180 free AWS CLF-C02 practice questions from the CertStash pack of 719, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 180 free here, all 719 in the pack, and each step includes the one before it.
Get all 719 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company plans to use an Amazon Snowball Edge device to transfer files to the AWS Cloud. Which activities related to a Snowball Edge device are available to the company at no cost?
Show answer and explanation
Correct answer: A. Use of the Snowball Edge appliance for a 10-day period
AWS Snowball Edge pricing follows a model where customers pay for the appliance service itself, but the first 10 days of use are included at no additional cost beyond the service fee. The transfer of data INTO Amazon S3 (option C) is actually included in the service, but option A more directly answers what activities are available at no cost, the initial 10-day usage period is the no-cost window provided. After 10 days, daily charges apply. Data transfers out of S3 to Snowball (option B) and continued use after day 10 (option D) both incur costs.
Why the other options are wrong
- B. Data transfer out of S3 to Snowball Edge incurs standard data transfer costs.
- C. While data transfer into S3 is part of the service, the 10-day usage period is what is specifically provided at no cost.
- D. Daily charges apply after the complimentary 10-day period expires.
Question 2
A company has deployed applications on Amazon EC2 instances. The company needs to assess application vulnerabilities and must identify infrastructure deployments that do not meet best practices. Which AWS service can the company use to meet these requirements?
Show answer and explanation
Correct answer: B. Amazon Inspector
Amazon Inspector is specifically designed to assess EC2 instances for security vulnerabilities and network exposure, identifying deviations from best practices and compliance standards. It performs automated security assessments on EC2 instances and provides detailed findings. AWS Trusted Advisor provides general best practice checks but is not specialized for application vulnerability assessment; AWS Config monitors configuration compliance but not vulnerabilities; Amazon GuardDuty focuses on threat detection rather than vulnerability assessment.
Why the other options are wrong
- A. AWS Trusted Advisor provides general best practice guidance but is not specialized for application vulnerabilities on EC2.
- C. AWS Config tracks configuration changes and compliance but does not perform vulnerability scanning.
- D. Amazon GuardDuty is designed for threat detection and anomalous behavior, not vulnerability assessment.
Question 3
A company has a centralized group of users with large file storage requirements that have exceeded the space available on premises. The company wants to extend its file storage capabilities for this group while retaining the performance benefit of sharing content locally. What is the MOST operationally efficient AWS solution for this scenario?
Show answer and explanation
Correct answer: B. Configure and deploy an AWS Storage Gateway file gateway. Connect each user’s workstation to the file gateway.
AWS Storage Gateway file gateway is the most operationally efficient solution for this scenario. It provides a local NFS/SMB interface that users can mount like a standard network share, maintaining local performance benefits while seamlessly extending storage to Amazon S3 in the cloud. This approach requires no application changes, provides local caching for performance, and scales storage capacity without on-premises infrastructure expansion. S3 bucket mounting (option A) lacks the seamless local performance; WorkSpaces (option C) requires major infrastructure changes; EC2 with EBS (option D) doesn't extend beyond on-premises capacity effectively.
Why the other options are wrong
- A. Mounting individual S3 buckets via utility does not provide the same seamless local performance and user experience as Storage Gateway.
- C. Migrating to WorkSpaces is operationally complex and represents a major infrastructure change beyond the storage requirements.
- D. An EC2 instance with EBS does not extend on-premises capacity and requires managing another cloud resource rather than transparently extending storage.
Question 4
According to security best practices, how should an Amazon EC2 instance be given access to an Amazon S3 bucket?
Show answer and explanation
Correct answer: C. Have the EC2 instance assume a role to obtain the privileges to upload the file.
According to AWS security best practices, EC2 instances should assume an IAM role to gain temporary, limited-scope credentials for accessing S3. This approach uses temporary security credentials, follows the principle of least privilege, enables audit logging, and avoids storing long-term secrets on the instance. Hard-coding credentials (option A) and storing them in files (option B) both create significant security risks by exposing permanent credentials. Opening the S3 bucket to any service (option D) violates the principle of least privilege and creates uncontrolled access.
Why the other options are wrong
- A. Hard-coding credentials in application code is a critical security vulnerability and makes credential rotation impossible.
- B. Storing credentials in text files on the EC2 instance exposes them to compromise if the instance is breached.
- D. Modifying bucket policy to allow any service at any time violates least privilege principles and creates security risks.
Question 5
Which option is a customer responsibility when using Amazon DynamoDB under the AWS Shared Responsibility Model?
Show answer and explanation
Correct answer: C. Access to DynamoDB tables
Under the AWS Shared Responsibility Model, customers are responsible for controlling access to DynamoDB tables through IAM policies, application-level controls, and access management. AWS is responsible for the physical security of the infrastructure, patching and maintaining the DynamoDB service itself, and managing encryption at rest. While encryption can be customer-managed with KMS, the fundamental responsibility for providing encryption is AWS's as part of the managed service.
Why the other options are wrong
- A. Physical security of the underlying infrastructure is AWS's responsibility in the managed service model.
- B. AWS is responsible for patching and maintaining the DynamoDB service as a fully managed database.
- D. Encryption at rest in DynamoDB is provided and maintained by AWS; customers may manage encryption keys but not the encryption service itself.
Question 6
Which option is a perspective that includes foundational capabilities of the AWS Cloud Adoption Framework (AWS CAF)?
Show answer and explanation
Correct answer: C. Governance
The AWS Cloud Adoption Framework (AWS CAF) consists of six perspectives: Business, People, Governance, Platform, Security, and Operations. Governance is one of the foundational capability perspectives that addresses organizational structures, policies, and controls. Sustainability is not an official CAF perspective; Performance Efficiency and Reliability are AWS Well-Architected Framework pillars, not CAF perspectives.
Why the other options are wrong
- A. Sustainability is not one of the six perspectives in the AWS Cloud Adoption Framework.
- B. Performance Efficiency is a pillar of the Well-Architected Framework, not a CAF perspective.
- D. Reliability is a pillar of the Well-Architected Framework, not a CAF perspective.
Question 7
A company is running and managing its own Docker environment on Amazon EC2 instances. The company wants an alternative to help manage cluster size, scheduling, and environment maintenance. Which AWS service meets these requirements?
Show answer and explanation
Correct answer: C. AWS Fargate
AWS Fargate is a serverless container orchestration service that abstracts away cluster management, scheduling, and environment maintenance for Docker containers. It allows companies to run containerized applications without managing the underlying EC2 infrastructure, automatically handling scaling, patching, and cluster operations. AWS Lambda is for serverless functions, not container orchestration; Amazon RDS is a managed database service; Amazon Athena is a query service for data in S3.
Why the other options are wrong
- A. AWS Lambda is for serverless function execution, not for managing Docker containers and cluster scheduling.
- B. Amazon RDS is a managed relational database service, not a container orchestration platform.
- D. Amazon Athena is a query service for analyzing data in S3, not a container management solution.
Question 8
A company wants to run a NoSQL database on Amazon EC2 instances. Which task is the responsibility of AWS in this scenario?
Show answer and explanation
Correct answer: C. Patch the physical infrastructure that hosts the EC2 instances.
When running a NoSQL database on EC2 instances, AWS is responsible for patching and maintaining the physical infrastructure that hosts the instances, including servers, networking hardware, and facilities. The customer is responsible for the guest operating system updates (option A), database high availability (option B), and security group configuration (option D). These customer responsibilities stem from the fact that the customer controls and manages the database software and instance configuration.
Why the other options are wrong
- A. Updating the guest operating system of EC2 instances is the customer's responsibility.
- B. Maintaining high availability at the database layer is the customer's responsibility; AWS provides the infrastructure foundation.
- D. Configuring security group firewall rules is the customer's responsibility for their EC2 instances.
Question 9
Which AWS services or tools can identify rightsizing opportunities for Amazon EC2 instances? (Choose two.)
Show answer and explanation
Correct answer: A, E. AWS Cost Explorer; AWS Compute Optimizer
AWS Cost Explorer and AWS Compute Optimizer are the primary AWS services for identifying EC2 rightsizing opportunities. Cost Explorer provides cost analysis and trending data that can reveal underutilized instances, while Compute Optimizer specifically analyzes EC2 instance metrics and provides rightsizing recommendations based on actual usage patterns. Together they enable organizations to optimize instance types and sizes for cost efficiency.
Why the other options are wrong
- B. AWS Billing Conductor is used for setting up billing groups and custom pricing, not for identifying rightsizing opportunities.
- C. Amazon CodeGuru analyzes code quality and application performance, not EC2 instance utilization patterns.
- D. Amazon SageMaker is a machine learning service for building and training models, not for EC2 infrastructure optimization.
Question 10
Which of the following are benefits of using AWS Trusted Advisor? (Choose two.)
Show answer and explanation
Correct answer: C, D. Detecting underutilized resources to save costs; Improving security by proactively monitoring the AWS environment
AWS Trusted Advisor provides two key benefits: it detects underutilized resources to help save costs by identifying unused services and oversized instances, and it improves security by proactively monitoring the AWS environment against best practices and compliance checks. These core functions help organizations optimize spending and maintain security posture across their infrastructure.
Why the other options are wrong
- A. High-performance container orchestration is provided by Amazon ECS and EKS, not Trusted Advisor.
- B. Creating and rotating encryption keys is the responsibility of AWS Key Management Service (KMS), not Trusted Advisor.
- E. Implementing enforced tagging across AWS resources is handled by tools like AWS Config and tag policies, not Trusted Advisor.
What people say about the full CLF-C02 pack 4.9 from 13
Thrilled to let you know I aced the CLF-C02 exam, thanks to Cert Stash! 🎉 Their exceptional content and 100% pass guarantee made my preparation a breeze. 📚 If you’re preparing for the CLF-C02, Cert Stash is a top choice. 🚀 Highly recommend! 👍
Studied this thoroughly and passed. This dump helped me prep quickly and efficiently. Really glad I bought it.
Passed the Cloud Practitioner on first attempt. This dump covers the real exam content well. For the price there is no reason not to get it. Good starting point for AWS certs.
Question 11
A company wants its Amazon EC2 instances to operate in a highly available environment, even if there is a natural disaster in a particular geographic area. Which approach will achieve this goal?
Show answer and explanation
Correct answer: A. Use EC2 instances in multiple AWS Regions.
Using EC2 instances across multiple AWS Regions provides protection against natural disasters in specific geographic areas. Regions are geographically distributed and independent, so if a disaster affects one region, instances in other regions remain operational. This is the only option that addresses geographic disaster recovery at the required scale.
Why the other options are wrong
- B. CloudFront locations are content delivery points, not compute resources, and cannot run EC2 instances.
- C. Edge locations are primarily for caching and content delivery, not for running EC2 instances or providing compute capacity.
- D. AWS Local Zones are extensions of AWS Regions in nearby geographic areas, not separate enough to protect against regional disasters.
Question 12
A company wants to store and retrieve files in Amazon S3 for its existing on-premises applications by using industry-standard file system protocols. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: C. Amazon S3 File Gateway
Amazon S3 File Gateway is part of AWS Storage Gateway and allows on-premises applications to access S3 using standard file system protocols (NFS and SMB). This enables existing applications to interact with S3 as if it were a local file system without requiring application changes.
Why the other options are wrong
- A. AWS DataSync is used for data transfer between on-premises systems and AWS, but not for ongoing file protocol access.
- B. AWS Snowball Edge is for large-scale data migration, not for continuous file protocol access to S3.
- D. AWS Transfer Family supports SFTP, FTPS, and FTP protocols for file transfer, not standard NFS/SMB file system protocols.
Question 13
Which pillar of the AWS Well-Architected Framework refers to the ability of a system to recover from infrastructure or service disruptions and dynamically acquire computing resources to meet demand?
Show answer and explanation
Correct answer: B. Reliability
The Reliability pillar specifically addresses the ability of a system to recover from infrastructure or service disruptions and dynamically acquire computing resources to meet demand. It encompasses fault tolerance, high availability, disaster recovery, and the capacity to scale resources elastically based on workload requirements.
Why the other options are wrong
- A. Security focuses on protecting assets and data, not on recovery or scaling capabilities.
- C. Performance Efficiency is about using computing resources efficiently, not specifically about recovery from disruptions.
- D. Cost Optimization focuses on managing expenses, not on disaster recovery or resource elasticity.
Question 14
A company wants to migrate its PostgreSQL database to AWS. The company does not use the database frequently. Which AWS service or resource will meet these requirements with the LEAST management overhead?
Show answer and explanation
Correct answer: D. Amazon Aurora Serverless
Amazon Aurora Serverless provides automatic scaling and pay-per-use pricing with minimal management overhead, making it ideal for infrequently used databases. It automatically scales capacity up and down, eliminating the need to manage instance sizing. EC2 requires full management, RDS requires instance management, and standard Aurora requires provisioned capacity even when unused.
Why the other options are wrong
- A. PostgreSQL on EC2 requires extensive management including patching, backups, and performance tuning.
- B. RDS for PostgreSQL requires managing provisioned database instances with ongoing administrative overhead.
- C. Aurora PostgreSQL-Compatible Edition requires provisioning and managing database capacity even during periods of low usage.
Question 15
Which of the following is a software development framework that a company can use to define cloud resources as code and provision the resources through AWS CloudFormation?
Show answer and explanation
Correct answer: C. AWS Cloud Development Kit (AWS CDK)
AWS CDK is a software development framework that allows developers to define cloud resources as code using programming languages, which CloudFormation then uses to provision the resources. It provides higher-level abstractions compared to writing raw CloudFormation templates.
Why the other options are wrong
- A. AWS CLI is a command-line tool for interacting with AWS services, not a framework for defining infrastructure as code.
- B. AWS Developer Center is a resource hub, not a framework for defining cloud resources.
- D. AWS CodeStar is a project management service for developing and deploying applications, not primarily an infrastructure-as-code framework.
Question 16
A company wants to migrate its NFS on-premises workload to AWS. Which AWS Storage Gateway type should the company use to meet this requirement?
Show answer and explanation
Correct answer: D. Amazon S3 File Gateway
Amazon S3 File Gateway presents NFS and SMB file shares on premises and stores the files as objects in Amazon S3. That makes it the Storage Gateway type used to move NFS workloads to AWS.
Why the other options are wrong
- A. Tape Gateway presents a virtual tape library for backups, not NFS file shares.
- B. Volume Gateway presents iSCSI block volumes, not NFS file shares.
- C. FSx File Gateway provides SMB access to Amazon FSx for Windows File Server and does not support NFS.
Question 17
A global company wants to use a managed security service for protection from SQL injection attacks. The service also must provide detailed logging information about access to the company's ecommerce applications. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: D. AWS WAF
AWS WAF (Web Application Firewall) protects web applications from common web exploits including SQL injection attacks and provides detailed logging of all requests and matches. It is a managed security service specifically designed for this purpose on ecommerce and other web applications.
Why the other options are wrong
- A. AWS Network Firewall protects network traffic but is not specifically designed for application-layer attacks like SQL injection.
- B. Amazon RDS for SQL Server is a database service, not a security service for protecting against SQL injection attacks.
- C. Amazon GuardDuty detects threats at the infrastructure level but is not designed for application-level protection or detailed web request logging.
Question 18
Which of the following is a fully managed graph database service on AWS?
Show answer and explanation
Correct answer: D. Amazon Neptune
Amazon Neptune is AWS's fully managed graph database service. It is purpose-built for storing and querying highly connected data with support for both property graphs and RDF graphs. Aurora is a relational database, FSx is a file storage service, and DynamoDB is a key-value NoSQL database.
Why the other options are wrong
- A. Amazon Aurora is a relational database engine, not a graph database.
- B. Amazon FSx is a file storage service for Windows file shares and Lustre, not a graph database.
- C. Amazon DynamoDB is a key-value NoSQL database, not a graph database.
Question 19
A company is assessing its AWS Business Support plan to determine if the plan still meets the company’s needs. The company is considering switching to AWS Enterprise Support. Which additional benefit will the company receive with AWS Enterprise Support?
Show answer and explanation
Correct answer: C. A designated technical account manager (TAM) to assist in monitoring and optimization
AWS Enterprise Support uniquely provides a designated Technical Account Manager (TAM) who proactively monitors and optimizes the customer's environment. Option A (Trusted Advisor checks) is available in Business Support. Option B (24/7 phone/email/chat support) is available in Business Support. Option D (consultative review and architecture guidance) is available in Business Support, though TAM provides more personalized ongoing guidance.
Why the other options are wrong
- A. Full Trusted Advisor checks are available with Business Support, not exclusive to Enterprise.
- B. 24/7 phone, email, and chat access is available with Business Support.
- D. Consultative review and architecture guidance are available in Business Support as well.
Question 20
Which option is an AWS Cloud Adoption Framework (AWS CAF) platform perspective capability?
