Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company has an internal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A CloudOps engineer must make the ap...
Key requirement: Make the application highly available
The application currently has:
EC2 instances behind an Application Load Balancer (ALB) ✅
EC2 instances managed by an Auto Scaling group (ASG) ✅
Instances deployed in only one Availability Zone (AZ) ❌
The main problem is a single point of failure. If that Availability Zone experiences an outage, all EC2 instances in that AZ become unavailable, and the application goes down.
For AWS exams, remember:
High availability within a Region = Multiple Availability Zones
Disaster recovery across Regions = Multi-Region architecture
Auto Scaling handles instance replacement and scaling, but not AZ redundancy unless configured
ALB already supports multi-AZ routing when targets exist in multiple AZs
---
Option A: Increase the maximum number of instances in the Auto Scaling group
Why it is rejected:
Increasing the maximum capacity only allows the ASG to launch more instances during high demand.
Example use case:
Application traffic increases during peak hours.
Current ASG maximum is 5 instances.
Increase maximum to 20 instances so the application can scale further.
Why it does not solve this problem:
All new instances will still launch in the same Availability Zone.
If that AZ fails, all instances are unavailable.
This improves scalability, not availability.
❌ Rejected
---
Option B: Increase the minimum number of instances in the Auto Scaling group
Why it is rejected:
Increasing the minimum number of instances ensures that a certain number of instances are always running.
Example use case:
The application needs at least 4 instances running at all times.
Set ASG minimum capacity to 4.
Why it does not solve this problem:
The instances are still located in only one Availability Zone.
If the AZ fails, all minimum instances fail together.
This improves capacity availability, but not infrastructure availability.
❌ Rejected
---
Option C: Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region
Why it is correct:
This removes the single Availability Zone dependency.
Example architecture:
```
...
Author: Aarav2020 · Last updated Jul 11, 2026
A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the user requests. The company needs to monitor the number of times that...
Question Summary
The company needs to monitor the number of HTTP 404 responses generated by a web server. The logs are already being sent to Amazon CloudWatch Logs, and the log events have a consistent structure containing HTTP response codes.
The key requirement is continuous monitoring of a specific pattern (HTTP 404 errors) in logs.
---
Key AWS Exam Factors
When choosing an AWS monitoring solution, consider:
| Requirement | Best AWS Feature |
| -------------------------------------------------------- | ----------------------------------- |
| Count occurrences of a specific log pattern continuously | CloudWatch Logs Metric Filter |
| Send log events to another service for processing | CloudWatch Logs Subscription Filter |
| Run ad-hoc queries on logs | CloudWatch Logs Insights |
| Automate custom processing | Lambda / scripts |
The requirement is not to analyze logs occasionally; it is to monitor and count 404 responses operationally efficiently.
---
Option A: Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.
✅ Correct
Why?
A CloudWatch Logs metric filter can scan incoming log events and create a CloudWatch metric whenever a matching pattern appears.
Example:
```
HTTP 404
```
Each matching log event increments the metric count.
The company can then:
Create CloudWatch alarms.
View the number of 404 errors over time.
Track trends on dashboards.
Automatically detect increased error rates.
Why it is operationally efficient?
No additional code required.
Works automatically as logs arrive.
Uses native AWS monitoring capability.
No servers or Lambda functions to manage.
Scenario where this option is used:
Use CloudWatch Logs Metric Filters when:
You need to count specific events in logs.
You need alarms based on log patterns.
You want real-time monitoring.
Examples:
Count HTTP 500 errors.
Count failed login attempts.
Monitor application exceptions.
Detect unauthorized access attempts.
---
Option B: Create a CloudWatch Logs subscription filter that counts the number of times that the web server returns an HTTP 404 response.
❌ Incorrect
Why?
A CloudWatch Logs subscription filter does not count log events.
Its purpose is to stream log d...
Author: Leah Davis · Last updated Jul 11, 2026
A company operates compute resources in a VPC and in the company's on-premises data center. The company already has an AWS Direct Connect connection between the VPC and the on-premises data center. A CloudOps engineer needs to ensure that Amazon EC2 instances in the VPC can resolve DNS names for...
Question Summary
Requirement:
EC2 instances inside an AWS VPC must resolve DNS names of hosts that exist in the on-premises data center.
Existing connectivity:
AWS VPC ↔ On-premises data center already connected using AWS Direct Connect.
Need the solution with the least ongoing maintenance.
The key AWS service to think about here is Amazon Route 53 Resolver because it provides DNS resolution between AWS and on-premises environments without manually maintaining records.
---
Option Analysis
A) Create an Amazon Route 53 private hosted zone. Populate the zone with the hostnames and IP addresses of the hosts in the on-premises data center.
❌ Rejected
Why?
A private hosted zone is used for DNS records inside AWS VPCs.
Example use case:
EC2 instances need to resolve internal AWS names:
`database.company.internal`
`app.internal`
You would create records like:
```
db.company.internal → 10.0.1.50
```
However, this option requires manually adding and maintaining every on-premises hostname and IP address.
Problems:
High maintenance effort.
Every new on-premises server requires updating Route 53 records.
IP changes require manual updates.
Does not integrate with the existing corporate DNS infrastructure.
When to use:
Use a Route 53 private hosted zone when:
You want AWS-managed DNS records for resources inside a VPC.
The DNS namespace is owned and managed in AWS.
Example:
```
AWS VPC resources:
web.prod.internal
db.prod.internal
```
---
B) Create an Amazon Route 53 Resolver outbound endpoint. Add the IP addresses of an on-premises DNS server for the domain names that need to be forwarded.
✅ Selected
Why?
This is the recommended hybrid DNS solution.
A Route 53 Resolver outbound endpoint allows DNS queries from AWS VPCs to be forwarded to DNS servers in the on-premises network.
Flow:
```
EC2 Instance
|
|
VPC Resolver (Route 53 Resolver)
|
|
Outbound Resolver Endpoint
|
|
AWS Direct Connect
|
|
On-premises DNS Server
```
Example:
EC2 queries:
```
server1.company.local
```
Route 53 Resolver checks forwarding rules:
```
company.local → On-premises DNS server
```
The query is forwarded to the corporate DNS server, which already knows the hostname.
---
Why it has the least maintenance
No need to create DNS records in AWS.
Existing on-premises DNS remains the source of truth.
New servers added on-premises automatically become resolvable.
DNS administration stays with the existing DNS team.
This is ideal for hybrid cloud environments.
When to use:
Use an outbound Resolver endpoint when:
AWS resources need to resolve on-premises DNS names.
A corporate DNS server already exists.
You have connectivity through:
AWS Direct Connect
VPN
Example:
On-p...
Author: Olivia Johnson · Last updated Jul 11, 2026
A CloudOps engineer is designing a solution for an Amazon RDS for PostgreSQL DB instance. Database credentials must be stored and rotated monthly. The applications that connect to the DB instance send write-intensive traffic with variable client connections that sometimes increas...
Question Analysis
Requirements:
1. Database credentials must be stored and rotated monthly
The solution must manage DB usernames/passwords and automatically rotate them.
This points to a secrets management service, not a key management service.
2. Applications generate write-intensive traffic with variable client connections
The number of application connections can suddenly increase.
The solution must handle connection spikes efficiently.
This points to a database connection pooling/proxy solution.
---
Option Evaluation
A) Configure AWS KMS to automatically rotate the keys for the DB instance. Use RDS Proxy to handle the increases in database connections.
Why it is rejected:
AWS Key Management Service (AWS KMS) manages encryption keys, not database credentials.
KMS automatic key rotation rotates encryption keys used for services such as RDS encryption at rest.
It does not store, retrieve, or rotate database usernames/passwords.
Where KMS is used:
Encrypting RDS storage.
Encrypting backups and snapshots.
Managing customer-managed encryption keys.
Example:
"Automatically rotate the encryption key used to encrypt an RDS database."
However, this requirement is about credentials, so KMS is incorrect.
✅ RDS Proxy is correctly chosen because it:
Provides connection pooling.
Reduces the number of direct database connections.
Handles sudden increases in application connections.
Improves database availability during connection bursts.
---
B) Configure AWS KMS to automatically rotate the keys for the DB instance. Use RDS read replicas to handle the increases in database connections.
Why it is rejected:
The first issue remains:
KMS cannot rotate database credentials.
Additionally:
Amazon RDS Read Replicas are designed for read scaling, not connection management.
Read replicas are useful when:
Applications have heavy read workloads.
Reporting or analytics queries need offloading.
Read traffic needs horizontal scaling.
Example:
A web application receives millions of product searches and needs additional read capacity.
They are not useful for:
Handling increased write connections.
Managing database connection spikes.
Since the workload is write-intensive, read replicas do not solve the problem.
---
C) Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections.
Why it is correct:
This option satisfies both requirements.
1. Credential storage and rotation:
AWS Secrets Manager is designed for:
Storing database credentials securely.
Automatically rotating credent...
Author: Carlos Garcia · Last updated Jul 11, 2026
An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read write, and delete messages from ...
Key AWS exam concept: Use IAM roles for applications running on EC2
When an application running on an Amazon EC2 instance needs to access AWS services (such as Amazon SQS), the most secure approach is to use an IAM role attached to the EC2 instance.
Important reasoning factors:
IAM users are for humans or long-term external identities, not for applications running on AWS resources.
IAM roles provide temporary credentials through the EC2 Instance Metadata Service.
Hardcoding access keys or storing them as environment variables increases the risk of credential exposure.
Least privilege principle requires granting only the exact permissions required, not broad permissions like `sqs:`.
The application needs:
`sqs:SendMessage` → write messages to queues
`sqs:ReceiveMessage` → read messages from queues
`sqs:DeleteMessage` → remove processed messages
---
Option Analysis
A) Create an IAM user and embed credentials in the application's configuration.
Rejected ❌
Why:
This creates long-term static credentials inside application configuration files.
