Amazon Practice Questions, Discussions & Exam Topics by our Authors
A user wants to invoke an AWS Lambda function when an Amazon EC2 instance enters the =E2=80=9Cstopping=E2=80=9D state....
The user wants to invoke an AWS Lambda function when an Amazon EC2 instance enters the "stopping" state. This implies the need for an event-driven approach that can monitor EC2 state changes and trigger Lambda based on these changes. Let’s analyze each service option based on this requirement:
A) Amazon EventBridge
- Selected: Amazon EventBridge (formerly known as CloudWatch Events) is the most appropriate service for this use case. EventBridge can listen for state changes of AWS resources like EC2 instances. You can set up a rule to detect when an EC2 instance enters the "stopping" state and invoke a Lambda function in response. This is a highly scalable and flexible event-driven service that integrates well with Lambda.
- Scenario: This is the ideal solution for event-driven architectures. When an EC2 instance enters a specific state (like "stopping"), EventBridge can trigger actions, such as invoking a Lambda function, making it perfect for this use case.
B) AWS Config
- Rejected: AWS Config is a service that helps with auditing and tracking the configuration of AWS resources over time. It records configuration changes and allows you to assess resource compliance with defined rules. However, it is not designed for real-time event detection or triggering Lambda functions based on state changes. AWS Config would be useful if you needed to track EC2 instance states for compliance purposes, but not for triggering real-time actions like invoking Lambda.
- Scenario: AWS Config could be used to audit configuration changes over time, but it’s not designed for triggering real-time actions based on EC2 state changes.
C) Amazon Simple Notification Service (Amazon SNS)
- Rejected: Amazon SNS is a messaging servic...
Author: Liam · Last updated Jul 11, 2026
A company has a MariaDB database on premises. The company wants to move the data to the AWS Cloud.Which AWS service will host this...
To determine the best AWS service for hosting a MariaDB database with the least amount of operational overhead, we need to assess several factors such as the nature of the workload, the level of management required, the ease of migration, and the specific database requirements.
Option Analysis:
A) Amazon RDS (Relational Database Service):
- Use Case: Amazon RDS is specifically designed to manage relational databases such as MariaDB, MySQL, PostgreSQL, and others with minimal administrative overhead.
- Advantages:
- Managed Service: AWS handles backups, patching, monitoring, and scaling automatically, reducing operational overhead.
- MariaDB Support: RDS directly supports MariaDB, making it easy to migrate the on-premises MariaDB database to the cloud.
- High Availability: With options like Multi-AZ deployments, RDS offers high availability and automatic failover.
- Cost-Effective: You pay for what you use (instance, storage, I/O requests), and it's a managed service that reduces administrative costs.
- Effort & Time: The least amount of effort and time required to migrate and manage a MariaDB database on RDS compared to other options.
- Scenario: Ideal for companies looking to migrate an existing MariaDB database to the cloud without heavy management overhead.
B) Amazon Neptune:
- Use Case: Amazon Neptune is a graph database service, designed for storing and querying highly connected data (e.g., social networks, fraud detection).
- Reasons for Rejection:
- Not Relational: It does not support relational databases like MariaDB, so it is not suitable for hosting a MariaDB database.
- Migration Issues: Moving from MariaDB to Neptune woul...
Author: Vikram · Last updated Jul 11, 2026
Which AWS service or feature supports governance, compliance, and risk auditing of AWS accounts?
To determine which AWS service or feature supports governance, compliance, and risk auditing of AWS accounts, we need to consider the core functionalities of these services and how they contribute to these specific areas. Let's analyze each option carefully based on its purpose, operational overhead, cost, and relevance to governance, compliance, and auditing.
Option Analysis:
A) Multi-factor authentication (MFA):
- Use Case: MFA is a security feature that adds an additional layer of authentication to secure access to AWS accounts or services.
- Advantages:
- Security: Enhances security by requiring users to provide two or more forms of verification (e.g., password and a one-time passcode from a device).
- Compliance: MFA is often required for regulatory compliance (e.g., PCI DSS, HIPAA).
- Reasons for Rejection:
- Limited Scope: While MFA helps secure access, it is not a comprehensive solution for governance, compliance, or auditing. It does not track activities or provide detailed logs for auditing purposes.
- Does not address all governance and compliance needs: It only focuses on authentication security and does not provide risk auditing or detailed activity tracking.
B) AWS Lambda:
- Use Case: AWS Lambda is a serverless compute service that allows you to run code in response to events without provisioning servers.
- Advantages:
- Event-driven: Lambda can be triggered by events from other AWS services, enabling automation and integration with other services.
- Reasons for Rejection:
- Not designed for auditing: AWS Lambda is focused on running code, not for providing governance, compliance, or risk auditing features. While it can help automate actions based on events, it doesn't offer the audit logs or compliance management features required.
- Limited scope: Lambda doesn't inherently provide tools for tracking or governing AWS account activities.
C) Amazon Simple Notification Service (Amazon SNS):
- Use Case: Amazon SNS is a fully managed messaging service that enables the sending of notifications to various recipients (e.g., emails, SMS, HTTP endpoints).
- Advantages:
- Communication: Hel...
Author: BlazingPhoenix22 · Last updated Jul 11, 2026
Which AWS Cloud design principle is a company using when the company implements AWS CloudTrail?
To determine the AWS Cloud design principle that a company is using when implementing AWS CloudTrail, let's analyze each of the design principles in the context of what AWS CloudTrail does and how it aligns with best practices in cloud architecture.
Option Analysis:
A) Activate traceability:
- Use Case: This design principle emphasizes the importance of monitoring and tracking activities within the cloud environment. Implementing AWS CloudTrail directly aligns with this principle because CloudTrail records API calls made within your AWS account, providing detailed logs that enable traceability of all user actions, service calls, and changes to resources.
- Advantages:
- Direct Fit: CloudTrail is specifically designed to provide traceability by logging every action taken in the AWS environment. This includes who did what, when, and from where, which is essential for security auditing, troubleshooting, and compliance.
- Audit and Compliance: This principle is foundational to governance and compliance, as it ensures that every change and access request can be traced and reviewed.
- Operational Oversight: It helps companies ensure accountability and provides transparency into their cloud operations, making it easier to monitor and audit AWS resources.
B) Use serverless compute architectures:
- Use Case: This principle advocates for the use of serverless services like AWS Lambda to avoid managing the underlying infrastructure.
- Reasons for Rejection:
- Not Related to CloudTrail: AWS CloudTrail is a logging and auditing service, not a compute service. It doesn't focus on serverless computing or infrastructure management.
- Differ...
Author: Madison · Last updated Jul 11, 2026
A company needs a threat detection service that will continuously monitor its AWS accounts, workloads, and Amazon S3 buckets for malicious activity and...
To determine which AWS service meets the requirements of continuously monitoring AWS accounts, workloads, and Amazon S3 buckets for malicious activity and unauthorized behavior, we need to understand the capabilities and focus of each service in relation to threat detection.
Option Analysis:
A) AWS Shield:
- Use Case: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service designed to protect AWS resources from DDoS attacks.
- Reasons for Rejection:
- Limited Scope: While AWS Shield provides protection against DDoS attacks, it does not focus on broader threat detection, malicious activity monitoring, or unauthorized behavior across AWS accounts or workloads.
- Not for Continuous Monitoring: AWS Shield is not a service for continuous monitoring of malicious activities or for auditing behaviors in AWS accounts and S3 buckets.
B) AWS Firewall Manager:
- Use Case: AWS Firewall Manager is a security management service that simplifies the management of AWS WAF (Web Application Firewall), AWS Shield Advanced, and VPC security groups across multiple accounts.
- Reasons for Rejection:
- Configuration & Management: Firewall Manager is primarily focused on managing firewall rules and security group settings across multiple AWS accounts. It is not designed for continuous monitoring of malicious activity or unauthorized behaviors.
- Not a Threat Detection Service: While it helps enforce security policies, it does not actively detect threats or analyze the behavior within AWS accounts and S3 buckets.
C) Amazon GuardDuty:
- Use Case: Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts, workloads, and data stored in Amazon S3 for malicious or unauthorized activity.
- Advantages:
- Continuous Monitoring: GuardDuty actively monitors AWS accounts, workloads, and Amazon S3 buckets for suspicious activity, such as unauthorized access or anomalous behaviors.
- Integrated with AWS Services: It integrates seamlessly with other AWS services such as AWS CloudTrail, VPC F...
Author: Ishaan · Last updated Jul 11, 2026
A company is planning to migrate to the AWS Cloud. The company is conducting organizational transformation and wants to become more responsive to customer inquiries and feedback.Which task should the company pe...
To determine the most appropriate task for the company to meet its requirements—becoming more responsive to customer inquiries and feedback—based on the AWS Cloud Adoption Framework (AWS CAF), we need to consider how the framework guides organizational transformation and alignment with business objectives. The company is aiming to become more responsive, which implies a need to improve agility, collaboration, and product development to better serve customer needs.
1. A) Realign teams to focus on products and value streams
- Use Case: This involves restructuring teams to work in a more agile, customer-centric manner, where they are organized around products or services, as opposed to traditional functional silos.