Show answer and explanation
Correct answer: A. Data architecture
The AWS Cloud Adoption Framework includes six perspectives: Business, People, Governance, Platform, Security, and Operations. The Platform perspective encompasses technical capabilities including data architecture, which involves designing systems for data flow, storage, processing, and integration. Data architecture is a core platform capability.
Why the other options are wrong
- B. Data protection is a capability within the Security perspective, not the Platform perspective.
- C. Data governance is a capability within the Governance perspective, not the Platform perspective.
- D. Data science is not a standard AWS CAF capability; it may be part of organizational practices but is not a recognized CAF perspective capability.
Question 21
A company wants to allow users to authenticate and authorize multiple AWS accounts by using a single set of credentials. Which AWS service or resource will meet this requirement?
Show answer and explanation
Correct answer: C. AWS IAM Identity Center (AWS Single Sign-On)
AWS IAM Identity Center (formerly AWS Single Sign-On) enables users to authenticate once with a single set of credentials and then access multiple AWS accounts and applications. It provides centralized authentication and authorization across an organization's AWS environment, which is exactly what the company needs.
Why the other options are wrong
- A. AWS Organizations manages multiple AWS accounts but does not provide single credential authentication across accounts.
- B. IAM users are account-specific and require separate credentials for each AWS account.
- D. AWS Control Tower sets up and governs AWS environments but does not provide cross-account single sign-on authentication.
Question 22
Which AWS service provides a single location to track the progress of application migrations?
Show answer and explanation
Correct answer: D. AWS Migration Hub
AWS Migration Hub provides a single location to track and manage the progress of application migrations across multiple AWS and on-premises environments. It aggregates migration data and provides dashboards and reports for visibility into migration status, making it the dedicated service for this purpose.
Why the other options are wrong
- A. Application Discovery Service helps discover applications and dependencies but does not provide centralized progress tracking.
- B. Application Migration Service is used to perform the actual migration of servers, not to track overall migration progress.
- C. Service Catalog is for provisioning and managing approved IT services, not for tracking migrations.
Question 23
Which AWS service could an administrator use to provide desktop environments for several employees?
Show answer and explanation
Correct answer: D. AWS WorkSpaces
AWS WorkSpaces is a fully managed desktop computing service that provides secure, cloud-based virtual desktops for multiple users. It allows administrators to quickly provision and manage desktop environments for employees. AWS Organizations manages multiple accounts, AWS Fargate runs containers, and AWS WAF protects web applications.
Why the other options are wrong
- A. AWS Organizations is used for managing multiple AWS accounts, not providing desktop environments.
- B. AWS Fargate is a serverless container compute service, not for providing desktop environments.
- C. AWS WAF is a web application firewall service for protecting web applications, not for providing desktops.
Question 24
A company wants to provide managed Windows virtual desktops and applications to its remote employees over secure network connections. Which AWS services can the company use to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, C. Amazon AppStream 2.0; Amazon WorkSpaces
Amazon WorkSpaces provides managed Windows (and Linux) virtual desktops that remote employees can access over secure connections. Amazon AppStream 2.0 enables streaming of applications to remote users over secure network connections. Together, these services meet the requirement of providing managed Windows virtual desktops and applications securely to remote employees.
Why the other options are wrong
- A. Amazon Connect is a contact center service for customer communications, not for virtual desktops or application delivery.
- D. AWS Site-to-Site VPN provides network connectivity but does not deliver virtual desktops or managed applications.
- E. Amazon ECS is a container orchestration service for running containerized applications, not for delivering managed Windows virtual desktops.
Question 25
Which of the following is a recommended design principle of the AWS Well-Architected Framework?
Show answer and explanation
Correct answer: C. Learn to improve from operational failures.
Learning and improving from operational failures is a core design principle of the AWS Well-Architected Framework, particularly within the Operational Excellence pillar. This principle encourages organizations to implement mechanisms for post-incident analysis and continuous improvement.
Why the other options are wrong
- A. The framework recommends frequent, incremental infrastructure changes to enable rapid iteration and reduce risk, the opposite of infrequent, large changes.
- B. Infrastructure as Code and automation are recommended; manual configuration is discouraged as it is error-prone and not scalable.
- D. The framework recommends microservices and modular architectures for scalability and resilience, not monolithic designs.
Question 26
A systems administrator created a new IAM user for a developer and assigned the user an access key instead of a user name and password. What is the access key used for?
Show answer and explanation
Correct answer: C. To access the AWS account through a CLI
IAM access keys are used to access AWS accounts through the AWS Command Line Interface (CLI) and AWS SDKs for programmatic access. Access keys consist of an access key ID and secret access key, enabling developers to authenticate API requests and CLI commands without using the console.
Why the other options are wrong
- A. Access keys are for IAM users, not the AWS account root user, which uses different authentication methods.
- B. AWS Management Console access requires a user name and password, not access keys.
- D. Access keys are specific to a single IAM user within a single AWS account, not multiple accounts.
Question 27
Which AWS Cloud benefit is shown by an architecture’s ability to withstand failures with minimal downtime?
Show answer and explanation
Correct answer: D. High availability
High availability refers to the ability of an application or architecture to withstand failures and continue operating with minimal downtime. This is the defining characteristic of high availability design.
Why the other options are wrong
- A. Agility refers to the ability to quickly develop and deploy applications, not resilience to failures.
- B. Elasticity refers to the ability to automatically scale resources up and down based on demand.
- C. Scalability refers to the ability to handle increased load, not specifically about withstanding failures with minimal downtime.
Question 28
At what support level do users receive access to a support concierge?
Show answer and explanation
Correct answer: D. Enterprise Support
Enterprise Support is the only AWS support tier that includes access to a support concierge, who helps with operational questions, best practices, and account coordination. Basic, Developer, and Business support tiers do not include this personalized concierge service.
Why the other options are wrong
- A. Basic Support does not include a support concierge or any technical support channels.
- B. Developer Support does not include a support concierge service.
- C. Business Support includes technical support but does not include a dedicated concierge service.
Question 29
Which AWS service or feature can be used to create a private connection between an on-premises workload and an AWS Cloud workload?
Show answer and explanation
Correct answer: C. AWS Direct Connect
AWS Direct Connect creates a dedicated network connection between on-premises infrastructure and AWS, providing a private, consistent network experience. While AWS PrivateLink enables private connectivity between AWS services and on-premises applications, Direct Connect is the primary service designed for establishing a dedicated private connection between on-premises workloads and AWS Cloud workloads.
Why the other options are wrong
- A. Route 53 is a DNS service and does not create private connections between on-premises and AWS.
- B. Macie is a data security service for discovering and protecting sensitive data, not for creating network connections.
- D. PrivateLink is used for private connectivity within AWS or to AWS services, not as the primary solution for on-premises to AWS connections.
Question 30
A company plans to migrate to the AWS Cloud. The company is gathering information about its on-premises infrastructure and requires information such as the hostname, IP address, and MAC address. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: C. AWS Application Discovery Service
AWS Application Discovery Service is designed to help gather information about on-premises infrastructure, including hostnames, IP addresses, MAC addresses, and other system details. This information is critical for planning migration to AWS.
Why the other options are wrong
- A. DataSync is for transferring large amounts of data between on-premises and AWS, not discovery
- B. Application Migration Service is for migrating applications to AWS, not discovering infrastructure details
- D. Database Migration Service is specifically for migrating databases, not discovering general infrastructure information
Question 31
Which service enables customers to audit API calls in their AWS accounts?
Show answer and explanation
Correct answer: A. AWS CloudTrail
AWS CloudTrail is the primary service designed to audit and log API calls made within AWS accounts. It provides a complete history of API activity, enabling compliance monitoring, security analysis, and troubleshooting. CloudTrail records who made the call, when it was made, what resources were affected, and the response returned.
Why the other options are wrong
- B. AWS Trusted Advisor provides recommendations for optimizing AWS resources but does not audit API calls.
- C. Amazon Inspector performs security assessments on EC2 instances and applications, not API call auditing.
- D. AWS X-Ray traces and analyzes application requests and performance, not general API call auditing.
Question 32
An external auditor has requested that a company provide a list of all its IAM users, including the status of users' credentials and access keys. What is the SIMPLEST way to provide this information?
Show answer and explanation
Correct answer: C. Download the IAM credential report, then provide the report to the auditor.
Downloading the IAM credential report is the simplest and most appropriate way to provide a comprehensive list of all IAM users with their credential status and access key information in a single document. This report can be generated and shared directly with the auditor without creating unnecessary access or taking multiple screenshots. Creating an auditor account grants excessive permissions, screenshots are inefficient and incomplete, and Trusted Advisor reports focus on cost optimization and service limits rather than IAM credentials.
Why the other options are wrong
- A. Creating an administrator account for the auditor is a security risk and violates the principle of least privilege.
- B. Taking screenshots is inefficient, error-prone, and doesn't provide a complete or auditable format.
- D. Trusted Advisor reports address cost, performance, and service limits, not IAM credential status.
Question 33
What can a cloud practitioner use to retrieve AWS security and compliance documents and submit them as evidence to an auditor or regulator?
Show answer and explanation
Correct answer: C. AWS Artifact
AWS Artifact is a portal that provides access to AWS security and compliance documents, including audit reports, certifications, and compliance attestations. It allows organizations to download and submit these documents to auditors and regulators as evidence of AWS security and compliance.
Why the other options are wrong
- A. AWS Certificate Manager manages SSL/TLS certificates for applications, not compliance documents.
- B. AWS Systems Manager is for operational management of AWS resources, not compliance documentation retrieval.
- D. Amazon Inspector assesses application security vulnerabilities, not for retrieving compliance documents.
Question 34
Which guideline is a well-architected design principle for building cloud applications?
Show answer and explanation
Correct answer: C. Design for automated recovery from failure.
Designing for automated recovery from failure is a core principle of the AWS Well-Architected Framework's Reliability pillar. This principle emphasizes building systems that can automatically detect and recover from failures without manual intervention. Keeping data closer to compute is not a standard principle, provisioning for peak capacity is wasteful and contradicts elasticity, and tightly coupled components violate design best practices.
Why the other options are wrong
- A. This is not a well-architected principle; moving data closer to compute adds complexity without clear benefit.
- B. Provisioning for peak capacity is inefficient; cloud design should use auto-scaling instead.
- D. Tightly coupled components violate the principle of loose coupling that enables scalability and resilience.
Question 35
A company is running a critical workload on an Amazon RDS DB instance. The company needs the DB instance to be highly available with a recovery time of less than 5 minutes. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Modify the DB instance to be a Multi-AZ deployment.
Multi-AZ deployment for RDS provides automatic failover with a recovery time objective (RTO) typically under 5 minutes. When the primary instance fails, RDS automatically promotes the standby replica in another availability zone, ensuring minimal downtime and meeting the critical requirement. This is AWS's native solution for high availability on RDS.
Why the other options are wrong
- A. Read replicas are for scaling read capacity and reporting, not for automatic failover to meet strict RTO requirements.
- B. CloudFormation templates are for infrastructure-as-code but don't provide automatic failover or meet RTO requirements.
- C. Snapshots require manual restore which takes significantly longer than 5 minutes and are not suitable for automatic recovery.
Question 36
An online gaming company needs to choose a purchasing option to run its Amazon EC2 instances for 1 year. The web traffic is consistent, and any increases in traffic are predictable. The EC2 instances must be online and available without any disruption. Which EC2 instance purchasing option will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Reserved Instances
Reserved Instances provide the most cost-effective option for predictable, consistent workloads with guaranteed uptime over a 1-year commitment. They offer significant discounts (typically 40-70%) compared to On-Demand pricing while ensuring availability without interruption.
Why the other options are wrong
- A. On-Demand Instances have the highest per-hour cost and are not cost-effective for predictable, long-term workloads.
- C. Spot Instances offer low prices but can be interrupted with 2-minute notice, making them unsuitable for applications requiring uninterrupted availability.
- D. Spot Fleet manages collections of Spot Instances, which still face interruption risks and are not appropriate for mission-critical consistent traffic.
Question 37
A company wants to automatically add and remove Amazon EC2 instances. The company wants the EC2 instances to adjust to varying workloads dynamically. Which service or feature will meet these requirements?
Show answer and explanation
Correct answer: D. Amazon EC2 Auto Scaling
Amazon EC2 Auto Scaling automatically adjusts the number of EC2 instances in response to changing workloads and demand. It monitors application performance and automatically adds instances during traffic spikes and removes instances during low-demand periods, meeting the requirement for dynamic adjustment with minimal management overhead. DynamoDB is for databases, Spot Instances are for cost optimization but not automatic management, and Snow Family is for data transfer.
Why the other options are wrong
- A. DynamoDB is a NoSQL database service and has no role in managing EC2 instance capacity.
- B. EC2 Spot Instances reduce costs but do not automatically adjust to workload changes without additional orchestration.
- C. AWS Snow Family is designed for data migration and edge computing, not for managing EC2 capacity.
Question 38
A company is designing its AWS workloads so that components can be updated regularly and so that changes can be made in small, reversible increments. Which pillar of the AWS Well-Architected Framework does this design support?
Show answer and explanation
Correct answer: C. Operational excellence
The design principle of updating components regularly in small, reversible increments directly supports Operational Excellence. This pillar emphasizes the ability to support development and run workloads effectively, monitor systems, and continuously improve processes and procedures. Regular updates and reversible changes are core practices for operational excellence, enabling teams to learn from changes and quickly roll back if needed.
Why the other options are wrong
- A. Security focuses on protecting information and systems, not on deployment and update strategies.
- B. Performance Efficiency concerns optimizing compute, storage, and network resources, not deployment methodology.
- D. Reliability is about ensuring workloads perform their intended functions, not specifically about update processes and reversibility.
Question 39
Which task requires a user to sign in as the AWS account root user?
Show answer and explanation
Correct answer: B. The deletion of an AWS account
AWS account deletion is one of the few tasks that requires root user credentials for security reasons. AWS enforces this requirement to prevent accidental account deletion and to ensure only the account owner can perform this critical operation.
Why the other options are wrong
- A. IAM users can be deleted by any user with appropriate IAM permissions, not requiring root access.
- C. AWS Organizations can be created by IAM users with sufficient permissions.
- D. EC2 instances can be terminated by users with appropriate IAM permissions without root access.
Question 40
A company uses AWS security services and tools. The company needs a service to help manage the security alerts and must organize the alerts into a single dashboard. Which AWS service should the company use to meet these requirements?
Show answer and explanation
Correct answer: D. AWS Security Hub
AWS Security Hub is specifically designed to aggregate security alerts and findings from multiple AWS security services into a single dashboard, allowing centralized monitoring and management. It collects findings from GuardDuty, Inspector, Macie, and other sources, making it the ideal solution for organizing alerts. GuardDuty, Inspector, and Macie are individual detection services that generate alerts, but Security Hub is the aggregation and dashboard solution.
Why the other options are wrong
- A. GuardDuty detects threats but doesn't provide centralized dashboard management of alerts.
- B. Inspector performs vulnerability assessments but doesn't aggregate alerts into a unified dashboard.
- C. Macie detects sensitive data in S3 but doesn't manage or organize security alerts from multiple services.
Question 41
A company needs to quickly and securely move files over long distances between its client and an Amazon S3 bucket. Which S3 feature will meet this requirement?
Show answer and explanation
Correct answer: B. S3 Transfer Acceleration
S3 Transfer Acceleration uses CloudFront's globally distributed edge locations to enable fast, secure file transfers over long distances. It automatically routes uploads through the optimal edge location, providing both speed and security for transferring files between clients and S3 buckets.
Why the other options are wrong
- A. S3 Versioning maintains multiple versions of objects but does not accelerate transfers.
- C. S3 ACLs control access permissions but do not improve transfer speed.
- D. S3 Intelligent-Tiering automatically moves objects between storage tiers for cost optimization, not transfer speed.
Question 42
In which ways does the AWS Cloud offer lower total cost of ownership (TCO) of computing resources than on-premises data centers? (Choose two.)
Show answer and explanation
Correct answer: A, D. AWS replaces upfront capital expenditures with pay-as-you-go costs; AWS uses economies of scale to continually reduce prices.
AWS lowers TCO by replacing upfront capital expenditures with pay-as-you-go operational costs (A), eliminating large infrastructure investments. Additionally, AWS uses economies of scale to continually reduce prices (D) by spreading infrastructure costs across millions of customers. High availability does not eliminate downtime (B is misleading), AWS does not eliminate IT staff needs (C), and AWS offers many EC2 pricing models, not a single one (E).
Why the other options are wrong
- B. High availability reduces downtime but does not eliminate it; this doesn't directly impact TCO calculation.
- C. AWS does not eliminate the need for IT staff; companies still require IT expertise for cloud management.
- E. AWS offers multiple EC2 pricing models including on-demand, reserved instances, and spot instances.
Question 43
Which AWS service enables users to check for vulnerabilities on Amazon EC2 instances by using predefined assessment templates?
Show answer and explanation
Correct answer: C. Amazon Inspector
Amazon Inspector is the AWS service that enables users to check EC2 instances for vulnerabilities using predefined assessment templates. It automatically assesses applications for vulnerabilities and deviations from best practices.