If the application code, configuration file, backup, or logs are exposed, the IAM user's access keys can be compromised.
Rotating credentials becomes difficult because the application must be updated.
When this approach might be used:
Rarely, for applications running outside AWS where IAM roles are not available (for example, an on-premises application), though alternatives such as IAM Roles Anywhere or federation are preferred.
Why it is not suitable here:
The application is running on EC2, where IAM roles are specifically designed for this purpose.
---
B) Create an IAM user and export credentials as environment variables on the EC2 instance.
Rejected ❌
Why:
Although this avoids hardcoding credentials in source code, it still uses long-term IAM user credentials.
Environment variables can accidentally be exposed through:
Debugging tools
Process inspection
Misconfigured applications
Logs
Credential rotation remains a management burden.
When this approach might be used:
Temporary testing environments or legacy applications ...
Author: Krishna · Last updated Jul 11, 2026
A CloudOps engineer is responsible for a company's disaster recovery procedures. The company has a source Amazon S3 bucket in a production account, and it wants to replicate objects from the source to a destination S3 bucket in a nonproduction account. The CloudOps engineer configures S3 cross-Region, cross-account replication to copy the source S3 bucket to the destination S3 bucke...
Key factors in the scenario
The replication is cross-account: source S3 bucket is in a production AWS account, destination S3 bucket is in a nonproduction AWS account.
S3 replication can successfully copy objects, but object ownership and permissions are separate issues.
In cross-account S3 replication, the replicated objects might remain owned by the source account unless ownership is explicitly changed.
The CloudOps engineer receives Access Denied when accessing objects in the destination bucket, which strongly indicates an object ownership/permission problem, not a replication timing or storage issue.
---
Option A: Modify the replication configuration to change object ownership to the destination S3 bucket owner. ✅ Correct
Why this is correct:
For cross-account replication, the destination account owner must be able to access and manage the replicated objects.
By configuring S3 Replication with S3 Object Ownership = Bucket owner preferred (or using the replication setting that grants ownership to the destination bucket owner), the replicated objects become owned by the destination account.
This resolves situations where:
Objects are replicated successfully.
The destination bucket owner tries to access them.
Access is denied because the source account still owns the objects.
When this option is used:
Use this when:
Replication is cross-account.
The destination account needs full control of replicated objects.
A destination administrator receives Access Denied errors.
This is a common AWS disaster recovery pattern where a secondary account owns and manages replicated backups.
---
Option B: Ensure that the replication rule applies to all objects in the source S3 bucket and is not scoped to a single prefix. ❌ Incorrect
Why it is rejected:
Replication rules can be filtered by:
Prefix
Object tags
If the rule only replicates certain objects, some objects may not appear in the destination bucket.
However, the problem states that the CloudOps engineer is attempting to access objects in the destination bucket and receives Access Denied.
This indicates:
Objects exist in the destination...
Author: Noah Williams · Last updated Jul 11, 2026
A company has millions of subscribers. The company's marketing department wants to automate a process that sends notifications to subscribers every Saturday. The company already has a mechanism that uses Amazon Simple Notification Service (Amazon SNS) to send notifications to subscribers. However, the company has historically sent notifications to subscribers manually
A CloudOp...
Question Summary
The company already uses Amazon SNS to send notifications. The problem is that notifications are currently sent manually, and the company wants an automated weekly schedule (every Saturday) in the most operationally efficient way.
The key requirement is:
Trigger an action on a fixed schedule.
Publish a message to an existing SNS topic.
Avoid managing infrastructure.
Use a serverless, low-maintenance AWS service.
---
Option Analysis
A) Launch a new Amazon EC2 instance. Configure a cron job to use the AWS SDK to send an SNS notification every Saturday.
Why it could work:
An EC2 instance can run a cron job.
The cron job can call the AWS SDK and publish messages to SNS.
Why it is rejected:
Requires managing an EC2 instance:
Operating system patches.
Instance availability.
Security updates.
Monitoring.
Scaling considerations.
This is unnecessary infrastructure for a simple scheduled task.
When this option is useful:
Use EC2 cron jobs when:
A workload already runs on EC2.
You need custom scripts with OS-level control.
The task requires long-running processes or local dependencies.
For simple scheduled AWS service actions, serverless options are preferred.
---
B) Create a rule in Amazon EventBridge that triggers every Saturday. Configure the rule to publish a notification to an SNS topic.
Why it is correct:
Amazon EventBridge supports scheduled rules using cron or rate expressions.
It can directly invoke AWS services, including SNS.
No servers need to be managed.
It is fully managed and highly available.
It automatically runs according to the defined schedule.
Key AWS exam factors:
✅ Serverless
✅ No infrastructure management
✅ Native AWS integration
✅ Supports scheduled events
✅ Operationally efficient
✅ Scales automatically
Example flow:
```
EventBridge Scheduled Rule
|
v
SNS Topic
|
v
Subscribers receive notifications
```
When to use EventBridge schedules:
Use EventBridge when:
You need to run something at a specific time.
You need periodic automation.
You want to trigger Lambda, SNS, SQS, Step Functions, or other AWS services.
You want a fully managed replacement for cron jobs.
---
C) Create an SNS subscription to a message fanout that sen...
Author: Elizabeth · Last updated Jul 11, 2026
A CloudOps engineer must ensure that all of a company's current and future Amazon S3 buckets have logging enabled. If an S3 bucket does not have logging enabled, an automated process mus...
Question Analysis
Requirement keywords:
All current and future Amazon S3 buckets
Detect buckets without logging enabled
Automatically enable logging
CloudOps automation
The solution must provide:
1. Continuous compliance monitoring → detect non-compliant S3 buckets.
2. Automatic remediation → fix the issue without manual intervention.
3. Support future resources → work whenever new S3 buckets are created.
---
Option A — Use AWS Trusted Advisor to check and enable logging
❌ Rejected
Why?
AWS Trusted Advisor provides recommendations and best-practice checks, but it is not an automated remediation service.
Trusted Advisor can identify issues such as security weaknesses or configuration problems.
It does not automatically modify resources to fix issues.
It cannot be configured to enable S3 logging automatically.
When can Trusted Advisor be used?
Use Trusted Advisor when you need:
Cost optimization recommendations.
Security best-practice checks.
Performance and reliability recommendations.
Example:
> Finding unused Elastic IP addresses or publicly accessible S3 buckets.
It is a recommendation tool, not a remediation automation tool.
---
Option B — Configure an S3 bucket policy requiring all current and future buckets to have logging enabled
❌ Rejected
Why?
S3 bucket policies control access permissions, not bucket configuration enforcement.
A bucket policy can:
Allow or deny actions.
Restrict users or services.
Enforce encryption requirements.
Block public access.
A bucket policy cannot enable S3 server access logging automatically.
Also:
Bucket policies are configured per bucket.
They cannot enforce configuration across all existing and future buckets in an AWS account.
When can bucket policies be used?
Use bucket policies for:
Preventing unencrypted uploads.
Restricting access to specific IAM principals.
Enforcing secure transport (`aws:SecureTransport`).
Example:
> Deny all S3 requests that do not use HTTPS.
---
Option C — Use AWS Config managed rule and Lambda remediation
✅ Technically possible, but not the best answer
Why?
The AWS Config managed rule:
`s3-bucket-logging-enabled`
can continuously evaluate whether S3 buckets have logging enabled.
A remediation action can invoke a Lambda function that:
Receives the non-compliant bucket information.
Calls the S3 API.
Enables logging.
This meets the requirement.
However, the question is asking for the best AWS-native operational solution. Writing and maintaining a custom Lambda function is unnecessary because AWS already provides a Systems Mana...
Author: SolarFalcon11 · Last updated Jul 11, 2026
A company has users that deploy Amazon EC2 instances that have more volume performance capacity than is required. A CloudOps engineer needs to review all Amazon Elastic Block Store (Amazon EBS) volumes that are associated with the instances and create cost optimization recommendations based on...
Question Summary
A company has Amazon EC2 instances with EBS volumes that have more performance capacity (IOPS and throughput) than needed. A CloudOps engineer must:
Review all EBS volumes
Identify over-provisioned performance capacity
Create cost optimization recommendations
Do this in the MOST operationally efficient way
The key requirement is analyzing EBS volume performance (IOPS and throughput) and receiving optimization recommendations at scale.
---
Option Analysis
✅ C) Opt in to AWS Compute Optimizer. Allow sufficient time for metrics to be gathered. Review the Compute Optimizer findings for EBS volumes.
Why this is correct
AWS Compute Optimizer is designed specifically to provide automated cost and performance optimization recommendations for AWS resources, including:
Amazon EC2 instances
Amazon EBS volumes
Auto Scaling groups
Lambda functions
For EBS volumes, Compute Optimizer analyzes CloudWatch metrics such as:
Volume IOPS utilization
Volume throughput utilization
Volume type
Provisioned performance vs actual usage
It can identify cases where:
gp3/io1/io2 volumes have excessive provisioned IOPS
Throughput is much higher than workload requirements
A lower-cost volume configuration would satisfy workload needs
Key exam factors
The requirement says "review all EBS volumes" → requires a scalable service, not manual inspection.
The requirement says "create cost optimization recommendations" → Compute Optimizer provides recommendations directly.
The requirement focuses on IOPS and throughput, not storage capacity usage.
It is the most operationally efficient because no agents, scripts, or manual testing are required.
When to use Compute Optimizer
Use Compute Optimizer when you need:
Automated rightsizing recommendations
Cost reduction opportunities
Analysis across many AWS resources
Recommendations based on historical utilization metrics
Example scenario:
> A company has thousands of EC2 instances and EBS volumes and wants recommendations for reducing unnecessary provisioned IOPS.
---
Why Other Options Are Incorrect
---
❌ A) Use the monitoring graphs in the EC2 console to view metrics for EBS volumes. Review the consumed space against the provisioned space on each volume. Identify any volumes that have low utilization.
