Tüm alıştırma soruları

693 soru

Soru 1Soru

A cloud architect is reviewing the compute requirements for a media distribution platform. The platform has two distinct components:

1. A video rendering pipeline that requires deep customization of the underlying Linux kernel and direct access to physical GPU hardware resources.
2. A containerized metadata extraction service that runs on an event-driven basis in response to user uploads, with highly unpredictable traffic and a strict requirement to avoid managing host servers.

Which two of the following compute solutions should the architect select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon EC2 instances configured with custom Amazon Machine Images (AMIs) to support the required custom operating system kernel and GPU access; AWS Fargate to run the containerized metadata extraction service dynamically without provisioning or managing host servers

Cevap

The architect should select Amazon EC2 instances configured with custom Amazon Machine Images (AMIs) to support the custom operating system and GPU requirements, and AWS Fargate to run the containerized metadata extraction service dynamically without provisioning or managing host servers.
Selecting Amazon EC2 with custom AMIs and AWS Fargate is correct because EC2 provides the administrative access needed to customize the operating system kernel and utilize physical GPU instances, while AWS Fargate provides a serverless compute engine to run containerized workloads dynamically without host management.

Adım Adım Çözüm

1
Analyze the video rendering pipeline requirements: deep kernel customization and direct GPU hardware access.
Identify that a service granting full control over the guest operating system (IaaS) and supporting GPU hardware instances is required. Amazon EC2 meets these criteria.
Serverless or fully managed services do not allow direct kernel configuration or physical hardware mappings.
2
Analyze the metadata extraction service requirements: containerized, event-driven, unpredictable usage, and no host server management.
Identify that a serverless container orchestration platform is required. AWS Fargate runs containers without requiring instance management.
AWS Fargate manages the underlying compute infrastructure automatically, scaling to meet demand without operational overhead.
3
Evaluate the remaining options against the AWS Shared Responsibility Model and service limitations.
Eliminate the option suggesting AWS patches EC2 guest operating systems, and eliminate AWS Lambda due to its inability to run custom kernels or access physical GPU hardware.
Operating system patching on EC2 is a customer responsibility, and Lambda does not support the rendering workload's hardware and kernel needs.

Anahtar Kavram

Selecting appropriate AWS compute services based on operational control, infrastructure management boundaries, and application architecture.
Soru 2Soru

A global media network is migrating its digital publishing platform to AWS. The network needs to ensure that its primary publishing database is resilient against localized disasters, such as power grid failures or flooding, within its main operating market. Additionally, the network must deliver static image and video assets to a worldwide audience with minimal delay. Which of the following AWS Global Infrastructure design decisions will meet these requirements? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploying the primary database across multiple Availability Zones within a single AWS Region; Utilizing AWS Edge Locations to cache and serve static media assets globally

Cevap

Deploying the primary database across multiple Availability Zones within a single AWS Region, and utilizing AWS Edge Locations to cache and serve static media assets globally.
Deploying the primary database across multiple Availability Zones within a single AWS Region ensures high availability and resilience because each Availability Zone is physically isolated with independent infrastructure (power, cooling, network). Utilizing AWS Edge Locations to cache and serve static media assets globally reduces latency for international viewers by serving files from locations closer to them.

Adım Adım Çözüm

1
Analyze the high-availability requirement for the database.
Identify that protecting against localized disasters (power failures, flooding) within a market requires deploying resources across physically separated locations within the same region (Availability Zones).
Availability Zones are isolated locations within a geographic AWS Region that are connected through low-latency links but are on separate power and flood plains.
2
Analyze the low-latency content delivery requirement.
Identify that serving static images and videos to a worldwide audience with minimal delay requires caching content close to the users.
AWS Edge Locations cache content close to global end-users, reducing latency for static assets.