Why the other options are wrong
- A. WAF is a web application firewall for protecting against web exploits, not vulnerability assessment
- B. Trusted Advisor provides best practice recommendations across AWS accounts but is not specifically for EC2 vulnerability scanning
- D. Shield is a DDoS protection service, not a vulnerability assessment tool
Question 44
Which AWS service can identify when an Amazon EC2 instance was terminated?
Show answer and explanation
Correct answer: B. AWS CloudTrail
AWS CloudTrail is the service that logs and tracks API calls made within AWS accounts, including EC2 TerminateInstances API calls. It provides a complete audit trail showing when an instance was terminated, by whom, and from where, making it the definitive source for identifying instance termination events.
Why the other options are wrong
- A. AWS IAM manages access control and permissions but does not track or log when instances are terminated.
- C. AWS Compute Optimizer provides recommendations for optimizing compute resources but does not identify termination events.
- D. Amazon EventBridge can react to termination events but does not identify or log when terminations occurred; CloudTrail is the source of that information.
Question 45
A user needs to quickly deploy a nonrelational database on AWS. The user does not want to manage the underlying hardware or the database software. Which AWS service can be used to accomplish this?
Show answer and explanation
Correct answer: B. Amazon DynamoDB
Amazon DynamoDB is a fully managed, serverless nonrelational database service that requires no infrastructure or database software management. Users define tables and DynamoDB handles all underlying operations, scaling, and availability. Amazon RDS is relational, Aurora is relational, and Redshift is for data warehousing, none of these meet the nonrelational requirement.
Why the other options are wrong
- A. Amazon RDS is a relational database service, not a nonrelational database.
- C. Amazon Aurora is a relational database engine, not a nonrelational database.
- D. Amazon Redshift is a data warehouse service optimized for analytics, not a general-purpose nonrelational database.
Question 46
A company wants to save costs by archiving data that is no longer frequently accessed by end users. Which Amazon S3 feature will meet this requirement?
Show answer and explanation
Correct answer: B. S3 Lifecycle
S3 Lifecycle policies automatically transition objects between storage classes based on age and access patterns. This allows companies to move infrequently accessed data to cheaper storage tiers like S3 Glacier or S3 Deep Archive, directly addressing the cost-saving requirement for archiving older data.
Why the other options are wrong
- A. S3 Versioning maintains multiple versions of objects but does not archive or reduce costs for infrequently accessed data.
- C. S3 Object Lock prevents object deletion and is designed for compliance, not for cost optimization through archiving.
- D. S3 Inventory generates reports about objects but does not automatically archive or transition data between storage classes.
Question 47
A company must be able to develop, test, and launch an application in the AWS Cloud quickly. Which advantage of cloud computing will meet these requirements?
Show answer and explanation
Correct answer: D. Increase speed and agility
Increased speed and agility directly addresses the ability to quickly develop, test, and launch applications. Cloud computing enables rapid provisioning of resources without waiting for hardware procurement, reducing time-to-market. While the other options are valid cloud benefits, they do not specifically relate to development, testing, and launch speed.
Why the other options are wrong
- A. Stopping capacity guessing relates to elasticity, not development/launch speed.
- B. Trading fixed for variable expenses is about cost structure, not development speed.
- C. Economies of scale relate to overall AWS cost efficiency, not application launch speed.
Question 48
What can a user accomplish using AWS CloudTrail?
Show answer and explanation
Correct answer: B. Record API calls made to AWS services.
AWS CloudTrail records all API calls made to AWS services, logging who made the call, what action was taken, what resources were affected, and when the event occurred. This provides an audit trail essential for security, compliance, and troubleshooting purposes.
Why the other options are wrong
- A. Generating IAM credentials reports is done through the IAM console or API, not CloudTrail.
- C. Assessing resource configuration compliance is performed by AWS Config, not CloudTrail.
- D. Ensuring EC2 patching is managed by Systems Manager Patch Manager, not CloudTrail.
Question 49
A company wants an AWS service to provide product recommendations based on its customer data. Which AWS service will meet this requirement?
Show answer and explanation
Correct answer: B. Amazon Personalize
Amazon Personalize is an AWS machine learning service specifically designed to deliver personalized recommendations based on customer data and behavior. It analyzes historical customer interactions to generate product recommendations tailored to individual users. The other services serve different purposes: Polly converts text to speech, Comprehend performs natural language processing for text analysis, and Rekognition analyzes images and video.
Why the other options are wrong
- A. Amazon Polly is a text-to-speech service, not designed for generating product recommendations.
- C. Amazon Comprehend analyzes text sentiment and content, not customer purchasing patterns for recommendations.
- D. Amazon Rekognition performs image and video analysis, not customer behavior analysis for recommendations.
Question 50
Which task is a responsibility of AWS, according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: D. Apply updates to the Nitro Hypervisor.
Patching the Nitro Hypervisor is AWS responsibility as it is part of the foundational AWS infrastructure layer. Option A is customer responsibility (client-side encryption), option B is customer responsibility (IAM policy configuration), and option C is customer responsibility (guest OS patching on EC2 instances).
Why the other options are wrong
- A. Client-side encryption for S3 objects is a customer responsibility.
- B. Configuring IAM security policies is a customer responsibility.
- C. Patching guest operating systems on EC2 instances is a customer responsibility.
Question 51
A company wants to provide access to Windows file shares in AWS from its on-premises workloads. The company does not want to provision any additional infrastructure or applications in its data center. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: A. Amazon FSx File Gateway
Amazon FSx File Gateway allows on-premises workloads to access Windows file shares in AWS without requiring additional infrastructure in the data center. It provides a gateway that caches frequently accessed data locally while storing the primary data in Amazon FSx for Windows File Server in AWS. DataSync requires additional setup, S3 is object storage not file shares, and Snow Family is for data transfer appliances.
Why the other options are wrong
- B. AWS DataSync requires deploying an agent in the on-premises environment, which violates the requirement of not provisioning additional infrastructure in the data center.
- C. Amazon S3 is object storage, not suitable for providing Windows file share access with the same user experience.
- D. AWS Snow Family consists of physical data transfer appliances, not for providing persistent access to cloud file shares.
Question 52
Who enables encryption of data at rest for Amazon Elastic Block Store (Amazon EBS)?
Show answer and explanation
Correct answer: B. AWS customers
AWS customers are responsible for enabling encryption of data at rest for Amazon EBS volumes. While AWS KMS can be used as the encryption mechanism, the decision and action to enable encryption is a customer responsibility as part of the shared responsibility model.
Why the other options are wrong
- A. AWS Support can assist but does not enable encryption; this is a customer responsibility.
- C. AWS KMS provides the encryption service but the customer must enable its use for EBS volumes.
- D. AWS Trusted Advisor provides recommendations but does not directly enable encryption.
Question 53
What is the customer ALWAYS responsible for managing, according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: C. Customer data
According to the AWS shared responsibility model, customers are always responsible for managing their data. This includes data creation, storage, protection, and lifecycle management. AWS is responsible for the infrastructure and services, but the customer's data and its security remain under customer control and responsibility.
Why the other options are wrong
- A. Software licenses depend on the service model and whether the software is customer-provided or AWS-provided
- B. AWS manages the infrastructure networking; customers manage networking configuration within their VPCs
- D. Encryption key management is shared; customers manage their own keys, but AWS manages infrastructure encryption keys
Question 54
Which perspective in the AWS Cloud Adoption Framework (AWS CAF) includes capabilities for configuration management and patch management?
Show answer and explanation
Correct answer: B. Operations
The Operations perspective of the AWS CAF focuses on day-to-day activities and includes capabilities such as configuration management, patch management, monitoring, and incident response. This perspective addresses the operational infrastructure and processes needed to maintain systems.
Why the other options are wrong
- A. The Platform perspective focuses on infrastructure modernization, cloud-native architecture, and data architecture.
- C. The Security perspective addresses governance of IT security, application security, and data protection.
- D. The Governance perspective focuses on organizational policies, compliance, and risk management.
Question 55
A company is storing sensitive customer data in an Amazon S3 bucket. The company wants to protect the data from accidental deletion or overwriting. Which S3 feature should the company use to meet these requirements?
Show answer and explanation
Correct answer: B. S3 Versioning
S3 Versioning enables protection against accidental deletion or overwriting by maintaining multiple versions of objects. When versioning is enabled, deleted objects are marked as deleted but previous versions remain available for recovery, and overwrites create new versions rather than replacing the original.
Why the other options are wrong
- A. S3 Lifecycle rules manage object transitions and expiration but do not prevent accidental deletion.
- C. S3 bucket policies control access permissions but do not prevent authorized users from deleting or overwriting objects.
- D. S3 server-side encryption protects data confidentiality during transmission and storage but does not prevent deletion or modification.
Question 56
A company has decided to adopt Amazon EC2 infrastructure and wants to scale various stateless services for short-term usage. Which EC2 pricing model is MOST cost-efficient to meet these requirements?
Show answer and explanation
Correct answer: A. Spot Instances
Spot Instances are the most cost-efficient option for short-term, stateless services. They offer up to 90% discounts compared to On-Demand pricing. Since the services are stateless and for short-term usage, interruption tolerance is acceptable, making Spot Instances ideal for temporary scaling needs.
Why the other options are wrong
- B. On-Demand Instances are significantly more expensive than Spot for temporary workloads.
- C. Reserved Instances require term commitments unsuitable for short-term, variable demand.
- D. Dedicated Hosts are for licensing compliance and specific use cases, not cost optimization for stateless services.
Question 57
Which AWS service is a key-value database that provides sub-millisecond latency on a large scale?
Show answer and explanation
Correct answer: A. Amazon DynamoDB
Amazon DynamoDB is a fully managed NoSQL key-value database that delivers sub-millisecond latency and scales to handle large workloads. It is specifically designed for applications requiring consistent, low-latency performance at scale.
Why the other options are wrong
- B. Aurora is a relational database, not a key-value store, and is optimized for ACID transactions rather than sub-millisecond latency at scale.
- C. DocumentDB is a document database compatible with MongoDB, not a key-value database optimized for sub-millisecond performance.
- D. Neptune is a graph database designed for relationship queries, not a key-value store.
Question 58
Which of the following is a fully managed MySQL-compatible database?
Show answer and explanation
Correct answer: D. Amazon Aurora
Amazon Aurora is a fully managed relational database service that is MySQL-compatible, providing high performance, reliability, and cost-effectiveness. It is designed as a drop-in replacement for MySQL while offering additional features and performance improvements.
Why the other options are wrong
- A. Amazon S3 is an object storage service, not a relational database.
- B. Amazon DynamoDB is a NoSQL key-value database, not a MySQL-compatible relational database.
- C. Amazon Redshift is a data warehouse service optimized for OLAP analytics, not a MySQL-compatible OLTP database.
Question 59
A company needs to migrate a PostgreSQL database from on-premises to Amazon RDS. Which AWS service or tool should the company use to meet this requirement?
Show answer and explanation
Correct answer: C. AWS Database Migration Service (AWS DMS)
AWS Database Migration Service (AWS DMS) is specifically designed for migrating databases from on-premises or other cloud sources to AWS. It supports PostgreSQL and provides schema conversion, continuous data replication, and minimal downtime migration capabilities, making it the ideal tool for this PostgreSQL to RDS migration.
Why the other options are wrong
- A. Cloud Adoption Readiness Tool assesses organizational cloud readiness but does not perform database migrations.
- B. AWS Migration Hub is a central location to track migration progress but is not the tool that performs the actual database migration.
- D. AWS Application Migration Service is designed for migrating applications, not specifically for database migrations from on-premises.
Question 60
Which of the following are benefits that a company receives when it moves an on-premises production workload to AWS? (Choose two.)
Show answer and explanation
Correct answer: D, E. AWS offers high availability; AWS provides economies of scale.
AWS offers high availability through its global infrastructure with multiple Availability Zones and regions, enabling fault tolerance. Additionally, AWS provides economies of scale, as AWS serves millions of customers, infrastructure costs are distributed, resulting in lower per-unit costs that benefit individual customers. These are direct, concrete benefits of moving to AWS.
Why the other options are wrong
- A. AWS does not provide general staff training on all services; training is the customer's responsibility or available through paid options.
- B. Security in the cloud is a shared responsibility model; AWS secures the infrastructure while customers secure their data and applications.
- C. AWS provides Technical Account Managers only with Enterprise Support, not as a universal free benefit for all customers.
Question 61
Which of the following are benefits of AWS Trusted Advisor? (Choose two.)
Show answer and explanation
Correct answer: B, D. Cost optimization recommendations; Security checks
AWS Trusted Advisor provides automated checks across security, cost optimization, performance, fault tolerance, and service limits. Cost optimization recommendations (B) help identify ways to reduce AWS spending, and security checks (D) identify security vulnerabilities and best practice violations. These are core features of Trusted Advisor.
Why the other options are wrong
- A. SQS access is not a benefit provided by Trusted Advisor; it is a separate AWS service.
- C. Trusted Advisor performs periodic refreshes, but not hourly for all checks; refresh rates vary by check type and support plan.
- E. IAM approval management is not a function of Trusted Advisor; this is handled by IAM policies and access controls.
Question 62
A company wants to launch multiple workloads on AWS. Each workload is related to a different business unit. The company wants to separate and track costs for each business unit. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS Organizations and create one account for each business unit.
AWS Organizations with separate accounts for each business unit is the recommended approach for isolating and tracking costs with minimal operational overhead. Organizations provides built-in billing consolidation, cost allocation tags, and AWS Cost Explorer integration, enabling automatic cost tracking per account. This is far superior to manual spreadsheets or database tracking, and integrates natively with AWS billing systems.
Why the other options are wrong
- B. Using spreadsheets requires manual data entry and updates, creating significant operational overhead and error-prone tracking.
- C. Using DynamoDB to manually record costs requires custom development and ongoing maintenance, adding operational complexity.
- D. The AWS Billing console alone doesn't provide account-level separation for different business units and still requires manual cost tracking across resources.
Question 63
A company needs to engage third-party consultants to help maintain and support its AWS environment and the company’s business needs. Which AWS service or resource will meet these requirements?
Show answer and explanation
Correct answer: D. AWS Partner Network (APN)
The AWS Partner Network (APN) connects companies with qualified AWS partners and consultants who specialize in maintaining and supporting AWS environments. APN partners have validated expertise and can provide the specialized support and maintenance services the company requires.
Why the other options are wrong
- A. AWS Support provides direct support from AWS but is not specifically designed for engaging third-party consultants.
- B. AWS Organizations is used for managing multiple AWS accounts and consolidating billing, not for engaging external consultants.
- C. AWS Service Catalog is used for creating and managing IT services and products, not for finding external consultants.
Question 64
Which AWS services or features provide high availability and low latency by enabling failover across different AWS Regions? (Choose two.)
Show answer and explanation
Correct answer: A, D. Amazon Route 53; AWS Global Accelerator
Amazon Route 53 is a DNS service that enables failover across different AWS Regions by routing traffic to healthy endpoints. AWS Global Accelerator uses Anycast IP addresses and edge locations to direct traffic to the nearest optimal endpoint across Regions, providing both high availability and low latency. Both services explicitly support cross-Region failover and latency-based routing.
Why the other options are wrong
- B. Network Load Balancer distributes traffic within a Region or across availability zones but does not provide cross-Region failover.
- C. Amazon S3 Transfer Acceleration optimizes data transfer speed to S3 but does not provide high availability failover across Regions.
- E. Application Load Balancer operates at Layer 7 for application-level routing within a Region or across zones but not across Regions for failover.
Question 65
Which AWS service or resource can provide discounts on some AWS service costs in exchange for a spending commitment?
Show answer and explanation
Correct answer: C. Savings Plans
Savings Plans are AWS's commitment-based pricing model that provides discounts in exchange for agreeing to spend a certain amount over a 1 or 3-year term. They offer up to 72% savings and apply across various AWS services and compute options.
Why the other options are wrong
- A. Amazon Detective is a security analysis service unrelated to pricing discounts.
- B. AWS Pricing Calculator is a tool for estimating costs, not a service that provides discounts.
- D. Basic Support is an entry-level support plan and does not provide service cost discounts.
Question 66
Which AWS service provides command line access to AWS tools and resources directly from a web browser?
Show answer and explanation
Correct answer: B. AWS CloudShell
AWS CloudShell provides a web browser-based shell with AWS CLI and other tools pre-installed, allowing direct command-line access to AWS resources without needing to install or configure tools locally.
Why the other options are wrong
- A. CloudHSM is a hardware security module service for key management, not command-line access.
- C. WorkSpaces provides desktop virtualization, not a command-line shell environment.
- D. Cloud Map is a service registry for discovering AWS resources, not a command-line access tool.
Question 67
A company wants to migrate to AWS and use the same security software it uses on premises. The security software vendor offers its security software as a service on AWS. Where can the company purchase the security solution?