Why rejected
This option looks at storage capacity utilization, not performance utilization.
EBS optimization requires checking:
IOPS usage
Throughput usage
However, this option checks:
Used storage space
Provisioned storage capacity
A volume can have:
Low storage usage but high IOPS demand
High storage usage but low IOPS demand
Example:
A 1 TB gp3 volume using only 100 GB does not necessarily mean it is over-provisioned. The issue may be excessive provisioned IOPS or throughput.
When this option can be used
Use storage utilization analysis when:
You need to identify oversized v...
Author: Carlos Garcia · Last updated Jul 11, 2026
A company plans to migrate several of its high performance computing (HPC) virtual machines (VMs) to Amazon EC2 instances on AWS. A CloudOps engineer must identify a placement group for this deployment. The strategy must minimize network latency and must maximize netw...
Question Summary
The company is migrating high performance computing (HPC) VMs to Amazon EC2 and needs a placement strategy that:
Minimizes network latency
Maximizes network throughput
Keeps communication between HPC instances as fast as possible
This requirement points to a placement group designed for tightly coupled workloads such as HPC, machine learning, and high-performance databases.
---
Key AWS Concept: EC2 Placement Groups
An EC2 placement group controls how EC2 instances are physically placed on AWS infrastructure. AWS provides three strategies:
| Placement Group Type | Main Purpose | Best Use Cases |
| -------------------- | ------------------------------------------------------------- | ---------------------------------------------------- |
| Cluster | Places instances close together in the same Availability Zone | HPC, low-latency applications, distributed computing |
| Partition | Separates instances into logical partitions across hardware | Large distributed systems needing fault isolation |
| Spread | Places instances on distinct hardware | Critical applications needing maximum availability |
---
Option Analysis
A) Deploy the instances in a cluster placement group in one Availability Zone ✅
Correct option
A cluster placement group places EC2 instances physically close together within a single Availability Zone.
Why this meets the requirements:
Instances are located close to each other on the AWS network.
Provides:
Lowest network latency
Highest network throughput
High-speed east-west communication between instances
Supports HPC workloads that require frequent communication between nodes.
Typical scenarios for cluster placement groups:
High Performance Computing (HPC)
Computational fluid dynamics
Financial modeling
Machine learning model training
Big data analytics requiring fast node-to-node communication
Distributed applications where latency is critical
Limitation:
All instances are in one Availability Zone, so it does not provide Availability Zone-level fault tolerance.
For HPC workloads, performance is usually more important than multi-AZ availability, making this the preferred choice.
---
B) Deploy the instances in a partition placement group in two Availability Zones ❌
A partition placement group divides instances into separate partitions, where each partition is placed on different hardware.
Why it is rejected:
Designed for large distributed workloads that need fault isolation, not max...
Author: StarlightBear · Last updated Jul 11, 2026
A company manages a set of accounts on AWS by using AWS Organizations. The company's security team wants to use a native AWS service to regularly scan all AWS accounts against the Center for Internet Security (CIS) AWS F...
Question Summary
A company uses AWS Organizations to manage multiple AWS accounts. The security team wants a native AWS service that can regularly scan all accounts against the CIS AWS Foundations Benchmark with the least operational effort.
The key requirements are:
Must scan all AWS accounts in the organization.
Must use a native AWS security service.
Must run CIS AWS Foundations Benchmark checks.
Must be operationally efficient (avoid manual invitations/scripts).
---
Key AWS Concepts
AWS Security Hub + CIS AWS Foundations Benchmark
AWS Security Hub is the AWS service that performs security posture checks, including:
CIS AWS Foundations Benchmark checks.
AWS Foundational Security Best Practices.
PCI DSS checks.
Security Hub supports AWS Organizations integration, allowing a central administrator account to manage member accounts automatically.
Amazon GuardDuty
GuardDuty provides:
Threat detection.
Malware detection.
Suspicious activity monitoring.
It does not perform CIS AWS Foundations Benchmark compliance scans.
Amazon Inspector
Inspector focuses on:
Vulnerability scanning.
EC2 instance vulnerabilities.
Container image vulnerabilities.
Lambda code vulnerabilities.
It does not run CIS AWS Foundations Benchmark checks.
---
Option Analysis
A) Use Security Hub administrator account, create scripts to send and accept invitations, run script for new accounts.
Why it looks correct:
Security Hub is the correct service.
Security Hub can run CIS AWS Foundations Benchmark scans.
Why it is rejected:
This is not operationally efficient.
AWS Organizations integration allows Security Hub to automatically manage member accounts.
Creating custom scripts to invite and accept accounts introduces unnecessary maintenance.
When this option could be used:
In environments where accounts are not managed through AWS Organizations.
When manually managing a small number of standalone AWS accounts.
For an organization-managed environment, automation already exists.
---
B) Run CIS AWS Foundations Benchmark using Amazon Inspector.
Why it is rejected:
Amazon Inspector does not perform CIS AWS Foundations Benchmark assessments.
Inspector is designed for vulnerability mana...
Author: ShadowWolf101 · Last updated Jul 11, 2026
A company hosts an FTP server on Amazon EC2 instances. In the company's AWS environment, AWS Security Hub sends findings for the EC2 instances to Amazon EventBridge because the FTP port has become publicly exposed in the security groups that are attached to the instances.
A CloudOps engineer wants an automated solution to remediate the Security Hub f...
Question focus
The requirements are:
AWS Security Hub detects publicly exposed FTP port/security group rules.
Findings are already sent to Amazon EventBridge.
The solution must be automated.
The solution must use an event-driven approach.
The remediation should handle this finding and similar exposed port findings.
The key AWS pattern is:
Security Hub → EventBridge → Lambda → Remediation action
Security Hub findings can trigger EventBridge events, and EventBridge can invoke Lambda functions for automated remediation.
---
Option analysis
A) Configure the existing EventBridge event to stop the EC2 instances that have the exposed port.
Why it is rejected:
Stopping EC2 instances is not a proper remediation for an exposed security group rule.
The vulnerability is caused by a security group rule allowing public access, not the running state of the instance.
Stopping instances causes service disruption and does not fix the underlying security issue.
The FTP server would still be vulnerable when restarted.
When this option could be used:
If a security policy requires immediately isolating a compromised instance.
For findings involving active compromise, malware, or unauthorized activity where stopping an instance is an acceptable containment action.
---
B) Create a cron job for the FTP server to invoke an AWS Lambda function. Configure the Lambda function to modify the security group of the identified EC2 instances and to remove the instances that allow public access.
Why it is rejected:
This is not an event-driven approach.
A cron job is a scheduled/polling mechanism, not a response to Security Hub findings.
The FTP server should not be responsible for triggering security remediation.
The option also incorrectly suggests removing instances rather than removing the insecure security group rule.
When this option could be used:
For periodic compliance checks.
For scheduled maintenance tasks where real-time response is not required.
---
C) Create a cron job for the FTP server that invokes an AWS Lambda function. Configure the Lambda function to modify the server to use SFTP instead of FTP.
Why it is rejected:
FTP-to-SFTP migration is an architectural/security improvement, but it does not rem...
Author: Ava · Last updated Jul 11, 2026
A company has deployed Amazon EC2 instances from custom Amazon Machine Images (AMIs) in two AWS Regions. The company registered all the instances with AWS Systems Manager.
The company discovers that the operating system on some instances has a significant zero-day exploit. However, the company does not know how many instances are affected.
A CloudOps engineer must implem...
Key requirement analysis
The company’s requirements are:
1. Find how many EC2 instances are affected by a zero-day OS vulnerability.
2. Deploy OS patches to only affected instances.
3. Instances are already registered with AWS Systems Manager (SSM).
4. The solution should have the least operational overhead.
5. The solution must work across two AWS Regions.
The important AWS service for this scenario is AWS Systems Manager Patch Manager, because it is designed to assess and patch managed instances without manually tracking instances.
---
Option analysis
A) Define a patch baseline in Systems Manager Patch Manager. Use a Patch Manager scan to identify the affected instances. Use the Patch Now option in each Region to update the affected instances.
Why this is correct
✅ Systems Manager Patch Manager can scan managed instances for missing patches and compliance issues.
The workflow is:
1. Create or update a patch baseline that defines which patches should be applied.
2. Run a patch scan to identify instances that are missing required patches.
3. Use Patch Now to immediately apply patches to the affected instances.
Key factors:
The instances are already registered with SSM, so no additional agent setup is needed.
Patch Manager provides both visibility (scan) and remediation (patching).
It avoids manually identifying instances.
It works across multiple AWS Regions by configuring Patch Manager in each Region.
It requires less operational effort than rebuilding AMIs or manually managing replacements.
Scenario where this option is used:
You have many EC2 instances.
You do not know which instances are vulnerable.
You need to quickly identify and patch only affected systems.
---
Why other options are rejected
---
B) Use AWS Config to identify the affected instances. Define a patch baseline in Systems Manager Patch Manager. Use the Patch Now option in Patch Manager to update the affected instances.
❌ Incorrect
AWS Config is mainly used for configuration auditing and compliance tracking, not operating system vulnerability scanning.
Problems:
AWS Config does not natively determine whether an OS has a specific missing security patch.
It can identify configuration states (for example, security groups, encryption settings, instance properties), but not detailed OS patch compliance.
Systems Manager Patch Manager already provides patch compliance information.
When AWS Config is appropriate:
Checking whether resources meet compliance requirements.
Detecting configuration changes.
Enforcing rules such as "EBS volumes must be encrypted."
It is not the bes...
Author: Daniel · Last updated Jul 11, 2026
A company must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The company uses AWS Systems Manager, and the Windows instances are tagged appropriately. The company must deploy periodic updates to the third-party agent when the up...