- Pros: This task directly supports agility, responsiveness, and the ability to respond quickly to customer feedback and market changes. By focusing on value streams, the company can improve its ability to deliver value faster and adapt to customer needs in real-time.
- Cons: This task requires organizational change management, which may take time and effort, but it aligns well with the company’s goal of becoming more responsive.
- Why selected: This task aligns directly with the company’s goal of becoming more responsive to customer inquiries and feedback. It enables the company to be more flexible and adaptive in delivering products and services.
2. B) Create new value propositions with new products and services
- Use Case: This involves developing new products and services to address customer needs, potentially expanding the company’s market offerings.
- Pros: Developing new value propositions can attract more customers and provide competitive advantages.
- Cons: While this can improve customer satisfaction, it may not directly address the company's immediate need to become more responsive to existing customer inquiries and feedback. Creating new products is a longer-term strategy, and responsiveness involves a more immediate adjustment to the way the company operates.
- Why not selected: This option focuses on innovation and market expansion, which are valuable but do not directly address the compan...
Author: Henry · Last updated Jul 11, 2026
A company wants to rightsize its Amazon EC2 instances.Which configuration change will meet this requ...
To determine which configuration change will meet the requirement of rightsizing Amazon EC2 instances with the least operational overhead, we must analyze the options based on factors such as simplicity, cost-effectiveness, automation, and impact on the current infrastructure.
Option Analysis:
A) Add EC2 instances in another Availability Zone:
- Use Case: Adding EC2 instances to another Availability Zone is typically used for improving fault tolerance, high availability, or scalability, but it does not directly address the concept of rightsizing EC2 instances.
- Reasons for Rejection:
- Not Related to Rightsizing: Rightsizing involves adjusting the resources (e.g., CPU, memory) allocated to existing EC2 instances based on usage and performance metrics. Adding more EC2 instances in another Availability Zone does not address resource utilization or efficiency for the existing instances.
- Increased Overhead: Introducing additional instances across zones could increase operational overhead without addressing the core requirement of optimizing resource usage for existing instances.
B) Change the size and type of the EC2 instances based on utilization:
- Use Case: This option involves evaluating the current usage patterns of the EC2 instances (e.g., CPU, memory) and adjusting the size and instance type to better match the actual workload requirements. This is a key approach for rightsizing.
- Advantages:
- Directly Addresses Rightsizing: By changing the instance size and type based on utilization, this directly aligns with the goal of rightsizing to reduce costs and improve efficiency.
- Minimized Overhead: EC2 instances can be resized with minimal effort by modifying the instance type. This can often be done through the AWS Management Console or automation tools with very little operational overhead.
- Cost Efficiency: Rightsizing to a smaller instance type or size based on actual utilization can save costs, especially when the existing instances are over-provisioned.
C) Convert the payment method from...
Author: Michael · Last updated Jul 11, 2026
Which AWS service supports user sign-up functionality and authentication to mobile and web applicati...
The question specifies that we are looking for an AWS service that supports user sign-up functionality and authentication for mobile and web applications. This implies the need for a service that can manage user identities and securely handle authentication processes.
Breakdown of each option:
- A) Amazon Cognito:
- Description: Amazon Cognito is a fully managed service that handles user authentication, authorization, and user management for mobile and web applications. It supports user sign-up, sign-in, and access control, allowing developers to easily integrate these features into their applications.
- Key Points:
- Effort: Low effort to implement user sign-up and authentication, as Cognito provides pre-built authentication flows, SDKs, and integration with popular identity providers.
- Time: Quick setup with easy integration into mobile and web applications.
- Cost: Cognito is cost-effective, offering a free tier for up to 50,000 monthly active users, with pricing based on active users and authentication operations.
- Best Fit: Ideal for applications requiring user management, sign-up, and authentication for both mobile and web applications.
- Why it's selected: Amazon Cognito is specifically designed for user authentication and sign-up functionality, making it the perfect fit for this requirement.
- B) AWS Config:
- Description: AWS Config is a service that enables you to assess, audit, and evaluate the configurations of AWS resources. It helps in tracking configuration changes and ensuring compliance.
- Key Points:
- Effort: AWS Config focuses on resource configuration management, not user authentication or sign-up.
- Time: Not relevant to the user sign-up or authentication use case.
- Cost: Primarily priced based on the number of confi...
Author: Michael · Last updated Jul 11, 2026
Which benefit of the AWS Cloud helps companies achieve lower usage costs because of the aggregate us...
To determine which benefit of the AWS Cloud helps companies achieve lower usage costs due to the aggregate usage of all AWS users, it’s essential to analyze how AWS services work together, leverage the shared infrastructure, and provide cost-effective scaling options.
1. A) No need to guess capacity
- Use Case: This refers to AWS’s ability to allow companies to provision exactly the resources they need at any time, without over-provisioning.
- Pros: Helps avoid over-provisioning or under-provisioning of resources, reducing wasted costs.
- Cons: While this benefits cost management, it does not directly relate to the aggregate usage of all AWS users. It's more about flexibility in scaling resources up or down based on demand.
- Why not selected: It focuses more on resource optimization at an individual level rather than cost savings from shared usage.
2. B) Ability to go global in minutes
- Use Case: Refers to the capability to deploy applications and services in multiple regions worldwide within minutes.
- Pros: Provides quick deployment, low-latency solutions, and geographical flexibility.
- Cons: While it helps expand reach, it does not directly relate to lower usage costs through shared infrastructure or the aggregate usage of all AWS users.
- Why not selected: This primarily addresses the global reach and operational speed, not cost reduction from economies of scale.
3. C) Economies of scale
- Use Case: Economies of scale refer to the cost advantages that AWS can provide due to the aggregated demand of all cu...
Author: CrystalWolfX · Last updated Jul 11, 2026
Which task is the responsibility of the customer, according to the AWS shared responsibility model?
According to the AWS Shared Responsibility Model, the responsibility for security and operations is divided between AWS and the customer. AWS manages the infrastructure (physical and network security, hardware, and global operations), while the customer is responsible for configuring and securing the services they use, such as managing user access, encrypting data, and patching software.
Let’s analyze each option based on this:
A) Patch the Amazon DynamoDB operating system.
- Explanation: DynamoDB is a fully managed NoSQL database service provided by AWS. Since it is a managed service, AWS is responsible for the underlying infrastructure, including patching the operating system that runs the DynamoDB service.
- Reasoning: As a customer, you do not need to manage the operating system or patch it, as AWS handles it for you.
- Rejection: This is an AWS responsibility, not the customer’s.
B) Secure Amazon CloudFront edge locations by allowing physical access according to the principle of least privilege.
- Explanation: Amazon CloudFront is a content delivery network (CDN) service, and securing the physical access to CloudFront edge locations falls under AWS's domain, as it involves managing hardware and physical security.
- Reasoning: The customer has no responsibility in securing the physical infrastructure of AWS services.
- Rejection: AWS manages physical security for its infrastructure, including edge locations.
C) Protect the hardware that runs AWS services.
- Explanation: The protection of the h...
Author: Layla · Last updated Jul 11, 2026
A company wants to manage its cloud resources by using infrastructure as code (IaC) templates. The company needs to meet compliance requirements.Whic...
To determine which AWS service should be used to manage cloud resources with Infrastructure as Code (IaC) templates while meeting compliance requirements, let's analyze each service based on the key requirements: managing resources using IaC templates and ensuring compliance.
Option A: AWS Artifact
AWS Artifact is a service that provides on-demand access to AWS compliance reports and security and compliance documentation. It offers resources like AWS's SOC reports, ISO certifications, and other compliance-related documents. While Artifact helps in managing and viewing compliance information, it does not provide direct tools for managing cloud infrastructure via IaC templates. Thus, it is not directly related to IaC management.
- Time & Effort: It provides documents and compliance reports easily, but doesn't help with IaC or resource management.
- Cost: Low, as it’s free to access compliance reports.
- Scenario: Useful for auditing compliance and accessing reports but not for managing IaC templates.
Option B: AWS Resource Explorer
AWS Resource Explorer allows you to view and explore AWS resources across accounts, regions, and services. It helps in discovering resources and their relationships, but it does not provide functionality for managing infrastructure via IaC or ensuring compliance. While useful for exploring resources, it does not meet the requirement of managing cloud resources using IaC templates.
- Time & Effort: Requires configuration to explore resources, but does not directly help in managing infrastructure or enforcing compliance.
- Cost: Low cost for discovering resources, but irrelevant to IaC or compliance management.
- Scenario: Suitable for resource discovery, but not for IaC management.
Option C: AWS License Manager
AWS License Manager is a service for m...
Author: ShadowWolf101 · Last updated Jul 11, 2026
A systems administrator wants to monitor the CPU utilization of a company's Amazon EC2 instances.Whi...
To monitor the CPU utilization of Amazon EC2 instances, the systems administrator needs a service that can provide metrics and insights about the performance of those instances.
Let's analyze each option based on this requirement:
A) AWS Config
- Explanation: AWS Config is a service that provides visibility into the configuration of AWS resources and tracks changes to them. While AWS Config is useful for compliance auditing, security analysis, and operational troubleshooting, it does not directly monitor performance metrics like CPU utilization.