Show answer and explanation
Correct answer: D. AWS Marketplace
AWS Marketplace is the designated platform where companies can discover, purchase, and deploy third-party software and services, including security solutions from vendors. This allows seamless integration with AWS and often includes pre-configured billing arrangements.
Why the other options are wrong
- A. AWS Partner Solutions Finder helps find AWS partner consulting services, not software purchases.
- B. AWS Support Center is for technical support and case management, not for purchasing third-party software.
- C. AWS Management Console is for managing AWS resources and services, not for purchasing third-party software.
Question 68
How does the AWS Enterprise Support Concierge team help users?
Show answer and explanation
Correct answer: C. Answering billing and account inquiries
The AWS Enterprise Support Concierge team specifically assists with billing and account inquiries. They help with cost optimization, resource planning, and account management questions. While Enterprise Support includes other benefits like architectural guidance and technical case support, the Concierge team's primary role is addressing billing, account structure, and administrative matters.
Why the other options are wrong
- A. Application development support is not a primary function of the Concierge team.
- B. Architecture guidance comes from AWS Technical Account Managers, not the Concierge team.
- D. Technical support case questions are handled through standard support channels, not the Concierge team specifically.
Question 69
Which AWS benefit is demonstrated by on-demand technology services that enable companies to replace upfront fixed expenses with variable expenses?
Show answer and explanation
Correct answer: C. Pay-as-you-go pricing
Pay-as-you-go pricing is the AWS benefit that directly replaces upfront fixed capital expenses with variable operational expenses. Users pay only for the resources they consume without long-term commitments, allowing companies to avoid large capital expenditures and scale costs with actual usage.
Why the other options are wrong
- A. High availability is a technical capability of AWS services, not a financial benefit related to expense structure.
- B. Economies of scale relate to AWS's efficiency in operating infrastructure, which may lower overall costs, but don't directly address the replacement of fixed with variable expenses.
- D. Global reach is a geographic capability of AWS, not a pricing model or expense management benefit.
Question 70
Which AWS service enables companies to deploy an application close to end users?
Show answer and explanation
Correct answer: A. Amazon CloudFront
Amazon CloudFront is a content delivery network (CDN) that caches and serves content from edge locations worldwide, positioned close to end users. This reduces latency and improves performance by serving content from the nearest geographic location rather than from origin servers.
Why the other options are wrong
- B. AWS Auto Scaling adjusts compute capacity but does not inherently deploy applications closer to end users.
- C. AWS AppSync is a GraphQL API service, not a service for geographic deployment to end users.
- D. Amazon Route 53 is a DNS service that can route traffic but does not itself deploy applications closer to users.
Question 71
A company wants to generate a list of IAM users. The company also wants to view the status of various credentials that are associated with the users, such as password, access keys, and multi-factor authentication (MFA) devices. Which AWS service or feature will meet these requirements?
Show answer and explanation
Correct answer: A. IAM credential report
The IAM credential report is specifically designed to generate a list of all IAM users and display the status of their credentials including passwords, access keys, and MFA devices. This report provides a comprehensive view of user credential statuses and is the standard tool for this type of credential audit and compliance checking.
Why the other options are wrong
- B. AWS IAM Identity Center (Single Sign-On) manages centralized authentication, not credential status reporting.
- C. AWS IAM Access Analyzer helps analyze resource access policies, not credential status.
- D. AWS Cost and Usage Report provides billing and cost information, not IAM credential status.
Question 72
Which option is an environment that consists of one or more data centers?
Show answer and explanation
Correct answer: B. Availability Zone
An Availability Zone is an environment consisting of one or more data centers within a geographic region. Each AZ is independent with separate power, cooling, and networking to provide fault tolerance and high availability for applications distributed across multiple AZs.
Why the other options are wrong
- A. CloudFront is a content delivery network service with edge locations, not a definition of data center grouping.
- C. A VPC is a virtual network in the cloud, not a physical data center environment.
- D. AWS Outposts are on-premises AWS infrastructure extensions, not standard AWS data center groupings.
Question 73
A company has migrated its workloads to AWS. The company wants to adopt AWS at scale and operate more efficiently and securely. Which AWS service or framework should the company use for operational support?
Show answer and explanation
Correct answer: C. AWS Managed Services (AMS)
AWS Managed Services (AMS) provides comprehensive operational support and management for AWS infrastructure at scale, helping companies operate more efficiently and securely post-migration. AWS Support (A) provides technical support; AWS CAF (B) guides initial migration strategy; AWS Well-Architected Framework (D) is for design principles, not operational management services.
Why the other options are wrong
- A. AWS Support provides technical assistance but not comprehensive operational management at scale.
- B. AWS CAF is for migration planning and adoption roadmaps, not ongoing operational support.
- D. AWS Well-Architected Framework provides design principles, not operational management services.
Question 74
Which tasks are customer responsibilities, according to the AWS shared responsibility model? (Choose two.)
Show answer and explanation
Correct answer: A, B. Configure the AWS provided security group firewall; Classify company assets in the AWS Cloud.
Configuring security groups is a customer responsibility as it involves application-level firewall rules and network access control. Classifying company assets is a customer responsibility involving organizational and governance decisions. Both fall under customer control and management rather than AWS infrastructure responsibilities.
Why the other options are wrong
- C. Availability Zone selection for S3 is an AWS responsibility; S3 automatically manages regional redundancy and customers do not select specific AZs for S3 buckets.
- D. Patching and upgrading DynamoDB is an AWS responsibility; customers manage only their data and access configurations.
- E. AWS Lambda does not run on EC2 instances; Lambda is a serverless service managed entirely by AWS.
Question 75
Which AWS service or feature allows a user to establish a dedicated network connection between a company’s on-premises data center and the AWS Cloud?
Show answer and explanation
Correct answer: A. AWS Direct Connect
AWS Direct Connect provides a dedicated physical network connection between an on-premises data center and AWS, offering consistent network performance, reduced bandwidth costs, and enhanced security compared to internet-based connections.
Why the other options are wrong
- B. VPC peering connects multiple VPCs together but does not establish connections to on-premises infrastructure.
- C. AWS VPN encrypts traffic over the internet but uses shared internet bandwidth, not a dedicated connection.
- D. Amazon Route 53 is a DNS service and does not establish network connections to on-premises data centers.
Question 76
A company has a managed IAM policy that does not grant the necessary permissions for users to accomplish required tasks. How can this be resolved?
Show answer and explanation
Correct answer: B. Create a custom IAM policy.
When a managed IAM policy lacks necessary permissions, the solution is to create a custom IAM policy that grants the specific permissions required for users to accomplish their tasks. This allows precise control over what actions users can perform. AWS Shield Advanced provides DDoS protection, not IAM permissions. A WAF protects web applications, not IAM permissions. KMS manages encryption keys, not IAM permissions.
Why the other options are wrong
- A. AWS Shield Advanced provides DDoS protection and is unrelated to resolving insufficient IAM permissions.
- C. A WAF protects web applications from attacks and does not grant IAM permissions to users.
- D. KMS manages encryption keys and does not resolve insufficient IAM permissions for task completion.
Question 77
A company wants to monitor its workload performance. The company wants to ensure that the cloud services are delivered at a level that meets its business needs. Which AWS Cloud Adoption Framework (AWS CAF) perspective will meet these requirements?
Show answer and explanation
Correct answer: D. Operations
The Operations perspective of the AWS Cloud Adoption Framework focuses on delivering and supporting cloud services to meet business needs. It encompasses monitoring, maintaining, and optimizing cloud workloads to ensure they perform at desired levels and meet business objectives. While the Business perspective addresses business outcomes, the Operations perspective specifically handles the ongoing monitoring and management of workload performance.
Why the other options are wrong
- A. Business perspective focuses on business case development and benefits realization, not performance monitoring of deployed services.
- B. Governance perspective addresses risk management and compliance, not workload performance monitoring.
- C. Platform perspective focuses on building and managing cloud infrastructure platforms, not monitoring delivered services.
Question 78
What is a customer responsibility when using AWS Lambda according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: A. Managing the code within the Lambda function
Under the AWS shared responsibility model for Lambda, customers are responsible for managing the code within their Lambda functions. AWS handles the underlying infrastructure, operating system patching, runtime management, and hardware maintenance. The customer's responsibility extends to writing secure code, managing dependencies, and configuring proper permissions.
Why the other options are wrong
- B. Hardware monitoring in the data center is AWS's responsibility, not the customer's.
- C. Operating system patching is entirely AWS's responsibility in the Lambda serverless model.
- D. While good practice, shutting down Lambda functions is not a formal responsibility requirement; functions are event-driven and auto-scale.
Question 79
A company wants to integrate its online shopping website with social media login credentials. Which AWS service can the company use to make this integration?
Show answer and explanation
Correct answer: C. Amazon Cognito
Amazon Cognito is designed to enable user authentication and authorization, including integration with external identity providers such as social media platforms (Facebook, Google, Amazon, Apple). It allows companies to add sign-up, sign-in, and access control to web and mobile applications using social media credentials.
Why the other options are wrong
- A. AWS Directory Service manages Microsoft Active Directory, not social media integration.
- B. AWS IAM manages AWS service access and is not designed for customer-facing social media authentication.
- D. AWS IAM Identity Center (Single Sign-On) is for enterprise workforce identity management, not customer social media login integration.
Question 80
A company that has multiple business units wants to centrally manage and govern its AWS Cloud environments. The company wants to automate the creation of AWS accounts, apply service control policies (SCPs), and simplify billing processes. Which AWS service or tool should the company use to meet these requirements?
Show answer and explanation
Correct answer: A. AWS Organizations
AWS Organizations is the centralized management service that enables automation of AWS account creation, application of Service Control Policies (SCPs) for governance, and consolidated billing across multiple accounts. It is specifically designed for multi-account management and organizational governance.
Why the other options are wrong
- B. Cost Explorer is for analyzing spending patterns, not for managing accounts or applying policies.
- C. AWS Budgets is for setting spending limits and alerts, not for account creation or SCP management.
- D. AWS Trusted Advisor provides recommendations for optimization but does not automate account creation or governance.
Question 81
Which AWS service or tool can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet?
Show answer and explanation
Correct answer: D. Network ACL
Network ACLs (Access Control Lists) are stateless firewall rules that operate at the subnet level in a VPC, controlling both inbound and outbound traffic. They are the primary tool for setting up a subnet-level firewall to control traffic entering and leaving a VPC subnet.
Why the other options are wrong
- A. Security groups are instance-level stateful firewalls attached to ENIs, not subnet-level controls for VPC subnets.
- B. AWS WAF protects web applications from web exploits at the application layer, not VPC subnet traffic.
- C. AWS Firewall Manager is a centralized management service for multiple firewalls across accounts, not the service that directly controls subnet traffic.
Question 82
A company wants to migrate its on-premises workloads to the AWS Cloud. The company wants to separate workloads for chargeback to different departments. Which AWS services or features will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, E. Consolidated billing; Multiple AWS accounts
Multiple AWS accounts allow workload isolation and separate chargeback per department. Consolidated billing enables centralized billing while maintaining separate accounts for cost allocation and chargeback purposes. Placement groups are for network performance within a region, edge locations are for content delivery, and AWS Config is for compliance monitoring, none address the chargeback requirement.
Why the other options are wrong
- A. Placement groups optimize network performance, not billing or cost allocation.
- C. Edge locations are for content delivery, not for workload separation or chargeback.
- D. AWS Config monitors compliance and configuration drift, not billing separation.
Question 83
A company is planning to migrate its application to the AWS Cloud. Which AWS tool or set of resources should the company use to analyze and assess its readiness for migration?
Show answer and explanation
Correct answer: A. AWS Cloud Adoption Framework (AWS CAF)
The AWS Cloud Adoption Framework (AWS CAF) is specifically designed to help organizations assess their readiness for cloud migration by evaluating people, processes, and technology across multiple perspectives. It provides a structured approach to understanding gaps and planning migration strategies. The other options serve different purposes: pricing calculator estimates costs, Well-Architected Framework guides architecture decisions, and Budgets tracks spending.
Why the other options are wrong
- B. AWS Pricing Calculator is used to estimate cloud costs, not to assess migration readiness.
- C. AWS Well-Architected Framework provides guidance on building secure, high-performing systems after migration, not for assessing initial readiness.
- D. AWS Budgets is a cost management tool for tracking spending, not for assessing migration readiness.
Question 84
Which options are AWS Cloud Adoption Framework (AWS CAF) security perspective capabilities? (Choose two.)
Show answer and explanation
Correct answer: C, D. Incident response; Infrastructure protection
The AWS Cloud Adoption Framework security perspective includes capabilities focused on protecting infrastructure and responding to incidents. Incident response and infrastructure protection are core security perspective capabilities that address threat detection, remediation, and secure resource deployment. These align with the security pillar's focus on protecting data, systems, and assets.
Why the other options are wrong
- A. Observability is primarily an operational capability, not a security perspective capability.
- B. Incident and problem management is part of the operations perspective, not the security perspective.
- E. Availability and continuity are operational and business continuity concerns, not core security perspective capabilities.
Question 85
Which AWS services make use of global edge locations? (Choose two.)
Show answer and explanation
Correct answer: B, C. Amazon CloudFront; AWS Global Accelerator
Amazon CloudFront and AWS Global Accelerator both utilize AWS global edge locations to deliver content and route traffic with low latency. CloudFront is a CDN service that caches content at edge locations worldwide, while Global Accelerator uses edge locations to route traffic to optimal endpoints. AWS Fargate is a serverless container service without edge location dependencies, AWS Wavelength extends AWS to 5G networks at the carrier edge (not global edge locations), and Amazon VPC is a regional networking service.
Why the other options are wrong
- A. AWS Fargate is a serverless container compute service that does not use global edge locations.
- D. AWS Wavelength extends AWS infrastructure to 5G carrier networks, not standard global edge locations.
- E. Amazon VPC is a regional service for creating isolated network environments and does not use edge locations.
Question 86
Which design principles should a company apply to AWS Cloud workloads to maximize sustainability and minimize environmental impact? (Choose two.)
Show answer and explanation
Correct answer: A, E. Maximize utilization of Amazon EC2 instances; Reduce the need for users to reinstall applications.
Maximizing utilization of EC2 instances (A) reduces idle resources and environmental waste, and reducing the need for application reinstallations (E) minimizes redundant resource consumption and user effort. These align with AWS sustainability principles of optimizing resource utilization and reducing operational overhead. Minimizing managed services contradicts best practices, and forcing reinstallations increases environmental impact.
Why the other options are wrong
- B. Minimizing EC2 utilization is wasteful and increases environmental impact by requiring more resources.
- C. Using managed services reduces environmental impact by leveraging AWS's shared infrastructure efficiency.
- D. Forcing frequent reinstallations increases resource consumption and environmental impact.
Question 87
Which task is the customer’s responsibility, according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: B. Configure firewalls and networks.
According to the AWS shared responsibility model, customers are responsible for configuring and managing their own firewalls and networks. AWS maintains the underlying cloud infrastructure security, while customers are responsible for securing their own resources and configurations.
Why the other options are wrong
- A. Maintaining security of the AWS Cloud infrastructure is AWS's responsibility, not the customer's.
- C. AWS is responsible for patching the underlying operating systems of managed services like RDS; the customer manages their application-level configurations.
- D. Implementing physical and environmental controls is AWS's responsibility as part of the underlying cloud infrastructure.
Question 88
An ecommerce company has migrated its IT infrastructure from an on-premises data center to the AWS Cloud. Which cost is the company’s direct responsibility?
Show answer and explanation
Correct answer: A. Cost of application software licenses
Under the AWS Shared Responsibility Model, the company is responsible for application software licenses. AWS is responsible for the hardware infrastructure, power, cooling, physical security, and data center operations. Software licenses are customer-owned intellectual property and costs that the customer brings to or purchases for use in AWS, making this the direct responsibility of the migrating company.
Why the other options are wrong
- B. AWS is responsible for the cost and maintenance of hardware infrastructure.
- C. AWS is responsible for power and cooling costs for data centers.
- D. AWS is responsible for physical security of data centers.
Question 89
Which cloud transformation journey phase of the AWS Cloud Adoption Framework (AWS CAF) focuses on demonstrating how the cloud helps accelerate business outcomes?
Show answer and explanation
Correct answer: B. Envision
The Envision phase of the AWS Cloud Adoption Framework focuses on demonstrating how cloud adoption will help accelerate business outcomes. It involves creating a vision for cloud transformation, identifying business benefits, and establishing initial business cases. This foundational phase comes before Align, Launch, and Scale phases.
Why the other options are wrong
- A. Scale is a later phase focused on expanding cloud adoption across the organization after successful launches.
- C. Align is about getting stakeholder alignment and establishing governance, not demonstrating business outcomes.
- D. Launch involves executing specific cloud migration and implementation projects, not demonstrating overall outcomes.
Question 90
A company hosts a large amount of data in AWS. The company wants to identify if any of the data should be considered sensitive. Which AWS service will meet the requirement?