Question focus
Requirements:
1. All Amazon EC2 Windows instances must have a third-party agent installed.
2. Instances are already tagged appropriately.
3. The company uses AWS Systems Manager.
4. The company must perform periodic updates when new agent versions are available.
5. The solution should require the least operational effort.
The key AWS services involved are:
Systems Manager Distributor → Packages and distributes software agents.
Systems Manager State Manager → Automatically installs, updates, or maintains software on managed instances based on schedules and tags.
AWS-ConfigureAWSPackage → Installs or updates packages from Distributor.
---
Option analysis
A) Create a Systems Manager Distributor package for the third-party agent.
✅ Selected
Why:
AWS Systems Manager Distributor is designed to package and distribute software to managed instances.
It can:
Store the third-party agent package.
Manage agent versions.
Install/update software on managed EC2 instances.
Work with State Manager associations.
This removes the need to manually connect to instances or write custom automation.
When this option is useful:
Deploying antivirus agents.
Installing monitoring agents.
Deploying security software.
Managing third-party software across many EC2 instances.
Key exam point:
> Distributor = package software for deployment.
---
B) Create a Systems Manager OpsItem that includes the tag value for Windows. Attach the Systems Manager inventory to the OpsItem.
❌ Rejected
Why:
OpsItems are part of AWS Systems Manager OpsCenter.
They are used for:
Tracking operational issues.
Managing incidents.
Recording remediation tasks.
They do not:
Install software.
Maintain software versions.
Automatically update agents.
When this option is useful:
Creating operational tickets.
Tracking failed resources.
Managing troubleshooting workflows.
Key exam point:
> OpsItem = operational issue tracking, not configuration management.
---
C) Create an AWS Lambda function. Program the Lambda function to log in to each instance and to install or update the third-party agent as needed.
❌ Rejected
Why:
Although Lambda could automate installation, it requires more operational effort.
Problems:
Requires custom code.
Requires handling authentication/access.
Requires instance connectivity logic.
Requires error handling and maintenance.
Does not naturally use the existing Systems Manager setup.
AWS Systems Manager already provides a managed solution.
When this option is useful:
Custom workflows not supported by Systems Manager.
Event-driven automation requiring API calls.
Complex remediation logic.
Key exam point:
> Prefer Systems Manager over c...
Author: Victoria · Last updated Jul 11, 2026
A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. The company's security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The load bal...
Question focus
Requirements:
1. Host a public web application on EC2 instances behind an Elastic Load Balancer.
2. Protect the website using AWS Certificate Manager (ACM) certificates.
3. Automatically redirect:
HTTP requests → HTTPS requests.
4. Choose the solution requiring the correct ELB type and listener configuration.
Key AWS concepts
ACM certificates are attached to load balancers for HTTPS/TLS termination.
Application Load Balancer (ALB) supports:
HTTP listeners.
HTTPS listeners.
Listener rules such as redirect HTTP to HTTPS.
Network Load Balancer (NLB) supports TCP/TLS listeners but does not support HTTP-level redirect rules.
---
Option analysis
A) Create an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to listener port 80. Create a rule to redirect requests from HTTP to HTTPS.
❌ Rejected
Why:
This configuration is incorrect because:
HTTPS normally uses port 443, not port 80.
Port 80 is used for HTTP traffic.
An HTTPS listener cannot be created on port 80 for normal web traffic.
The redirect rule also requires an HTTP listener to receive HTTP requests first.
Correct usage scenario:
An HTTPS listener would be configured on port 443 with an ACM certificate to terminate TLS.
Key exam point:
> HTTP listener receives the insecure request; HTTPS listener terminates TLS.
---
Option B) Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
✅ Selected
Why:
This matches the required architecture.
The flow is:
1. User accesses:
```
http://example.com
```
2. Request reaches the ALB HTTP listener on port 80.
3. ALB listener rule redirects:
```
HTTP :80 → HTTPS :443
```
4. User reconnects using HTTPS.
5. HTTPS listener on port 443 uses the ACM certificate to establish secure communication.
Benefits:
Uses managed ACM certificates.
Provides automatic HTTPS enforcement.
Requires no application code changes.
Uses native ALB redirect functionality.
When this option is useful:
Public websites.
Web applications requiring HTTPS.
Enforcing secure access.
TLS termination at the load balancer.
Key exam point:
> ALB + HTTP listener ...
Author: NebulaEagle11 · Last updated Jul 11, 2026
A company has an application that runs on Amazon EC2 instances. The application needs to use dynamic feature flags that will be shared with other applications. The application must poll on an interval for new feature flag values. The values must be cached w...
The requirements are:
Dynamic feature flags shared across multiple applications
Must support polling on an interval for updates
Must cache values after retrieval
Must be most operationally efficient (low operational overhead, managed solution)
---
Correct Answer: C
✅ Why C is correct — AWS AppConfig with Agent
AWS AppConfig is purpose-built for feature flags and dynamic application configuration.
Key reasons it is the best fit:
Built for feature flags/config management (not a workaround like DB or secrets)
Supports centralized configuration shared across multiple applications
Provides AppConfig Agent on EC2, which:
Polls AWS AppConfig automatically at configured intervals
Caches configuration locally on the instance (low latency, no repeated API calls)
Eliminates the need to build custom polling + caching logic inside the application
Reduces operational overhead significantly compared to DIY caching solutions
👉 This directly satisfies:
Polling requirement → handled by AppConfig Agent
Caching requirement → handled locally by the agent
Shared usage → native multi-app support
---
Why the other options are incorrect
❌ A) AWS Secrets Manager + Amazon ElastiCache
AWS Secrets Manager is designed for secrets (passwords, API keys), not feature flags
Using it for feature flags is a misuse of the service
Requires custom integration logic to sync to cache
Lazy-loading cache introduces application complex...
Author: Noah Williams · Last updated Jul 14, 2026
A company uses two AWS accounts: production and development. The company stores data in an Amazon S3 bucket that is in the production account. The data is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The company plans to copy the data to another S3 bucket that is in the development account.
A developer needs to use a KMS key to encrypt the data in the S3 bucket...
Correct Answer: B
The requirement is to encrypt copied S3 data in the development account using a KMS key that is accessible from the production account. This is a classic cross-account AWS KMS access design problem.
---
Key idea (important for exams)
AWS KMS keys are regional and account-bound
You cannot replicate KMS keys across accounts
Only customer managed KMS keys (CMKs) support:
Key policy modification
Cross-account access
AWS managed keys (like `aws/s3`) cannot be shared or modified for cross-account use
---
Why Option B is correct
B) Create a new customer managed KMS key in the development account. Specify the production account in the key policy.
✔ This works because:
A customer managed KMS key in the development account can be explicitly shared
The key policy in the dev account can allow principals from the production account
Enables production account roles/users to encrypt/decrypt data using the dev KMS key when copying S3 objects
✔ This is the standard cross-account KMS pattern:
Key lives in destination account (dev)
Source account (prod) is granted access via key policy
---
Why other options are incorrect
❌ A) Replicate t...
Author: Siddharth · Last updated Jul 14, 2026
A company has an AWS Step Functions state machine named myStateMachine. The company configured a service role for Step Functions.
The developer must ensure that only the myStateMachine state machine can assume the service...
Author: Oscar · Last updated Jul 14, 2026
A developer is designing an event-driven architecture. An AWS Lambda function that processes data needs to push processed data to a subset of four consumer Lambda functions. The data must be routed based on the value of one fiel...
Key requirement breakdown
Event-driven architecture using AWS services
One producer Lambda must send processed data to one of four consumer Lambdas
Routing must depend on a field in the payload
Goal: least operational overhead
This is a classic fan-out with conditional delivery (content-based routing) problem.
---
Option analysis
❌ A) SQS queue per consumer + Lambda event source mapping
Why it seems plausible:
You can route messages by pushing to different queues.
Producer Lambda can implement routing logic.
Why it’s NOT best:
You must manage 4 SQS queues
Each queue needs:
configuration
monitoring
scaling considerations
Routing logic is fully manual in producer Lambda → tight coupling
No native filtering → increases code + ops overhead
When used:
When you need durable per-consumer buffering or retry isolation
Or decoupled workloads with independent scaling
---
❌ B) SNS topic + subscriptions + filtering in consumer Lambdas
Why it seems plausible:
SNS supports fan-out to multiple Lambdas
Reduces infrastructure compared to SQS
Why it’s wrong:
SNS subscription filtering happens before invocation, not inside Lambda
The option incorrectly says “add filtering logic to each consumer Lambda function” → this does NOT route messages
If all Lambdas subscribe without filter policies, all get all messages (incorrect behavior)
If filtering is in Lambda, you lose routing efficiency and still invoke all consumers
When used:
When all consumers receive events and decide internally whether to process or ignore
Not suitable for strict routing requirements
---
❌ C) Multiple SNS topics (one per consumer) + routing in producer
Why it works:
Simple and deterministic routing
Producer directly publishes to correct topic
Why it’s NOT best:
...
Author: Deepak · Last updated Jul 14, 2026
A developer built an application that uses AWS Lambda functions to process images. The developer wants to improve image processing times throughout the day.
The developer needs to create an Amazon CloudWatch Logs Insights query that shows the avera...
Author: Zain · Last updated Jul 14, 2026
A company's application includes an Amazon DynamoDB table for product orders. The table has a primary partition key of orderId and has no sort key. The company is adding a new feature that requires the application to query the...
We need to enable querying a DynamoDB table by `customerId`, while the existing table already has:
Primary key: partition key = `orderId`
No sort key
So the core constraint is: we cannot efficiently query by `customerId` unless it is part of the primary key or an index.
---
Key DynamoDB concepts to apply
1. Primary key cannot be changed
Once a DynamoDB table is created, you cannot modify the partition key or sort key.
So any option suggesting changing the primary key is invalid.