Anahtar Kavram

AWS Global Infrastructure components, specifically the distinction between AWS Regions, Availability Zones, and Edge Locations.
Soru 3Soru

A municipal utility enterprise operates a smart grid analytics platform. The workload fluctuates dramatically and unpredictably based on seasonal weather patterns, leading to periods where on-premises servers run at 95% capacity, followed by weeks of near-zero utilization. To address this, the enterprise wants to migrate to a model where they only pay for resources when they are actively consumed, eliminating the need to pre-allocate hardware. Furthermore, they are mandated to quickly replicate their software environment to support municipal grids across South America and Europe with sub-second response times. Which of the following core benefits of the AWS Cloud directly support the resolution of these operational challenges? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Stop guessing capacity; Go global in minutes

Cevap

The correct answers are the benefits to go global in minutes and to stop guessing capacity.
The correct options are stopping guessing capacity and going global in minutes. Stopping guessing capacity allows the utility enterprise to scale automatically to match variable workloads instead of maintaining idle on-premises hardware. Going global in minutes enables them to rapidly deploy applications to multiple global AWS Regions to reduce latency for municipal partners in South America and Europe.

Adım Adım Çözüm

1
Analyze the first requirement: dealing with dramatic, unpredictable workload fluctuations and eliminating pre-allocated hardware.
Identify that the ability to scale resources automatically to meet demand without upfront capacity planning corresponds to the AWS benefit of stopping guessing capacity.
This matches the operational challenge of weather-induced traffic spikes.
2
Analyze the second requirement: replicating the software environment across South America and Europe with sub-second response times.
Identify that the capability to deploy applications in multiple regions globally with minimal effort corresponds to the AWS benefit of going global in minutes.
This addresses the geographical expansion requirement with low latency.

Anahtar Kavram

Benefits of the AWS Cloud (Stop guessing capacity and Go global in minutes)
Tahmini Süre:2m 0s
Soru 4Soru

A media streaming company is redesigning its video processing and delivery platform to handle highly fluctuating demand. The platform experiences sudden spikes in traffic during popular video releases and very low traffic during off-peak hours. Which two architectural decisions align with the AWS Cloud design principles of elasticity and services not servers? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring Amazon EC2 Auto Scaling to dynamically adjust the number of active virtual servers in response to fluctuating user demand; Utilizing AWS Lambda to transcode short video clips serverlessly without provisioning or managing underlying virtual machines

Cevap

The correct architectural decisions are configuring Amazon EC2 Auto Scaling to dynamically adjust the number of active virtual servers in response to fluctuating user demand, and utilizing AWS Lambda to transcode short video clips serverlessly without provisioning or managing underlying virtual machines.
The correct choices are using Amazon EC2 Auto Scaling to dynamically adjust instance count, which is a direct application of elasticity, and using AWS Lambda to run code serverlessly, which applies the 'services, not servers' principle. Together, they allow the application to scale dynamically based on demand and minimize server management overhead.

Adım Adım Çözüm

1
Analyze the requirements in the scenario.
The platform needs to handle fluctuating traffic efficiently (demand spikes vs. off-peak lows) using elasticity and 'services not servers' principles.
Understanding the core cloud design principles requested is key to identifying correct answers.
2
Evaluate options for the elasticity principle.
Configuring Amazon EC2 Auto Scaling allows the platform to scale out/in automatically to match the demand curve, proving elastic.
Elasticity is the ability to match resource supply to demand dynamically.
3
Evaluate options for the 'services not servers' principle.
Utilizing AWS Lambda allows executing code serverlessly without managing underlying operating systems or virtual machines.
The 'services, not servers' principle advocates using managed and serverless offerings to reduce operational overhead.

Anahtar Kavram

AWS Cloud Design Principles: Elasticity and Services not Servers
Tahmini Süre:1m 30s
Soru 5Soru

A multi-department enterprise wants to secure its AWS environment by implementing the principle of least privilege and reducing security risks associated with credential management. The administrator must configure access for both developers (human users) and applications running on Amazon EC2 instances (machine identities). Which two methods represent AWS security best practices for managing these identities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use AWS IAM Identity Center to federate human identities and centrally manage user access to AWS accounts.; Attach an IAM role to the Amazon EC2 instances to provide applications with temporary security credentials.