Show answer and explanation
Correct answer: B. Amazon Macie
Amazon Macie is an AWS service specifically designed to discover, classify, and protect sensitive data in AWS. It uses machine learning and pattern matching to identify personally identifiable information (PII) and other sensitive data types, making it the appropriate choice for identifying sensitive data across large datasets.
Why the other options are wrong
- A. Amazon Inspector is for assessing security vulnerabilities in EC2 instances and applications, not for identifying sensitive data.
- C. AWS IAM manages access and permissions but does not identify sensitive data within stored information.
- D. Amazon CloudWatch is for monitoring and logging application and infrastructure metrics, not for discovering sensitive data.
Question 91
To reduce costs, a company is planning to migrate a NoSQL database to AWS. Which AWS service is fully managed and can automatically scale throughput capacity to meet database workload demands?
Show answer and explanation
Correct answer: C. Amazon DynamoDB
Amazon DynamoDB is a fully managed NoSQL database service that automatically scales throughput capacity based on demand. It handles provisioning, patching, and scaling transparently, making it ideal for applications with variable workloads.
Why the other options are wrong
- A. Amazon Redshift is a data warehouse for analytical queries, not a NoSQL database.
- B. Amazon Aurora is a relational database, not NoSQL.
- D. Amazon RDS is a relational database service; while it can auto-scale, it's not NoSQL.
Question 92
A company wants to monitor for misconfigured security groups that are allowing unrestricted access to specific ports. Which AWS service will meet this requirement?
Show answer and explanation
Correct answer: A. AWS Trusted Advisor
AWS Trusted Advisor is the correct service for identifying misconfigured security groups. It performs security checks including detection of security groups allowing unrestricted access to specific ports. Trusted Advisor provides actionable recommendations to improve security posture across AWS accounts.
Why the other options are wrong
- B. CloudWatch is for monitoring metrics and logs, not for security configuration assessments.
- C. GuardDuty detects malicious activity and threats, not misconfigurations like overly permissive security groups.
- D. AWS Health Dashboard shows service health status and events, not security configuration issues.
Question 93
A company needs to plan, schedule, and run hundreds of thousands of computing jobs on AWS. Which AWS service can the company use to meet this requirement?
Show answer and explanation
Correct answer: D. AWS Batch
AWS Batch is specifically designed to efficiently plan, schedule, and execute large numbers of computing jobs on AWS infrastructure. It automatically provisions compute resources and manages job scheduling, making it ideal for running hundreds of thousands of batch computing jobs.
Why the other options are wrong
- A. AWS Step Functions is used for orchestrating workflows and microservices but is not optimized for running massive numbers of batch jobs.
- B. AWS Service Catalog is for creating and managing IT service catalogs, not for job scheduling and execution.
- C. Amazon SQS is a message queue service that can support distributed job processing but is not a job scheduling and planning service like AWS Batch.
Question 94
A company wants to manage its AWS Cloud resources through a web interface. Which AWS service will meet this requirement?
Show answer and explanation
Correct answer: A. AWS Management Console
The AWS Management Console is the web-based user interface that allows users to manage AWS resources through a graphical interface. It is the primary web interface for accessing and managing AWS Cloud resources.
Why the other options are wrong
- B. AWS CLI is a command-line interface, not a web interface.
- C. AWS SDK is a set of libraries for programmatic access, not a web interface.
- D. AWS Cloud9 is an IDE for writing and running code, not for managing AWS resources through a web interface.
Question 95
A global company wants to migrate its third-party applications to the AWS Cloud. The company wants help from a global team of experts to complete the migration faster and more reliably in accordance with AWS internal best practices. Which AWS service or resource will meet these requirements?
Show answer and explanation
Correct answer: B. AWS Professional Services
AWS Professional Services provides expert guidance and implementation support for cloud migrations, leveraging a global team of certified professionals who follow AWS best practices and methodologies. This service is specifically designed to help organizations complete complex migrations faster and more reliably by providing strategic planning, architecture guidance, and hands-on implementation assistance.
Why the other options are wrong
- A. AWS Support provides technical support and troubleshooting, but not comprehensive migration planning and execution services.
- C. AWS Launch Wizard is an automated tool for deploying applications, not a service providing expert team support for migrations.
- D. AWS Managed Services focuses on ongoing operational management of deployed infrastructure, not migration execution.
Question 96
A company's application developers need to quickly provision and manage AWS services by using scripts. Which AWS offering should the developers use to meet these requirements?
Show answer and explanation
Correct answer: A. AWS CLI
The AWS CLI (Command Line Interface) allows developers to provision and manage AWS services through scripts and commands. It is designed for automation and programmatic control of AWS resources.
Why the other options are wrong
- B. AWS CodeBuild is a managed build service for compiling and testing code, not for provisioning AWS services.
- C. AWS CAF is a strategic framework for cloud adoption planning, not a tool for scripting resource provisioning.
- D. Systems Manager Session Manager is used for secure shell access to instances, not for provisioning AWS services.
Question 97
A company created an Amazon EC2 instance. The company wants to control the incoming and outgoing network traffic at the instance level. Which AWS resource or service will meet this requirement?
Show answer and explanation
Correct answer: B. Security groups
Security groups act as virtual firewalls at the instance level, controlling both incoming (inbound) and outgoing (outbound) network traffic for EC2 instances. They allow precise filtering of traffic based on protocols, ports, and source/destination IP addresses, making them the correct resource for instance-level traffic control.
Why the other options are wrong
- A. AWS Shield protects against DDoS attacks at the network and application layers, not instance-level traffic control.
- C. Network Access Analyzer is a tool for analyzing network access, not for controlling traffic at the instance level.
- D. VPC endpoints enable private connectivity to AWS services but do not control general network traffic filtering at the instance level.
Question 98
A company is planning to host its workloads on AWS. Which AWS service requires the company to update and patch the guest operating system?
Show answer and explanation
Correct answer: C. Amazon EC2
Amazon EC2 is an Infrastructure as a Service (IaaS) offering where the company maintains responsibility for patching and updating the guest operating system. DynamoDB and S3 are fully managed services with no guest OS to patch, and Aurora is a managed database service where AWS handles OS patching.
Why the other options are wrong
- A. DynamoDB is a fully managed NoSQL database with no guest operating system to patch.
- B. S3 is a fully managed object storage service with no guest operating system.
- D. Aurora is a managed relational database service where AWS handles OS patching automatically.
Question 99
Which of the following are advantages of the AWS Cloud? (Choose two.)
Show answer and explanation
Correct answer: B, C. High economies of scale; Launch globally in minutes
High economies of scale (B) refers to AWS's ability to achieve lower costs through massive infrastructure and resource sharing. Launching globally in minutes (C) demonstrates the agility and global reach of AWS Cloud infrastructure. Option A is backwards (cloud trades capital expenses for variable expenses). Option D is contrary to cloud benefits. Option E is an anti-pattern in cloud computing.
Why the other options are wrong
- A. Cloud computing trades capital expenses for variable expenses, the opposite of this statement.
- D. Cloud computing reduces the focus on managing hardware infrastructure, not increases it.
- E. Overprovisioning is inefficient and contrary to cloud benefits; cloud enables right-sizing.
Question 100
A company needs a fully managed file server that natively supports Microsoft workloads and file systems. The file server must also support the SMB protocol. Which AWS service should the company use to meet these requirements?
Show answer and explanation
Correct answer: C. Amazon FSx for Windows File Server
Amazon FSx for Windows File Server is a fully managed Windows native file server that natively supports Microsoft workloads, NTFS file systems, and the SMB protocol. It provides full compatibility with Windows-based applications and meets all specified requirements for this scenario.
Why the other options are wrong
- A. EFS is a managed file system designed for Linux workloads, not Microsoft workloads or SMB protocol support.
- B. FSx for Lustre is optimized for high-performance computing and machine learning workloads, not Windows environments.
- D. EBS is block storage for EC2 instances and does not provide a managed file server with SMB protocol support.
Question 101
Which AWS services are supported by Savings Plans? (Choose two.)
Show answer and explanation
Correct answer: A, C. Amazon EC2; Amazon SageMaker
Savings Plans are supported by Amazon EC2 and Amazon SageMaker, providing flexible pricing options across these services. EC2 Savings Plans and Compute Savings Plans cover EC2 instances, while SageMaker Savings Plans cover SageMaker instance usage. These services are explicitly supported by AWS Savings Plans for cost optimization.
Why the other options are wrong
- B. Amazon RDS uses Reserved Instances, not Savings Plans.
- D. Amazon Redshift uses Reserved Instances, not Savings Plans.
- E. Amazon DynamoDB uses Reserved Capacity, not Savings Plans.
Question 102
A company wants to migrate its applications to the AWS Cloud. The company plans to identify and prioritize any business transformation opportunities and evaluate its AWS Cloud readiness. Which AWS service or tool should the company use to meet these requirements?
Show answer and explanation
Correct answer: A. AWS Cloud Adoption Framework (AWS CAF)
The AWS Cloud Adoption Framework (AWS CAF) is specifically designed to help organizations identify and prioritize business transformation opportunities and assess their readiness for cloud adoption. It provides guidance across multiple perspectives to evaluate current state, desired future state, and the transformation journey needed to migrate to AWS.
Why the other options are wrong
- B. AWS Managed Services provides ongoing management of AWS infrastructure but doesn't assess transformation opportunities or cloud readiness.
- C. AWS Well-Architected Framework helps design solutions after deciding to move to cloud, not for initial assessment and readiness evaluation.
- D. Migration Hub tracks and manages migration projects but doesn't identify business transformation opportunities or assess cloud readiness.
Question 103
Which AWS service or feature allows users to create new AWS accounts, group multiple accounts to organize workflows, and apply policies to groups of accounts?
Show answer and explanation
Correct answer: D. AWS Organizations
AWS Organizations is specifically designed to create and manage multiple AWS accounts, consolidate billing, apply policies across account groups, and organize workflows. It provides the account creation, grouping, and policy application capabilities described in the requirement.
Why the other options are wrong
- A. AWS IAM manages users and permissions within individual accounts, not account creation or organization.
- B. AWS Trusted Advisor provides best practice recommendations, not account management or policy application.
- C. AWS CloudFormation is an infrastructure-as-code service for deploying resources, not for managing AWS accounts.
Question 104
A company has an application with robust hardware requirements. The application must be accessed by students who are using lightweight, low-cost laptops. Which AWS service will help the company deploy the application without investing in backend infrastructure or high-end client hardware?
Show answer and explanation
Correct answer: A. Amazon AppStream 2.0
Amazon AppStream 2.0 is an application streaming service that delivers resource-intensive applications to lightweight client devices over the internet. It allows students with low-cost laptops to access and interact with applications that require robust hardware by running them on AWS infrastructure and streaming the display to their devices.
Why the other options are wrong
- B. AWS AppSync is a GraphQL service for building APIs and real-time applications, not for streaming resource-intensive applications.
- C. Amazon WorkLink provides secure mobile access to internal websites and web apps, not application streaming for hardware-intensive software.
- D. AWS Elastic Beanstalk is a platform for deploying web applications, not for streaming applications to lightweight client hardware.
Question 105
A company that uses AWS needs to transfer 2 TB of data. Which type of transfer of that data would result in no cost for the company?
Show answer and explanation
Correct answer: A. Inbound data transfer from the internet
AWS provides free inbound data transfer from the internet to AWS services. All other data transfer scenarios incur charges: outbound transfer to the internet is charged, inter-region transfers are charged, and even inter-availability zone transfers within the same region carry data transfer costs. Inbound data transfer is AWS's way of encouraging adoption of cloud services.
Why the other options are wrong
- B. Outbound data transfer to the internet incurs charges based on the amount transferred.
- C. Data transfer between AWS Regions is charged at standard inter-region data transfer rates.
- D. Data transfer between Availability Zones within the same region incurs charges of $0.01 per GB.
Question 106
Which option is a benefit of using AWS for cloud computing?
Show answer and explanation
Correct answer: B. Pay-as-you-go pricing
Pay-as-you-go pricing is a fundamental benefit of AWS cloud computing, allowing organizations to pay only for resources consumed without upfront capital expenditure. Option A describes trading variable for fixed expense, which is opposite to how cloud typically works. Option C is false (cloud increases speed and agility), and option D is a disadvantage of on-premises infrastructure, not a benefit of AWS.
Why the other options are wrong
- A. Cloud computing typically converts fixed data center expenses to variable costs, not the reverse.
- C. Cloud computing increases speed and agility, not decreases it.
- D. Eliminating spending on data center operations is a benefit, not a disadvantage of AWS.
Question 107
Which options are AWS Cloud Adoption Framework (AWS CAF) cloud transformation journey recommendations? (Choose two.)
Show answer and explanation
Correct answer: A, B. Envision phase; Align phase
The AWS CAF cloud transformation journey includes the Envision phase (identifying transformation opportunities), Align phase (identifying skills and organizational gaps), Assess phase (detailed discovery and planning), Mobilize phase (building the foundation), and Migrate and Modernize phase (executing migration). The Envision and Align phases are foundational stages for cloud transformation recommendations.
Why the other options are wrong
- C. Assess is a phase but not one of the two primary recommendations for the overall journey.
- D. Mobilize is a phase but not one of the two primary recommendations for the overall journey.
- E. Migrate and Modernize is an execution phase, not one of the two primary recommendations.
Question 108
Which AWS service or tool helps users visualize, understand, and manage spending and usage over time?
Show answer and explanation
Correct answer: C. AWS Cost Explorer
AWS Cost Explorer is the primary service designed to help users visualize, understand, and manage their AWS spending and usage over time. It provides interactive dashboards, cost analysis tools, and forecasting capabilities that allow organizations to track expenses by service, region, and other dimensions to optimize their cloud spending.
Why the other options are wrong
- A. AWS Organizations manages multiple AWS accounts and consolidated billing, not detailed cost visualization.
- B. AWS Pricing Calculator is used to estimate costs for resources before deployment, not to analyze historical spending.
- D. AWS Service Catalog manages approved IT service offerings, not cost analysis and visualization.
Question 109
Which option is a physical location of the AWS global infrastructure?
Show answer and explanation
Correct answer: B. AWS Region
An AWS Region is a physical geographic location consisting of multiple Availability Zones where AWS services are deployed. Regions are the fundamental building blocks of AWS's global infrastructure and are what users select when provisioning resources.
Why the other options are wrong
- A. AWS DataSync is a data transfer service, not a physical location.
- C. Amazon Connect is a cloud-based contact center service, not an infrastructure location.
- D. AWS Organizations is an account management service, not a physical geographic location.
Question 110
A company is developing an application that uses multiple AWS services. The application needs to use temporary, limited-privilege credentials for authentication with other AWS APIs. Which AWS service or feature should the company use to meet these authentication requirements?
Show answer and explanation
Correct answer: C. AWS Security Token Service (AWS STS)
AWS Security Token Service (STS) provides temporary, limited-privilege credentials for authentication with AWS APIs. These short-lived credentials are ideal for applications needing to assume roles or obtain federated access without managing long-term access keys.
Why the other options are wrong
- A. API Gateway is used for creating and managing APIs, not for providing temporary credentials.
- B. IAM users have long-term credentials, not temporary ones, and don't meet the temporary requirement.
- D. IAM instance profiles provide temporary credentials to EC2 instances but are specific to that use case, not the general solution for application authentication.
Question 111
Which AWS service or feature improves network performance by sending traffic through the AWS worldwide network infrastructure?
Show answer and explanation
Correct answer: C. AWS Global Accelerator
AWS Global Accelerator improves network performance by routing traffic through AWS's optimized global network infrastructure rather than the public internet. It uses edge locations and AWS's private backbone to accelerate traffic and improve overall performance for end users.
Why the other options are wrong
- A. A route table is a set of rules for directing network traffic within a VPC, not a service for optimizing global network performance.
- B. AWS Transit Gateway connects multiple VPCs and on-premises networks but does not specifically improve performance through AWS's global network.
- D. Amazon VPC is a networking service for creating isolated network environments, not specifically designed for global network performance optimization.
Question 112
Which AWS service gives users the ability to discover and protect sensitive data that is stored in Amazon S3 buckets?
Show answer and explanation
Correct answer: A. Amazon Macie
Amazon Macie is a fully managed service that uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3 buckets. It automatically identifies personally identifiable information (PII) and other sensitive data, making it the dedicated solution for this requirement.
Why the other options are wrong
- B. Amazon Detective is used for investigating security findings and analyzing logs, not for discovering sensitive data in S3.
- C. Amazon GuardDuty detects malicious activity and threats to AWS accounts, not for identifying sensitive data in storage.
- D. AWS IAM Access Analyzer reviews IAM permissions and resource access policies, not for discovering sensitive data within S3 objects.
Question 113
A company needs Amazon EC2 instances for a workload that can tolerate interruptions. Which EC2 instance purchasing option meets this requirement with the LARGEST discount compared to On-Demand prices?