- Reasoning: AWS Config helps track configuration changes but doesn't provide performance monitoring metrics such as CPU utilization.
- Rejection: This service is not designed for performance monitoring like CPU utilization.
B) AWS Trusted Advisor
- Explanation: AWS Trusted Advisor is a service that provides real-time best practice recommendations for optimizing AWS resources. It offers insights into cost optimization, security, fault tolerance, and performance, but it doesn't focus on real-time monitoring or provide detailed metrics like CPU utilization.
- Reasoning: While AWS Trusted Advisor can offer some recommendations on performance optimizations, it does not give real-time performance data like CPU utilization.
- Rejection: Trusted Advisor is more about offering best practices and recommendations, not real-time resource monitoring.
C) AWS CloudTrail
- Explanation: AWS CloudTrail records API calls and related activities in AWS, providing a history of actions taken on resource...
Author: FrostFalcon88 · Last updated Jul 11, 2026
A company wants to migrate all of its on-premises infrastructure to the AWS Cloud. Before migration, the company wants estimate of costs for running its as-is infrastructure.Whi...
To estimate the costs for running its infrastructure in the AWS Cloud, the company needs a service that can help calculate the potential costs of using AWS services based on its current (as-is) infrastructure.
Let’s analyze each option:
A) AWS Pricing Calculator
- Explanation: The AWS Pricing Calculator allows users to estimate the cost of using AWS services based on their projected usage. It provides detailed estimates for different AWS services (e.g., EC2, S3, RDS), helping organizations calculate the costs of migrating their on-premises infrastructure to AWS by selecting services that match their current needs.
- Reasoning: AWS Pricing Calculator is specifically designed to provide cost estimates, making it ideal for the company’s goal of estimating the costs of running its as-is infrastructure in AWS.
- Acceptance: This is the most suitable option as it is directly designed to calculate costs based on the user’s infrastructure needs and usage patterns.
B) AWS Well-Architected Framework
- Explanation: The AWS Well-Architected Framework provides best practices and guidelines for designing, building, and maintaining secure, high-performing, resilient, and efficient infrastructure in the cloud. While it helps optimize workloads for the cloud, it does not provide cost estimations.
- Reasoning: The Well-Architected Framework focuses on best practices for cloud architectures but does not provide tools to estimate costs directly.
- Rejection: While useful for improving cloud architectures, it does not address the specific requirement of cost estimation.
C) A...
Author: Ryan · Last updated Jul 11, 2026
An independent software vendor wants to deliver and share its custom Amazon Machine Images (AMIs) to prospective custo...
The requirement is for an independent software vendor (ISV) to deliver and share custom Amazon Machine Images (AMIs) to prospective customers. Let’s break down the options in this context.
Let’s analyze each option:
A) AWS Marketplace
- Explanation: AWS Marketplace is a digital catalog where ISVs can offer their software, including custom AMIs, to customers. It allows vendors to list, deliver, and share AMIs, software, and other products for customers to purchase and deploy in their AWS environments. AWS Marketplace also provides features like pricing management, billing, and customer support integration.
- Reasoning: AWS Marketplace is specifically designed for vendors like independent software vendors (ISVs) who want to deliver and share their custom AMIs with a wide range of customers. It simplifies the process of distribution and licensing.
- Acceptance: This is the best option for an ISV to deliver and share custom AMIs with prospective customers.
B) AWS Data Exchange
- Explanation: AWS Data Exchange is a service for exchanging third-party data, such as data sets, between providers and subscribers. It is focused on data sharing and distribution, not specifically for distributing software or AMIs.
- Reasoning: While it facilitates data exchange, it is not designed for the distribution of custom AMIs or software products.
- Rejection: This service is not intended for distributing AMIs or software, so it doesn’t meet the ISV’s requirement.
C) Amazon EC2
- Explanati...
Author: Maya2022 · Last updated Jul 11, 2026
Which component must be attached to a VPC to enable inbound internet access?
To enable inbound internet access to a VPC, a component that connects the VPC to the internet is required. Let's analyze each option based on this requirement:
Let’s analyze each option:
A) NAT Gateway
- Explanation: A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet, but it does not enable inbound internet access. It is used primarily for private subnets that need to access the internet but do not require incoming traffic from the internet.
- Reasoning: A NAT Gateway does not allow inbound traffic from the internet to your VPC; it only facilitates outbound traffic from private subnets to the internet.
- Rejection: It doesn’t meet the requirement of enabling inbound internet access to the VPC.
B) VPC Endpoint
- Explanation: A VPC Endpoint is a service that enables private connectivity between your VPC and supported AWS services, without the need for internet access. VPC Endpoints do not provide direct access to the internet.
- Reasoning: VPC endpoints are primarily used for private, secure connections between a VPC and AWS services like S3 or DynamoDB. They do not facilitate inbound internet traffic.
- Rejection: VPC endpoints are designed for connecting to specific AWS services, not the internet.
C) VPN Connection
- Explanation: A VPN connection connects your on-premises network or client to your VPC securely over the internet. It allows secure, private communication but d...
Author: IceDragon2023 · Last updated Jul 11, 2026
Which AWS service supports a company's ability to treat infrastructure as code?
To answer this question, we need to identify the AWS service that best supports the ability to treat infrastructure as code (IaC). This typically refers to a service that allows you to define and manage infrastructure (like servers, networks, databases, etc.) using code and automation.
Option A: AWS CodeDeploy
AWS CodeDeploy is a deployment service used for automating the deployment of applications to Amazon EC2 instances, AWS Lambda, and on-premises servers. While it is a great tool for automating application deployments, it does not directly support managing infrastructure as code. It's more about managing the deployment lifecycle rather than provisioning infrastructure.
Rejection Reason:
- CodeDeploy is more about deployment automation, not infrastructure management.
- Does not provide IaC functionality.
Use case: Use AWS CodeDeploy when you need to automate the deployment of applications to servers or Lambda functions.
---
Option B: AWS Elastic Beanstalk
AWS Elastic Beanstalk is a platform-as-a-service (PaaS) offering that helps deploy and manage applications in the cloud without worrying about infrastructure. Elastic Beanstalk handles provisioning the infrastructure (like EC2 instances, load balancers, etc.) and scaling automatically. However, while it provides an easy way to deploy applications, it does not focus on treating infrastructure as code in the true sense, as you don't define and manage the infrastructure explicitly using code.
Rejection Reason:
- Elastic Beanstalk abstracts the infrastructure management, meaning you don’t define it explicitly as code.
- Does not fully align with the concept of infrastructure as code.
Use case: Use AWS Elastic Beanstalk for quick, ...
Author: Ryan · Last updated Jul 11, 2026
A company is building an application that will receive millions of database queries each second. The company needs the data store for the application to sca...
To determine the best AWS service for handling millions of database queries per second, we need to evaluate each service based on their scalability, performance, and the ability to handle such high query loads.
Option A: Amazon DynamoDB
Amazon DynamoDB is a fully managed NoSQL database service designed to handle large amounts of traffic and provide low-latency responses. DynamoDB can scale automatically to meet traffic demands and supports millions of requests per second without manual intervention. It is ideal for applications requiring high availability, scalability, and low-latency reads and writes. DynamoDB also supports auto-scaling to handle varying workloads.
Reason for selection:
- Highly scalable and can handle millions of queries per second.
- Fully managed, serverless, and provides fast performance.
- Optimized for high-traffic applications with low-latency requirements.
- Offers features like provisioned and on-demand capacity modes.
Use case: Use Amazon DynamoDB for applications that require fast, scalable, and high-throughput database operations, such as mobile apps, e-commerce websites, and IoT applications.
---
Option B: AWS Cloud9
AWS Cloud9 is a cloud-based integrated development environment (IDE) that helps developers write, run, and debug code. It is primarily used for development tasks and does not serve as a data store or database service.
Rejection Reason:
- Cloud9 is an IDE and not a database service.
- It does not support high-query workloads or act as a data store.
Use case: Use AWS Cloud9 for development and coding tasks, not for database storage or scaling query workloads.
---
Option C: Amazon ElastiCache for Memcached
Amazon ElastiCache is a fully managed caching service that supports both Redis and Memcached engines. ElastiCache is primarily used for caching data to ...
Author: Isabella · Last updated Jul 11, 2026
An AWS user wants to proactively detect when an instance or account might be compromised or if there are threats fro...
To proactively detect when an instance or account might be compromised or if there are threats from attacks, the ideal AWS service needs to focus on threat detection, continuous monitoring, and security incident identification.
Option A: Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity, unauthorized behavior, and security threats across AWS accounts and instances. It analyzes log data, network activity, and other AWS resources, using machine learning and threat intelligence feeds to identify potential threats like compromised instances, unusual API calls, and unauthorized access attempts. GuardDuty offers real-time alerts and integrates seamlessly with other AWS security services to help detect and respond to potential security incidents.
Reason for selection:
- Specifically designed for continuous monitoring and detecting threats such as compromised instances, unauthorized access, and other malicious activities.
- Uses machine learning and threat intelligence to detect security risks.
- Highly effective for proactive detection of compromised accounts and instances.
- No need for deep technical effort to set up; provides actionable alerts.
Use case: Use Amazon GuardDuty to detect and respond to account compromises, unusual behavior, or threats in real-time in AWS environments.