Cevap

The correct practices are to use AWS IAM Identity Center for federated human access, and to attach IAM roles to Amazon EC2 instances for secure machine access using temporary credentials.
Centrally managing human user identities with AWS IAM Identity Center and using IAM roles to assign temporary credentials to EC2 instances are the industry-standard AWS best practices. They eliminate the need for permanent access keys, simplify credential rotation, and preserve detailed accountability in audit logs.

Adım Adım Çözüm

1
Analyze the requirements for human identities (developers).
Identify that AWS IAM Identity Center is the modern, recommended approach to centrally manage federated human access instead of creating static IAM users.
Reduces credential management overhead and aligns with the best practice of avoiding long-term IAM user credentials.
2
Analyze the requirements for machine identities (applications running on EC2 instances).
Identify that IAM roles should be attached to EC2 instances to provide temporary, automatically rotated security credentials.
Eliminates the risk of hardcoding or storing long-term API access keys in application configuration files.
3
Evaluate the incorrect choices to ensure they violate AWS security best practices.
Confirm that using the root user, sharing IAM accounts, or storing long-term access keys on EC2 instances are insecure configurations.
These practices increase the attack surface and violate the principles of least privilege and individual accountability.

Anahtar Kavram

AWS IAM best practices for securing human and machine access using federation and temporary credentials.
Soru 6Soru

A retail corporation is designing a hybrid cloud architecture and needs to secure its data at rest on AWS. The security compliance policy states that the keys used for encrypting financial transactions must be stored on dedicated, single-tenant cryptographic hardware controlled entirely by the customer. However, for standard application logs stored in Amazon S3, the company wants to use a fully managed service where AWS handles the physical hardware management, but the customer retains control over key policies and rotation.

Which two of the following actions should the company take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions.; Use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.

Cevap

Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions, and use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys. AWS CloudHSM satisfies the need for dedicated, single-tenant hardware cryptographic keys controlled entirely by the customer. AWS KMS with customer managed keys satisfies the requirement for a fully managed multi-tenant key service where AWS manages the underlying HSM hardware while the customer retains control over key policies and key rotation.

Adım Adım Çözüm

1
Analyze the encryption requirements for the financial transaction keys.
The requirement specifies dedicated, single-tenant cryptographic hardware controlled entirely by the customer, which points directly to AWS CloudHSM.
AWS CloudHSM is a dedicated HSM service that gives the customer exclusive administrative control.
2
Analyze the encryption requirements for the application logs stored in Amazon S3.
The requirement specifies a fully managed service where AWS manages the hardware, but the customer controls key policies and rotation. This aligns with AWS KMS customer managed keys.
AWS KMS customer managed keys are managed by the customer but run on AWS-managed multi-tenant HSM infrastructure.
3
Select the correct combination of AWS services that fulfill both conditions.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys.
This combination successfully meets both dedicated and fully-managed encryption needs.

Anahtar Kavram

Selecting appropriate AWS services (AWS KMS vs. AWS CloudHSM) based on multi-tenant versus single-tenant encryption hardware requirements under the shared responsibility model.
Soru 7Soru

A community theater company plans to migrate its ticketing platform to AWS. The platform receives extremely high volumes of traffic during the first hour of ticket releases for major shows, but experiences negligible traffic during the rest of the month. The theater needs to avoid paying for idle infrastructure and eliminate upfront server procurement costs.

Which two AWS cloud economics concepts or benefits should the theater leverage to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replacing upfront capital expenses with variable operational expenses; Leveraging elasticity to dynamically adjust resource capacity to match actual demand

Cevap

The theater company should replace upfront capital expenses with variable operational expenses, and leverage elasticity to dynamically adjust resource capacity to match actual demand.
The correct options identify two core AWS cloud economics benefits: shifting upfront capital expenses (CapEx) to variable operational expenses (OpEx), and using elasticity to scale resources dynamically. By trading capital expenses for operational expenses, the theater avoids upfront server purchasing costs. By leveraging elasticity, the ticketing system dynamically provisions resources to handle the sudden burst of ticket buyers and downscales during idle periods to prevent wasted expenditures.

