multi-tenant SaaS environments, and the SecurityAudit policy ensures read-only metadata visibility.
3
Verify responsibility boundaries under the Shared Responsibility Model.
Confirm that the customer, not AWS Support, is responsible for executing this configuration.
Customer configuration of IAM identities, roles, and resource access policies is fully within the customer's domain of responsibility.

Anahtar Kavram

Delegating cross-account access to third-party integrations using IAM Roles and trust relationships.
Soru 178Soru →

A financial technology company is preparing for an annual security audit and needs to retrieve the latest AWS Service Organization Control (SOC) reports to verify AWS compliance. Which AWS service or portal provides on-demand access to these third-party audit reports?

Cevabı ve açıklamayı göster

Cevap: AWS Artifact

Cevap

AWS Artifact is the AWS portal that provides on-demand access to AWS compliance reports and agreements.
AWS Artifact is the primary, self-service portal for downloading AWS compliance documentation, such as SOC and PCI reports, which are necessary for proving compliance to auditors.

Adım Adım Çözüm

1
Identify the business requirement of retrieving external compliance reports (like SOC reports) for AWS infrastructure.
The requirement is to download third-party compliance documents demonstrating AWS security posture.
Knowing what document or certification is required helps identify the correct portal designed for compliance artifacts.
2
Select the specific AWS service that acts as the repository for audit reports and agreements.
AWS Artifact is identified as the service dedicated to providing AWS compliance reports.
AWS Artifact is the only self-service portal on AWS specifically designed to let customers download these reports directly.

Anahtar Kavram

AWS compliance reports and agreements retrieval via AWS Artifact
Tahmini Süre:1m 0s
Soru 179Soru →

A financial services organization is deploying AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) to enable single sign-on (SSO) for its cloud-based workloads. According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring trust relationships between the AWS Managed Microsoft AD domain and the organization's on-premises Active Directory domains.; Creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.

Cevap

The customer is responsible for configuring trust relationships between the AWS Managed AD domain and on-premises domains, and creating and managing Active Directory users, groups, and Group Policy Objects (GPOs) within the directory.
For AWS Managed Microsoft AD, the customer is responsible for defining directory configurations, which includes establishing trust relationships with on-premises directories and managing organizational units, users, groups, and Group Policy Objects (GPOs) inside the directory.

Adım Adım Çözüm

1
Identify the service classification under the AWS Shared Responsibility Model.
AWS Managed Microsoft AD is a managed service. Under this model, AWS manages the physical security, infrastructure, and operating system of the domain controllers, while the customer manages directory content and access configuration.
Managed services shift infrastructure management tasks, such as OS patching, from the customer to AWS.
2
Determine which options represent customer configuration rather than infrastructure maintenance.
Configuring domain trusts and managing AD objects (users, groups, GPOs) are configuration tasks. Patching domain controller operating systems, configuring subnet-level network rules at the instance level, and compiling data center physical compliance documentation are handled by AWS.
This isolates the administrative directory management duties that remain the customer's responsibility.

Anahtar Kavram

Shared Responsibility Model for Managed Services
Tahmini Süre:2m 0s
Soru 180Soru →

A retail company hosts its e-commerce website on Amazon Elastic Compute Cloud (Amazon EC2) instances. Under the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Cevabı ve açıklamayı göster

Cevap: Patching the guest operating system on the instances

Cevap

Patching the guest operating system on the instances
Under the AWS Shared Responsibility Model, Amazon EC2 is treated as an Infrastructure as a Service (IaaS). AWS is responsible for securing the underlying infrastructure (such as the hardware, physical data centers, and virtualization software), while the customer is responsible for configuring, updating, and patching the guest operating system that runs on the instance.

Adım Adım Çözüm

1
Identify the AWS service type being used in the scenario.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering.
The shared responsibility model boundaries vary depending on whether the service is IaaS, PaaS, or SaaS.
2
Determine the boundary of responsibility for IaaS services like Amazon EC2.
AWS manages security 'of' the cloud (hardware, virtualization, physical security), while the customer manages security 'in' the cloud (guest OS, application code, data configuration).
Since the customer has root access to the EC2 instances, they must configure and maintain the guest operating system.
3
Evaluate the choices to find the task that falls under security 'in' the cloud.
Patching the guest operating system is a customer responsibility, whereas physical security, host hardware replacement, and virtualization software maintenance are AWS responsibilities.
Guest OS updates require access to the instance's OS, which only the customer can configure.

Anahtar Kavram

AWS Shared Responsibility Model for IaaS (Amazon EC2)
ÖncekiSayfa 9 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin