100 Free AWS CLF-C02 Practice Questions and Answers
100 questions for the AWS CLF-C02 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Which Amazon EC2 instance purchasing option will meet these requirements MOST cost-effectively?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Spot Instances are unsuitable for continuous 3-year operations as they can be interrupted with short notice.
Right, B is the answer.
Why B is right
Reserved Instances provide the most cost-effective option for a 3-year commitment with continuous runtime. They offer substantial discounts (up to 72%) compared to On-Demand pricing when committing to a specific term. For a predictable 3-year workload, Reserved Instances are designed specifically for this scenario.
Not this one. Try another answer.
Why C is wrong
Dedicated Hosts are for licensing requirements and specific compliance needs, not general cost optimization.
Not this one. Try another answer.
Why D is wrong
On-Demand Instances are the most expensive option for long-term, continuous workloads.
Question 2 Play from 01:40
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS CloudFormation is the service that enables users to define and deploy infrastructure using code templates (Infrastructure as Code). CloudFormation allows highly repeatable, consistent infrastructure deployments by codifying resource configurations in JSON or YAML templates that can be version-controlled and reused.
Not this one. Try another answer.
Why B is wrong
AWS CodeDeploy is a deployment service focused on automating application deployments to instances, not defining infrastructure configurations.
Not this one. Try another answer.
Why C is wrong
AWS CodeBuild is a build service that compiles source code and runs tests, not for deploying infrastructure configurations.
Not this one. Try another answer.
Why D is wrong
AWS Systems Manager provides operational tools for managing resources, but is not the primary service for deploying repeatable infrastructure configurations.
Question 3 Play from 03:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Resource Groups organizes and manages AWS resources based on tags, not for discovery of on-premises infrastructure.
Right, B is the answer.
Why B is right
AWS Application Discovery Service collects configuration, usage, and behavior data from on-premises data centers to help plan and execute migrations to AWS. Resource Groups manages AWS resources by tags, Service Catalog provides curated product portfolios, and Systems Manager handles operational tasks, none of which specifically target discovery for migration planning.
Not this one. Try another answer.
Why C is wrong
AWS Service Catalog provides curated IT service offerings, not discovery of on-premises data center configurations.
Not this one. Try another answer.
Why D is wrong
AWS Systems Manager handles operational management tasks across resources, not discovery for migration planning.
Question 4 Play from 05:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Copilot is a command-line tool for containerized applications, not a graphical interface for general AWS service management.
Not this one. Try another answer.
Why B is wrong
AWS CLI is a command-line interface, not a graphical interface.
Right, C is the answer.
Why C is right
The AWS Management Console is the web-based graphical user interface that allows users to manage and interact with AWS services. It provides a visual dashboard for accessing and configuring AWS resources without requiring command-line knowledge.
Not this one. Try another answer.
Why D is wrong
AWS SDKs are programming libraries for developers to build applications, not a graphical management interface.
Question 5 Play from 07:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Trusted Advisor provides recommendations for cost optimization, security, and performance based on best practices, not real-time monitoring.
Right, B is the answer.
Why B is right
Amazon CloudWatch is the AWS service that monitors AWS resources and applications in real time. It collects and tracks metrics, logs, and events from AWS services and applications, providing real-time visibility into resource performance and health.
Not this one. Try another answer.
Why C is wrong
AWS CloudTrail logs API calls and account activity for compliance and auditing purposes, not for real-time resource monitoring.
Not this one. Try another answer.
Why D is wrong
AWS Cost Explorer analyzes and visualizes historical and forecasted AWS spending patterns, not real-time resource monitoring.
Question 6 Play from 08:44
Which solution will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Direct Connect requires physical provisioning and coordination with telecommunications providers, taking 4-8 weeks to establish.
Not this one. Try another answer.
Why B is wrong
Amazon VPC is a foundational networking service but is not a connectivity solution from on-premises to AWS.
Right, C is the answer.
Why C is right
AWS Site-to-Site VPN can be set up quickly, typically within days or hours, providing an encrypted network connection between on-premises infrastructure and AWS. It requires minimal setup compared to AWS Direct Connect, which involves physical infrastructure provisioning and can take weeks to months to implement, making Site-to-Site VPN the correct choice for a 1-week timeline.
Not this one. Try another answer.
Why D is wrong
Edge locations are CloudFront content delivery nodes and are not relevant to establishing on-premises-to-AWS connectivity.
Question 7 Play from 10:34
Which AWS service should the team use?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
EC2 requires manual configuration of each instance and does not provide template-based repeatable deployments.
Right, B is the answer.
Why B is right
AWS CloudFormation is the correct service for deploying multiple test environments in a fast, repeatable manner. It allows teams to define infrastructure as code using templates, enabling consistent and automated deployment of entire application stacks across multiple environments. While EC2 can be used to create instances, it requires manual configuration. ECS is for container orchestration, and QuickSight is for business analytics.
Not this one. Try another answer.
Why C is wrong
Amazon QuickSight is a business intelligence and data visualization service, not for environment deployment.
Not this one. Try another answer.
Why D is wrong
Amazon ECS is for container orchestration, not for defining and deploying entire infrastructure environments.
Question 8 Play from 12:27
Which AWS service or tool should the company use to meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud Adoption Readiness Tool assesses organizational cloud readiness but does not perform database migrations.
Not this one. Try another answer.
Why B is wrong
AWS Migration Hub is a central location to track migration progress but is not the tool that performs the actual database migration.
Right, C is the answer.
Why C is right
AWS Database Migration Service (AWS DMS) is specifically designed for migrating databases from on-premises or other cloud sources to AWS. It supports PostgreSQL and provides schema conversion, continuous data replication, and minimal downtime migration capabilities, making it the ideal tool for this PostgreSQL to RDS migration.
Not this one. Try another answer.
Why D is wrong
AWS Application Migration Service is designed for migrating applications, not specifically for database migrations from on-premises.
Question 9 Play from 14:29
Which AWS service should the company choose?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS VPN uses the public internet and does not provide the consistent bandwidth throughput and dedicated connection that Direct Connect offers.
Right, B is the answer.
Why B is right
AWS Direct Connect provides a dedicated network connection from your premises to AWS, delivering consistent network performance, lower bandwidth costs, and higher reliability compared to internet-based connections. It maintains consistent throughput and provides a more stable network experience than public internet, which is subject to variable latency and congestion.
Not this one. Try another answer.
Why C is wrong
Amazon Connect is a cloud-based contact center service, not a network connectivity solution.
Not this one. Try another answer.
Why D is wrong
Amazon CloudFront is a content delivery network for caching and distributing content, not for maintaining bandwidth throughput to AWS.
Question 10 Play from 16:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Cloud Development Kit (CDK) allows users to define and provision AWS infrastructure programmatically using familiar programming languages. It abstracts CloudFormation templates and enables code-based infrastructure definition, which is the definition of Infrastructure as Code.
Not this one. Try another answer.
Why B is wrong
Amazon CodeGuru is a code review and profiling service for application quality improvement, not infrastructure provisioning.
Not this one. Try another answer.
Why C is wrong
AWS Config is a service for compliance monitoring and configuration tracking, not infrastructure provisioning.
Not this one. Try another answer.
Why D is wrong
AWS CodeCommit is a source code repository service, not an infrastructure provisioning tool.
Show all 100 questionsShow fewer questions
Question 11 Play from 17:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network and firewall configuration is the customer's responsibility for their resources and applications.
Not this one. Try another answer.
Why B is wrong
Client-side data encryption is the customer's responsibility to implement before data reaches AWS.
Not this one. Try another answer.
Why C is wrong
Management of user permissions and IAM policies is the customer's responsibility to configure and maintain.
Right, D is the answer.
Why D is right
Under the AWS shared responsibility model, AWS is responsible for the security of the cloud itself, which includes the physical hardware, infrastructure, and the underlying systems that support AWS services. Customers are responsible for security in the cloud, including their network configuration, data encryption, and user permission management.
Question 12 Play from 19:34
Which AWS offering will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon EventBridge is an event routing service for application integration, not a cost monitoring tool.
Not this one. Try another answer.
Why B is wrong
Compute Savings Plans provide discounted pricing for committed compute usage but don't provide monitoring or alerts for overall costs.
Right, C is the answer.
Why C is right
AWS Budgets allows companies to set custom cost budgets and receive alerts when costs approach or exceed those thresholds. It provides proactive monitoring of overall operating costs and enables organizations to track spending against planned budgets.
Not this one. Try another answer.
Why D is wrong
Migration Evaluator assesses on-premises costs and migration projections but isn't designed for ongoing cost monitoring and alerts.
Question 13 Play from 21:13
Which AWS service supports this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS CloudFormation is for infrastructure-as-code and resource provisioning, not multi-account governance setup.
Right, B is the answer.
Why B is right
AWS Control Tower is specifically designed to set up and govern multi-account AWS environments. It automates account creation, applies preventive and detective guardrails, and provides centralized management, making it the ideal service for establishing a new multi-account structure.
Not this one. Try another answer.
Why C is wrong
AWS Config monitors and audits resource configurations but doesn't set up multi- account structures.
Not this one. Try another answer.
Why D is wrong
Amazon VPC is for network isolation and architecture, not multi-account environment setup and governance.
Question 14 Play from 22:54
Which AWS service or tool will meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IAM Access Analyzer is used to identify external access and policies, not credential rotation tracking.
Not this one. Try another answer.
Why B is wrong
AWS Artifact provides compliance documentation and certifications, not specific credential rotation audit data.
Right, C is the answer.
Why C is right
The IAM credential report is a CSV file that contains details about password and access key rotation for all IAM users in an account. It specifically shows when credentials were created, last used, and when they last changed, making it the ideal tool for compliance auditing of credential rotation details.
Not this one. Try another answer.
Why D is wrong
AWS Audit Manager is for managing compliance audit frameworks and evidence collection, not specifically for credential rotation reporting.
Question 15 Play from 24:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS VPN provides secure connectivity between on-premises and AWS but does not provision an isolated section of the cloud itself.
Not this one. Try another answer.
Why B is wrong
Availability Zones are physical locations within regions but do not represent logically isolated sections that users control.
Right, C is the answer.
Why C is right
Amazon Virtual Private Cloud (VPC) allows users to provision a logically isolated section of the AWS Cloud with complete network control. It enables custom IP ranges, subnets, and security controls within a private cloud environment.
Not this one. Try another answer.
Why D is wrong
AWS Regions are geographic areas containing multiple Availability Zones but do not provide logical isolation controlled by individual users.
Question 16 Play from 26:33
Which AWS service can the company use to make this integration?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Directory Service manages Microsoft Active Directory, not social media integration.
Not this one. Try another answer.
Why B is wrong
AWS IAM manages AWS service access and is not designed for customer-facing social media authentication.
Right, C is the answer.
Why C is right
Amazon Cognito is designed to enable user authentication and authorization, including integration with external identity providers such as social media platforms (Facebook, Google, Amazon, Apple). It allows companies to add sign-up, sign-in, and access control to web and mobile applications using social media credentials.
Not this one. Try another answer.
Why D is wrong
AWS IAM Identity Center (Single Sign-On) is for enterprise workforce identity management, not customer social media login integration.
Question 17 Play from 28:20
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The AWS Cloud Adoption Framework includes six perspectives: Business, People, Governance, Platform, Security, and Operations. The Platform perspective encompasses technical capabilities including data architecture, which involves designing systems for data flow, storage, processing, and integration. Data architecture is a core platform capability.
Not this one. Try another answer.
Why B is wrong
Data protection is a capability within the Security perspective, not the Platform perspective.
Not this one. Try another answer.
Why C is wrong
Data governance is a capability within the Governance perspective, not the Platform perspective.
Not this one. Try another answer.
Why D is wrong
Data science is not a standard AWS CAF capability; it may be part of organizational practices but is not a recognized CAF perspective capability.
Question 18 Play from 29:58
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Consolidated billing provides two key benefits: it combines multiple AWS accounts under one bill (option C), and it qualifies the entire organization for volume discounts based on aggregate usage across all accounts (option A). These are the primary advantages that organizations gain by consolidating their AWS billing.
Not this one. Try another answer.
Why B is wrong
Consolidated billing does not incur minimal additional fees; it is a free feature that can actually reduce costs.
Right, C is one of the answers.
Why C is right
Consolidated billing provides two key benefits: it combines multiple AWS accounts under one bill (option C), and it qualifies the entire organization for volume discounts based on aggregate usage across all accounts (option A). These are the primary advantages that organizations gain by consolidating their AWS billing.
Not this one. Try another answer.
Why D is wrong
Installment payment options are not a benefit of consolidated billing and are not directly related to it.
Not this one. Try another answer.
Why E is wrong
Custom cost and usage budget creation is a feature of AWS Budgets, not specifically a benefit of consolidated billing.
Question 19 Play from 31:40
Which phase of the cloud transformation journey includes these activities?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Envision phase of the cloud transformation journey focuses on identifying business outcomes, defining the vision for cloud migration, and establishing measurable goals. This foundational phase establishes the strategic value and business case for cloud adoption before proceeding with alignment and execution.
Not this one. Try another answer.
Why B is wrong
Align focuses on preparing people, processes, and technology for migration execution.
Not this one. Try another answer.
Why C is wrong
Scale involves expanding successful implementations across the organization.
Not this one. Try another answer.
Why D is wrong
Launch is the execution phase where actual migration workloads begin.
Question 20 Play from 33:12
Which AWS service can be used to accomplish this?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon RDS is a relational database service, not a nonrelational database.
Right, B is the answer.
Why B is right
Amazon DynamoDB is a fully managed, serverless nonrelational database service that requires no infrastructure or database software management. Users define tables and DynamoDB handles all underlying operations, scaling, and availability. Amazon RDS is relational, Aurora is relational, and Redshift is for data warehousing, none of these meet the nonrelational requirement.
Not this one. Try another answer.
Why C is wrong
Amazon Aurora is a relational database engine, not a nonrelational database.
Not this one. Try another answer.
Why D is wrong
Amazon Redshift is a data warehouse service optimized for analytics, not a general- purpose nonrelational database.
Question 21 Play from 34:56
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Cost Explorer is a tool that analyzes spending patterns and identifies opportunities to optimize costs, which directly demonstrates the concept of rightsizing, adjusting resource sizes and types to match actual usage patterns and reduce unnecessary spending.
Not this one. Try another answer.
Why B is wrong
Reliability refers to the ability of a system to function correctly and recover from failures, which Cost Explorer doesn't directly demonstrate.
Not this one. Try another answer.
Why C is wrong
Resilience is about a system's ability to withstand and recover from disruptions, not a cost optimization concept that Cost Explorer illustrates.
Not this one. Try another answer.
Why D is wrong
Modernization involves updating applications and infrastructure to newer technologies; while Cost Explorer can support modernization decisions, it primarily demonstrates rightsizing.
Question 22 Play from 36:34
Which AWS service is appropriate for this use case?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Amazon EventBridge is designed to route events from AWS services to target services like Lambda functions. It can detect when EC2 instances enter specific states (such as 'stopping') and automatically invoke Lambda functions in response. AWS Config tracks configuration changes; SNS sends notifications but isn't the primary service for state- based triggering; CloudFormation provisions infrastructure.
Not this one. Try another answer.
Why B is wrong
AWS Config monitors configuration compliance and changes, not state transitions that trigger Lambda.
Not this one. Try another answer.
Why C is wrong
SNS sends notifications but is not the primary service for detecting EC2 state changes and invoking Lambda.
Not this one. Try another answer.
Why D is wrong
CloudFormation is for infrastructure provisioning and management, not event routing.
Question 23 Play from 38:23
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
AWS Regions and Availability Zones are the foundational components of AWS's global infrastructure. Regions are geographic areas containing multiple Availability Zones for redundancy and latency optimization. ElastiCache, S3, and VPC are services or resources that run within this infrastructure but are not components of it.
Not this one. Try another answer.
Why B is wrong
Amazon ElastiCache is a caching service that runs within the infrastructure, not part of it.
Right, C is one of the answers.
Why C is right
AWS Regions and Availability Zones are the foundational components of AWS's global infrastructure. Regions are geographic areas containing multiple Availability Zones for redundancy and latency optimization. ElastiCache, S3, and VPC are services or resources that run within this infrastructure but are not components of it.
Not this one. Try another answer.
Why D is wrong
Amazon S3 is a storage service that utilizes the infrastructure but is not a component of it.
Not this one. Try another answer.
Why E is wrong
Amazon VPC is a networking service that runs within the infrastructure, not a foundational component.
Question 24 Play from 40:03
Which cloud concept describes this functionality?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Availability refers to the uptime and accessibility of services, not the automatic scaling of resources.
Right, B is the answer.
Why B is right
Elasticity describes the ability of cloud infrastructure to automatically scale resources up or down based on demand, acquiring resources when needed and releasing them when no longer required. This is a core characteristic of cloud computing.
Not this one. Try another answer.
Why C is wrong
Durability refers to the long-term protection and preservation of data, not resource scaling.
Not this one. Try another answer.
Why D is wrong
Reliability refers to the consistent performance and fault tolerance of systems, not automatic resource acquisition and release.
Question 25 Play from 41:39
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The AWS shared responsibility model lists patch management, configuration management, and awareness and training as shared controls. AWS configures its infrastructure devices, while customers configure their own guest operating systems, databases and applications.
Not this one. Try another answer.
Why B is wrong
Physical and environmental controls are inherited controls that AWS handles entirely.
Not this one. Try another answer.
Why C is wrong
Data integrity authentication is a customer-specific control.
Not this one. Try another answer.
Why D is wrong
Identity and access management is not one of the shared controls listed in the model; customers manage their own users and permissions.
Question 26 Play from 43:14
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Amazon Route 53 is a DNS service that enables failover across different AWS Regions by routing traffic to healthy endpoints. AWS Global Accelerator uses Anycast IP addresses and edge locations to direct traffic to the nearest optimal endpoint across Regions, providing both high availability and low latency. Both services explicitly support cross-Region failover and latency-based routing.
Not this one. Try another answer.
Why B is wrong
Network Load Balancer distributes traffic within a Region or across availability zones but does not provide cross-Region failover.
Not this one. Try another answer.
Why C is wrong
Amazon S3 Transfer Acceleration optimizes data transfer speed to S3 but does not provide high availability failover across Regions.
Right, D is one of the answers.
Why D is right
Amazon Route 53 is a DNS service that enables failover across different AWS Regions by routing traffic to healthy endpoints. AWS Global Accelerator uses Anycast IP addresses and edge locations to direct traffic to the nearest optimal endpoint across Regions, providing both high availability and low latency. Both services explicitly support cross-Region failover and latency-based routing.
Not this one. Try another answer.
Why E is wrong
Application Load Balancer operates at Layer 7 for application-level routing within a Region or across zones but not across Regions for failover.
Question 27 Play from 45:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This is not a well-architected principle; moving data closer to compute adds complexity without clear benefit.
Not this one. Try another answer.
Why B is wrong
Provisioning for peak capacity is inefficient; cloud design should use auto-scaling instead.
Right, C is the answer.
Why C is right
Designing for automated recovery from failure is a core principle of the AWS Well- Architected Framework's Reliability pillar. This principle emphasizes building systems that can automatically detect and recover from failures without manual intervention. Keeping data closer to compute is not a standard principle, provisioning for peak capacity is wasteful and contradicts elasticity, and tightly coupled components violate design best practices.
Not this one. Try another answer.
Why D is wrong
Tightly coupled components violate the principle of loose coupling that enables scalability and resilience.
Question 28 Play from 46:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Physical connectivity among Availability Zones is AWS's responsibility as part of infrastructure management.
Not this one. Try another answer.
Why B is wrong
Network switch maintenance is AWS's responsibility as part of infrastructure management.
Not this one. Try another answer.
Why C is wrong
Hardware updates and firmware patches to the underlying physical infrastructure are AWS's responsibility.
Right, D is the answer.
Why D is right
Under the AWS shared responsibility model, customers are responsible for security and maintenance of the guest operating system, applications, and data on EC2 instances, including applying security patches and updates to the EC2 instances themselves. AWS manages the physical infrastructure, networking, and hypervisor layer.
Question 29 Play from 48:33
Which AWS service or feature should be used?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Security groups control network access at the instance level, not API permissions for calling other AWS services.
Not this one. Try another answer.
Why B is wrong
AWS Firewall Manager is for managing firewall policies across accounts, not for granting EC2 service permissions.
Right, C is the answer.
Why C is right
IAM roles are the secure mechanism for granting EC2 instances permissions to call other AWS services. Roles use temporary security credentials that are automatically rotated and do not require hardcoded credentials in application code. Security groups (A) control network traffic, not API permissions. AWS Firewall Manager (B) manages firewall rules. IAM user SSH keys (D) are for authentication to instances, not for service-to-service authorization.
Not this one. Try another answer.
Why D is wrong
SSH keys are for authenticating to EC2 instances, not for authorizing API calls to other AWS services.
Question 30 Play from 50:33
Which Amazon S3 feature will meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
S3 Versioning maintains multiple versions of objects but does not archive or reduce costs for infrequently accessed data.
Right, B is the answer.
Why B is right
S3 Lifecycle policies automatically transition objects between storage classes based on age and access patterns. This allows companies to move infrequently accessed data to cheaper storage tiers like S3 Glacier or S3 Deep Archive, directly addressing the cost- saving requirement for archiving older data.
Not this one. Try another answer.
Why C is wrong
S3 Object Lock prevents object deletion and is designed for compliance, not for cost optimization through archiving.
Not this one. Try another answer.
Why D is wrong
S3 Inventory generates reports about objects but does not automatically archive or transition data between storage classes.
Question 31 Play from 52:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Speed of innovation describes rapid development cycles and access to new services, not scaling capabilities.
Right, B is the answer.
Why B is right
Resource elasticity directly refers to the ability to automatically scale infrastructure up or down based on demand. This is a core AWS value proposition that allows customers to provision resources dynamically without over-provisioning or under-provisioning, optimizing both performance and cost.
Not this one. Try another answer.
Why C is wrong
Decoupled architecture is about system design patterns, not the ability to scale based on demand.
Not this one. Try another answer.
Why D is wrong
Global deployment refers to geographic distribution of infrastructure, not to scaling responsiveness to demand.
Question 32 Play from 53:55
Which AWS service should the company use for this workload?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Lambda has a maximum execution timeout of 15 minutes, far too short for a 5-hour data processing job.
Right, B is the answer.
Why B is right
Amazon EC2 is the most appropriate service for a periodic 5-hour data processing job. EC2 instances can be launched on-demand for the weekly job and terminated after completion, providing cost efficiency for long-running batch workloads. AWS Lambda has a 15-minute timeout limit, making it unsuitable for 5-hour jobs. CodeDeploy is for application deployment, and Wavelength is for edge computing.
Not this one. Try another answer.
Why C is wrong
AWS CodeDeploy is an application deployment service, not designed for data processing workloads.
Not this one. Try another answer.
Why D is wrong
AWS Wavelength is for edge computing in 5G networks, not for standard batch data processing.
Question 33 Play from 55:41
Which AWS service will meet these requirements?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Marketplace is the service that allows vendors to share and sell custom AMIs to prospective customers. It provides a platform for independent software vendors to package and distribute their solutions as AMIs with integrated billing and licensing.
Not this one. Try another answer.
Why B is wrong
AWS Data Exchange is for sharing data products, not for distributing custom AMIs.
Not this one. Try another answer.
Why C is wrong
Amazon EC2 is the compute service itself but is not a platform for sharing AMIs to external customers.
Not this one. Try another answer.
Why D is wrong
AWS Organizations manages multiple AWS accounts but is not designed for sharing AMIs with external customers.
Question 34 Play from 57:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Config monitors and records AWS resource configurations, not network connectivity.
Not this one. Try another answer.
Why B is wrong
VPC is for creating virtual networks within AWS, not for on-premises to AWS connections.
Right, C is the answer.
Why C is right
AWS Direct Connect creates a dedicated private network connection from an on-premises data center to AWS infrastructure, providing consistent network performance, reduced latency, and enhanced security compared to internet-based connections.
Not this one. Try another answer.
Why D is wrong
Route 53 is a DNS service for domain name resolution, not for establishing private network connections.
Question 35 Play from 58:53
Which AWS service will help prevent network layer DDoS attacks against the web application?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS WAF protects against application layer (Layer 7) attacks, not network layer DDoS attacks.
Not this one. Try another answer.
Why B is wrong
AWS Firewall Manager is for centralized management of firewall rules across accounts, not primary DDoS protection.
Not this one. Try another answer.
Why C is wrong
Amazon GuardDuty detects malicious activity and threats but is not specifically designed for DDoS attack prevention.
Right, D is the answer.
Why D is right
AWS Shield is the dedicated DDoS protection service that provides both standard (automatic) and advanced protection against DDoS attacks at the network and transport layers. It is specifically designed to protect AWS resources from DDoS attacks and is the primary service for this purpose.
Question 36 Play from 1:00:35
Which advantage of cloud computing will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Stopping capacity guessing relates to elasticity, not development/launch speed.
Not this one. Try another answer.
Why B is wrong
Trading fixed for variable expenses is about cost structure, not development speed.
Not this one. Try another answer.
Why C is wrong
Economies of scale relate to overall AWS cost efficiency, not application launch speed.
Right, D is the answer.
Why D is right
Increased speed and agility directly addresses the ability to quickly develop, test, and launch applications. Cloud computing enables rapid provisioning of resources without waiting for hardware procurement, reducing time-to-market. While the other options are valid cloud benefits, they do not specifically relate to development, testing, and launch speed.
Question 37 Play from 1:02:15
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Agility in AWS Cloud computing refers to the speed of implementation and the ability to experiment quickly. Option A is correct because resources can be deployed in minutes. Option C is correct because the cloud enables rapid experimentation and iteration without large upfront investments. Options B, D, and E describe other AWS benefits (region expansion, capacity management, and affordability) but not agility specifically.
Not this one. Try another answer.
Why B is wrong
AWS Region creation is an AWS responsibility, not a measure of customer agility.
Right, C is one of the answers.
Why C is right
Agility in AWS Cloud computing refers to the speed of implementation and the ability to experiment quickly. Option A is correct because resources can be deployed in minutes. Option C is correct because the cloud enables rapid experimentation and iteration without large upfront investments. Options B, D, and E describe other AWS benefits (region expansion, capacity management, and affordability) but not agility specifically.
Not this one. Try another answer.
Why D is wrong
Elimination of wasted capacity relates to efficiency and cost optimization, not agility.
Not this one. Try another answer.
Why E is wrong
Low cost of entry describes affordability or accessibility, not agility.
Question 38 Play from 1:04:07
Which AWS service or tool can the company use to meet these requirements?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Pricing Calculator is specifically designed for creating cost estimates for AWS use cases before deployment. It allows companies to model their anticipated AWS usage, select services, configure parameters, and generate detailed cost projections.
Not this one. Try another answer.
Why B is wrong
Amazon CloudWatch is a monitoring and observability service for tracking metrics and logs of running resources, not for pre-deployment cost estimation.
Not this one. Try another answer.
Why C is wrong
AWS Cost Explorer is used to analyze historical and current spending of already-deployed resources, not to estimate costs for planned migrations.
Not this one. Try another answer.
Why D is wrong
AWS Budgets is used to set spending alerts and track against budgets for existing resource usage, not to create initial cost estimates.
Question 39 Play from 1:05:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CloudHSM is a hardware security module service for key management, not command-line access.
Right, B is the answer.
Why B is right
AWS CloudShell provides a web browser-based shell with AWS CLI and other tools pre- installed, allowing direct command-line access to AWS resources without needing to install or configure tools locally.
Not this one. Try another answer.
Why C is wrong
WorkSpaces provides desktop virtualization, not a command-line shell environment.
Not this one. Try another answer.
Why D is wrong
Cloud Map is a service registry for discovering AWS resources, not a command-line access tool.
Question 40 Play from 1:07:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon QuickSight is a business intelligence tool for data visualization and analytics, not for programmatic resource deployment.
Not this one. Try another answer.
Why B is wrong
AWS PrivateLink enables private connectivity between AWS services and on-premises networks, but doesn't provide programmatic resource deployment capabilities.
Not this one. Try another answer.
Why C is wrong
AWS Direct Connect establishes dedicated network connections to AWS, but is not the tool for programmatic resource deployment.
Right, D is the answer.
Why D is right
AWS SDKs (Software Development Kits) are libraries that enable developers to write code in various programming languages to connect with AWS services and deploy resources programmatically. They provide the primary means for programmatic interaction with AWS APIs.
Question 41 Play from 1:08:58
Which AWS service will meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon MQ is a message broker service for application messaging.
Right, B is the answer.
Why B is right
Amazon Polly is an AI service that converts text into natural-sounding speech (text-to- speech), making it ideal for accessibility applications. Amazon MQ is a message broker, Neptune is a graph database, and Timestream is for time-series data, none provide text- to-speech capabilities.
Not this one. Try another answer.
Why C is wrong
Amazon Neptune is a graph database service for data queries.
Not this one. Try another answer.
Why D is wrong
Amazon Timestream is a time-series database service for metrics and events.
Question 42 Play from 1:10:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VPC endpoints enable private connections to AWS services from within a VPC, not connections between VPCs.
Not this one. Try another answer.
Why B is wrong
Amazon Route 53 is a DNS service for domain management and does not provide network connectivity between VPCs.
Right, C is one of the answers.
Why C is right
C. VPC peering E. AWS Transit Gateway VPC peering creates a direct network connection between two VPCs, allowing resources in each VPC to communicate as if they were on the same network. AWS Transit Gateway provides a centralized hub for connecting multiple VPCs and on-premises networks, effectively enabling communication between VPCs. VPC endpoints allow private access to AWS services but connect within a single VPC, Route 53 is a DNS service without network connectivity functionality, and Direct Connect connects on-premises networks to AWS rather than VPCs to each other.
Not this one. Try another answer.
Why D is wrong
AWS Direct Connect connects on-premises corporate networks to AWS, not VPCs to each other.
Right, E is one of the answers.
Why E is right
C. VPC peering E. AWS Transit Gateway VPC peering creates a direct network connection between two VPCs, allowing resources in each VPC to communicate as if they were on the same network. AWS Transit Gateway provides a centralized hub for connecting multiple VPCs and on-premises networks, effectively enabling communication between VPCs. VPC endpoints allow private access to AWS services but connect within a single VPC, Route 53 is a DNS service without network connectivity functionality, and Direct Connect connects on-premises networks to AWS rather than VPCs to each other.
Question 43 Play from 1:12:32
Which AWS service will meet these requirements?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Global Accelerator improves application performance by routing user traffic through AWS's optimized global network infrastructure, reducing latency and improving availability for geographically distributed users accessing applications behind load balancers.
Not this one. Try another answer.
Why B is wrong
Amazon Connect is a cloud-based contact center service for customer communications
Not this one. Try another answer.
Why C is wrong
Amazon ElastiCache caches data to reduce database load but doesn't improve ALB application performance
Not this one. Try another answer.
Why D is wrong
Amazon CloudWatch monitors applications but does not improve performance
Question 44 Play from 1:14:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
On-premises deployments do not use AWS services or Outposts.
Not this one. Try another answer.
Why B is wrong
Serverless is a computing model, not a deployment model that specifically incorporates Outposts.
Not this one. Try another answer.
Why C is wrong
Cloud-native typically refers to applications designed for cloud environments, not hybrid infrastructures with Outposts.
Right, D is the answer.
Why D is right
Hybrid cloud deployment model uses AWS Outposts as part of the infrastructure. AWS Outposts brings AWS services and infrastructure to on-premises environments, creating a true hybrid deployment where applications and data can reside both in AWS and on- premises. This is distinct from pure on-premises, serverless, or cloud-native deployments.
Question 45 Play from 1:15:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon API Gateway is a service for managing APIs, not a VPC component.
Not this one. Try another answer.
Why B is wrong
S3 buckets and objects are regional services; while they can be accessed from a VPC, they are not components of it.
Not this one. Try another answer.
Why C is wrong
AWS Storage Gateway is a hybrid storage appliance service, not a VPC component.
Right, D is one of the answers.
Why D is right
An Internet Gateway enables communication between resources in a VPC and the internet, and a Subnet is a logical subdivision of a VPC that groups resources. These are both core VPC components. API Gateway is a service for API management not a VPC component. S3 buckets are regional services outside the VPC. AWS Storage Gateway is a hybrid storage service, not a VPC component.
Right, E is one of the answers.
Why E is right
An Internet Gateway enables communication between resources in a VPC and the internet, and a Subnet is a logical subdivision of a VPC that groups resources. These are both core VPC components. API Gateway is a service for API management not a VPC component. S3 buckets are regional services outside the VPC. AWS Storage Gateway is a hybrid storage service, not a VPC component.
Question 46 Play from 1:17:22
Which AWS Storage Gateway type should the company use to meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tape Gateway presents a virtual tape library for backups, not NFS file shares.
Not this one. Try another answer.
Why B is wrong
Volume Gateway presents iSCSI block volumes, not NFS file shares.
Not this one. Try another answer.
Why C is wrong
FSx File Gateway provides SMB access to Amazon FSx for Windows File Server and does not support NFS.
Right, D is the answer.
Why D is right
Amazon S3 File Gateway presents NFS and SMB file shares on premises and stores the files as objects in Amazon S3. That makes it the Storage Gateway type used to move NFS workloads to AWS.
Question 47 Play from 1:18:56
Which AWS service or tool will meet this requirement?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The AWS CLI (Command Line Interface) provides a unified, consistent method to interact with all AWS services from the command line. It offers a single tool that works across all AWS services with standardized syntax and commands.
Not this one. Try another answer.
Why B is wrong
Amazon ECS is a container orchestration service, not a unified tool for interacting with AWS services.
Not this one. Try another answer.
Why C is wrong
AWS Cloud9 is an IDE for development, not a unified tool for general AWS service interaction.
Not this one. Try another answer.
Why D is wrong
AWS VPN provides secure network connectivity, not a method to interact with AWS services.
Question 48 Play from 1:20:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
VPC Flow Logs is the AWS service specifically designed to capture information about inbound and outbound traffic in a VPC. It provides detailed network traffic logs that can be used for monitoring, troubleshooting, and security analysis.
Not this one. Try another answer.
Why B is wrong
Inspector is for vulnerability assessment of EC2 instances and applications, not network traffic capture
Not this one. Try another answer.
Why C is wrong
VPC endpoint services are for private connectivity to AWS services, not traffic monitoring
Not this one. Try another answer.
Why D is wrong
NAT gateway is for translating private IP addresses for outbound traffic, not capturing traffic information
Question 49 Play from 1:22:13
Which AWS service or feature will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lake Formation is for data lake setup and management, not for analyzing cross-account bucket sharing.
Not this one. Try another answer.
Why B is wrong
IAM credential reports show user credentials and access keys, not bucket sharing or cross-account access patterns.
Not this one. Try another answer.
Why C is wrong
CloudWatch monitors metrics and logs but does not analyze or report on cross-account resource access permissions.
Right, D is the answer.
Why D is right
IAM Access Analyzer is specifically designed to identify and analyze resource access, including cross-account access to resources like S3 buckets. It uses automated reasoning to validate IAM policies and can generate findings showing which external accounts have access to your resources, making it the ideal service for this requirement.
Question 50 Play from 1:24:00
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
AWS Cost Explorer and AWS Compute Optimizer are the primary AWS services for identifying EC2 rightsizing opportunities. Cost Explorer provides cost analysis and trending data that can reveal underutilized instances, while Compute Optimizer specifically analyzes EC2 instance metrics and provides rightsizing recommendations based on actual usage patterns. Together they enable organizations to optimize instance types and sizes for cost efficiency.
Not this one. Try another answer.
Why B is wrong
AWS Billing Conductor is used for setting up billing groups and custom pricing, not for identifying rightsizing opportunities.
Not this one. Try another answer.
Why C is wrong
Amazon CodeGuru analyzes code quality and application performance, not EC2 instance utilization patterns.
Not this one. Try another answer.
Why D is wrong
Amazon SageMaker is a machine learning service for building and training models, not for EC2 infrastructure optimization.
Right, E is one of the answers.
Why E is right
AWS Cost Explorer and AWS Compute Optimizer are the primary AWS services for identifying EC2 rightsizing opportunities. Cost Explorer provides cost analysis and trending data that can reveal underutilized instances, while Compute Optimizer specifically analyzes EC2 instance metrics and provides rightsizing recommendations based on actual usage patterns. Together they enable organizations to optimize instance types and sizes for cost efficiency.
Question 51 Play from 1:26:03
Which AWS tool or set of resources should the company use to analyze and assess its readiness for migration?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The AWS Cloud Adoption Framework (AWS CAF) is specifically designed to help organizations assess their readiness for cloud migration by evaluating people, processes, and technology across multiple perspectives. It provides a structured approach to understanding gaps and planning migration strategies. The other options serve different purposes: pricing calculator estimates costs, Well-Architected Framework guides architecture decisions, and Budgets tracks spending.
Not this one. Try another answer.
Why B is wrong
AWS Pricing Calculator is used to estimate cloud costs, not to assess migration readiness.
Not this one. Try another answer.
Why C is wrong
AWS Well-Architected Framework provides guidance on building secure, high-performing systems after migration, not for assessing initial readiness.
Not this one. Try another answer.
Why D is wrong
AWS Budgets is a cost management tool for tracking spending, not for assessing migration readiness.
Question 52 Play from 1:28:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Pricing Calculator is used for estimating costs, not for analyzing workload data and providing rightsizing recommendations.
Right, B is the answer.
Why B is right
AWS Compute Optimizer analyzes historical workload usage data and provides recommendations for right-sizing EC2 instances, helping to optimize performance and cost. It uses machine learning to identify underutilized or overutilized instances and suggests appropriate instance types. This directly addresses the requirement to get rightsized instances based on usage data.
Not this one. Try another answer.
Why C is wrong
AWS App Runner is a container application service, not a tool for EC2 instance optimization analysis.
Not this one. Try another answer.
Why D is wrong
AWS Systems Manager is for operational management and does not provide EC2 rightsizing recommendations.
Question 53 Play from 1:29:56
Which AWS service will meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon Polly is a text-to-speech service, not designed for generating product recommendations.
Right, B is the answer.
Why B is right
Amazon Personalize is an AWS machine learning service specifically designed to deliver personalized recommendations based on customer data and behavior. It analyzes historical customer interactions to generate product recommendations tailored to individual users. The other services serve different purposes: Polly converts text to speech, Comprehend performs natural language processing for text analysis, and Rekognition analyzes images and video.
Not this one. Try another answer.
Why C is wrong
Amazon Comprehend analyzes text sentiment and content, not customer purchasing patterns for recommendations.
Not this one. Try another answer.
Why D is wrong
Amazon Rekognition performs image and video analysis, not customer behavior analysis for recommendations.
Question 54 Play from 1:31:42
Which AWS service will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not for content delivery.
Right, B is the answer.
Why B is right
Amazon CloudFront is a content delivery network (CDN) designed specifically to deliver content with low latency to users worldwide. It caches content at edge locations globally and is the standard solution for providing fast, geographically distributed website access.
Not this one. Try another answer.
Why C is wrong
Amazon ElastiCache is an in-memory cache for application performance, not for global content delivery to end users.
Not this one. Try another answer.
Why D is wrong
Amazon DynamoDB is a database service, not a content delivery mechanism for websites.
Question 55 Play from 1:33:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Elasticity refers to the ability to scale resources up or down, not the speed of initial deployment.
Not this one. Try another answer.
Why B is wrong
Cost savings is a benefit but does not directly address the speed of resource deployment.
Right, C is the answer.
Why C is right
Agility is the AWS cloud benefit that enables companies to quickly deploy resources in minutes. It refers to the speed and ease of provisioning compute, storage, and database infrastructures without lengthy procurement or setup times.
Not this one. Try another answer.
Why D is wrong
Reliability refers to system uptime and availability, not deployment speed.
Question 56 Play from 1:34:48
Which AWS service will meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IAM groups are used to manage permissions within a single AWS account and cannot be used to grant access across accounts.
Right, B is the answer.
Why B is right
IAM roles are the appropriate mechanism for granting cross-account access. By creating a role in the target account with appropriate permissions and establishing a trust relationship with the source account, users in one account can assume that role to access resources in another account. This is the standard AWS pattern for multi-account access scenarios.
Not this one. Try another answer.
Why C is wrong
IAM tags are metadata labels used to organize and manage resources; they do not grant permissions or enable cross-account access.
Not this one. Try another answer.
Why D is wrong
IAM Access Analyzer is a tool for validating and monitoring resource policies and access configurations; it does not grant cross-account access itself.
Question 57 Play from 1:36:36
Which AWS service will meet this requirement?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Lambda is AWS's serverless compute service that automatically scales, requires no server provisioning, and charges only for code execution time. It is the primary AWS service for serverless computing requirements.
Not this one. Try another answer.
Why B is wrong
AWS CloudFormation is an infrastructure-as-code service for provisioning and managing AWS resources, not a compute service.
Not this one. Try another answer.
Why C is wrong
AWS Elastic Beanstalk is a managed platform-as-a-service that still requires infrastructure provisioning and management, not a serverless solution.
Not this one. Try another answer.
Why D is wrong
Elastic Load Balancing is a networking service for distributing traffic across instances and does not provide compute functionality.
Question 58 Play from 1:38:13
Which AWS Cloud computing benefit is the company seeking?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Easy to use refers to user interface simplicity, not the ability to handle unpredictable demand.
Not this one. Try another answer.
Why B is wrong
Cost-effectiveness alone doesn't address the challenge of unpredictable demand; scalability does.
Not this one. Try another answer.
Why C is wrong
Security is important but doesn't directly address the challenge of handling unknown usage patterns.
Right, D is the answer.
Why D is right
When a company cannot predict usage demand, they need the ability to scale resources up and down elastically to match actual demand, and maintain high performance regardless of load. This is the fundamental benefit of cloud scalability and high performance, the ability to automatically adjust capacity without predicting requirements in advance.
Question 59 Play from 1:39:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Observability is primarily an operational capability, not a security perspective capability.
Not this one. Try another answer.
Why B is wrong
Incident and problem management is part of the operations perspective, not the security perspective.
Right, C is one of the answers.
Why C is right
C. Incident response D. Infrastructure protection The AWS Cloud Adoption Framework security perspective includes capabilities focused on protecting infrastructure and responding to incidents. Incident response and infrastructure protection are core security perspective capabilities that address threat detection, remediation, and secure resource deployment. These align with the security pillar's focus on protecting data, systems, and assets.
Right, D is one of the answers.
Why D is right
C. Incident response D. Infrastructure protection The AWS Cloud Adoption Framework security perspective includes capabilities focused on protecting infrastructure and responding to incidents. Incident response and infrastructure protection are core security perspective capabilities that address threat detection, remediation, and secure resource deployment. These align with the security pillar's focus on protecting data, systems, and assets.
Not this one. Try another answer.
Why E is wrong
Availability and continuity are operational and business continuity concerns, not core security perspective capabilities.
Question 60 Play from 1:41:46
Which AWS service will store this data MOST cost-effectively?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Aurora is a relational database service designed for transactional workloads, not cost-effective for log storage and analysis.
Not this one. Try another answer.
Why B is wrong
EFS is a managed file system service with higher costs than S3 and is not optimized for log analytics.
Not this one. Try another answer.
Why C is wrong
EBS provides block storage volumes attached to EC2 instances and is far more expensive than S3 for log data storage.
Right, D is the answer.
Why D is right
Amazon S3 is the most cost-effective solution for storing and querying large volumes of server logs. S3 offers low storage costs, lifecycle policies for archiving, and integrates with query services like Amazon Athena for analytics without requiring database infrastructure. Aurora, EFS, and EBS are all more expensive options designed for different use cases (relational databases, file systems, and block storage respectively) and would be wasteful for log data that primarily needs to be stored and occasionally queried.