2. Global Secondary Index (GSI)
Can define new partition key and optional sort key
Can be created anytime after table creation
Supports queries on non-key attributes (like `customerId`)
Has eventual consistency (by default) but supports flexible access patterns
3. Local Secondary Index (LSI)
Must use the same partition key as the base table
Can only define a different sort key
Must be created at table creation time (cannot be added later)
Not suitable when you need a new partition key like `customerId`
---
Option analysis
❌ A) Change primary key to make `customerId` sort key
Not possible in DynamoDB.
You cannot modify an existing table’s primary key schema.
Also, even if designing from scratch, `customerId` cannot be a sort key unless partition key supports grouping logic.
👉 Rejected due to immutability of primary key structure
---
✅ B) Create a Global Secondary Index (GSI) with partition key = `customerId`
This is the correct and standard...
Author: Rahul · Last updated Jul 14, 2026
A company is developing a new application that uses Amazon EC2, Amazon S3, and AWS Lambda resources. The company wants to allow employees to access the AWS Management Console by using existing credentials that the company stores and manages in an on-premises Microsoft Active Directory. Each employee must have a specific level of acces...
The correct answer is A.
Why A is correct (least operational overhead)
AWS Directory Service for Microsoft Active Directory allows you to extend your on-premises Active Directory into AWS with minimal management effort. By establishing a trust relationship between on-premises AD and AWS Managed Microsoft AD, users can authenticate using their existing corporate credentials.
Key factors:
Uses existing on-prem AD identities (no duplicate identity store)
Supports federation/SSO into AWS Management Console
Role-based access control via IAM roles mapped to AD groups
Fully managed directory in AWS reduces operational burden vs self-managed solutions
Standard enterprise pattern for hybrid AD integration
This solution cleanly supports:
EC2, S3, Lambda access via IAM roles
Centralized identity in on-prem AD
Scalable group-to-role mapping for authorization
---
Why the other options are incorrect
B) LDAP direct integration with IAM
❌ Incorrect because AWS IAM does NOT support direct LDAP integration
LDAP is not a supported authentication mechanism for IAM federation
Would require a middleware or identity broker anyway
Therefore, not a valid or maintainable solution
When LDAP is used correctly:
Inside enterprise ap...
Author: Aditya · Last updated Jul 14, 2026
A development team is designing a mobile app that requires multi-factor authentication.
Which steps s...
The question is about implementing multi-factor authentication (MFA) for a mobile application using AWS services. The key is to identify which options support application-level user authentication, not AWS infrastructure access.
---
✅ Correct Options: A and C
---
✅ A) Use Amazon Cognito to create a user pool and create users in the user pool
Why this is correct:
Amazon Web Services provides Amazon Cognito, which is designed specifically for application authentication and user management.
A Cognito User Pool:
Manages app users (sign-up/sign-in)
Supports OAuth, OpenID Connect, and SAML
Integrates directly with mobile and web apps
Supports MFA for end users
When this is used:
Mobile apps needing login (e.g., banking apps, social apps)
SaaS applications with customer accounts
---
❌ B) Send multi-factor authentication text codes using Amazon SNS Publish API call in the app code
Why this is incorrect:
Although Amazon Web Services provides Amazon SNS for SMS messaging, using SNS directly in the app to implement MFA is not a secure or managed MFA solution.
Problems:
You would need to manually generate, store, and validate OTPs
No built-in authentication lifecycle
Higher risk of implementation errors and security flaws
When SNS is appropriate:
Sending notifications (alerts, marketing SMS, system messages)
Not for authentication workflows
---
✅ C) Enable m...
Author: Liam · Last updated Jul 14, 2026
A developer has an application that runs in AWS Account A. The application must retrieve an AWS Secrets Manager secret that is encrypted by an AWS Key Management Service (AWS KMS) key from AWS Account B. The application's role has permissions to access the secret in Account B.
The developer must add a statement to the KMS key's key policy to allow the role in...
This is a cross-account access scenario involving AWS Secrets Manager in Account B encrypted with an AWS KMS key in Account B, accessed by a role in Account A.
The key requirement is specifically:
Update the KMS key policy in Account B
Allow the IAM role in Account A to use the KMS key
Follow least privilege
---
Correct Option: A) `kms:Decrypt` and `kms:DescribeKey`
Why this is correct
To retrieve a secret from AWS Secrets Manager, AWS must:
1. Allow access to the secret (Secrets Manager permissions handled separately via IAM)
2. Decrypt the secret value using the KMS key that encrypted it
In KMS key policies, the minimum permissions required for decrypting encrypted data are:
kms:Decrypt → Required to decrypt the ciphertext (the actual secret value)
kms:DescribeKey → Required so AWS services can validate and reference the key metadata during encryption/decryption operations
Key reasoning
The role in Account A does NOT need full KMS access
It only needs the ability to decrypt secrets encrypted under that specific key
This is the least privilege KMS permission set for cross-account secret access
---
Why the other options are incorrect
B) `secretsmanager:DescribeSecret` and `secretsmanager:GetSecretValue`
These are Secrets Manager IAM permissions, not KMS key policy perm...
Author: Kai99 · Last updated Jul 14, 2026
A developer needs to automate deployments for a serverless, event-based workload. The developer needs to create standardized templates to define the infrastructure and to test the functionality of the workload locally before deployment
The developer already uses a pipeline in AWS CodePipeline. The develo...
Key requirements from the question
We need a solution that:
1. Uses standardized infrastructure templates
2. Supports serverless, event-driven workloads
3. Allows local testing before deployment
4. Integrates with an existing AWS CodePipeline
5. Incorporates infrastructure changes into the pipeline (not manual scripts)
---
Option Analysis
✅ A) AWS SAM template + CodePipeline running SAM CLI commands
This is the best fit.
Why it works:
AWS SAM (Serverless Application Model) is purpose-built for serverless, event-driven applications.
It provides standardized infrastructure-as-code templates (built on CloudFormation).
Supports local testing using `sam local invoke` and `sam local start-api`, which meets the requirement for pre-deployment testing.
Easily integrates with CodePipeline, where build/deploy stages can run:
`sam build`
`sam package`
`sam deploy`
Key advantage:
Fully automatable inside CI/CD pipeline (no manual steps).
Native support for Lambda, API Gateway, event sources.
When this is used:
Serverless apps (Lambda, API Gateway, DynamoDB streams, etc.)
Event-driven architectures needing local emulation and CI/CD integration
---
❌ B) Step Functions + Amazon States Language
Why it's wrong:
Step Functions is for workflow orchestration, not infrastructure definition.
It defines state machine logic, not infrastructure provisioning.
Cannot define or deploy infrastructure like Lambda, API Gateway, etc.
When...
Author: Sam · Last updated Jul 14, 2026
A developer is deploying an application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The developer is using a Docker container with an Ubuntu image.
The developer needs to implement a solution to store application data that is available from multiple ECS task...
The requirement is to provide shared, persistent storage across multiple ECS tasks running on AWS Fargate, and the data must persist after the container stops or is terminated.
Key constraints to focus on
Fargate is serverless → no direct host access (unlike EC2 launch type)
Storage must be:
Shared across multiple tasks
Persistent beyond container lifecycle
Compatible with Linux (Ubuntu container)
Need a managed shared file system
---
Option analysis
A) Amazon FSx for Windows File Server
Amazon FSx for Windows File Server
Provides SMB-based shared storage
Primarily designed for Windows workloads
Requires Windows-compatible authentication (Active Directory integration often needed)
Not a natural fit for Ubuntu/Linux containers in ECS Fargate
While technically network-attached, it is not the standard or recommended solution for ECS Fargate shared Linux storage
✅ When it can be used:
Windows-based ECS workloads
Applications requiring SMB shares
❌ Why rejected here:
Not optimized for Linux container workloads on Fargate
Exam expects a POSIX/Linux-native shared storage solution
---
B) DockerVolumeConfiguration (ECS Docker volumes)
Amazon Elastic Container Service
Works only with EC2 launch type, not Fargate
Uses Docker-managed volumes on the host instance
Volumes are not shared across ...
Author: Liam · Last updated Jul 14, 2026
A developer is creating an AWS Lambda function that needs network access to private resources in a VPC.
Which solution will p...
The question asks for the least operational overhead solution that allows an AWS Lambda function to access private resources inside a VPC.
✅ Correct Option: A
A) Attach the Lambda function to the VPC through private subnets. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function.
This is the standard and native AWS approach for giving AWS Lambda access to private VPC resources such as:
Amazon RDS databases in private subnets
EC2 instances in private subnets
Internal microservices within a VPC
Why A is correct (key reasoning factors)
Native integration: Lambda directly supports VPC attachment.
Minimal setup: Only requires selecting subnets + security groups.
Security control: Security groups control traffic flow to private resources.
Lowest operational overhead: No additional networking components beyond VPC configuration.
Common exam pattern: Default answer when Lambda needs private subnet access.
---
❌ Why other options are incorrect
B) VPN connection
VPN is used for hybrid connectivity (on-premises ↔ AWS).
Adds unnecessary infrastructure (VPN gateway, routing, maintenance).
Not needed for Lambda-to-VPC i...
Author: Madison · Last updated Jul 14, 2026
An application is experiencing performance issues based on increased demand. This increased demand is on read-only historical records pulled from an Amazon RDS-hosted database with custom views and queries. A developer must improve performance without ...
Problem breakdown (key exam signals)
Workload type: read-heavy access to historical records
Source: Amazon RDS with custom views and complex queries
Constraint: improve performance without changing database structure
Goal: minimize operational/management overhead
This is a classic caching layer / read-scaling optimization question.
---
Option analysis
A) Move data to Amazon DynamoDB
Amazon DynamoDB
Why it’s wrong:
Requires full data migration
Would force redesign of schema and query patterns
Breaks constraint: “without changing database structure”
High refactoring + operational effort
When it WOULD be used:
New system design
High-scale key-value / document workloads
When relational joins/views are not needed
❌ Eliminated due to migration + redesign requirement
---
B) Use Amazon ElastiCache (Redis OSS) for caching
Amazon ElastiCache
Redis OSS
Why this is correct:
Offloads repeated read queries from RDS
Handles read-heavy historical data efficiently
Supports complex caching strategies (query/result caching)
Fully managed → low operational overhead
Works well with existing RDS schema unchanged
When it’s used:
High read traffic on databases
Repeated query results (especially reporting/historica...