---
Option B: AWS WAF (Web Application Firewall)
AWS WAF is a security service designed to protect web applications from common web exploits such as SQL injection, cross-site scripting (XSS), and other HTTP-based attacks. It is used to protect applications by filtering incoming web traffic. While AWS WAF is a powerful tool to prevent attacks at the application layer, it is not focused on detecting compromised instances or broad-scale account-level security threats.
Rejection Reason:
- AWS WAF is designed primarily to block malicious traffic at the application layer and is not built to proactively detect compromised instances or overall security threats across an account or infrastructure.
- It does not provide broad monitoring or detection for general AWS resources and accounts.
Use case: Use AWS WAF to protect web application...
Author: Zara · Last updated Jul 11, 2026
Which AWS Support plan provides the full set of AWS Trusted Advisor checks at the LOWEST cost?
To determine which AWS Support plan provides the full set of AWS Trusted Advisor checks at the lowest cost, we need to consider the following factors: cost, services, effort, time, and other key features of each support plan. Let’s break down each plan:
A) AWS Developer Support
- Cost: This is the lowest-cost support plan, intended for users with minimal support needs.
- Services: Provides basic support with best practices, customer service, and a limited set of Trusted Advisor checks (only the Core Trusted Advisor checks).
- Effort and Time: The service is mainly self-service with limited support, focusing on issues like account and billing questions and guidance on using AWS services.
- Rejection Reason: Does not include the full set of Trusted Advisor checks. Since the question specifies the full set, this is not suitable.
B) AWS Business Support
- Cost: This is a mid-tier plan, more expensive than Developer Support but less expensive than the Enterprise plans.
- Services: Includes the full set of AWS Trusted Advisor checks, including cost optimization, security, fault tolerance, and performance checks. Also includes 24/7 support for critical issues and access to AWS support engineers.
- Effort and Time: With 24/7 support and full Trusted Advisor access, it reduces effort and time needed to address potential issues, providing a more proactive approach to managing AWS infrastructure.
- Rejection Reason: Although this plan provides the full set of Trusted Advisor checks, it's not the lowest-cost option compared to Developer Support.
C) AWS Enterprise On-Ramp Support
- Cost: This is an intermediary option designed for medium-sized businesses or enterprises with growi...
Author: Samuel · Last updated Jul 11, 2026
A company's application is running on Amazon EC2 instances. The company is planning a partial migration to a serverless architecture in the next year and wants to pay for resou...
Let's evaluate the given AWS purchasing options based on the company's needs: partial migration to a serverless architecture, payment up front, and the goal to optimize costs for resources over the next year.
Key Considerations:
- The company wants to optimize costs.
- It plans to migrate to a serverless architecture in the next year, meaning the full transition to serverless may not happen immediately.
- The goal is to pay for resources up front, so we are looking at options that involve upfront payments to reduce overall costs.
Option A: Convertible Reserved Instances
- Service Description: Convertible Reserved Instances (RIs) allow you to reserve EC2 instances for a 1 or 3-year term with the flexibility to change the instance type, operating system, and tenancy during the term. Convertible RIs offer lower hourly rates than On-Demand instances in exchange for a commitment to use them over the term.
- Use Case: Convertible RIs are ideal for EC2 workloads that require a consistent and predictable compute usage pattern. They allow flexibility but still assume a level of commitment to EC2 instances.
- Effort and Cost: Convertible RIs require a one- or three-year commitment but are not specifically designed to optimize costs in a situation where the company plans to migrate to a serverless model. Given the partial migration plan, RIs could lock the company into EC2 usage for the future, which may not align with the planned transition to serverless.
Rejection: While Convertible Reserved Instances are cost-effective for predictable EC2 workloads, the company plans a partial migration to serverless, which makes the commitment to EC2 instances less optimal.
---
Option B: Spot Instances
- Service Description: Spot Instances allow you to bid for unused EC2 capacity at a lower price. Spot Instances can be very cost-effective but are subject to termination by AWS with little notice when the capacity is needed for other customers.
- Use Case: Spot Instances are ideal for flexible workloads that can tolerate interruptions (e.g., batch processing, data analysis). They would not be suitable for production workloads that require high availability or for workloads that need to run without interruptions.
- Effort and Cost: While Spot Instances are the cheapest option for non-critical workloads, they come with a high risk of termination. Given that the company’s application is critical and the migration involves some transition to serverless, Spot Instances may not offer the reliability needed.
Rejection: Spot Instances are too risky for the company’s application, especially considering its ...
Author: Noah · Last updated Jul 11, 2026
A retail company is building a new mobile app. The company is evaluating whether to build the app at an on-premises data center or in the AWS Cloud.Which of the foll...
When evaluating the benefits of building a mobile app in the AWS Cloud versus an on-premises data center, the following factors need to be considered: cost, scalability, speed of deployment, flexibility, and the effort required to manage infrastructure. Let's review each option in the context of building the app in AWS.
A) A large, upfront capital expense and low variable expenses
This is typically a characteristic of on-premises infrastructure rather than the AWS Cloud. With an on-premises data center, companies usually need to invest heavily in hardware, software, and physical space upfront. On the other hand, AWS Cloud operates on a pay-as-you-go model, where you only pay for what you use, minimizing upfront costs and offering variable pricing. Therefore, this option does not align with the cloud benefits but rather with traditional on-premises data center costs.
B) Increased speed for trying out new projects
One of the major advantages of AWS Cloud is the ability to quickly experiment and deploy new applications or projects. With AWS, developers can quickly provision resources, test new features, and scale workloads without long delays. This speed and agility are not as easily achieved with on-premises infrastructure, where provisioning and scaling require more time and effort due to hardware setup and configuration. Therefore, this option aligns with the AWS Cloud.
C) Complete control over the physical security of the infrastructure
With an on-premises data center, a company has complete control over the physical security of the infrastructure, as it owns and manages the hardware. However, in AWS, while there are strong security measures in place, the company does not have direct control over the physical data centers themselves. AWS follows a shared responsibility model, where AWS is responsi...
Author: Aarav · Last updated Jul 11, 2026
A company wants to protect its AWS Cloud information systems and assets while performing risk assessment and mitigation tasksWhich pillar of t...
To identify the AWS Well-Architected Framework pillar that aligns with protecting AWS Cloud information systems and assets while performing risk assessment and mitigation tasks, we need to consider the focus of each pillar in relation to security, risk management, and protection of assets.
Option A: Reliability
The Reliability pillar of the AWS Well-Architected Framework focuses on ensuring that a system can recover from failures and meet customer demands despite disruptions. While reliability is critical to maintaining business continuity, it is not primarily focused on protecting information systems and assets or performing risk assessments. Instead, it emphasizes system resilience and availability.
Rejection Reason:
- The Reliability pillar is focused on system uptime and recovery, not on directly addressing the protection of information systems or performing risk assessments.
- Does not emphasize security or risk mitigation tasks.
Use case: Use the Reliability pillar to ensure systems are resilient and can recover from disruptions, but it does not directly support the goal of security and risk mitigation.
---
Option B: Security
The Security pillar of the AWS Well-Architected Framework focuses on protecting information systems, data, and assets. It addresses security considerations such as confidentiality, integrity, and availability of data. This pillar emphasizes proactive risk management and the implementation of controls to protect systems from threats and vulnerabilities. It directly aligns with the goals of protecting AWS Cloud information systems and assets while performing risk assessment and mitigation tasks.
Reason for selection:
- The Security pillar is directly aligned with the goal of protecting information systems, assessing risks, and implementing mitigation strategies.
- It focuses on the protection of assets, managing security risks, and ensuring that security controls are in place.
Use case: Use the Security pillar to ensure the confidentiality, integrity, and availability of information systems and assets while managing and mitigating security risks.
---
Option ...
Author: Scarlett · Last updated Jul 11, 2026
A company has batch workloads that need to run for short periods of time on Amazon EC2. The workloads can handle interruptions and can start again from where they ended.What is the ...
To determine the most cost-effective EC2 instance purchasing option for the company’s batch workloads that can handle interruptions and resume from where they left off, we need to evaluate each option in terms of cost-effectiveness, flexibility, and suitability for handling interruptions.
Option A: Reserved Instances
Reserved Instances provide a significant discount (up to 75%) compared to On-Demand Instances in exchange for committing to use a specific instance type in a specific region for a term of one or three years. However, Reserved Instances are best suited for workloads that require consistent and predictable usage. Since the company's workloads are batch workloads that run intermittently and can handle interruptions, Reserved Instances would not be the most cost-effective option, as they require upfront commitment and are less flexible.
Rejection Reason:
- Reserved Instances are not flexible for workloads that are sporadic or interruptible.
- Requires upfront commitment for one or three years, making it less ideal for workloads that don’t run continuously.
Use case: Use Reserved Instances when you have predictable, long-term workloads that need to run continuously.
---
Option B: Spot Instances
Spot Instances allow you to bid for unused EC2 capacity at significantly lower prices (up to 90% cheaper than On-Demand). They are ideal for workloads that can tolerate interruptions, as Spot Instances can be terminated by AWS with little notice when the demand for capacity increases. Since the company’s workloads can handle interruptions and can resume from where they left off, Spot Instances provide the most cost-effective solution for batch workloads that run for short periods of time and can be restarted.