Adım Adım Çözüm

1
Analyze the financial constraint of avoiding upfront server procurement costs.
Trading upfront hardware costs for variable billing maps to the concept of shifting capital expenses (CapEx) to operational expenses (OpEx).
AWS allows businesses to pay as they go rather than buying hardware before using it.
2
Analyze the operational constraint of handling high traffic surges while minimizing idle resource costs.
Scaling resources up and down to match demand maps to the concept of elasticity.
Elasticity prevents paying for unused, running infrastructure during periods of low activity.

Anahtar Kavram

AWS Cloud Economics (CapEx to OpEx shift and Elasticity)
Tahmini Süre:1m 0s
Soru 8Soru

NovaSprout Organics, a distributor of organic produce, is migrating its operations to the AWS Cloud. The IT department has finalized plans for two distinct workloads:

1. The company's core inventory tracking database will be moved to Amazon RDS to eliminate the administrative burden of backups and patching, while keeping the database engine and application code unchanged.
2. The legacy customer relationship management (CRM) system, which is complex and expensive to maintain on-premises, will be decommissioned in favor of a cloud-based CRM software-as-a-service (SaaS) application.

Which two migration strategies are being utilized by NovaSprout Organics? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replatforming; Repurchasing

Cevap

Replatforming and Repurchasing are the migration strategies utilized in this scenario.
Replatforming is the correct strategy for the database migration because the company is moving the database to a managed service (Amazon RDS) to reduce administrative overhead while keeping the application code unchanged. Repurchasing is the correct strategy for the CRM system because the company is decommissioning its legacy on-premises system and replacing it with a third-party Software as a Service (SaaS) application.

Adım Adım Çözüm

1
Analyze the database migration: The workload is moved to Amazon RDS (a managed database service) to reduce administrative tasks, but the engine and code remain unchanged.
Identify this as Replatforming (lift-tinker-and-shift), which involves optimizing a workload during migration without rewriting application code.
To classify the first workload's migration strategy.
2
Analyze the CRM system migration: The legacy system is decommissioned and replaced by a third-party CRM Software-as-a-Service (SaaS) product.
Identify this as Repurchasing (drop-and-shop), which involves moving to a different product, typically a SaaS platform.
To classify the second workload's migration strategy.
3
Select the two options that correspond to the identified strategies.
Select the options representing Replatforming and Repurchasing.
To provide the final correct answer keys.

Anahtar Kavram

Identifying cloud migration strategies (the 6 Rs), specifically Replatforming and Repurchasing.
Tahmini Süre:1m 30s
Soru 9Soru

A logistics company, RouteLogix, runs a fleet management application that processes vehicle telemetry. The application requires high compute capacity to run route optimization algorithms for 4 hours every morning. During the rest of the day, the system only requires minimal resources to receive and store GPS location pings. The company's management wants to understand the economic impact of migrating this workload from their on-premises data center to AWS. Which of the following describe the financial benefits of this migration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The company can eliminate cost overhead from idle compute capacity by dynamically scaling resources down when the optimization algorithms are not running.; The company shifts from upfront capital expenditures (CapEx) for physical server procurement to variable operating expenditures (OpEx) based on actual compute usage.

Cevap

The correct options are the statements describing how the company can eliminate cost overhead from idle compute capacity by dynamically scaling resources down, and how the company shifts from upfront capital expenditures (CapEx) to variable operating expenditures (OpEx).
The correct answer identifies the fundamental cloud economic principles of elasticity and shifting CapEx to OpEx. By utilizing elasticity, the company stops paying for idle compute capacity during the 20 hours of low daily utilization. Additionally, paying for AWS resources on-demand shifts upfront capital investments in physical hardware to operational expenses based on actual usage.

Adım Adım Çözüm

1
Analyze the workload requirements of RouteLogix.
The workload has a high requirement for 4 hours and minimal requirements for the remaining 20 hours.
Identifying the variability of the workload helps determine the relevance of elasticity and compute demand matching.
2
Evaluate the financial transition from on-premises to AWS.
On-premises requires buying physical hardware for peak capacity (CapEx), leading to idle resources. AWS allows pay-as-you-go billing (OpEx) and dynamic resource scaling (elasticity).
This matches the target economic principles: shifting CapEx to OpEx and maximizing savings through elasticity.