Show answer and explanation
Correct answer: A. Spot Instances
Spot Instances offer up to 90% discount compared to On-Demand pricing and are designed for workloads that can tolerate interruptions. They are the most cost-effective option for interruptible workloads, providing significantly larger discounts than Reserved Instances or Dedicated Hosts.
Why the other options are wrong
- B. Convertible Reserved Instances provide smaller discounts than Spot and require commitment.
- C. Standard Reserved Instances provide moderate discounts but less than Spot Instances.
- D. Dedicated Hosts are for licensing requirements and provide no discount compared to On-Demand.
Question 114
Which AWS tool gives users the ability to plan their service usage, service costs, and instance reservations, and also allows them to set custom alerts when their costs or usage exceed established thresholds?
Show answer and explanation
Correct answer: B. AWS Budgets
AWS Budgets allows users to set custom cost and usage budgets, monitor spending against those budgets, and configure alerts when thresholds are exceeded. It enables proactive cost management by providing visibility into planned versus actual spending and supporting reservation planning decisions.
Why the other options are wrong
- A. Cost Explorer provides visualization and analysis of historical costs and usage patterns but does not support setting budgets or custom alerts for threshold breaches.
- C. AWS Cost and Usage Report delivers detailed billing data for analysis but lacks the budgeting and alert functionality required by this scenario.
- D. Reserved Instance reporting provides information about RI utilization but does not offer comprehensive budgeting or custom alert capabilities.
Question 115
Which of the following are pillars of the AWS Well-Architected Framework? (Choose two.)
Show answer and explanation
Correct answer: B, E. Performance efficiency; Operational excellence
The six pillars of the AWS Well-Architected Framework are Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Performance Efficiency (B) and Operational Excellence (E) are both official pillars. Resource scalability and system elasticity are related concepts but not named pillars, and agile development is a software methodology, not a pillar.
Why the other options are wrong
- A. Resource scalability is not one of the six official pillars of the Well-Architected Framework.
- C. System elasticity is a desired characteristic but not one of the six named pillars.
- D. Agile development is a software development methodology, not a pillar of the Well-Architected Framework.
Question 116
Which of the following are features of network ACLs as they are used in the AWS Cloud? (Choose two.)
Show answer and explanation
Correct answer: A, D. They are stateless; They process rules in order, starting with the lowest numbered rule, when deciding whether to allow traffic.
Network ACLs are stateless (meaning they do not automatically allow return traffic) and process rules in numerical order starting from the lowest numbered rule to determine whether to allow or deny traffic. This is distinct from security groups which are stateful. Network ACLs operate at the subnet level, not the instance level.
Why the other options are wrong
- B. Network ACLs are stateless, not stateful; they do not remember connection states.
- C. Network ACLs stop processing rules once a match is found; they don't evaluate all rules.
- E. Network ACLs operate at the subnet level, not the instance level; security groups operate at the instance level.
Question 117
Which of the following are advantages of moving to the AWS Cloud? (Choose two.)
Show answer and explanation
Correct answer: B, D. The ability to use the pay-as-you-go model; No longer having to guess what capacity will be required.
The pay-as-you-go model (B) is a fundamental advantage of AWS, allowing companies to pay only for resources consumed without upfront capital expenses. Eliminating capacity guessing (D) is also a key advantage, AWS provides on-demand scalability so organizations can provision resources dynamically based on actual needs rather than predicting future capacity requirements.
Why the other options are wrong
- A. AWS shares responsibility for security; customers retain responsibility for their data, applications, and access controls, security is never fully transferred to AWS.
- C. AWS Cloud customers do not have control over physical infrastructure; that is AWS's responsibility in the shared responsibility model.
- E. Users still need to manage and worry about access controls through IAM and other security mechanisms; this responsibility does not disappear in the cloud.
Question 118
A company uses Amazon S3 to store records that can contain personally identifiable information (PII). The company wants a solution that can monitor all S3 buckets for PII and immediately alert staff about vulnerabilities. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: C. Amazon Macie
Amazon Macie is specifically designed to discover, monitor, and protect sensitive data like PII in S3 buckets. It uses machine learning to automatically identify and classify sensitive information and alert staff about potential vulnerabilities. GuardDuty detects malicious activity and threats, Detective performs forensic analysis of suspicious activity, and Shield protects against DDoS attacks, none of these are designed for PII discovery and monitoring.
Why the other options are wrong
- A. GuardDuty detects malicious threats and intrusions, not sensitive data like PII in S3.
- B. Detective performs post-incident forensic investigation, not proactive PII monitoring.
- D. Shield provides DDoS protection, not data sensitivity monitoring or PII detection.
Question 119
A company needs to deploy applications in the AWS Cloud as quickly as possible. The company also needs to minimize the complexity that is related to the management of AWS resources. Which AWS service should the company use to meet these requirements?
Show answer and explanation
Correct answer: B. AWS Elastic Beanstalk
AWS Elastic Beanstalk is a Platform-as-a-Service that allows developers to deploy applications quickly with minimal infrastructure management. It automatically handles capacity provisioning, load balancing, scaling, and application health monitoring. AWS Config is a compliance monitoring tool, Amazon EC2 requires significant manual infrastructure management, and Amazon Personalize is a machine learning service for recommendations, none of these address rapid deployment with minimized complexity.
Why the other options are wrong
- A. AWS Config is a configuration monitoring and compliance service, not an application deployment platform.
- C. Amazon EC2 requires significant manual management of instances, security, and infrastructure configuration.
- D. Amazon Personalize is a machine learning service for building recommendation systems, not an application deployment solution.
Question 120
Which option is a customer responsibility under the AWS shared responsibility model?
Show answer and explanation
Correct answer: B. Application data security
Under the AWS shared responsibility model, customers are responsible for application data security, including data encryption, access controls, and protecting sensitive information. AWS handles the security of the infrastructure itself, while customers secure their data and applications running on AWS resources.
Why the other options are wrong
- A. AWS is responsible for maintaining the underlying hardware and hypervisor for EC2 instances.
- C. AWS is responsible for physical security of data centers as part of their infrastructure security.
- D. AWS is responsible for maintaining VPC infrastructure components; customers configure and manage their VPC settings.
Question 121
A company has a test AWS environment. A company is planning on testing an application within AWS. The application testing can be interrupted and does not need to run continuously. Which Amazon EC2 purchasing option will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. Spot Instances
Spot Instances are the most cost-effective option for workloads that can be interrupted and don't need to run continuously. They offer up to 90% discount compared to On-Demand pricing, making them ideal for test environments where application testing can be paused or restarted. The interruptible nature of the workload aligns perfectly with Spot Instance characteristics.
Why the other options are wrong
- A. On-Demand Instances are more expensive than Spot Instances and don't provide the cost savings needed for optional testing workloads.
- B. Dedicated Instances are for compliance/licensing requirements and are not cost-effective for temporary testing scenarios.
- D. Reserved Instances require long-term commitment and upfront payment, unsuitable for short-term testing that can be interrupted.
Question 122
Which option is a shared control between AWS and the customer, according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: A. Configuration management
The AWS shared responsibility model lists patch management, configuration management, and awareness and training as shared controls. AWS configures its infrastructure devices, while customers configure their own guest operating systems, databases and applications.
Why the other options are wrong
- B. Physical and environmental controls are inherited controls that AWS handles entirely.
- C. Data integrity authentication is a customer-specific control.
- D. Identity and access management is not one of the shared controls listed in the model; customers manage their own users and permissions.
Question 123
A company is migrating to the AWS Cloud. The company wants to understand and identify potential security misconfigurations or unexpected behaviors. The company wants to prioritize any protective controls it might need. Which AWS Cloud Adoption Framework (AWS CAF) security perspective capability will meet these requirements?
Show answer and explanation
Correct answer: B. Threat detection
Threat detection is the AWS CAF security perspective capability focused on identifying security misconfigurations, unexpected behaviors, and implementing protective controls. This perspective specifically addresses understanding vulnerabilities and establishing detection mechanisms. Identity and access management focuses on user and service permissions, platform engineering deals with infrastructure security implementation, and availability and continuity management addresses disaster recovery and business continuity.
Why the other options are wrong
- A. Identity and access management addresses user authentication and authorization, not detection of misconfigurations and threats.
- C. Platform engineering is about infrastructure security architecture and implementation, not threat detection and identification.
- D. Availability and continuity management focuses on disaster recovery and business continuity planning, not security threat detection.
Question 124
A company has an uninterruptible application that runs on Amazon EC2 instances. The application constantly processes a backlog of files in an Amazon Simple Queue Service (Amazon SQS) queue. This usage is expected to continue to grow for years. What is the MOST cost-effective EC2 instance purchasing model to meet these requirements?
Show answer and explanation
Correct answer: C. Savings Plans
Savings Plans provide the most cost-effective option for uninterruptible workloads with predictable, long-term usage that is expected to grow for years. They offer discounts up to 72% compared to On-Demand pricing and provide flexibility across instance types and regions. Spot Instances (A) are unsuitable for uninterruptible applications. On-Demand (B) has no discount. Dedicated Hosts (D) are for licensing compliance, not cost optimization.
Why the other options are wrong
- A. Spot Instances can be interrupted by AWS and are unsuitable for the uninterruptible application requirement.
- B. On-Demand Instances have no discounts and are the most expensive option for long-term, predictable usage.
- D. Dedicated Hosts are for license-specific requirements, not cost optimization for uninterruptible workloads.
Question 125
Which tasks are the customer’s responsibility, according to the AWS shared responsibility model? (Choose two.)
Show answer and explanation
Correct answer: B, C. Perform client-side data encryption; Configure IAM credentials.
According to the AWS Shared Responsibility Model, customers are responsible for security 'in' the cloud, including client-side data encryption and IAM credential configuration. AWS is responsible for the global infrastructure, edge locations, and patching managed services like RDS. Options B and C are customer responsibilities: B covers data protection at the application layer, and C covers identity and access management configuration.
Why the other options are wrong
- A. AWS, not the customer, is responsible for establishing and maintaining the global infrastructure.
- D. AWS is responsible for securing edge locations as part of the global infrastructure.
- E. AWS is responsible for patching managed database services like RDS; customers only patch their own databases when using EC2-based databases.
Question 126
A company wants to create a globally accessible ecommerce platform for its customers. The company wants to use a highly available and scalable DNS web service to connect users to the platform. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: C. Amazon Route 53
Amazon Route 53 is AWS's highly available and scalable DNS web service specifically designed to route end users to internet applications. It provides geolocation routing, latency-based routing, and other advanced features to connect users globally to application endpoints, making it ideal for a globally accessible ecommerce platform.
Why the other options are wrong
- A. Amazon EC2 is a compute service for running virtual servers, not a DNS service for routing users.
- B. Amazon VPC is for creating isolated network environments, not for DNS routing to external users.
- D. Amazon RDS is a relational database service, not a DNS or routing service.
Question 127
Which AWS service provides highly durable object storage?
Show answer and explanation
Correct answer: A. Amazon S3
Amazon S3 provides highly durable object storage with 11 nines of durability (99.999999999%), designed specifically for storing and retrieving large amounts of unstructured data reliably and securely at scale.
Why the other options are wrong
- B. Amazon EFS is a file system service for shared file access, not object storage.
- C. Amazon EBS provides block storage for EC2 instances, not object storage.
- D. Amazon FSx is a managed file system service, not object storage.
Question 128
Which actions are best practices for an AWS account root user? (Choose two.)
Show answer and explanation
Correct answer: C, D. Enable multi-factor authentication (MFA) on the root user; Create an IAM user with administrator privileges for daily administrative tasks, instead of using the root user.
Best practices for the AWS root user include enabling multi-factor authentication (MFA) to protect the most privileged account, and creating an IAM user with administrator privileges for daily tasks instead of using the root user. This limits exposure of root credentials and follows the principle of least privilege. Root credentials should never be shared, creating multiple root users is impossible (only one exists per account), and programmatic access keys should be avoided for the root user.
Why the other options are wrong
- A. Root user credentials must never be shared; they should be secured and used minimally for highly sensitive operations only.
- B. Only one root user exists per AWS account; additional users must be created as IAM users, not root users separated by environment.
- E. Programmatic access (access keys) should be avoided for the root user to minimize the risk of credential exposure and misuse.
Question 129
A company needs to transfer data between an Amazon S3 bucket and an on-premises application. Who is responsible for the security of this data, according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: A. The company
Under the AWS shared responsibility model, the company is responsible for security of data in transit and at rest for data transfer between on-premises and AWS. AWS manages the infrastructure security, but the customer must secure their data, encryption keys, access controls, and application-level security. The company must implement encryption, network security, and authentication mechanisms.
Why the other options are wrong
- B. AWS is responsible for the security of the cloud infrastructure, not the data itself or how customers use it.
- C. Firewall vendors are third-party tools; responsibility still lies with the company implementing and configuring them.
- D. AWS Marketplace partners sell solutions but do not assume security responsibility for customer data transfers.
Question 130
A user needs programmatic access to AWS resources through the AWS CLI or the AWS API. Which option will provide the user with the appropriate access?
Show answer and explanation
Correct answer: B. Access keys
Access keys consist of an access key ID and secret access key pair that enable programmatic access to AWS services via the AWS CLI, SDKs, and APIs. They are the standard credential type for application-level authentication to AWS resources.
Why the other options are wrong
- A. Amazon Inspector is a vulnerability assessment service and does not provide access credentials.
- C. SSH public keys are used for EC2 instance access, not for programmatic API access to AWS services.
- D. AWS KMS keys are used for encryption and key management, not for authenticating API requests or CLI commands.
Question 131
A company wants to create templates that the company can reuse to deploy multiple AWS resources. Which AWS service or feature can the company use to meet this requirement?
Show answer and explanation
Correct answer: C. AWS CloudFormation
AWS CloudFormation is the native AWS service designed specifically for creating reusable infrastructure templates. It uses JSON or YAML templates to define and provision multiple AWS resources consistently and repeatedly. CloudFormation enables infrastructure as code, version control, and repeatable deployments across environments.
Why the other options are wrong
- A. AWS Marketplace is a catalog for purchasing third-party software and solutions, not for creating reusable deployment templates.
- B. AMI is a pre-configured machine image for EC2 instances only, not a general multi-resource templating solution.
- D. AWS OpsWorks is a configuration management service using Chef and Puppet, primarily for application deployment and management rather than infrastructure templating.
Question 132
A company has 5 TB of data stored in Amazon S3. The company plans to occasionally run queries on the data for analysis. Which AWS service should the company use to run these queries in the MOST cost-effective manner?
Show answer and explanation
Correct answer: B. Amazon Athena
Amazon Athena is the most cost-effective service for running occasional queries on data stored in S3. It uses a pay-per-query pricing model based on data scanned, making it ideal for infrequent analysis. Athena requires no infrastructure setup or management and works directly with S3 data, minimizing costs for occasional query workloads.
Why the other options are wrong
- A. Amazon Redshift is designed for continuous, large-scale data warehousing and requires provisioned clusters, making it costly for occasional queries.
- C. Amazon Kinesis is for real-time streaming data processing, not for querying historical data stored in S3.
- D. Amazon RDS would require loading data from S3 into a database and maintaining instances, adding unnecessary cost and complexity for occasional queries.
Question 133
A company plans to migrate to AWS and wants to create cost estimates for its AWS use cases. Which AWS service or tool can the company use to meet these requirements?
Show answer and explanation
Correct answer: A. AWS Pricing Calculator
AWS Pricing Calculator is specifically designed for creating cost estimates for AWS use cases before deployment. It allows companies to model their anticipated AWS usage, select services, configure parameters, and generate detailed cost projections.
Why the other options are wrong
- B. Amazon CloudWatch is a monitoring and observability service for tracking metrics and logs of running resources, not for pre-deployment cost estimation.
- C. AWS Cost Explorer is used to analyze historical and current spending of already-deployed resources, not to estimate costs for planned migrations.
- D. AWS Budgets is used to set spending alerts and track against budgets for existing resource usage, not to create initial cost estimates.
Question 134
Which AWS Cloud benefit gives a company the ability to quickly deploy cloud resources to access compute, storage, and database infrastructures in a matter of minutes?
Show answer and explanation
Correct answer: C. Agility
Agility is the AWS cloud benefit that enables companies to quickly deploy resources in minutes. It refers to the speed and ease of provisioning compute, storage, and database infrastructures without lengthy procurement or setup times.
Why the other options are wrong
- A. Elasticity refers to the ability to scale resources up or down, not the speed of initial deployment.
- B. Cost savings is a benefit but does not directly address the speed of resource deployment.
- D. Reliability refers to system uptime and availability, not deployment speed.
Question 135
A company wants a customized assessment of its current on-premises environment. The company wants to understand its projected running costs in the AWS Cloud. Which AWS service or tool will meet these requirements?
Show answer and explanation
Correct answer: D. Migration Evaluator
Migration Evaluator is an AWS tool specifically designed to assess on-premises environments and provide detailed analysis including projected AWS running costs, total cost of ownership comparisons, and migration readiness. It helps organizations understand the financial impact of migrating to AWS.