Author: Ella · Last updated Jul 14, 2026
A company's developer needs to activate Amazon CloudWatch Logs Insights for an application's AWS Lambda functions. The company uses an AWS Serverless Application Model (AWS SAM) template to deploy the application. The SAM template includes a logical resource that is named CloudWatchL...
The key to this question is understanding the difference between Amazon CloudWatch Logs Insights and Amazon CloudWatch Lambda Insights (a Lambda monitoring extension).
Even though the stem mentions “Logs Insights,” the options clearly focus on Lambda function-level activation, which points to Lambda Insights, not the Logs Insights query feature.
---
Correct approach: What actually enables Lambda Insights?
To enable CloudWatch Lambda Insights, you must:
Attach the Lambda Insights extension layer to each Lambda function
Attach the IAM policy CloudWatchLambdaInsightsExecutionRolePolicy
Ensure the function has permission to publish telemetry data
This is a per-function configuration, not a log group or output configuration.
---
Option Analysis
✅ C) Add a Lambda Insights layer + CloudWatchLambdaInsightsExecutionRolePolicy
Why this is correct:
Lambda Insights requires the CloudWatch Lambda Insights extension layer
Requires the CloudWatchLambdaInsightsExecutionRolePolicy managed policy
This is the standard and required setup for enabling Lambda Insights in SAM or CloudFormation
When this option is used:
When you want metrics, dashboards, and enhanced observability for...
Author: Kai · Last updated Jul 14, 2026
A developer is building an application that stores sensitive user data. The application includes an Amazon CloudFront distribution and multiple AWS Lambda functions that handle user requests.
The user requests contain over 20 data fields. Each application transaction contains sensitive data that must be encrypt...
Correct Answer: A
Why Option A is the best choice
Option A describes using CloudFront + Lambda@Edge with field-level asymmetric encryption using RSA keys, which aligns most closely with AWS’s field-level encryption concept for protecting sensitive data end-to-end.
Key reasoning factors:
The requirement is selective encryption of specific data fields (20+ fields), not full payload encryption.
It must ensure only specific backend components can decrypt the data.
This implies asymmetric encryption (public key encrypt / private key decrypt).
AWS supports this pattern via CloudFront Field-Level Encryption (FLE), which is designed exactly for encrypting specific form fields before they reach the origin.
Even though the option incorrectly mentions storing the public key in AWS KMS (which is not how FLE actually works), it still correctly captures the core architecture:
Asymmetric encryption
Field-level protection at the edge
Controlled decryption at origin/backend
---
Why other options are incorrect
B) WAF + Lambda with self-managed keys
AWS WAF is for filtering malicious traffic, not encryption
Using Lambda for encryption/decryption introduces:
Operational overhead
Key management risks (self-managed keys)
No built-in mechanism ensuring secure, standardized field-level encryption
Violates best practice of using managed AWS encryption services instead of custom cryptography
👉 ...
Author: Scarlett · Last updated Jul 14, 2026
A developer is building an application that consists of many AWS Lambda functions. The Lambda functions connect to a single Amazon RDS database.
The developer needs to implement a solution to store the database credentials securely. When the credentials are updated, the Lambda functions must be able t...
The requirement has two critical constraints:
1. Credentials must be stored securely
2. When credentials change, Lambda functions must automatically use the new values without code or configuration updates
That second requirement is the key discriminator: it demands runtime retrieval of the latest secret, not static injection at deploy time.
---
Option A — AWS Secrets Manager (Correct)
Store credentials in AWS Secrets Manager and retrieve them at runtime from AWS Lambda.
Why this works
Secrets Manager is designed for secure storage + automatic rotation support
Lambda can fetch the secret at invocation time, ensuring it always gets the latest value
No need to update code or environment variables when credentials rotate
Supports caching (via SDK caching libraries) but still allows fresh retrieval when needed
Scenario where this is used
Database credentials (RDS, external DBs)
API keys that rotate frequently
Multi-service applications needing centralized secret management
---
Option B — ECS-style env var injection from Secrets Manager (Incorrect)
Uses `containerDefinitions` and `valueFrom`
This is an Amazon ECS feature, not Lambda
Even in ECS, environment variables are injected at deployment time
Why it fails
Lambda does not support `containerDefinitions`
Env vars are static → changes in Secrets Manager are NOT reflected automatically
...
Author: Isabella · Last updated Jul 14, 2026
A company is creating a new feature for existing software. Before the company fully releases a new version of the software, the company wants to test the feature.
The company needs to gather feedback about the feature from a small group of users while the current software version remains deployed. If the testing validates the feature, t...
Correct answer: B) Canary deployment
---
Why Canary deployment is correct
A canary deployment is designed exactly for this kind of requirement:
A new version is released to a small subset of users first
The existing version continues running for the majority of users
The company can collect real user feedback and monitor metrics
If everything is validated, traffic is shifted to the new version for all users
This aligns with the requirement:
> “gather feedback from a small group of users while the current version remains deployed, then deploy to all users if validated”
Key AWS concept: in services like AWS CodeDeploy, canary deployments allow controlled exposure (e.g., 10% traffic first, then 100%).
---
Why the other options are incorrect
A) All-at-once deployment
Deploys the new version to all users simultaneously
❌ No small test group
❌ No staged validation
❌ High risk if issues occur
👉 Use case:
When downtime is acceptable and the ...
Author: ThunderBear · Last updated Jul 14, 2026
A company stores data in an Amazon S3 bucket. The data is updated multiple times every day from an application that runs on a server in the company's on-premises data center.
The company enables S3 Versioning on the S3 bucket. After some time, the company observes multiple versions of the same objects in the S3 bucket.
The company needs the S3 bucke...
Key requirement breakdown
The company needs:
S3 Versioning enabled (already enabled)
Keep only 2 versions per object total:
Current version
Immediately previous version
Automatically remove older versions beyond that
This is a classic version cleanup + retention control problem, best handled by S3 Lifecycle policies, not policies or application logic.
---
Option analysis
❌ A) Configure an S3 bucket policy to retain one newer noncurrent version of the objects
This is incorrect because:
S3 bucket policies cannot manage object versions or lifecycle state
Bucket policies control access (Allow/Deny), not retention or deletion of versions
They cannot automatically delete old versions based on version history
Key idea:
Bucket policies ≠ lifecycle management tool
When bucket policies are used instead:
Restricting access to S3 objects
Enforcing encryption requirements
Controlling public access
---
✅ B) Configure an S3 Lifecycle rule to retain one newer noncurrent version of the objects
This is correct.
S3 Lifecycle rules are specifically designed to:
Transition storage classes
Expire objects
Manage noncurrent versions
You can configure:
“Keep only 1 noncurrent version” behavior
Automatically delete older versions after a new version is created
This directly satisfies:
> Keep current + previous version only
Why it works:
Lifecycle policy supports NoncurrentVersionExpiration
You can set:
`NoncurrentVers...
Author: Zara · Last updated Jul 14, 2026
A company has an application that processes audio files for different departments. When audio files are saved to an Amazon S3 bucket, an AWS Lambda function receives an event notification and processes the audio input.
A developer needs to update the solution so that the application can process the audio files for each department independently. The application must publish the audio file location for each de...
Key requirement breakdown
No changes to Lambda function code → eliminates any option requiring Lambda modification.
Process files per department independently → needs fanout + routing/filtering per department.
Publish S3 object location to each department’s existing SQS queue → requires a scalable distribution mechanism.
---
✅ Correct Option: A
Configure the S3 bucket to send event notifications to an Amazon SNS topic. Subscribe each department's SQS queue to the SNS topic. Configure subscription filter policies.
Why this works
Amazon SNS provides fanout messaging to multiple subscribers.
Each department’s Amazon SQS queue can subscribe independently to the SNS topic.
SNS filter policies allow routing messages to specific departments (e.g., based on message attributes like department name).
No changes required in the AWS Lambda function because it still only reacts to S3 events as before.
Clean decoupling: S3 → SNS → multiple SQS queues.
When this pattern is used
Use S3 → SNS → SQS fanout when:
Multiple downstream systems must receive the same event
You need filtering per consumer
You want to avoid modifying producers (Lambda/S3 event source)
---
❌ Why other options are incorrect
...
Author: Victoria · Last updated Jul 14, 2026
A developer is creating a web application to upload and store private data. The application will encrypt private data and then will upload the data to an Amazon S3 bucket.
The developer needs to implement a solution to automatically find any unencrypted private data in the S3 bucket. The solution must monitor the security and ac...
Correct Answer: B) Enable Amazon Macie for the S3 bucket. Set up custom criteria to find unencrypted private data in the S3 bucket. Set up AWS User Notifications to provide a notification when Macie detects security issues.
---
Why Option B is correct
The requirements are:
1. Automatically find unencrypted private/sensitive data in S3
2. Monitor security and access control of the S3 bucket
3. Send notifications when issues are detected
Amazon Macie fits perfectly because:
Purpose-built for S3 data security
It uses machine learning to discover and classify sensitive data (PII, financial data, credentials, etc.)
Detects unencrypted or improperly protected sensitive data
Flags objects that are not encrypted or contain sensitive information exposed in S3
Continuous monitoring
Monitors S3 buckets for data security risks and policy violations
Native integration for alerts
Works with EventBridge and AWS User Notifications (or SNS) for real-time alerts
👉 This makes Macie the only fully managed, purpose-built solution for S3 data discovery + security monitoring + alerting in this scenario.