Reason for selection:
- Spot Instances are the most cost-effective EC2 purchasing option, with significant discounts compared to On-Demand.
- Well-suited for workloads that can handle interruptions and resume processing.
- Ideal for batch workloads that run intermittently and do not require guaranteed uptime.
Use case: Use Spot Instances for workloads like batch processing or distributed...
Author: Liam · Last updated Jul 11, 2026
A company needs to deploy a PostgreSQL database into Amazon RDS. The database must be highly available and fault tolerant.Which AWS s...
When considering the requirements for high availability and fault tolerance for a PostgreSQL database in Amazon RDS, several options are available, each with specific advantages and trade-offs. Let's analyze each option based on the company's needs.
Option A: Amazon RDS with a single Availability Zone
- High Availability: Not highly available. If the instance in the Availability Zone goes down, there will be a disruption in service.
- Fault Tolerance: There is no inherent fault tolerance, as it only runs in a single Availability Zone.
- Cost and Effort: It is cost-effective and simple to deploy, but it does not meet the high availability or fault tolerance requirements.
Rejection: Since the database needs to be highly available and fault-tolerant, this option doesn’t meet the requirements.
---
Option B: Amazon RDS snapshots
- High Availability: RDS snapshots are a backup feature and do not provide high availability by themselves.
- Fault Tolerance: Snapshots can be used to restore the database in the event of a failure, but they don’t provide live failover or replication capabilities.
- Cost and Effort: Snapshots incur storage costs and may require manual intervention or scripting for automated recovery.
Rejection: Snapshots are useful for backup, but they don’t provide the continuous high availability or real-time fault tolerance needed for the database.
---
Option C: Amazon RDS with multiple Availability Zones
- High Availability: Amazon RDS with Multi-AZ (Availability Zones) deployment creates a standby replica in a different Availability Zone. If the primary instance fails, RDS automatically promotes the standby to become the new pr...
Author: Liam123 · Last updated Jul 11, 2026
What is the MOST secure way to store passwords on AWS?
To determine the most secure way to store passwords on AWS, we need to evaluate each option based on factors like security, ease of management, cost, time, and the specific use case. Let's break down each option:
A) Store passwords in an Amazon S3 bucket
- Explanation: Amazon S3 is a highly scalable object storage service, but it is not specifically designed for storing sensitive data like passwords. While you can store passwords in S3 by encrypting them, S3 buckets require proper security configuration (e.g., encryption at rest, strict access controls) to be secure. However, this setup still lacks automatic management features such as access control policies, rotation, or auditing specific to secret management.
- Rejected: This option is rejected because, while you can store passwords in S3 with encryption, it does not provide the robust security features, such as automatic password rotation, integrated access management, and audit logs, that are critical for storing sensitive data like passwords securely.
B) Store passwords as AWS CloudFormation parameters
- Explanation: CloudFormation is an infrastructure as code (IaC) service that allows you to define and provision AWS infrastructure. While CloudFormation parameters can be used to pass sensitive information (like passwords), they are not encrypted by default and require manual steps to ensure they are securely handled. Storing passwords as parameters may expose them in logs, templates, or other parts of the CloudFormation process.
- Rejected: This option is rejected because it does not provide sufficient encryption or management features specifically designed ...
Author: Rahul · Last updated Jul 11, 2026
Which statements accurately describe the relationships among components of AWS global infrastructure...
Let's analyze each statement to determine which two are accurate regarding the relationships among components of AWS global infrastructure.
A) There are more AWS Regions than Availability Zones.
- Explanation: This statement is incorrect. AWS has multiple Availability Zones (AZs) within each AWS Region. The number of Availability Zones typically exceeds the number of AWS Regions. Each AWS Region can have 2 or more Availability Zones, with some having up to 6 or more. The statement is misleading because it suggests the reverse.
- Rejected: This option is incorrect because AWS has more Availability Zones than Regions.
B) There are more edge locations than AWS Regions.
- Explanation: This statement is correct. AWS has far more edge locations (used for Amazon CloudFront and other services) than AWS Regions. Edge locations are distributed globally and are specifically designed to provide low-latency access to AWS services, especially for content delivery. AWS has more than 200 edge locations globally, while the number of AWS Regions is much fewer (over 30 as of 2025).
- Selected: This option is selected because there are indeed more edge locations than AWS Regions.
C) An edge location is an Availability Zone.
- Explanation: This statement is incorrect. Edge locations and Availability Zones are distinct compon...
Author: Liam · Last updated Jul 11, 2026
Which AWS service provides DNS resolution?
To determine which AWS service provides DNS resolution, let's evaluate each option based on their functionalities, usage scenarios, and how they relate to DNS resolution specifically.
A) Amazon CloudFront
- Explanation: Amazon CloudFront is a content delivery network (CDN) service that caches and delivers content from edge locations globally. While it helps reduce latency and improve content delivery speed, it does not provide DNS resolution. CloudFront uses DNS for directing traffic to the nearest edge location, but it is not a DNS resolution service in itself.
- Rejected: This option is rejected because CloudFront does not provide DNS resolution; it is focused on content delivery.
B) Amazon VPC
- Explanation: Amazon Virtual Private Cloud (VPC) provides a private network within the AWS cloud. It does offer DNS resolution capabilities within the VPC (e.g., resolving private DNS names for resources within the VPC). However, VPC DNS resolution is typically used for resolving names of resources within the VPC rather than providing public DNS resolution for general internet-facing domains.
- Rejected: This option is rejected for general DNS resolution because Amazon VPC is focused on DNS within the VPC and does not provide broader DNS resolution services like routing domain names to IP addresses across the internet.
C) Amazon Route 53
- Explanat...
Author: Vivaan · Last updated Jul 11, 2026
A company needs to host an application in a specific geographic area to comply with regulations.Which feature of the AWS global in...
To meet the requirement of hosting an application in a specific geographic area to comply with regulations, we need to consider which feature of the AWS global infrastructure helps companies deploy applications in particular regions.
A) Scalability
- Explanation: Scalability refers to the ability to scale resources up or down depending on the demand. While scalability is an important feature of AWS services (such as Amazon EC2 or Amazon S3), it does not specifically address the need to host an application in a specific geographic area.
- Conclusion: Scalability helps in handling varying workloads but does not directly assist in meeting geographic location requirements for compliance.
B) Global footprint
- Explanation: The global footprint of AWS refers to the network of AWS data centers distributed worldwide, including regions and availability zones. This feature directly addresses the ability to host applications in specific geographic areas. AWS has a wide range of regions across different countries and continents, allowing companies to choose a region that complies with their regulatory requirements regarding geographic location.
- Conclusion: This is the correct option because AWS’s global footprint allows the company to host the application in a specific region, ensuring compliance with geographic regulations.
C) Availability
- Explanation: Availability refers to the ability of a service or infrastructure to be up and running without disruption. While high avai...
Author: Ava · Last updated Jul 11, 2026
An ecommerce company plans to move its data center workload to the AWS Cloud to support highly dynamic usage patterns.Which benefits make the AWS Cloud cost...
When considering the migration of an ecommerce company's data center workload to the AWS Cloud to support highly dynamic usage patterns, we need to focus on the benefits that are most relevant to cost-effectiveness in this scenario. Let's analyze each option in terms of services, effort, time, cost, and other key factors.
A) Reliability
- Explanation: While reliability is crucial for ensuring uptime and operational continuity, it does not directly contribute to cost-effectiveness in the context of highly dynamic workloads. AWS offers reliability through multiple Availability Zones and regions, but this primarily helps ensure minimal downtime and not necessarily reduce costs.
- Rejected: This option is rejected because reliability is important for business continuity but does not directly contribute to the cost-effective nature of scaling dynamic workloads.
B) Security
- Explanation: Security is a fundamental feature of AWS and is essential for protecting data and applications. However, while security is crucial for any migration, it does not specifically address cost-effectiveness in supporting dynamic usage patterns. The costs related to security (e.g., compliance, encryption) are typically fixed costs and are not the main contributor to dynamically scaling the workload.
- Rejected: This option is rejected because security is not directly tied to the cost-effectiveness of scaling resources based on usage patterns.
C) Elasticity
- Explanation: Elasticity is a critical benefit for workloads with highly dynamic usage patterns, such as an ecommerce application that experiences fluctuating traffic. Elasticity allows AWS to automatically scale resources up or down based on demand, ensuring the company only pays for the resource...
Author: Mia · Last updated Jul 11, 2026
When designing AWS workloads to be operational even when there are component failures, what is an AW...
When designing AWS workloads to be operational even when there are component failures, the focus should be on high availability, fault tolerance, and resilience, ensuring that if one component fails, the workload continues to operate smoothly.
Let’s analyze each option in terms of AWS best practices, considering services, effort, time, cost, and other key factors:
A) Perform quarterly disaster recovery tests.
- While disaster recovery testing is essential for ensuring that a plan works in the event of a failure, this does not address how to design workloads for continuous operation. It only prepares the system for recovery after a disaster, not for keeping it operational during component failures. Disaster recovery tests are good but should not be the sole design practice for ensuring operational continuity.