Why the other options are wrong
- A. AWS Trusted Advisor provides recommendations on AWS account optimization but not customized on-premises assessment or migration cost projection.
- B. Amazon Inspector assesses security vulnerabilities in applications and infrastructure, not migration costs.
- C. AWS Control Tower sets up and governs AWS multi-account environments, not for assessing on-premises environments or migration costs.
Question 136
Which pricing model will interrupt a running Amazon EC2 instance if capacity becomes temporarily unavailable?
Show answer and explanation
Correct answer: C. Spot Instances
Spot Instances are interrupted when AWS reclaims capacity, making them unsuitable for workloads requiring continuous operation. On-Demand Instances run uninterrupted as long as you keep them running. Reserved Instances (both Standard and Convertible) provide uninterrupted service as long as the reservation is active.
Why the other options are wrong
- A. On-Demand Instances are not interrupted unless you stop or terminate them.
- B. Standard Reserved Instances provide uninterrupted service during the reservation period.
- D. Convertible Reserved Instances provide uninterrupted service during the reservation period.
Question 137
Using AWS Identity and Access Management (IAM) to grant access only to the resources needed to perform a task is a concept known as:
Show answer and explanation
Correct answer: C. least privilege access.
Least privilege access is the foundational security principle of granting users and roles only the minimum permissions necessary to perform their specific job functions. This reduces the attack surface and potential damage from compromised credentials.
Why the other options are wrong
- A. Restricted access is too vague and not the specific AWS terminology for this principle.
- B. As-needed access is not the formal AWS or security industry term for this principle.
- D. Token access refers to authentication mechanisms, not the principle of limiting permissions to only required resources.
Question 138
A company need an AWS service that provides a clear baseline of what the company runs in its on-premises data centers. The company needs the projected cost to run its on-premises workloads in the AWS Cloud. What AWS service or tool will meet these requirements?
Show answer and explanation
Correct answer: D. Migration Evaluator
Migration Evaluator (formerly CloudEndure Migration Evaluator) is specifically designed to analyze on-premises environments, establish a clear baseline of current infrastructure and workloads, and provide projected costs for running those workloads on AWS. It delivers detailed TCO analysis and business case development for cloud migration.
Why the other options are wrong
- A. AWS Compute Optimizer provides recommendations for optimizing existing AWS compute resources but doesn't assess on-premises environments.
- B. AWS Cost Explorer analyzes AWS spending but is designed for existing AWS usage, not on-premises baseline and projection.
- C. AWS Systems Manager Agent enables operational management of instances but doesn't provide cost baseline analysis or projections.
Question 139
Who is responsible for managing IAM user access and secret keys according to the AWS shared responsibility model?
Show answer and explanation
Correct answer: B. The customer is responsible for rotating keys.
According to the AWS shared responsibility model, customers are responsible for managing their IAM user access and rotating secret keys. AWS does not automatically rotate customer-managed keys, and while keys are static by nature, best security practices require regular rotation. The customer must take action to rotate keys periodically.
Why the other options are wrong
- A. Even though keys are static, security best practices require regular rotation to minimize risk if compromised.
- C. AWS does not automatically rotate customer-managed secret keys; this is the customer's responsibility.
- D. AWS Support does not rotate keys on behalf of customers; the customer must manage and rotate their own keys.
Question 140
Which cloud concept is demonstrated by using AWS Compute Optimizer?
Show answer and explanation
Correct answer: B. Rightsizing
AWS Compute Optimizer analyzes AWS resource utilization and provides recommendations to optimize instance types and sizes, which is the definition of rightsizing. It helps match compute resources to actual workload requirements to improve performance and reduce costs.
Why the other options are wrong
- A. Security validation is not the primary function of Compute Optimizer; security assessment is handled by other services like Inspector.
- C. Elasticity refers to scaling resources up or down automatically, which is not Compute Optimizer's primary function.
- D. Global reach describes AWS's infrastructure distribution, not a capability demonstrated by Compute Optimizer.
Question 141
Which AWS service can run a managed PostgreSQL database that provides online transaction processing (OLTP)?
Show answer and explanation
Correct answer: C. Amazon RDS
Amazon RDS (Relational Database Service) is a managed database service that supports PostgreSQL for online transaction processing (OLTP) workloads. It handles patching, backups, replication, and failover automatically while providing the relational database functionality needed for OLTP applications.
Why the other options are wrong
- A. Amazon DynamoDB is a NoSQL database, not a relational database suitable for traditional OLTP with PostgreSQL.
- B. Amazon Athena is a query service for analyzing data in S3, designed for OLAP and ad-hoc analytics, not for OLTP transactions.
- D. Amazon EMR is a big data processing service for distributed computing and analytics, not a managed PostgreSQL database for OLTP.
Question 142
A company needs to block SQL injection attacks. Which AWS service or feature can meet this requirement?
Show answer and explanation
Correct answer: A. AWS WAF
AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. It allows you to create rules to filter and block malicious requests based on patterns and signatures. AWS Shield protects against DDoS attacks, Network ACLs filter traffic at the subnet level, and Security Groups filter at the instance level, but none of these provide SQL injection protection like WAF does.
Why the other options are wrong
- B. AWS Shield protects against DDoS attacks, not SQL injection.
- C. Network ACLs operate at Layer 4 and cannot inspect application-level attacks like SQL injection.
- D. Security Groups control traffic based on IP and ports, not application-layer attack patterns.
Question 143
A company is hosting an application in the AWS Cloud. The company wants to verify that underlying AWS services and general AWS infrastructure are operating normally. Which combination of AWS services can the company use to gather the required information? (Choose two.)
Show answer and explanation
Correct answer: A, D. AWS Personal Health Dashboard; AWS Service Health Dashboard
The AWS Personal Health Dashboard (A) provides account-specific information about AWS service events affecting your resources, while the AWS Service Health Dashboard (D) shows general AWS infrastructure and service status for all customers. Together, these tools allow verification of both general AWS infrastructure health and specific impact on the company's account.
Why the other options are wrong
- B. AWS Systems Manager is for managing resources and operational tasks, not for monitoring underlying AWS infrastructure health.
- C. AWS Trusted Advisor provides optimization recommendations rather than real-time infrastructure and service health status.
- E. AWS Service Catalog is for managing IT service portfolios and governance, not for monitoring infrastructure health.
Question 144
An ecommerce company wants to use Amazon EC2 Auto Scaling to add and remove EC2 instances based on CPU utilization. Which AWS service or feature can initiate an Amazon EC2 Auto Scaling action to achieve this goal?
Show answer and explanation
Correct answer: D. Amazon CloudWatch alarm
Amazon CloudWatch alarms can monitor CPU utilization metrics and directly trigger EC2 Auto Scaling actions when thresholds are breached. CloudWatch provides the native integration needed to initiate scaling based on performance metrics, making it the correct choice for this CPU utilization-based scaling requirement.
Why the other options are wrong
- A. SQS is a message queue service and does not directly trigger Auto Scaling based on CPU utilization metrics.
- B. SNS is a notification service that can send messages but is not the primary mechanism to initiate Auto Scaling actions.
- C. AWS Systems Manager is used for operational tasks and patch management, not for triggering Auto Scaling based on metrics.
Question 145
A company needs to use third-party software for its workload on AWS. Which AWS service or feature can the company use to purchase the software?
Show answer and explanation
Correct answer: D. AWS Marketplace
AWS Marketplace is the service that allows companies to purchase third-party software and software-as-a-service (SaaS) solutions that run on AWS. It provides pre-configured software packages that can be deployed directly into AWS accounts, streamlining the procurement and deployment of commercial software. Resource Access Manager manages cross-account resource sharing, Managed Services provides outsourced operations, and License Manager tracks software licenses.
Why the other options are wrong
- A. AWS Resource Access Manager is for sharing AWS resources across accounts, not purchasing software.
- B. AWS Managed Services provides operational support but is not a marketplace for purchasing software.
- C. AWS License Manager tracks and manages software licenses but does not purchase third-party software.
Question 146
A network engineer needs to build a hybrid cloud architecture connecting on-premises networks to the AWS Cloud using AWS Direct Connect. The company has a few VPCs in a single AWS Region and expects to increase the number of VPCs to hundreds over time. Which AWS service or feature should the engineer use to simplify and scale this connectivity as the VPCs increase in number?
Show answer and explanation
Correct answer: B. AWS Transit Gateway
AWS Transit Gateway is designed to simplify and scale connectivity across multiple VPCs and on-premises networks. As the primary hub-and-spoke connection point, it allows centralized management of connections from AWS Direct Connect to hundreds of VPCs without requiring direct VPC-to-VPC peering.
Why the other options are wrong
- A. VPC endpoints provide private connectivity to AWS services but do not simplify multi-VPC hybrid connectivity.
- C. Route 53 is a DNS service and does not provide network connectivity solutions.
- D. Secrets Manager manages credentials but does not provide network connectivity infrastructure.
Question 147
Which options are AWS Cloud Adoption Framework (AWS CAF) governance perspective capabilities? (Choose two.)
Show answer and explanation
Correct answer: B, C. Cloud financial management; Application portfolio management
The AWS Cloud Adoption Framework's Governance perspective includes capabilities for Cloud Financial Management (managing costs and budgets) and Application Portfolio Management (assessing and managing applications for cloud migration). These are core governance functions that help organizations oversee their cloud investments and application strategies.
Why the other options are wrong
- A. Identity and Access Management is part of the Security perspective, not the Governance perspective.
- D. Innovation Management is part of the Business perspective, not the Governance perspective.
- E. Product Management is part of the Business perspective, not the Governance perspective.
Question 148
What are the benefits of consolidated billing for AWS Cloud services? (Choose two.)
Show answer and explanation
Correct answer: A, C. Volume discounts; One bill for multiple accounts
Consolidated billing provides two key benefits: it combines multiple AWS accounts under one bill (option C), and it qualifies the entire organization for volume discounts based on aggregate usage across all accounts (option A). These are the primary advantages that organizations gain by consolidating their AWS billing.
Why the other options are wrong
- B. Consolidated billing does not incur minimal additional fees; it is a free feature that can actually reduce costs.
- D. Installment payment options are not a benefit of consolidated billing and are not directly related to it.
- E. Custom cost and usage budget creation is a feature of AWS Budgets, not specifically a benefit of consolidated billing.
Question 149
Which security service automatically recognizes and classifies sensitive data or intellectual property on AWS?
Show answer and explanation
Correct answer: B. Amazon Macie
Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data on AWS, including personally identifiable information (PII) and intellectual property. It scans S3 buckets and other data stores to identify and categorize sensitive information. GuardDuty focuses on threat detection, Inspector on vulnerability assessment, and Shield on DDoS protection, none of which provide automatic sensitive data classification.
Why the other options are wrong
- A. Amazon GuardDuty is a threat detection service that identifies malicious activity, not sensitive data classification.
- C. Amazon Inspector is for vulnerability assessments of applications and infrastructure, not sensitive data discovery.
- D. AWS Shield is a DDoS protection service and does not discover or classify sensitive data.
Question 150
A company needs to connect its on-premises data center to the AWS Cloud. The company needs a dedicated, low-latency connection with consistent network performance. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: C. AWS Direct Connect
AWS Direct Connect provides a dedicated network connection from on-premises to AWS with consistent, low-latency performance. It establishes a private connection independent of the internet, ensuring reliable and predictable network performance. AWS Global Accelerator and Amazon CloudFront are content delivery services, and AWS Managed VPN uses the public internet, which does not guarantee the dedicated, consistent performance required.
Why the other options are wrong
- A. AWS Global Accelerator optimizes internet traffic routing but does not provide dedicated on-premises connectivity.
- B. Amazon CloudFront is a content delivery network; it does not provide dedicated on-premises connections.
- D. AWS Managed VPN uses the internet and cannot guarantee the consistent, dedicated performance of Direct Connect.
Question 151
Which AWS Cloud service can send alerts to customers if custom spending thresholds are exceeded?
Show answer and explanation
Correct answer: A. AWS Budgets
AWS Budgets allows users to set custom spending thresholds and send alerts when actual or forecasted spending exceeds those thresholds. This service is specifically designed for budget tracking and notifications, making it the appropriate tool for monitoring custom spending limits.
Why the other options are wrong
- B. AWS Cost Explorer provides cost analysis and visualization but does not send alerts for threshold breaches.
- C. AWS Cost Allocation Tags help organize costs but do not provide alert functionality.
- D. AWS Organizations manages multiple AWS accounts but does not provide spending threshold alerts.
Question 152
A company plans to migrate its application to AWS and run the application on Amazon EC2 instances. The application will have continuous usage for 1 year. Which EC2 instance purchasing option will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Reserved Instances
Reserved Instances provide the most cost-effective pricing for continuous, predictable workloads with a 1-year commitment. They offer up to 40% discount compared to On-Demand pricing for a guaranteed commitment period. Since the company plans 1 year of continuous usage, Reserved Instances are specifically designed for this scenario.
Why the other options are wrong
- B. Spot Instances are unpredictable and can be interrupted, making them unsuitable for critical continuous workloads.
- C. On-Demand Instances have no discount and are the most expensive option for long-term continuous usage.
- D. Dedicated Hosts are for licensing or compliance requirements and are more expensive than Reserved Instances.
Question 153
Which of the following services can be used to block network traffic to an instance? (Choose two.)
Show answer and explanation
Correct answer: A, C. Security groups; Network ACLs
Security groups and Network ACLs are both stateful and stateless firewalls, respectively, that can block inbound and outbound network traffic to EC2 instances. Security groups act at the instance level with stateful filtering, while Network ACLs operate at the subnet level with stateless filtering. Both provide explicit traffic blocking capabilities.
Why the other options are wrong
- B. VPC Flow Logs only monitor and log network traffic; they do not block or control traffic flow.
- D. Amazon CloudWatch is a monitoring service for metrics and logs; it cannot block network traffic.
- E. AWS CloudTrail logs API calls and account activity; it does not control or block network traffic to instances.
Question 154
An e-learning platform needs to run an application for 2 months each year. The application will be deployed on Amazon EC2 instances. Any application downtime during those 2 months must be avoided. Which EC2 purchasing option will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: D. On-Demand Instances
On-Demand Instances are the most cost-effective option for this scenario because the application runs for only 2 months per year with no downtime tolerance. Reserved Instances require long-term commitments that would be wasteful for short-duration usage, Spot Instances carry interruption risk incompatible with zero-downtime requirements, and Dedicated Hosts provide unnecessary isolation. On-Demand pricing is appropriate for short, predictable workload periods.
Why the other options are wrong
- A. Reserved Instances require 1 or 3-year commitments, making them uneconomical when the application only runs 2 months annually.
- B. Dedicated Hosts provide physical server isolation at premium cost, which is unnecessary and cost-ineffective for this use case.
- C. Spot Instances can be interrupted without notice, which directly conflicts with the requirement to avoid any application downtime.
Question 155
Which tool should a developer use to integrate AWS service features directly into an application?
Show answer and explanation
Correct answer: A. AWS Software Development Kit
The AWS Software Development Kit (SDK) provides libraries, code samples, and documentation that developers use to integrate AWS service features directly into applications through programmatic APIs, supporting multiple programming languages.
Why the other options are wrong
- B. AWS CodeDeploy is a deployment automation service for releasing applications to compute resources, not for integrating AWS services into application code.
- C. AWS Lambda is a serverless compute service for running code in response to events, not a tool for directly integrating AWS services into applications.
- D. AWS Batch is a managed job scheduling and processing service for batch computing workloads, not a tool for direct API integration into applications.
Question 156
A company is migrating to the AWS Cloud and plans to run experimental workloads for 3 to 6 months on AWS. Which pricing model will meet these requirements?
Show answer and explanation
Correct answer: D. Use On-Demand Instances.
For experimental workloads lasting 3 to 6 months, On-Demand Instances are the best choice because they provide maximum flexibility with no long-term commitments. Users pay only for the compute capacity used, making it ideal for temporary or unpredictable workloads. Reserved Instances and Savings Plans require longer commitments (1 or 3 years), and Dedicated Hosts are more expensive and designed for long-term, consistent usage.
Why the other options are wrong
- A. A 3-year Savings Plan commitment is inappropriate for a temporary 3-6 month experimental workload.
- B. Dedicated Hosts are expensive and designed for long-term dedicated capacity, not short-term experiments.
- C. Reserved Instances require 1 or 3-year commitments, which exceeds the planned 3-6 month duration and reduces flexibility.
Question 157
Which AWS service helps users audit API activity across their AWS account?
Show answer and explanation
Correct answer: A. AWS CloudTrail
AWS CloudTrail is the primary service for auditing and logging API activity across AWS accounts. It records all API calls made to AWS services, providing a complete history of account activity, user actions, and resource changes. This is essential for compliance, security monitoring, and troubleshooting. Inspector, WAF, and Config serve different purposes (vulnerability assessment, web protection, and configuration tracking respectively).