---
Why other options are incorrect
❌ A) Step Functions + Athena
Athena is a query engine, not a security monitoring tool
Cannot natively:
Detect encryption status automatically as a...
Author: Krishna · Last updated Jul 14, 2026
A developer adds new dependencies to an existing AWS Lambda function. The developer cannot deploy the Lambda function because the unzipped deployment package exceeds the maximum size quota for the Lambda function. The instruction set architecture of the Lambda function is x86_64.
The developer m...
Key constraint in the scenario
AWS Lambda has a hard limit on deployment package size:
ZIP package: 250 MB (unzipped)
This limit cannot be bypassed by architecture changes or storage tricks inside the ZIP deployment model
The developer’s issue is specifically:
> “Unzipped deployment package exceeds the maximum size quota”
So the solution must change the packaging/deployment approach, not just tweak configuration.
---
Option Analysis
❌ A) Create a snapshot of all the dependencies. Configure the Lambda function to use the snapshot.
This is invalid.
AWS Lambda does not support “snapshots” of dependencies as a deployment mechanism.
Snapshots are an EBS/EC2 concept, not Lambda.
Lambda cannot mount or execute code from a dependency snapshot.
👉 This option confuses Lambda with EC2 storage patterns.
---
❌ B) Change the instruction set architecture to arm64
This is incorrect for this problem.
Switching from x86_64 → arm64 only changes:
pricing (cheaper compute)
performance characteristics
It does NOT increase deployment package size limits
The 250 MB unzipped limit remains unchanged.
👉 Use case: when optimizing cost/performanc...
Author: Sofia2021 · Last updated Jul 14, 2026
A company has an ecommerce platform. A developer is designing an Amazon DynamoDB table to store customer order data for the platform. The table uses the order ID as the partition key.
The developer needs to modify the table to get all order IDs that are associated with a given customer email address in a single query. The solutio...
Requirements recap
You have a DynamoDB table where:
Primary key is order ID (partition key).
You need to query all order IDs by customer email in a single query.
Future requirement: ability to query by other attributes flexibly.
In DynamoDB, the key design principle is:
👉 You design tables based on access patterns, and secondary indexes (LSI/GSI) are used to support additional query patterns.
---
Option analysis
A) Configure the partition key to use the customer email address as the sort key
This is not valid for the requirement.
The table already uses order ID as the partition key, and partition keys cannot be “converted” into sort keys.
Even if redesigned as (email as partition key + order ID as sort key), this would still:
Require a table redesign
Force email to be the primary access pattern
Also, this option is structurally incorrect for DynamoDB modeling.
❌ Rejected.
When this would be used:
When designing a table from scratch where email is the primary query pattern and you want grouped access under a partition key.
---
B) Update the table to use the customer email address as the partition key
This would require replacing the existing primary key.
Problems:
DynamoDB does not allow changing the primary key of an existing table in-place (you must create a new table and migrate data).
Email is not necessarily unique per order, so it cannot replace order ID cleanly unless combined with a sort key (which is not specified).
Breaks existing access pattern (order ID lookups become inefficient or impossible without redesign).
❌ Rejected.
When this would be used:
When designing a new table where the main access pattern is lookup by customer email and the data naturally groups under that key.
---
...
Author: MysticJaguar44 · Last updated Jul 14, 2026
A large company has its application components distributed across multiple AWS accounts. The company needs to collect and visualize trace data across t...
Correct answer: A) AWS X-Ray
---
Why AWS X-Ray is the right choice
The requirement is to collect and visualize trace data across multiple AWS accounts for distributed application components.
This directly maps to distributed tracing, which is exactly what AWS X-Ray is designed for.
Key reasons:
Distributed tracing across services: X-Ray traces requests as they move through microservices, Lambda, EC2, ECS, and other AWS services.
Multi-account support: It supports cross-account tracing using resource-based policies and centralized tracing setup.
End-to-end request visibility: Helps visualize latency, service maps, and dependencies across distributed systems.
Built for application performance monitoring (APM), not just metrics or logs.
👉 This matches the keyword: “trace data across multiple accounts”
---
Why the other options are incorrect
B) Amazon CloudWatch
Amazon CloudWatch
CloudWatch is primarily for:
Metrics (CPU, memory, latency)
Logs (application/system logs)
Alarms
❌ Why it’s not correct:
It does not provide distributed tracing visualization by default
Cross-account log aggregation is possible, but trace correlation and service maps are not its core feature
CloudWatch X-Ray integration exists, but CloudWatch alone does not solve tracing requirements
👉 Use CloudWatch when:
You need ...
Author: Lina Zhang · Last updated Jul 14, 2026
A developer is working on a project that requires regular updates to a web application's backend code. The code is stored in AWS CodeCommit. Company policy states that all code must have complete unit testing and that the test results must be available for access.
The developer needs to implement a solution that will take each change to the code repository...
Correct Answer: C) Configure AWS CodeBuild to build the code and to run unit tests. Use test reporting in CodeBuild to generate and view reports.
---
Why Option C is correct
This requirement has three key needs:
1. Trigger on every code change in CodeCommit
2. Build the application automatically
3. Run unit tests and produce detailed, accessible reports
AWS CodeBuild is purpose-built for exactly this use case.
Key reasons:
Native integration with AWS CodeCommit (via triggers or CodePipeline)
Automatically builds code on every commit
Supports running unit tests during the build phase
Provides built-in test reporting (JUnit, NUnit, etc.)
Stores detailed, structured test reports in AWS CodeBuild Reports
Fully managed CI service (no infrastructure to manage)
👉 This directly satisfies:
> “take each change → build → run unit tests → provide detailed test report”
---
Why other options are incorrect
❌ A) CodeDeploy + CloudWatch metrics
AWS CodeDeploy is designed for deployment, not CI testing.
CodeDeploy:
Deploys applications to EC2, Lambda, or on-prem
Does NOT build code
Does NOT run unit tests as a primary function
CloudWatch metrics:
Only provides numeric monitoring data
❌ Not suitable for detailed unit test reports (failures, test cases, logs)
👉 When to use CodeDeploy:
Blu...
Author: Zain · Last updated Jul 14, 2026
Case Study -
A company is building a web-based AI application by using Amazon SageMaker. The application will provide the following capabilities and features: ML experimentation, training, a central model registry, model deployment, and model monitoring.
The application must ensure secure and isolated use of training data during the ML lifecycle. The training data is stored in Amazon S3.
The company n...
Let's analyze the options based on the requirements:
Key Requirements:
Web-based AI app using Amazon SageMaker
ML experimentation, training, central model registry, deployment, monitoring
Secure and isolated training data (stored in S3)
Central model registry to manage different versions of models
Least operational overhead
---
Option A: Create a separate Amazon Elastic Container Registry (Amazon ECR) repository for each model.
Pros:
ECR is good for storing container images.
Cons:
ECR is primarily a container image repository, not designed for model version management.
Creating a separate ECR repo per model adds operational complexity.
No built-in model version tracking or integration with SageMaker's model lifecycle.
When to use: Only if models are packaged as containers and you want to manage container images independently, not ideal for versioning models themselves.
Conclusion: This adds unnecessary overhead and lacks features for model version control and lifecycle management.
---
Option B: Use Amazon Elastic Container Registry (Amazon ECR) and unique tags for each model version.
Pros:
Using tags can differentiate container images.
Cons:
Still, ECR is a container image repo, not designed for managing ML models or their versions.
Tagging can get complicated and is manual without integrated tools.
Does not provide model lineage, approval, or deployment workflows.
When to use: If models are containerized and the deployment pipeline is fully container-centric.
Conclusion: Slightly better than option A but still lacks native model registry features.
---
...
Author: Mia · Last updated Jul 7, 2026
Case Study -
A company is building a web-based AI application by using Amazon SageMaker. The application will provide the following capabilities and features: ML experimentation, training, a central model registry, model deployment, and model monitoring.
The application must ensure secure and isolated use of training data during the ML lifecycle. The training data i...
Let's analyze the options based on the requirement: minimizing infrastructure startup times for consecutive training jobs on Amazon SageMaker.
---
Key factors to consider:
Minimizing startup times means reducing the time between initiating a training job and the job actually beginning execution.
The training data is stored in S3.
The company is running consecutive training jobs (multiple jobs one after another).
The application requires secure and isolated use of training data.
The overall ML lifecycle includes experimentation, training, model registry, deployment, and monitoring.
---
Option A: Use Managed Spot Training
Managed Spot Training uses spare EC2 capacity to reduce training costs.
Spot Instances can be interrupted and reclaimed by AWS, causing potential job failures or delays.
This option focuses on cost savings rather than minimizing startup latency.
Because spot instances might require waiting for capacity, startup time may increase or become unpredictable.
Not ideal for minimizing startup times, especially in consecutive jobs.
---
Option B: Use SageMaker Managed Warm Pools
Warm pools keep pre-initialized training instances ready to use, avoiding the cold start delay of spinning up new instances.
This significantly reduces infrastructure startup time for consecutive training jobs.
Managed warm pools reuse the compute environment, so jobs can start faster.
Fits well when the workload consists of consecutive training jobs, as the infrastructure is already warm.
Supports secure and isolated environments because each job can still have separate execution contex...
Author: Isabella · Last updated Jul 7, 2026
Case Study -
A company is building a web-based AI application by using Amazon SageMaker. The application will provide the following capabilities and features: ML experimentation, training, a central model registry, model deployment, and model monitoring.
The application must ensure secure and isolated use of training data during the ML lifecycle. The training data is stored in Amazon S3.
The com...
Let's analyze each option carefully based on the requirements:
Requirements Recap:
Web-based AI app using SageMaker.
Features: ML experimentation, training, central model registry, deployment, and model monitoring.
Secure, isolated use of training data stored in Amazon S3.
Manual approval workflow so only approved models are deployed to production.
---
Option A) Use SageMaker Experiments to facilitate the approval process during model registration.