Anahtar Kavram

Understand concepts of cloud economics (CapEx to OpEx shift and the financial benefit of elasticity)
Tahmini Süre:1m 30s
Soru 10Soru

A logistics company manages separate AWS accounts for its shipping, tracking, and warehousing divisions. The finance department wants to simplify its payment process and lower overall costs.

Which of the following are benefits of combining these accounts under a single organization using AWS Organizations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Receiving a combined bill for all member accounts instead of separate invoices for each division; Aggregating resource usage across all linked accounts to meet thresholds for volume tier discounts

Cevap

Consolidating payments into a single combined invoice and aggregating usage to qualify for volume tier discounts are both key benefits of consolidated billing in AWS Organizations.
Consolidated billing under AWS Organizations provides two primary financial benefits: it combines the billing of multiple member accounts into a single management account invoice (simplifying payment processing), and it aggregates the resource usage of all member accounts to help the company qualify for volume pricing discounts (such as tiered rates for storage or data transfer).

Adım Adım Çözüm

1
Analyze the company's requirement to simplify payments and reduce costs across multiple AWS accounts.
The requirement points to features of consolidated billing and AWS Organizations.
AWS Organizations allows linking multiple accounts to centralize billing and administration.
2
Identify which options describe valid benefits of consolidated billing in AWS Organizations.
Receiving one combined invoice simplifies payments, and aggregating usage across accounts helps qualify for volume-based pricing discounts.
These are direct, documented features designed to reduce administrative overhead and cost.
3
Evaluate the distractors to ensure they describe incorrect features or security models.
AWS Organizations does not automatically sync IAM users, root users cannot be deleted, and AWS retains sole responsibility for physical hardware.
Verifying the invalid options ensures that only the two correct answers are selected.

Anahtar Kavram

Unified billing and AWS Organizations benefits, specifically combined invoicing and aggregated volume pricing.
Tahmini Süre:1m 0s
Soru 11Soru

A medical research company is designing a new cloud architecture on AWS to handle two distinct processing tasks:

1. A batch processing job that performs genome sequencing simulations. This job must run on a custom Linux distribution with a modified kernel and runs continuously for several days.
2. An image processing task that automatically runs whenever a patient uploads a medical scan to an Amazon S3 bucket. The execution time is less than a minute, and uploads occur sporadically throughout the day.

Which two AWS compute services should the company use to support these workloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic Compute Cloud (Amazon EC2); AWS Lambda

Cevap

Amazon Elastic Compute Cloud (Amazon EC2) and AWS Lambda are the correct selections.
Amazon Elastic Compute Cloud (Amazon EC2) is correct because it provides full administrative access and allows running custom operating system kernels, which is required for the genome sequencing simulations. AWS Lambda is correct because it is a serverless, event-driven service that automatically runs code in response to Amazon S3 uploads and scales dynamically.

Adım Adım Çözüm

1
Analyze the first requirement: genome sequencing simulations running on a custom Linux distribution with a modified kernel for several days.
Identify that this requires full control over the operating system and kernel-level customization, which is uniquely supported by virtual machines.
Managed or serverless services do not allow modification of the underlying operating system kernel.
2
Analyze the second requirement: image processing running sporadically in response to Amazon S3 uploads, executing in under a minute.
Identify that this requires an event-driven, serverless compute service that runs code only when triggered.
A serverless service provides a cost-effective, scalable, and zero-administration solution for short-lived, event-driven tasks.

Anahtar Kavram

Selecting appropriate AWS compute services based on operating system control requirements and execution patterns (continuous vs. event-driven).
Soru 12Soru

An enterprise retail organization is preparing to deploy an e-commerce platform on AWS. The design includes running application containers on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate launch type across two AWS Regions, storing structured product catalogs in Amazon Aurora, and storing media assets in Amazon Simple Storage Service (Amazon S3). Before deploying any services or writing code, the cloud financial operations team must estimate the monthly costs for this hypothetical infrastructure.