Why the other options are wrong
- B. Amazon Inspector is used for vulnerability assessments of EC2 instances and applications, not API auditing.
- C. AWS WAF protects web applications from common web exploits, not for auditing API activity.
- D. AWS Config tracks configuration changes of AWS resources but does not audit API calls system-wide.
Question 158
Which AWS service provides the ability to manage infrastructure as code?
Show answer and explanation
Correct answer: D. AWS CloudFormation
AWS CloudFormation is the primary service for managing infrastructure as code, allowing users to define AWS resources in templates (JSON or YAML) and provision entire infrastructure stacks programmatically. It enables version control, reproducible deployments, and automated resource management.
Why the other options are wrong
- A. AWS CodePipeline orchestrates continuous integration and deployment workflows but is not the infrastructure-as-code service.
- B. AWS CodeDeploy automates application deployment to compute resources but does not manage infrastructure provisioning as code.
- C. AWS Direct Connect establishes dedicated network connections and is unrelated to infrastructure-as-code management.
Question 159
Which AWS service should users use to learn about AWS service availability and operations?
Show answer and explanation
Correct answer: D. AWS Health Dashboard
The AWS Health Dashboard is the primary service for learning about AWS service availability, performance, and operations. It provides real-time information about the status of AWS services and can alert users to events affecting their resources.
Why the other options are wrong
- A. EventBridge is for event-driven automation, not service status information
- B. Service Catalog is for governance and provisioning of approved services, not monitoring service health
- C. Control Tower is for multi-account AWS environment setup and governance, not service availability monitoring
Question 160
Which AWS service or feature can a company use to apply security rules to specific Amazon EC2 instances?
Show answer and explanation
Correct answer: B. Security groups
Security groups are stateful firewalls that control inbound and outbound traffic at the instance level, allowing granular security rules applied directly to specific EC2 instances. Network ACLs operate at the subnet level, AWS Trusted Advisor provides best-practice recommendations, and AWS WAF protects web applications, none of these provide instance-level security rule application like security groups do.
Why the other options are wrong
- A. Network ACLs operate at the subnet level, not at the individual EC2 instance level.
- C. AWS Trusted Advisor provides security and cost recommendations but does not apply security rules to instances.
- D. AWS WAF protects web applications from web exploits, not instance-level traffic control.
Question 161
Which option is an AWS Cloud Adoption Framework (AWS CAF) business perspective capability?
Show answer and explanation
Correct answer: C. Data monetization
Data monetization is one of the capabilities of the AWS CAF Business perspective, alongside strategy management, portfolio management, innovation management, product management, strategic partnership, business insight and data science. It focuses on turning data into business value.
Why the other options are wrong
- A. Culture evolution is a People perspective capability.
- B. Event management is an Operations perspective capability.
- D. Platform architecture is a Platform perspective capability.
Question 162
A company website is experiencing DDoS attacks. Which AWS service can help protect the company website against these attacks?
Show answer and explanation
Correct answer: C. AWS Shield
AWS Shield is a managed service that provides protection against Distributed Denial of Service (DDoS) attacks. It monitors traffic patterns and automatically mitigates DDoS attacks to keep applications available and protected.
Why the other options are wrong
- A. AWS Resource Access Manager manages resource sharing between AWS accounts, not DDoS protection.
- B. AWS Amplify is a development platform for building web and mobile applications, not for DDoS protection.
- D. Amazon GuardDuty detects malware and unauthorized activity, not specifically designed to protect against DDoS attacks.
Question 163
A customer runs an On-Demand Amazon Linux EC2 instance for 3 hours, 5 minutes, and 6 seconds. For how much time will the customer be billed?
Show answer and explanation
Correct answer: B. 3 hours, 5 minutes, and 6 seconds
On-Demand Amazon Linux instances are billed per second, with a 60-second minimum. The instance ran well beyond the minimum, so the customer pays for exactly 3 hours, 5 minutes and 6 seconds.
Why the other options are wrong
- A. Per-second billing charges the extra 6 seconds rather than dropping them.
- C. Amazon Linux usage is billed per second, not rounded up to the next minute.
- D. Hourly rounding does not apply to On-Demand Amazon Linux instances.
Question 164
Which AWS service allows users to download security and compliance reports about the AWS infrastructure on demand?
Show answer and explanation
Correct answer: C. AWS Artifact
AWS Artifact is the service that allows users to download security and compliance reports on demand, including audit reports, certifications, and attestations about AWS infrastructure and services. It provides access to AWS compliance documentation and third-party audit reports. GuardDuty, Security Hub, and Shield are threat detection and protection services, not compliance reporting platforms.
Why the other options are wrong
- A. GuardDuty is a threat detection service, not a compliance reporting platform.
- B. Security Hub aggregates security findings and alerts, not compliance documentation.
- D. Shield provides DDoS protection and is not a compliance reporting service.
Question 165
Which Amazon EC2 instance pricing model can provide discounts of up to 90%?
Show answer and explanation
Correct answer: D. Spot Instances
Spot Instances offer discounts of up to 90% compared to On-Demand pricing by allowing users to bid on spare EC2 capacity. Reserved Instances offer significant but lower discounts (typically 40-72%). On-Demand pricing has no discount, and Dedicated Hosts are priced differently based on physical host allocation rather than instance count.
Why the other options are wrong
- A. Reserved Instances offer lower discounts (40-72%), not up to 90%.
- B. On-Demand instances have no discount; they are the full price baseline.
- C. Dedicated Hosts are priced per physical host, not with instance-level discounts up to 90%.
Question 166
A company wants an automated process to continuously scan its Amazon EC2 instances for software vulnerabilities. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: B. Amazon Inspector
Amazon Inspector is the AWS service that automatically discovers and scans Amazon EC2 instances for software vulnerabilities and network exposure. It performs continuous security assessments and provides detailed findings about vulnerabilities. GuardDuty detects threats but doesn't perform vulnerability scans, Detective is for log analysis and investigation, and Cognito handles authentication.
Why the other options are wrong
- A. Amazon GuardDuty detects threats and anomalies but does not perform vulnerability scanning of EC2 instances.
- C. Amazon Detective analyzes logs and data for investigation purposes, not for vulnerability scanning.
- D. Amazon Cognito is an identity and authentication service, not a vulnerability scanning tool.
Question 167
A company is storing data that will not be frequently accessed in the AWS Cloud. If the company needs to access the data, the data needs to be retrieved within 12 hours. The company wants a solution that is cost-effective for storage costs for each gigabyte. Which Amazon S3 storage class will meet these requirements?
Show answer and explanation
Correct answer: B. S3 Glacier Flexible Retrieval
S3 Glacier Flexible Retrieval is designed for infrequently accessed data with retrieval times between 1-12 hours, making it ideal for this use case. It offers the lowest storage cost per gigabyte among the options that meet the 12-hour retrieval requirement. While it has higher retrieval costs than Standard storage, the significantly lower storage costs make it the most cost-effective solution for data that is rarely accessed.
Why the other options are wrong
- A. S3 Standard is optimized for frequent access and has much higher storage costs, making it uneconomical for infrequently accessed data.
- C. S3 One Zone-IA has higher storage costs than Glacier and is intended for infrequently accessed data that requires faster retrieval than 12 hours.
- D. S3 Standard-IA has higher storage costs than Glacier and is designed for more frequent access patterns than needed here.
Question 168
A company wants to use Amazon EC2 instances to provide a static website to users all over the world. The company needs to minimize latency for the users. Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Use Amazon CloudFront with the EC2 instances configured as the source.
Amazon CloudFront is a Content Delivery Network (CDN) that caches content at edge locations worldwide, minimizing latency for global users. By configuring EC2 instances as the origin, CloudFront distributes the static website content to 400+ points of presence globally, ensuring users access content from the nearest edge location.
Why the other options are wrong
- A. EC2 instances cannot be deployed in edge locations; only CloudFront and other edge services run there.
- B. Multiple instances in different regions without a CDN still require users to connect across long distances.
- D. Multiple AWS accounts do not reduce latency; this addresses organizational isolation, not performance.
Question 169
A company wants to establish a private network connection between AWS and its corporate network. Which AWS service or feature will meet this requirement?
Show answer and explanation
Correct answer: C. AWS Direct Connect
AWS Direct Connect establishes a dedicated private network connection between an on-premises corporate network and AWS, bypassing the public internet. This provides consistent network performance, reduced bandwidth costs, and enhanced security. Amazon Connect is a cloud contact center service, Amazon Route 53 is a DNS service for domain management, and VPC peering connects two VPCs together, not corporate networks to AWS.
Why the other options are wrong
- A. Amazon Connect is a cloud-based contact center service for customer communications, not network connectivity.
- B. Amazon Route 53 is a DNS service for domain registration and traffic routing, not private network establishment.
- D. VPC peering connects two VPCs within AWS, not a corporate on-premises network to AWS.
Question 170
A company is migrating its applications from on-premises to the AWS Cloud. The company wants to ensure that the applications are assigned only the minimum permissions that are needed to perform all operations. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: A. AWS Identity and Access Management (IAM)
AWS Identity and Access Management (IAM) is the service that controls access and permissions to AWS resources. It allows administrators to create users, roles, and policies with granular permissions, implementing the principle of least privilege by assigning only the minimum permissions necessary for each user or service to perform required operations.
Why the other options are wrong
- B. Amazon CloudWatch monitors and logs AWS resources and applications but does not control permissions or access.
- C. Amazon Macie discovers and protects sensitive data in S3 but does not manage access permissions or implement least privilege.
- D. Amazon GuardDuty provides threat detection and monitoring but does not control access permissions or enforce least privilege principles.
Question 171
Which option is a shared responsibility between AWS and its customers under the AWS shared responsibility model?
Show answer and explanation
Correct answer: C. Patch management
Patch management is a shared responsibility where AWS patches the underlying infrastructure, hypervisor, and managed services, while customers are responsible for patching their guest operating systems and applications. Option A is customer responsibility (OS configuration), option B is customer responsibility (encryption implementation), and option D is AWS responsibility (physical infrastructure security).
Why the other options are wrong
- A. Configuring EC2 instance operating systems is entirely a customer responsibility.
- B. Application file system server-side encryption implementation is a customer responsibility.
- D. Security of physical infrastructure is AWS responsibility, not shared.
Question 172
A company is migrating its workloads to the AWS Cloud. The company must retain full control of patch management for the guest operating systems that host its applications. Which AWS service should the company use to meet these requirements?
Show answer and explanation
Correct answer: B. Amazon EC2
Amazon EC2 is the only service that provides full control over guest operating system patch management. With EC2, the company has complete control over the instance and can manage all patches directly. Lambda is serverless with no OS control, DynamoDB is fully managed, and RDS is a managed database where AWS handles OS patching.
Why the other options are wrong
- A. DynamoDB is a fully managed service with no guest operating system to patch.
- C. Lambda is a serverless service where the company cannot manage the guest OS.
- D. RDS is a managed database service where AWS handles OS patching automatically.
Question 173
A company needs to evaluate its AWS environment and provide best practice recommendations in five categories: cost, performance, service limits, fault tolerance and security. Which AWS service can the company use to meet these requirements?
Show answer and explanation
Correct answer: C. AWS Trusted Advisor
AWS Trusted Advisor evaluates AWS environments against best practices in exactly five categories: cost optimization, performance, service limits, fault tolerance, and security. It provides actionable recommendations across all these dimensions.
Why the other options are wrong
- A. AWS Shield is a DDoS protection service focused only on security, not a comprehensive best practice evaluation tool.
- B. AWS WAF is a web application firewall for security only, not a multi-category best practice evaluation service.
- D. AWS Service Catalog is for provisioning approved IT services, not for evaluating and recommending best practices.
Question 174
A company is using the AWS Free Tier for several AWS services for an application. What will happen if the Free Tier usage period expires or if the application use exceeds the Free Tier usage limits?
Show answer and explanation
Correct answer: A. The company will be charged the standard pay-as-you-go service rates for the usage that exceeds the Free Tier usage.
When Free Tier usage expires or limits are exceeded, customers are automatically charged standard pay-as-you-go rates for the overage without service interruption or additional contact. AWS Support (B) does not contact customers first; charges are applied automatically. Option C is incorrect because Free Tier usage itself is free; only overage is charged. Option D is false; accounts are never frozen for billing purposes.
Why the other options are wrong
- B. AWS does not contact customers before charging; automatic billing occurs based on usage.
- C. Free Tier usage is free; customers are only charged for usage exceeding the Free Tier limits.
- D. AWS accounts are not frozen due to billing; customers can continue using services and are charged accordingly.
Question 175
A company wants to track tags, buckets, and prefixes for its Amazon S3 objects. Which S3 feature will meet this requirement?
Show answer and explanation
Correct answer: A. S3 Inventory report
S3 Inventory reports provide detailed lists of objects in buckets, including metadata like tags, prefixes, and other object properties. This feature is specifically designed to track and report on objects across S3 buckets with filtering capabilities, making it the ideal solution for tracking tags, buckets, and prefixes.
Why the other options are wrong
- B. S3 Lifecycle policies manage object transitions and expiration, not tracking or reporting on object metadata.
- C. S3 Versioning maintains multiple versions of objects but does not provide tracking or reporting of tags and prefixes.
- D. S3 ACLs control access permissions to buckets and objects, not track or report on object metadata.
Question 176
Which of the following acts as an instance-level firewall to control inbound and outbound access?
Show answer and explanation
Correct answer: B. Security groups
Security groups function as instance-level firewalls that control inbound and outbound traffic to EC2 instances. They operate at the instance level and allow fine-grained control over what traffic can reach each instance. Network ACLs operate at the subnet level, AWS Trusted Advisor provides optimization recommendations, and virtual private gateways are for VPN connectivity.
Why the other options are wrong
- A. Network access control lists operate at the subnet level, not the instance level.
- C. AWS Trusted Advisor provides best practice recommendations, not firewall functionality.
- D. Virtual private gateways facilitate VPN connections, not instance-level traffic control.
Question 177
A company needs to run a pre-installed third-party firewall on an Amazon EC2 instance. Which AWS service or feature can provide this solution?
Show answer and explanation
Correct answer: C. AWS Marketplace
AWS Marketplace is the service that provides pre-packaged third-party applications and software, including firewalls, that can be quickly deployed on EC2 instances. It offers vetted solutions that integrate seamlessly with AWS infrastructure.
Why the other options are wrong
- A. Network ACLs are stateless firewall rules at the subnet level, not a solution for deploying third-party firewall software.
- B. Security groups are AWS-native network controls, not solutions for running pre-installed third-party firewall applications.
- D. AWS Trusted Advisor provides recommendations and best practices but does not deploy third-party software.
Question 178
Which AWS service gives users the ability to build interactive business intelligence dashboards that include machine learning insights?
Show answer and explanation
Correct answer: C. Amazon QuickSight
Amazon QuickSight is AWS's business intelligence service that enables users to build interactive dashboards and includes machine learning-powered insights such as anomaly detection, forecasting, and auto-narratives. It is purpose-built for BI visualization and analysis with embedded ML capabilities.
Why the other options are wrong
- A. Athena is a query service for analyzing data in S3 but lacks interactive dashboard and ML insight capabilities.
- B. Kendra is a search and document intelligence service, not a BI dashboard tool.
- D. Redshift is a data warehouse for analytics but requires more manual configuration and doesn't natively provide interactive BI dashboards with built-in ML insights.
Question 179
Which AWS service can be used at no additional cost?
Show answer and explanation
Correct answer: C. AWS Organizations
AWS Organizations is provided at no additional cost. It allows customers to manage multiple AWS accounts and consolidate billing without incurring separate charges. All other services listed have associated costs, though CloudWatch does offer a free tier with limited metrics.
Why the other options are wrong
- A. Amazon SageMaker charges for compute instances, storage, and data processing used in machine learning operations.
- B. AWS Config incurs charges for the number of configuration items recorded and evaluated.
- D. Amazon CloudWatch charges for custom metrics, logs ingestion, and dashboards, though it offers limited free tier capabilities.
Question 180
A social media company wants to protect its web application from common web exploits such as SQL injections and cross-site scripting. Which AWS service will meet these requirements?
Show answer and explanation
Correct answer: B. AWS WAF
AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common web-based attacks including SQL injections and cross-site scripting (XSS). It filters and monitors HTTP/HTTPS traffic to enforce a set of rules that define what traffic is allowed. The other services have different purposes: Inspector scans for vulnerabilities, GuardDuty detects threats at the network level, and CloudWatch monitors metrics and logs.
Why the other options are wrong
- A. Amazon Inspector is a vulnerability scanner for EC2 instances and applications, not a web application firewall.
- C. Amazon GuardDuty is a threat detection service for networks and accounts, not a web application firewall.
- D. Amazon CloudWatch is a monitoring and logging service, not designed to filter web application attacks.
That was 180 of 719.
The full AWS CLF-C02 pack has all 719 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 359 free as one PDF by email. Get the Half Pack →