SageMaker Experiments is designed to organize, track, compare, and evaluate ML experiments and runs.
It helps track metadata, parameters, and results.
However, it does not provide built-in mechanisms for manual approval workflows or enforce deployment gating.
It is great for experimentation tracking but not for managing production model approval workflows.
Conclusion: Not suitable because it lacks a manual approval process integration.
---
Option B) Use SageMaker ML Lineage Tracking on the central model registry. Create tracking entities for the approval process.
ML Lineage Tracking tracks artifacts, datasets, model versions, and transformations for full auditability.
It can provide visibility on model provenance and lineage.
However, it is mainly for tracking relationships and metadata, not for enforcing manual approval workflows.
There is no direct feature to block deployment until manual approval is granted.
Conclusion: Good for auditing and traceability, but not a workflow tool for manual approval gating.
---
Option C) Use SageMaker Model Monitor to evaluate the performance of the model and to manage the approval.
Model Monitor is for monitoring model quality, data drift, and performance in production.
It helps detect issues post-deployment.
Model Monitor does not provide a manual approval or deployment gating mechanism before production deployment.
Monitoring happens after the model is live, not before.
...
Author: Olivia · Last updated Jul 7, 2026
Case Study -
A company is building a web-based AI application by using Amazon SageMaker. The application will provide the following capabilities and features: ML experimentation, training, a central model registry, model deployment, and model monitoring.
The application must ensure secure and isolated use of training data during the ML lifecycle. The training data is stored in Amazon S3.
The compan...
Let's analyze each option based on the requirements and key factors:
Requirements recap:
The app uses Amazon SageMaker for ML lifecycle: experimentation, training, model registry, deployment, monitoring.
Training data is in Amazon S3 and must be securely and isolated used.
Need an on-demand workflow to monitor bias drift for models deployed to real-time endpoints.
Bias monitoring should be automated and integrated with SageMaker deployment.
---
Option A: Configure the application to invoke an AWS Lambda function that runs a SageMaker Clarify job.
SageMaker Clarify is designed specifically for bias detection and drift monitoring in models.
It can run bias and explainability jobs on demand.
It integrates well with SageMaker endpoints and pipelines.
Lambda function invocation allows automation and integration with the app for on-demand checks.
Secure access to S3 data is maintained via IAM roles used by SageMaker Clarify jobs.
This option directly fits the requirement for an on-demand bias drift monitoring workflow linked to deployed real-time models.
Verdict: Strong fit.
---
Option B: Invoke an AWS Lambda function to pull the sagemaker-model-monitor-analyzer built-in SageMaker image.
SageMaker Model Monitor analyzes data quality and drift, but it is mostly designed for continuous data drift monitoring of input features, not specifically bias drift.
The model-monitor-analyzer image is typically used for batch or continuous monitoring pipelines.
Invoking via Lambda is possible but more complex to maintain for on-demand bias drift detection compared to Clarify.
It lacks specialized bias detection features compared to SageMaker Clarify.
Verdict: Less optimal for bias drift detection, more suited for general data quality drift monitoring.
---
Option C: Use AWS Glue Data Quality to monitor bias.
AWS Glue Data Quality is primarily for data quality checks and profiling.
It doesn't natively support bias drift detectio...
Author: Olivia · Last updated Jul 7, 2026
SNAPSHOT -
A company stores historical data in .csv files in Amazon S3. Only some of the rows and columns in the .csv files are populated. The columns are not labeled. An ML engineer needs to prepare and store the data so that the company can use the data to train ML models.
Select and order the correct steps from the following list to perform this task. Each step should be selected one time or not at all. (Select and order three.)
* Create an Amazon SageMaker batch transform job for data cleaning and feature engineering.
* Store the r...
Author: Madison · Last updated Jul 7, 2026
SNAPSHOT -
An ML engineer needs to use Amazon SageMaker Feature Store to create and manage features to train a model.
Select and order the steps from the following list to create and use the features in Feature Store. Each step should be selected one time. (Select and...
Author: Ava · Last updated Jul 7, 2026
SNAPSHOT -
A company wants to host an ML model on Amazon SageMaker. An ML engineer is configuring a continuous integration and continuous delivery (Cl/CD) pipeline in AWS CodePipeline to deploy the model. The pipeline must run automatically when new training data for the model is uploaded to an Amazon S3 bucket.
Select and order the pipeline's correct steps from the following list. Each step should be selected one time or not at all. (Select and order three.)
* An S3 event notification invokes the pipeline when new data is uploaded.
* S3 Lifecycle ru...
Author: Ishaan · Last updated Jul 7, 2026
SNAPSHOT -
An ML engineer is building a generative AI application on Amazon Bedrock by using large language models (LLMs).
Select the correct generative AI term from the following list for each description. Each term should be selected one time ...
Author: Victoria · Last updated Jul 7, 2026
SNAPSHOT -
An ML engineer is working on an ML model to predict the prices of similarly sized homes. The model will base predictions on several features The ML engineer will use the following feature engineering techniques to estimate the prices of the homes:
* Feature splitting
* Logarithmic transformation
* One-hot encoding
* Standardized distribution
Select the corre...
Author: Sofia2021 · Last updated Jul 7, 2026
Case study -
An ML engineer is developing a fraud detection model on AWS. The training dataset includes transaction logs, customer profiles, and tables from an on-premises MySQL database. The transaction logs and customer profiles are stored in Amazon S3.
The dataset has a class imbalance that affects the learning of the model's algorithm. Additionally, many of the features have interdepende...
To tackle this case study, the goal is to aggregate data from various sources such as Amazon S3 (for transaction logs and customer profiles) and an on-premises MySQL database. The data also needs to be processed to account for class imbalance and feature interdependencies.
Let's evaluate the options:
A) Amazon EMR (Spark jobs):
Use Case: EMR (Elastic MapReduce) is ideal for large-scale data processing. Spark, running on EMR, can handle complex data transformations, aggregations, and machine learning model training. It can easily handle data from Amazon S3 and external sources (like an on-premises MySQL database), and supports distributed processing, which can be highly effective for imbalanced datasets.
Why it's selected: EMR with Spark allows for parallelized processing and can perform feature engineering, transformation, and normalization, addressing both the class imbalance and interdependencies between features. It also supports data aggregation across multiple sources.
Scenario: This option is best suited for scenarios where complex transformations, aggregations, and scalable data processing are needed, especially with large datasets spread across multiple sources.
B) Amazon Kinesis Data Streams:
Use Case: Kinesis is primarily used for real-time data streaming and processing. It's perfect for scenarios where you need to handle continuous, real-time data like sensor data, log data, or live transaction streams.
Why it's rejected: Kinesis is not designed for batch processing or aggregating large historical datasets, nor does it integrate easily with non-streaming sources like a MySQL database. While it excels in real-time ingestion and processing, it would not be ideal for aggregating data from both S3 and an on-prem MySQL database.
Scenario: Kinesis is useful when you need to aggregate or process data in real time (e.g., continuous transactions or sensor data), but not for batch processing or data from a variety of sources like S3 and MySQL.
C) Amazon DynamoDB:
Use Case: DynamoDB is a fully managed NoSQ...
Author: William · Last updated Jul 7, 2026
Case study -
An ML engineer is developing a fraud detection model on AWS. The training dataset includes transaction logs, customer profiles, and tables from an on-premises MySQL database. The transaction logs and customer profiles are stored in Amazon S3.
The dataset has a class imbalance that affects the learning of the model's algorithm. Additionally, many of the features have interdependencies. The algorithm is not capturing all the desired underlying patterns in ...
Let's analyze each option carefully based on the key factors of the case study:
---
Key Factors from the case:
Data sources:
Transaction logs and customer profiles in Amazon S3
Tables from an on-premises MySQL database
Data characteristics:
Class imbalance affecting model learning
Feature interdependencies (complex patterns)
Requirements:
Automatically detect anomalies in the aggregated data
Visualize the anomaly detection results
Other considerations:
Need to handle integration of multiple data sources (S3 + on-prem MySQL)
Detect complex patterns (likely requiring more advanced or tailored anomaly detection, not just SQL queries)
Visualization is needed as a separate but connected step
---
Option A: Use Amazon Athena to automatically detect the anomalies and to visualize the result.
Amazon Athena is a serverless interactive query service that lets you analyze data directly in S3 using standard SQL.
Pros:
Can query data stored in S3 easily.
Cons:
Athena is not an anomaly detection tool; it performs SQL queries, which are limited for complex anomaly detection and handling feature interdependencies.
No built-in automatic anomaly detection capabilities.
Visualization is not native to Athena; typically you’d need a BI tool (like QuickSight) for visualization.
Conclusion:
Athena alone cannot automatically detect anomalies. It’s mainly for querying data, not for ML-based anomaly detection or advanced pattern recognition.
Also, it doesn't support native visualization.
---
Option B: Use Amazon Redshift Spectrum to automatically detect the anomalies. Use Amazon QuickSight to visualize the result.
Redshift Spectrum allows querying data directly in S3 using Redshift SQL, extending Redshift's querying capabilities.
Amazon QuickSight is a BI tool for visualization.
Pros:
Good for querying large datasets across S3 and Redshift.
QuickSight offers visualization capabilities.
Cons:
Like Athena, Redshift Spectrum itself is a SQL query engine, not an anomaly detection tool.
No built-in anomaly detection.
Would require you to implement anomaly detection logic manually using SQL, which is limited for complex patterns and feature interdependencies.
Conclusion:
Suitable if you want to query large data and visualize, but not for automatic anomaly detection.
---
Option C: Use Amazon SageMaker Data Wrangler to automatically detect the anomalies and to visualize the result.
Amazon SageMaker Data Wrangler is designed to simplify the data preparation and feature engineering process in ML workflows.
It offers built-in capabilities for detecting anomalies such as missing values, outliers, and supports data profiling.
It also supports visualizing data distributions, relationships, and anomalies interacti...