Question 61 Play from 1:43:47
Which AWS service should the company use to meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS WAF protects web applications from malicious traffic, not for auditing IAM access keys.
Not this one. Try another answer.
Why B is wrong
AWS Shield is a DDoS protection service, not for checking access key rotation.
Not this one. Try another answer.
Why C is wrong
Amazon Cognito manages user authentication and identity, not IAM access key audits.
Right, D is the answer.
Why D is right
AWS Trusted Advisor is a service that provides recommendations across multiple categories including security, and it specifically checks for IAM access keys that have not been rotated recently. AWS WAF protects against web attacks, AWS Shield provides DDoS protection, and Amazon Cognito handles user authentication, none of these check access key rotation.
Question 62 Play from 1:45:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS IAM manages users and permissions within individual accounts, not account creation or organization.
Not this one. Try another answer.
Why B is wrong
AWS Trusted Advisor provides best practice recommendations, not account management or policy application.
Not this one. Try another answer.
Why C is wrong
AWS CloudFormation is an infrastructure-as-code service for deploying resources, not for managing AWS accounts.
Right, D is the answer.
Why D is right
AWS Organizations is specifically designed to create and manage multiple AWS accounts, consolidate billing, apply policies across account groups, and organize workflows. It provides the account creation, grouping, and policy application capabilities described in the requirement.
Question 63 Play from 1:47:18
Which AWS service will meet this requirement?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS Trusted Advisor is the correct service for identifying misconfigured security groups. It performs security checks including detection of security groups allowing unrestricted access to specific ports. Trusted Advisor provides actionable recommendations to improve security posture across AWS accounts.
Not this one. Try another answer.
Why B is wrong
CloudWatch is for monitoring metrics and logs, not for security configuration assessments.
Not this one. Try another answer.
Why C is wrong
GuardDuty detects malicious activity and threats, not misconfigurations like overly permissive security groups.
Not this one. Try another answer.
Why D is wrong
AWS Health Dashboard shows service health status and events, not security configuration issues.
Question 64 Play from 1:49:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Scale is a later phase focused on expanding cloud adoption across the organization after successful launches.
Right, B is the answer.
Why B is right
The Envision phase of the AWS Cloud Adoption Framework focuses on demonstrating how cloud adoption will help accelerate business outcomes. It involves creating a vision for cloud transformation, identifying business benefits, and establishing initial business cases. This foundational phase comes before Align, Launch, and Scale phases.
Not this one. Try another answer.
Why C is wrong
Align is about getting stakeholder alignment and establishing governance, not demonstrating business outcomes.
Not this one. Try another answer.
Why D is wrong
Launch involves executing specific cloud migration and implementation projects, not demonstrating overall outcomes.
Question 65 Play from 1:50:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network ACLs operate at the subnet level, not the instance level, and are stateless.
Right, B is the answer.
Why B is right
A security group acts as a virtual firewall at the EC2 instance level, controlling inbound and outbound traffic to individual instances. Security groups are stateful and allow granular control over network access to specific instances, making them the appropriate choice for instance-level firewall functionality.
Not this one. Try another answer.
Why C is wrong
Route tables determine how network traffic is directed within a VPC; they do not provide firewall functionality.
Not this one. Try another answer.
Why D is wrong
NAT gateways enable instances in private subnets to initiate outbound traffic but do not function as a firewall.
Question 66 Play from 1:52:11
Which AWS service or feature will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS Transit Gateway is for connecting multiple networks but still uses public internet connectivity.
Not this one. Try another answer.
Why B is wrong
AWS VPN establishes connections over the public internet, which violates the requirement.
Not this one. Try another answer.
Why C is wrong
Amazon CloudFront is a content delivery network, not for dedicated on-premises connectivity.
Right, D is the answer.
Why D is right
AWS Direct Connect provides dedicated physical network connectivity between on- premises data centers and AWS without using the public internet. It offers consistent network performance and security. AWS VPN uses the internet, Transit Gateway coordinates multiple connections, and CloudFront is for content delivery.
Question 67 Play from 1:53:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Security awareness and training is a customer responsibility to educate their own staff.
Not this one. Try another answer.
Why B is wrong
IAM password policy development is the customer's responsibility to configure for their users.
Not this one. Try another answer.
Why C is wrong
Patching the guest operating system is the customer's responsibility; AWS only patches the host hypervisor.
Right, D is the answer.
Why D is right
Physical and environmental controls, such as data center security, power systems, cooling, and physical access, are entirely AWS's responsibility under the shared responsibility model. Customers have no control over these infrastructure elements.
Question 68 Play from 1:55:34
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The AWS CAF cloud transformation journey includes the Envision phase (identifying transformation opportunities), Align phase (identifying skills and organizational gaps), Assess phase (detailed discovery and planning), Mobilize phase (building the foundation), and Migrate and Modernize phase (executing migration). The Envision and Align phases are foundational stages for cloud transformation recommendations.
Right, B is one of the answers.
Why B is right
The AWS CAF cloud transformation journey includes the Envision phase (identifying transformation opportunities), Align phase (identifying skills and organizational gaps), Assess phase (detailed discovery and planning), Mobilize phase (building the foundation), and Migrate and Modernize phase (executing migration). The Envision and Align phases are foundational stages for cloud transformation recommendations.
Not this one. Try another answer.
Why C is wrong
Assess is a phase but not one of the two primary recommendations for the overall journey.
Not this one. Try another answer.
Why D is wrong
Mobilize is a phase but not one of the two primary recommendations for the overall journey.
Not this one. Try another answer.
Why E is wrong
Migrate and Modernize is an execution phase, not one of the two primary recommendations.
Question 69 Play from 1:57:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Security validation is not the primary function of Compute Optimizer; security assessment is handled by other services like Inspector.
Right, B is the answer.
Why B is right
AWS Compute Optimizer analyzes AWS resource utilization and provides recommendations to optimize instance types and sizes, which is the definition of rightsizing. It helps match compute resources to actual workload requirements to improve performance and reduce costs.
Not this one. Try another answer.
Why C is wrong
Elasticity refers to scaling resources up or down automatically, which is not Compute Optimizer's primary function.
Not this one. Try another answer.
Why D is wrong
Global reach describes AWS's infrastructure distribution, not a capability demonstrated by Compute Optimizer.
Question 70 Play from 1:58:51
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
A. Consumption-based pricing C. Economies of scale Consumption-based pricing means customers pay only for what they use without upfront capital expenditure, reducing costs. Economies of scale allow AWS to spread infrastructure costs across millions of customers, reducing per-unit costs that benefit individual customers. Perpetual licenses require upfront investment, AWS Enterprise Support has additional costs, and bring-your-own-hardware contradicts cloud benefits.
Not this one. Try another answer.
Why B is wrong
Perpetual licenses require large upfront capital investments, contrary to cloud economic benefits.
Right, C is one of the answers.
Why C is right
A. Consumption-based pricing C. Economies of scale Consumption-based pricing means customers pay only for what they use without upfront capital expenditure, reducing costs. Economies of scale allow AWS to spread infrastructure costs across millions of customers, reducing per-unit costs that benefit individual customers. Perpetual licenses require upfront investment, AWS Enterprise Support has additional costs, and bring-your-own-hardware contradicts cloud benefits.
Not this one. Try another answer.
Why D is wrong
AWS Enterprise Support is not included at no additional cost; it requires a separate paid subscription.
Not this one. Try another answer.
Why E is wrong
Bring-your-own-hardware is not a cloud benefit and contradicts the purpose of using cloud infrastructure.