- Rejected: This is a reactive approach and doesn't proactively handle failures.
B) Place the main component on the us-east-1 Region.
- While it’s common to host services in one AWS region, relying on a single region does not protect against regional failures. A single region could be affected by a disaster, connectivity issues, or service degradation. Therefore, relying on just one region compromises fault tolerance and availability.
- Rejected: Single-region deployments are risky for continuous operation during failures.
C) Design for auto...
Author: Alexander · Last updated Jul 11, 2026
Which of the following can the AWS Pricing Calculator do?
When evaluating what the AWS Pricing Calculator can do, it’s important to focus on its intended functionality and compare it with other AWS services and tools that provide different functionalities. Let's go through each option:
A) Project monthly AWS costs.
- The AWS Pricing Calculator is designed to estimate and project the monthly costs of AWS services based on your configuration. By selecting specific AWS resources (e.g., EC2, S3, RDS), you can simulate the cost for your planned architecture. This is the core use case of the AWS Pricing Calculator—helping users understand the expected cost before they start using AWS services.
- Selected: This is the primary function of the AWS Pricing Calculator, making it the correct answer.
B) Calculate historical AWS costs.
- The AWS Pricing Calculator is focused on projecting future costs based on your configuration, not on historical data. To analyze past costs, you would use the AWS Cost Explorer or AWS Budgets services. These tools can provide insights into historical usage and costs over specific time periods.
- Rejected: The AWS Pricing Calculator does not track historical usage; it is forward-looking.
C) Provide in-depth i...
Author: NightmareDragon2025 · Last updated Jul 11, 2026
Which AWS solution gives companies the ability to use protocols such as NFS to store and retrieve ob...
To address the question of using protocols like NFS to store and retrieve objects in Amazon S3, we need to consider the various AWS solutions that provide support for such protocols, alongside their respective trade-offs in terms of effort, time, cost, and use cases. Here's an evaluation of each option:
A) Amazon FSx for Lustre
- Description: Amazon FSx for Lustre provides a high-performance file system optimized for workloads that require high throughput and low latency. It can integrate with Amazon S3, enabling the use of Lustre file systems to access objects in S3.
- Protocols Supported: Amazon FSx for Lustre supports NFS and can be used to mount file systems on Linux and Windows instances.
- Use Case: While this solution integrates with S3 and supports NFS, it is generally used for high-performance computing and data-intensive workloads (e.g., ML, HPC) rather than for general file storage.
- Effort and Cost: FSx for Lustre is a high-performance solution with a higher cost, particularly if the workload doesn't require extreme performance. It also involves more setup and management overhead.
B) AWS Storage Gateway Volume Gateway
- Description: AWS Storage Gateway Volume Gateway provides block-level storage to on-premises applications and can integrate with S3 as a backend storage. However, it doesn't provide NFS access directly for file-level access to objects in S3.
- Protocols Supported: It primarily supports iSCSI and is used for block storage, not for NFS file access.
- Use Case: This solution is best for situations where organizations need to migrate on-premises block storage to the cloud, but it doesn't support NFS for accessing S3.
- Effort and Cost: It's not suitable for file-based access and doesn’t align with the question’s requirement.
C) AWS Storage Gateway File Gateway
- Description: AWS Storage Gateway File Gateway provides file-based access to cloud storage. It supports protocols such as NFS...
Author: Oscar · Last updated Jul 11, 2026
A user has been granted permission to change their own IAM user password.Which AWS services can the us...
When a user is granted permission to change their own IAM user password, there are specific AWS services that allow this action to be performed. Let’s go through each option and determine which ones are relevant.
A) AWS Command Line Interface (AWS CLI)
- Description: The AWS CLI provides a command-line interface to interact with AWS services, and IAM functionality is included within it. The user can use the `aws iam update-user` command to update their password by calling the IAM service programmatically.
- Why it's a good fit: The AWS CLI can be used by the user to change their IAM password, provided they have the necessary permissions. It is a powerful tool for performing administrative tasks via the command line, making it a suitable option.
B) AWS Key Management Service (AWS KMS)
- Description: AWS KMS is primarily used for managing encryption keys to secure data, such as encrypting data stored in S3 or RDS.
- Why it's not a good fit: AWS KMS does not provide functionality for changing IAM user passwords. It's specifically used for key management and encryption, not for user account management.
C) AWS Management Console
- Description: The AWS Management Console is the web-based user interface that allows users to manage AWS services. Through the console, a user can change their IAM password by...
Author: Maya · Last updated Jul 11, 2026
Which task is the customer's responsibility, according to the AWS shared responsibility model?
The AWS shared responsibility model defines the division of security tasks between AWS and the customer. Under this model:
- AWS is responsible for securing the cloud infrastructure (hardware, software, networking, and facilities), while the customer is responsible for managing security aspects within the cloud (data, identity, and access management).
Now, let's analyze each option:
A) Patch a guest operating system that is deployed on an Amazon EC2 instance.
- EC2 instances are virtual machines that run on top of the underlying AWS infrastructure. AWS manages the underlying hardware, hypervisors, and networking, but the customer is responsible for maintaining the guest operating system (OS) that runs on the EC2 instance, including patching and updates.
- Selected: This is the customer's responsibility, as they manage the OS and software on the EC2 instance.
B) Control physical access to an AWS data center.
- Physical security of AWS data centers (including access control, surveillance, and maintenance of physical infrastructure) is the responsibility of AWS. The customer does not have to worry about the physical acces...
Author: Sophia · Last updated Jul 11, 2026
Which AWS service or feature provides a firewall at the subnet level within a VPC?
When considering the question of which AWS service or feature provides a firewall at the subnet level within a VPC (Virtual Private Cloud), it's important to understand how AWS security services work and where they apply.
Let’s go through each option:
A) Security group
- Security groups act as stateful firewalls for controlling inbound and outbound traffic to individual EC2 instances within a VPC. While security groups can restrict traffic based on rules, they are instance-level firewalls and not specifically designed to provide firewall protection at the subnet level. They work at the instance level rather than the network level (subnet).
- Rejected: Security groups are for instance-level security, not subnet-level security.
B) Network ACL
- Network Access Control Lists (NACLs) provide firewall protection at the subnet level in a VPC. NACLs are stateless firewalls that can be applied to a subnet to control inbound and outbound traffic for all resources within that subnet. They allow the creation of rules to allow or deny traffic based on IP address, protocol, and port.
- Selected: NACLs are designed specifically to provide firewall control at the subnet level...
Author: Kunal · Last updated Jul 11, 2026
A company wants to use automated video analysis to identify employees that are accessing its offices.W...
To address the requirement of automated video analysis to identify employees accessing its offices, the goal is to use a service that can process video content and perform facial recognition or other relevant analyses. Let's review the options based on the use case:
A) Amazon Rekognition
- Amazon Rekognition is a powerful service that offers video and image analysis capabilities, including facial recognition, object detection, and activity recognition. It is capable of analyzing video streams to identify people, track movements, and detect specific activities. For the scenario where you need to identify employees in video footage, Rekognition's facial recognition feature would allow you to compare faces in the video against a database of known employees.
- Selected: Amazon Rekognition is the most suitable service for performing automated video analysis with facial recognition.
B) Amazon Polly
- Amazon Polly is a service that converts text into lifelike speech. It is primarily used for text-to-speech tasks, such as creating audio from written content. It does not support video analysis or facial recognition.
- Rejected: Amazon Polly is not designe...
Author: Chloe · Last updated Jul 11, 2026
A company needs to host a web server on Amazon EC2 instances for at least 1 year. The web server cannot tolerate interruption.Which EC2 instance purc...
To determine the most cost-effective EC2 instance purchasing option for hosting a web server that cannot tolerate interruption for at least one year, let's break down each option considering the key factors: cost, effort, time, and other relevant factors (such as the potential for interruption).
Option A: On-Demand Instances
- Cost: On-Demand instances are the most expensive option as you pay for compute capacity by the hour or second with no long-term commitment.
- Effort: There's no need to manage reservations or up-front payments, so it's simple to set up and scale.
- Time: On-Demand pricing is flexible and can be adjusted at any time.
- Other Factors: On-Demand instances do not offer interruptions as they are fully dedicated resources.
- Conclusion: While On-Demand instances are flexible and free from interruption, they are the least cost-effective option for long-term use, especially for a year or more, as their pricing is high over extended periods.
Option B: Partial Upfront Reserved Instances
- Cost: With this option, you pay a portion of the cost upfront and the rest in monthly payments. It provides a significant discount compared to On-Demand pricing.
- Effort: You need to commit to a one- or three-year term, but once reserved, the management effort is minimal.
- Time: This option is ideal for long-term use like one year or more, making it cost-effective for stable workloads.
- Other Factors: Reserved Instances do not suffer from interruptions, making them a suitable option for the web server that cannot tolerate interruptions.
- Conclusion: Partial Upfront Reserved Instances offer a good balance of cost savings and reliability for a web server that must run continuously for a year. It’s the most cost-effective option that meets the requirement for uninterrupted service.
Option C: Spot Instances
- Cost: Spot Instances are the cheapest option, allowing you to bid on unused E...