Which of the following actions should the team perform to model and estimate these projected costs? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the AWS Pricing Calculator to input the estimated container count, vCPU/memory requirements, database storage size, and data transfer volumes between regions to generate a monthly cost estimate.; Configure different groups of services and resource estimates in the AWS Pricing Calculator to compare the cost differences of deploying the architecture across multiple AWS Regions.

Cevap

To estimate these projected costs, the team should use the AWS Pricing Calculator to input the estimated resource specifications (such as container count, vCPU/memory, database size, and data transfer volumes) and configure service groups to compare costs across different AWS Regions.
The AWS Pricing Calculator is the primary tool for estimating the cost of AWS services before they are deployed. It allows users to create cost estimates for hypothetical architectures by specifying configurations such as the number of ECS containers, Fargate vCPU/memory requirements, database storage size, and S3 storage classes. It also supports grouping resources to compare costs across different AWS Regions or deployment configurations, helping teams make informed architectural decisions based on projected expenses.

Adım Adım Çözüm

1
Identify the requirements of the scenario, which is estimating the monthly costs of a hypothetical, pre-deployment multi-region application architecture.
The scenario requires a planning and cost estimation tool for future configurations rather than tracking actual historical spending.
Since no resources have been deployed yet, tools that track existing resources cannot be used.
2
Evaluate the capabilities of the AWS Pricing Calculator for the scenario.
The AWS Pricing Calculator can model hypothetical workloads, including Amazon ECS, AWS Fargate, Amazon Aurora, and Amazon S3 across multiple regions, allowing the team to estimate monthly costs and compare different region configurations.
This directly aligns with the need to generate pre-deployment cost projections based on custom resource settings.
3
Differentiate the AWS Pricing Calculator from post-deployment billing and monitoring tools like AWS Cost Explorer and the AWS Cost & Usage Report, and verify economic principles.
Eliminate options suggesting the use of historical monitoring or reporting tools, as well as capital expense planning for physical hardware.
Post-deployment tools require active resources to generate data, and AWS operates on an operating expense (OpEx) model rather than a capital expense (CapEx) hardware purchasing model.

Anahtar Kavram

Estimating pre-deployment costs of hypothetical workloads using the AWS Pricing Calculator.
Tahmini Süre:2m 30s
Soru 13Soru

A fitness technology company is launching a new health-tracking application that collects workout data from smartwatches. To handle unpredictable traffic spikes during morning workouts and prevent data loss if a processing server fails, the development team wants to implement core AWS Cloud design principles. Which two of the following architectural strategies represent the correct application of these design principles? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon Simple Queue Service (Amazon SQS) to buffer incoming metrics and decouple the data ingestion layer from the backend processing servers.; Configure Amazon EC2 Auto Scaling to dynamically adjust the number of instances based on real-time application load.

Cevap

Deploying Amazon Simple Queue Service (Amazon SQS) to buffer incoming metrics and decouple layers, and configuring Amazon EC2 Auto Scaling to dynamically adjust instance count.
Deploying Amazon SQS to buffer incoming metrics decouples the ingestion layer from the processing backend, adhering to the principle of loose coupling and ensuring that data is not lost if backend servers fail. Configuring Amazon EC2 Auto Scaling allows the system to scale out or in dynamically in response to workload demands, adhering to the principle of elasticity.

Adım Adım Çözüm

1
Analyze the business and technical requirements of the fitness tracking application, which include handling unpredictable traffic spikes and preventing data loss during server failures.
Identified the need for elasticity to handle traffic spikes and loose coupling/design for failure to prevent data loss.
Aligns the application scenario with core AWS design principles.
2
Evaluate the architectural options against AWS design principles.
Determined that using Amazon SQS to buffer metrics decouple components (loose coupling), and Amazon EC2 Auto Scaling to dynamically scale compute capacity (elasticity), directly address the requirements.
Identifies the correct cloud architecture practices.

Anahtar Kavram

AWS Cloud design principles such as loose coupling, design for failure, and elasticity enable resilient, scalable, and cost-effective cloud architectures.
Soru 14Soru

A retail company is migrating its customer database to Amazon RDS for PostgreSQL to reduce administrative overhead. Which two of the following tasks are the responsibility of the customer under the AWS Shared Responsibility Model?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Managing database user accounts, permissions, and access controls within the database engine; Configuring database security groups to control incoming network traffic to the RDS instance

Cevap

Managing database user accounts, permissions, and access controls within the database engine, as well as configuring database security groups to control incoming network traffic to the RDS instance, are both responsibilities of the customer.
For managed services like Amazon RDS, AWS manages the host operating system, patching, and physical infrastructure. The customer remains responsible for configuration tasks within the database engine (such as user accounts, roles, and privileges) and controlling network access to the database instance using database security groups.

Adım Adım Çözüm

1
Identify the type of service being deployed.
Amazon RDS is a managed database service (PaaS).
The boundary of responsibility shifts depending on whether the service is IaaS (like EC2) or PaaS (like RDS).
2
Determine the split of responsibilities for Amazon RDS.
AWS handles physical security, infrastructure, operating system maintenance, and database patching. The customer handles database configuration, database-level security groups, data encryption, and user access management.
This determines which options represent customer tasks rather than AWS tasks.
3
Evaluate the choices based on the determined responsibilities.
Managing database user accounts/permissions and configuring database security groups are customer tasks. Operating system patching, physical storage drive replacement, and retrieving raw physical facility logs are AWS tasks.
This confirms the correct options.

Anahtar Kavram

Under the AWS Shared Responsibility Model for managed database services (RDS), AWS manages the infrastructure, OS patching, and physical hardware, while the customer manages database access, application configuration, and network security groups.
Tahmini Süre:1m 30s
Soru 15Soru

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.; Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.

Cevap

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Adım Adım Çözüm

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Anahtar Kavram

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Soru 16Soru

A global online learning platform hosts virtual classrooms on Amazon EC2 instances and stores course materials in Amazon S3 buckets. The security team needs to implement a solution that continuously scans their EC2 instances for software vulnerabilities and unintended network exposure. Additionally, they must identify potential security threats across their AWS accounts, such as cryptocurrency mining or brute-force attacks, using machine learning and threat intelligence. Which combination of AWS services will address these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Inspector; Amazon GuardDuty

Cevap

Amazon Inspector and Amazon GuardDuty
Amazon Inspector and Amazon GuardDuty together fulfill both security objectives. Amazon Inspector acts as a static and dynamic vulnerability scanner for EC2 instances and ECR container images to locate software flaws. Amazon GuardDuty acts as an intelligent threat detector that analyzes active telemetry logs to identify operational and account-level security threats in real time.

Adım Adım Çözüm

1
Analyze the requirement for scanning EC2 instances for software vulnerabilities and network reachability issues.
Identify Amazon Inspector as the designated AWS service for automated host vulnerability assessment.
Amazon Inspector automatically discovers EC2 instances and scans them against a database of known vulnerabilities (CVEs) and evaluates network exposure configurations.
2
Analyze the requirement for detecting active threats, suspicious API calls, cryptomining, and brute-force attempts across the AWS account.
Identify Amazon GuardDuty as the primary intelligent threat detection service.
Amazon GuardDuty processes logs (such as VPC Flow Logs, CloudTrail, and DNS logs) using threat intelligence and machine learning to flag abnormal or malicious activity.

Anahtar Kavram

Vulnerability scanning of virtual servers versus intelligent, log-based cloud threat detection.
Soru 17Soru

A retail company is auditing its AWS account to align with AWS Identity and Access Management (IAM) security best practices. Currently, developers use shared credentials for daily administrative tasks, and multi-factor authentication (MFA) is not enabled on the account. Which of the following actions should the company perform to secure their environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to only specific tasks that require root credentials.; Configure AWS IAM Identity Center to delegate daily administrative access to developers using temporary security credentials.

Cevap

To secure the AWS environment, the company should enable multi-factor authentication (MFA) on the AWS account root user and restrict its use, and configure AWS IAM Identity Center to delegate daily administrative access using temporary credentials.
The correct actions are to enable multi-factor authentication (MFA) on the root user to secure the account, and to set up AWS IAM Identity Center to manage developer access. This ensures that developers use temporary, unique credentials for daily operations instead of sharing permanent administrative access.