Author: Sam · Last updated Jul 11, 2026
Which guidelines are best practices for using AWS Identity and Access Management (IAM)? (Choose two....
When implementing AWS Identity and Access Management (IAM), there are best practices designed to ensure security, proper management of access, and efficiency. Let’s analyze each option based on services, effort, time, cost, and security factors.
Option A: Share Access Keys
- Reasoning: Sharing access keys is not a best practice because it exposes sensitive credentials to multiple users, increasing the risk of unauthorized access. Access keys should be kept secure and should never be shared. Sharing keys undermines the principle of least privilege and auditability.
- Conclusion: This option is not recommended due to the security risk it introduces.
Option B: Create Individual IAM Users
- Reasoning: Creating individual IAM users for each person or service that requires access is a best practice. This allows for the implementation of the principle of least privilege by giving each user only the permissions necessary to perform their job. It also helps with accountability, as you can track the actions of individual users in logs.
- Conclusion: This is a best practice because it ensures secure and granular control over access.
Option C: Use Inline Policies Instead of Customer Managed Policies
- Reasoning: Customer managed policies are more flexible, reusable, and easier to manage than inline policies. Inline policies are embedded directly in a user, group, or role, making them harder to maintain at scale, especially in large environments where access needs to be consistent across multiple resources.
- Conclusion: This i...
Author: Leah · Last updated Jul 11, 2026
Which advantage of cloud computing allows users to scale resources up and down based on the amount o...
The question asks which advantage of cloud computing allows users to scale resources up and down based on the amount of load an application supports. Let's examine the options:
A) Go global in minutes
- Purpose: This advantage refers to the ability of cloud services to quickly deploy applications and services across different regions and geographic locations. It is often associated with enabling businesses to expand globally and serve customers in different regions.
- Use Case: While this is a valuable cloud computing benefit, it doesn't directly address scaling resources based on application load.
- Rejection Reason: This advantage focuses on global deployment rather than scaling resources up or down based on demand.
B) Stop guessing capacity
- Purpose: This advantage highlights the flexibility of cloud computing to allow users to provision exactly the amount of resources they need without having to guess how much capacity they will require. This aligns with the ability to scale resources up or down based on load.
- Use Case: This is directly related to scaling resources because it eliminates the need for over-provisioning or under-provisioning hardware. Cloud resources can be automatically adjusted based on the application’s demand.
- Key Factors:
- Effort: Cloud services like AWS Auto Scaling make it easy to adjust resources automatically.
- Time: Scaling can happen in real-time based on application load.
- Cost: Scaling resources only when needed can help control costs.
- Reas...
Author: Siddharth · Last updated Jul 11, 2026
A company is requesting Payment Card Industry (PCI) reports that validate the operating effectiveness of AWS security c...
To obtain Payment Card Industry (PCI) reports validating the operating effectiveness of AWS security controls, we need to assess each option in terms of its relevance to PCI compliance reports, time, effort, cost, and other relevant factors.
Option A: Contact AWS Support
- Reasoning: AWS Support can provide assistance and guidance, but PCI compliance reports are not typically obtained through direct support. AWS Support might not have direct access to these reports unless they are available through other channels like AWS Artifact. This is more for troubleshooting or operational support rather than obtaining specific compliance reports.
- Conclusion: Not the most efficient option, as it doesn’t directly provide the PCI compliance reports.
Option B: Download Reports from AWS Artifact
- Reasoning: AWS Artifact is the correct service for obtaining compliance reports, including PCI reports. AWS Artifact provides access to AWS’s audit reports, including PCI DSS compliance and other certifications. It is specifically designed for managing compliance documents such as PCI reports, SOC reports, and other audit reports.
- Effort: It is a self-service portal, so the company can easily download the required reports without needing to interact with support or account managers.
- Time: The reports are typically available immediately and can be downloaded directly from the AWS Artifact portal.
- Cost: Accessing these reports through AWS Artifact is free.
- Conclusion: Th...
Author: Olivia · Last updated Jul 11, 2026
An ecommerce company wants to distribute traffic between the Amazon EC2 instances that host its website.Which AWS ...
To meet the requirement of distributing traffic between Amazon EC2 instances that host an e-commerce website, let's evaluate the options in terms of services, effort, time, cost, and other factors relevant to the scenario:
Option A: Application Load Balancer (ALB)
- Reasoning: An Application Load Balancer is specifically designed to distribute incoming application traffic across multiple EC2 instances. ALBs operate at the application layer (Layer 7) and can route HTTP/HTTPS requests based on various conditions, such as URL paths or hostnames. This makes it ideal for web traffic to EC2 instances hosting a website.
- Effort: Setting up an ALB is relatively straightforward. It can automatically distribute traffic and scale as needed based on demand.
- Time: ALBs provide low-latency traffic distribution, ensuring quick load balancing for users.
- Cost: ALBs are cost-effective for distributing traffic across EC2 instances and scale automatically as traffic increases.
- Other Factors: ALBs also support features such as SSL termination, WebSocket support, and content-based routing.
- Conclusion: This is the best option for distributing web traffic across EC2 instances hosting a website.
Option B: AWS WAF (Web Application Firewall)
- Reasoning: AWS WAF is a security service that helps protect web applications from common web exploits. While it can be used alongside an Application Load Balancer (ALB) to provide security features such as rate limiting and blocking malicious traffic, it does not itself handle traffic distribution between EC2 instances.
- Effort: AWS WAF requires setup and configuration of rules to protect the web application, but it does not distribute traffic.
- Time: WAF operates at the security layer, not the traffic distribution layer, so it doesn’t directly solve the requirement of load balancing.
- Cost: AWS WAF incurs additional costs for rule sets and usage, but it doesn't fulfill the core requirement.
- Conclusion: AWS WAF is primarily for securi...
Author: Ming · Last updated Jul 11, 2026
Which AWS services or features form the AWS Cloud global infrastructure? (Choose two.)
To answer the question, we need to focus on AWS services or features that form the global infrastructure of AWS. This includes the components that enable AWS to provide its global network of data centers, hosting services, and scaling capabilities.
Option A: Availability Zones
- Reasoning: Availability Zones (AZs) are a key component of AWS’s global infrastructure. AZs are distinct, isolated locations within an AWS Region, designed to be fault-tolerant and provide high availability and redundancy. Each Region typically consists of multiple AZs, allowing customers to architect highly available applications across different zones.
- Effort: Setting up services across multiple AZs is straightforward and allows high availability and fault tolerance.
- Time: Availability Zones help reduce the risk of downtime by spreading resources across multiple locations.
- Cost: The cost is based on the usage of resources within those AZs, but it ensures reliability and redundancy.
- Conclusion: AZs are an essential part of AWS’s global infrastructure because they help to provide reliability, availability, and fault tolerance across regions.
Option B: Amazon ElastiCache
- Reasoning: Amazon ElastiCache is a managed service for caching, which speeds up applications by caching data. While it is useful for improving application performance, it is not part of the AWS Cloud global infrastructure. It operates within the infrastructure but does not form the core components that build the network and hosting capabilities of AWS.
- Effort: Setting up ElastiCache is simple, but it’s a service for application performance, not global infrastructure.
- Time: ElastiCache does not directly impact global availability or fault tolerance in terms of infrastructure.
- Cost: It incurs costs based on usage but is not part of the global infrastructure.
- Conclusion: ElastiCache is not part of the global infrastructure that forms AWS’s physical and regional network.
Option C: AWS Regions
- Reasoning: AWS Regions are geographic locations where AWS data centers are clustered. Each Region is made up of multiple Availability Zones, and these Regions help AWS provide low-latency, resilient, and scalable services to customers globally. AWS Regions form the backbone of AWS’s global infrastructure.
- Effort: Regions help manage and deploy services across the globe, ...
Author: MysticJaguar44 · Last updated Jul 11, 2026
According to the AWS shared responsibility model, which of the following are AWS responsibilities? (...
The AWS Shared Responsibility Model divides security and compliance responsibilities between AWS and the customer. AWS is responsible for the "Security of the Cloud," meaning the infrastructure, hardware, and virtualization technologies. Customers are responsible for "Security in the Cloud," which includes securing their applications, data, and user configurations.
Analyzing each option:
A) Network infrastructure and virtualization of infrastructure
- Selected: This is part of AWS's responsibility. AWS manages the physical network infrastructure, including networking and virtualization (such as compute resources and virtual machines). Customers do not need to worry about underlying infrastructure but focus on higher-level configurations.
- Scenario: You would use this option if you need to manage cloud resources without worrying about the physical servers or networking.
B) Security of application data
- Rejected: This responsibility lies with the customer. Customers are responsible for securing their application data, which includes data encryption, access management, and ensuring that applications are configured securely.
- Scenario: This option is applicable when a customer needs to ensure their data in the cloud is protected, such ...
Author: Lucas Carter · Last updated Jul 11, 2026
A company uses Amazon Aurora as its database service. The company wants to encrypt its databases and database backups.Which party manages the encryption of the database cluste...
The AWS Shared Responsibility Model defines the distinction between AWS and the customer’s roles regarding security and encryption.
In this case, the company is using Amazon Aurora, a managed database service offered by AWS. The key question here is who manages the encryption of the database clusters and database snapshots.