Adım Adım Çözüm

1
Identify root user credentials security requirements.
Determine that the root user should have MFA enabled and must not be used for daily operations.
Root user credentials have complete administrative access across the entire account and represent a high security risk if compromised.
2
Analyze credential management for daily developer operations.
Determine that developers should use temporary credentials managed via AWS IAM Identity Center rather than permanent or shared keys.
Using temporary credentials minimizes the risk of credential leakage and aligns with the principle of least privilege.

Anahtar Kavram

Implementing IAM best practices including securing the root account with MFA and utilizing temporary credentials via identity federation or IAM Identity Center.
Tahmini Süre:1m 0s
Soru 18Soru

A media company is planning to migrate its application portfolio to the AWS Cloud and wants to minimize implementation time and effort. Which TWO migration strategies should the company use to migrate its workloads with either zero changes to the underlying code, or only minor optimizations to use managed services without changing the core application architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rehosting; Replatforming

Cevap

The correct strategies are Rehosting and Replatforming.
The correct strategies are Rehosting and Replatforming. Rehosting, often called 'lift-and-shift', moves the application directly to the cloud without modifying its architecture or code. Replatforming, or 'lift-tinker-and-shift', introduces minor optimizations to take advantage of managed services (such as migrating a database to Amazon RDS) without altering the application's core architecture.

Adım Adım Çözüm

1
Analyze the migration requirements in the scenario.
The company wants to migrate workloads with either zero changes to code or only minor optimizations to use managed services, without altering the core application architecture.
This establishes the constraints of the migration, ruling out strategies that require code rewriting or vendor changes.
2
Evaluate the 6 Rs migration strategies against these requirements.
Rehosting ('lift-and-shift') requires no changes. Replatforming ('lift-tinker-and-shift') involves only minor optimizations (like adopting managed services) without changing the core architecture. Refactoring requires re-architecting/code changes, Repurchasing changes the application to a new product (SaaS), and Retaining leaves the application on-premises.
To select the two correct strategies that fit the criteria.

Anahtar Kavram

Cloud migration strategies (the 6 Rs), specifically Rehosting and Replatforming, which minimize changes to code and architecture during migration.
Tahmini Süre:45s
Soru 19Soru

A startup is building a new mobile application backend on AWS. The startup wants to focus on writing code and minimizing infrastructure management while automatically handling fluctuating user demands. Which two of the following design decisions align with AWS cloud design principles to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the application code on AWS Lambda to run without provisioning or managing servers; Configure Amazon EC2 Auto Scaling to automatically adjust compute capacity based on live traffic

Cevap

Deploying the application code on AWS Lambda to run without provisioning servers and configuring Amazon EC2 Auto Scaling to adjust capacity based on traffic are the correct answers.
The correct options are deploying application code on AWS Lambda and configuring Amazon EC2 Auto Scaling. AWS Lambda aligns with the 'services, not servers' design principle by eliminating server management tasks, while Auto Scaling aligns with the 'elasticity' principle by matching resource capacity to demand dynamically.

Adım Adım Çözüm

1
Analyze the scenario requirements: minimize infrastructure management overhead and automatically handle fluctuating demand.
Identified two primary design goals: adopting managed services ('services, not servers') and utilizing dynamic scaling ('elasticity').
This sets the target criteria for the correct options.
2
Evaluate the option regarding running serverless code.
AWS Lambda is a serverless service that aligns with the 'services, not servers' principle, removing the need to manage infrastructure.
This matches the goal of minimizing server management overhead.
3
Evaluate the option regarding automatic scaling.
Amazon EC2 Auto Scaling dynamically scales resources, which aligns with 'elasticity'.
This matches the goal of automatically handling fluctuating user demands.

Anahtar Kavram

AWS Cloud design principles including 'services, not servers' and 'elasticity'.
Soru 20Soru

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with permissions to read the database and attach it to the EC2 instance.; Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.

Cevap

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Adım Adım Çözüm

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Anahtar Kavram

Identity and Access Management (IAM) Best Practices
Sayfa 1 / 35Sonraki
Tüm alıştırma soruları — AWS Certified Cloud Practitioner | Examkin