Analyzing each option:
A) AWS
- Rejected: While AWS is responsible for the underlying infrastructure, it does not automatically encrypt customer data. AWS provides the tools and options for encryption (such as the ability to enable encryption at rest for Aurora), but it is ultimately the customer's responsibility to enable and manage the encryption.
- Scenario: This option would only be correct if we were talking about the encryption of the underlying infrastructure, such as securing the physical storage hardware in AWS data centers.
B) The company
- Selected: The company (the customer) is responsible for configuring encryption for their Aurora database clusters and database snapshots. AWS provides the capability to enable encryption at rest for Amazon Aurora, but the company needs to set up encryption keys and manage them (e.g., using AWS KMS). The company is also responsible for ensuring that backups and snapshots are ...
Author: Olivia · Last updated Jul 11, 2026
A company is hosting a web application on Amazon EC2 instances. The company wants to implement custom conditions to filter and control inboun...
To implement custom conditions to filter and control inbound web traffic for a web application hosted on Amazon EC2 instances, the company needs a service that specifically addresses filtering and controlling HTTP/HTTPS traffic. Let's evaluate each of the options:
A) Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized activity. It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs for potential security threats. However, GuardDuty is not designed for controlling or filtering inbound web traffic. It is used primarily for detecting security anomalies or malicious activities, such as unusual API calls or port scanning attempts, but it does not directly filter or control web traffic based on custom conditions.
- Time: GuardDuty is fast to enable and provides alerts, but it does not control inbound traffic.
- Cost: GuardDuty charges based on the volume of data analyzed, but it is not the right service for traffic filtering.
- Effort: While easy to configure, GuardDuty doesn't provide traffic filtering capabilities.
- Scenario: Best for security monitoring and threat detection, but not for traffic control.
B) AWS WAF
AWS WAF (Web Application Firewall) is a service designed specifically for filtering and controlling HTTP/HTTPS traffic to web applications hosted on Amazon EC2, Amazon CloudFront, and Application Load Balancers. AWS WAF allows you to define custom rules based on conditions such as IP addresses, HTTP headers, query string parameters, and more. You can create custom conditions to block or allow traffic, making it the ideal service for the company's requirements to filter and control inbound web traffic.
- Time: AWS WAF is quick to configure and deploy, allowing you to define custom rules for traffic filtering.
- Cost: AWS WAF is priced based on the number of web access control lists (ACLs) and the number of rules you configure. The cost is generally low for small to medium-scale applications.
- Effort: Setting up AWS WAF requires minimal effort and can be managed through the AWS Management Console or API.
- Scenario: Perfect for controlling inbound traffi...
Author: StarryEagle42 · Last updated Jul 11, 2026
A company wants to maintain bandwidth throughput and provide a more consistent network experience than public internet-based c...
To help the company maintain bandwidth throughput and provide a more consistent network experience than public internet-based connections, we need to evaluate each of the given AWS services in terms of factors like cost, effort, time, performance, and the specific requirement for reliability and consistency in the network.
Option A: AWS VPN
- Description: AWS VPN allows secure connections between a customer's on-premises network and AWS.
- Pros: Cost-effective, quick to set up, encrypted connections.
- Cons: Uses the public internet for traffic, so it doesn't guarantee a consistent or high-bandwidth experience, especially for large-scale needs.
- Best Use Case: It is suitable for smaller-scale or less performance-sensitive applications, where security over public internet is a concern but the network performance may not be mission-critical.
- Why Rejected: Since the company wants to maintain throughput and consistency, the use of public internet introduces variability in latency and bandwidth, making AWS VPN unsuitable.
Option B: AWS Direct Connect
- Description: AWS Direct Connect establishes a dedicated network connection from the customer's premises to AWS, bypassing the public internet.
- Pros: Offers higher bandwidth, lower latency, and more reliable network performance compared to the public internet. Direct Connect also offers a more consistent network experience, which is essential for business-critical applications.
- Cons: Higher upfront cost, longer setup time, and more effort required to establish and maintain the dedicated connection.
- Best Use Case: Ideal for large enterprises with high-performance requirements or heavy data workloads that need a stable, low-latency connection.
- Why Selected: This is the best option for a company that wants to maintain high b...
Author: Sofia2021 · Last updated Jul 11, 2026
A company has temporary workload that is also variable. The company needs to use Amazon EC2 instances for the workload. The EC2 instances need to handle short bursts of work that ca...
The company needs Amazon EC2 instances for a temporary, variable workload that requires short bursts of work and cannot stop before finishing. The key requirements are flexibility, ability to handle burst workloads, and ensuring that the EC2 instances do not terminate prematurely.
Analyzing each option:
A) Spot Instances
- Rejected: Spot instances are typically used for non-critical, flexible workloads that can be interrupted. These instances are provisioned at a lower cost but can be terminated by AWS with little notice when the spot price exceeds the bid or when there is insufficient capacity. Since the workload cannot stop before finishing, Spot Instances are not suitable for this scenario.
- Scenario: Spot instances would be appropriate for batch jobs or tasks where interruptions are acceptable and cost savings are prioritized.
B) On-Demand Instances
- Selected: On-Demand Instances are ideal for workloads that are temporary and variable in nature. They are charged based on the hourly usage without the need for long-term commitment, and they can handle short bursts of work without the risk of interruption. Since the workload must not stop before completion, On-Demand Instances ensure that the instances remain running for the duration of the task. This option provides flexibility, ensuring that the workload can handle bursts an...
Author: Siddharth · Last updated Jul 11, 2026
A company's employees are working from home. The company wants its employees to use their personal devices to connect to a managed workstation in the AWS Cloud.Whic...
The company's employees are working from home and need to connect to a managed workstation in the AWS Cloud. To enable this setup, the company should provide its employees with a remote environment they can access via personal devices.
Analyzing each option:
A) Amazon Workspaces
- Selected: Amazon Workspaces is a managed virtual desktop service that allows users to access a full desktop environment in the AWS Cloud. It is specifically designed for remote access and enables employees to securely connect to a virtual workstation. Since employees are working from home and using personal devices, Amazon Workspaces provides the ideal solution. It is easy to set up, scalable, and ensures a secure environment for remote work.
- Scenario: This service would be used when companies need to provide remote, cloud-based desktop environments that can be accessed from various personal devices, with full control over the workstations.
B) AWS Cloud9
- Rejected: AWS Cloud9 is an IDE (Integrated Development Environment) in the cloud, primarily aimed at software development. While it provides a browser-based environment for coding and collaboration, it is not a fully managed desktop or workstation solution. It is not designed to support remote, general-purpose work environments like those required for employees working from home on personal devices.
- Scenario: Clou...
Author: Ishaan · Last updated Jul 11, 2026
A company needs to use SQL syntax to perform a direct query of objects in an Amazon S3 bucket.Which AWS servi...
The company needs to use SQL syntax to perform a direct query of objects in an Amazon S3 bucket. This suggests the company is looking for a service that allows querying S3 data using SQL directly, without needing to load the data into a database or transform it beforehand.
Analyzing each option:
A) AWS Glue
- Rejected: AWS Glue is a fully managed ETL (Extract, Transform, Load) service used for preparing and transforming data for analytics. While AWS Glue can be used to catalog data in S3 and prepare it for querying, it is not primarily a querying service itself. Instead, Glue is more focused on data processing and integration with other AWS services like Amazon Redshift or Amazon Athena. It does not allow direct querying of S3 objects using SQL without first performing ETL operations.
- Scenario: Glue would be used if the company needed to extract, transform, and load data, but it does not directly support SQL queries on S3 objects.
B) Amazon Athena
- Selected: Amazon Athena is a serverless interactive query service that allows users to run SQL queries directly on data in Amazon S3. Athena uses Presto and can query data in S3 without the need for any ETL process. It supports multiple formats (such as CSV, JSON, and Parquet) and allows for SQL-like queries on data stored in S3, making it the best cho...
Author: Aria · Last updated Jul 11, 2026
A company uses Amazon RDS for a product database. The company wants to ensure the database is highly available.Which...
To ensure high availability for an Amazon RDS database, the best option is Multi-AZ deployment. Let’s go through the reasoning behind this selection, considering the services, effort, time, cost, and other key factors.
Explanation:
A) Read replicas:
- Functionality: Read replicas are primarily used to offload read traffic from the primary database to improve performance, but they are not specifically designed for high availability in terms of automatic failover.
- Reason for Rejection: If the primary database instance fails, read replicas do not automatically promote themselves to be the primary instance. There is some manual intervention needed for promoting a read replica to become the new primary, making it less ideal for high availability purposes.
- Scenario: Read replicas can be used for improving read scalability and distributing traffic, but they are not suitable when the primary goal is high availability.
B) Blue/green deployment:
- Functionality: Blue/green deployment is a strategy used for minimizing downtime during application updates or changes by switching between two environments (blue and green). It’s typically used for deploying new application versions.
- Reason for Rejection: While it helps with application deployment processes and reducing downtime during application releases, it does not directly relate to ensuring high availability for a database instance.
- Scenario: This could be used when you're deploying a new version of an application or system, but it doesn’t provide high availability for a database.
C) Multi-AZ deployment:
- ...