Question 71 Play from 2:00:40
Which EC2 instance purchasing option will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reserved Instances require long-term commitments and upfront payments
Not this one. Try another answer.
Why B is wrong
Spot Instances are interruptible and can be terminated with short notice, violating the uninterruptible requirement
Right, C is the answer.
Why C is right
On-Demand Instances provide the required uninterruptible service with per-second billing. They offer flexibility without interruption risk or long-term commitments, making them suitable for applications needing guaranteed availability and predictable pricing.
Not this one. Try another answer.
Why D is wrong
Dedicated Instances are for compliance/licensing but don't address the billing-by-the-second requirement
Question 72 Play from 2:02:15
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The Governance perspective of AWS CAF includes Program and Project Management (for managing governance initiatives) and Risk Management (for identifying and mitigating governance-related risks). Both are core governance capabilities for ensuring compliance and organizational alignment.
Not this one. Try another answer.
Why B is wrong
Product Management belongs to the Business perspective, not Governance.
Not this one. Try another answer.
Why C is wrong
Portfolio Management belongs to the Business perspective, not Governance.
Right, D is one of the answers.
Why D is right
The Governance perspective of AWS CAF includes Program and Project Management (for managing governance initiatives) and Risk Management (for identifying and mitigating governance-related risks). Both are core governance capabilities for ensuring compliance and organizational alignment.
Not this one. Try another answer.
Why E is wrong
Event Management is not a standard AWS CAF capability; it is not part of the Governance perspective.
Question 73 Play from 2:03:45
Which AWS service can the company use to meet this requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon Personalize is a specialized service for building recommendation systems, not a general ML development platform.
Not this one. Try another answer.
Why B is wrong
Amazon Comprehend is a pre-built service for natural language processing tasks, not for building custom ML models.
Not this one. Try another answer.
Why C is wrong
Amazon Forecast is a specialized service for time series forecasting, not a general ML development platform.
Right, D is the answer.
Why D is right
Amazon SageMaker is a fully managed service that provides the complete toolset to build, train, and deploy machine learning models. It supports the entire ML workflow from data preparation through model deployment and monitoring. While Amazon Personalize, Comprehend, and Forecast are specialized ML services, they are pre-built for specific use cases rather than general-purpose ML development platforms.
Question 74 Play from 2:05:34
(Choose two.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
AWS Database Migration Service (AWS DMS) is used to migrate data from commercial relational databases to Amazon-managed open-source databases, while AWS Schema Conversion Tool converts the database schema from the source commercial database format to the target open-source database format. Together, these tools handle both schema conversion and data migration.
Not this one. Try another answer.
Why B is wrong
AWS SDKs are development tools, not specifically designed for database migration.
Right, C is one of the answers.
Why C is right
AWS Database Migration Service (AWS DMS) is used to migrate data from commercial relational databases to Amazon-managed open-source databases, while AWS Schema Conversion Tool converts the database schema from the source commercial database format to the target open-source database format. Together, these tools handle both schema conversion and data migration.
Not this one. Try another answer.
Why D is wrong
AWS Systems Manager is for operational management, not database migration.
Not this one. Try another answer.
Why E is wrong
Amazon EMR is for big data processing, not for migrating traditional relational databases.
Question 75 Play from 2:07:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
High availability is a technical capability of AWS services, not a financial benefit related to expense structure.
Not this one. Try another answer.
Why B is wrong
Economies of scale relate to AWS's efficiency in operating infrastructure, which may lower overall costs, but don't directly address the replacement of fixed with variable expenses.
Right, C is the answer.
Why C is right
Pay-as-you-go pricing is the AWS benefit that directly replaces upfront fixed capital expenses with variable operational expenses. Users pay only for the resources they consume without long-term commitments, allowing companies to avoid large capital expenditures and scale costs with actual usage.
Not this one. Try another answer.
Why D is wrong
Global reach is a geographic capability of AWS, not a pricing model or expense management benefit.
Question 76 Play from 2:09:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud fluency is not an official AWS CAF perspective.
Right, B is one of the answers.
Why B is right
The AWS Cloud Adoption Framework (AWS CAF) defines six perspectives: Business, People, Governance, Platform, Security, and Operations. Business and Security are two of these core perspectives used to align organizational strategy with cloud adoption initiatives.
Not this one. Try another answer.
Why C is wrong
Change acceleration is not one of the six AWS CAF perspectives.
Not this one. Try another answer.
Why D is wrong
Architecture is not a primary AWS CAF perspective; Platform is the infrastructure-focused perspective.
Right, E is one of the answers.
Why E is right
The AWS Cloud Adoption Framework (AWS CAF) defines six perspectives: Business, People, Governance, Platform, Security, and Operations. Business and Security are two of these core perspectives used to align organizational strategy with cloud adoption initiatives.
Question 77 Play from 2:10:41
Which pillar of the AWS Well-Architected Framework does this goal represent?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Performance efficiency addresses optimizing resource utilization, not improving processes and procedures.
Right, B is the answer.
Why B is right
Operational excellence is the pillar focused on continuously improving processes, procedures, and practices to deliver business value. It emphasizes monitoring, automation, and iterative improvement. Performance efficiency addresses optimization of resources, Reliability focuses on system stability and recovery, and Sustainability concerns environmental impact, none directly address continuous process improvement for business value.
Not this one. Try another answer.
Why C is wrong
Reliability focuses on system availability and fault tolerance, not process improvement.
Not this one. Try another answer.
Why D is wrong
Sustainability addresses minimizing environmental impact of cloud usage.
Question 78 Play from 2:12:22
Which AWS services will meet these requirements? (Choose two.)
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon Athena is a query service for analyzing data in S3 using SQL, not a PostgreSQL-compatible database.
Right, B is one of the answers.
Why B is right
Amazon RDS (B) supports PostgreSQL as a managed relational database engine, and Amazon Aurora (E) is a MySQL and PostgreSQL-compatible managed database built for high performance and availability. Both services provide fully managed PostgreSQL-compatible databases with automated backups, patching, and scaling capabilities.
Not this one. Try another answer.
Why C is wrong
Amazon EC2 is a compute service; while PostgreSQL can be installed on EC2, it is not a managed AWS database service.
Not this one. Try another answer.
Why D is wrong
Amazon DynamoDB is a NoSQL document database, not compatible with PostgreSQL.
Right, E is one of the answers.
Why E is right
Amazon RDS (B) supports PostgreSQL as a managed relational database engine, and Amazon Aurora (E) is a MySQL and PostgreSQL-compatible managed database built for high performance and availability. Both services provide fully managed PostgreSQL-compatible databases with automated backups, patching, and scaling capabilities.
Question 79 Play from 2:14:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS WAF is a web application firewall for protection against web exploits, not for failover.
Right, B is the answer.
Why B is right
AWS Global Accelerator provides fast failover capabilities for multi-Region and Multi-AZ architectures by directing traffic to optimal endpoints and enabling rapid failover between regions and availability zones, ensuring high availability for applications.
Not this one. Try another answer.
Why C is wrong
AWS Shield is a DDoS protection service, not specifically designed for multi-Region failover.
Not this one. Try another answer.
Why D is wrong
AWS Direct Connect is for dedicated network connections, not for providing failover capabilities across multiple regions.
Question 80 Play from 2:15:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon Transcribe converts speech to text, not for image organization.
Right, B is the answer.
Why B is right
Amazon Rekognition is AWS's machine learning service specifically designed to analyze images and videos. It can organize, characterize, search, and extract insights from large volumes of images, including object detection, facial recognition, and content moderation. This directly addresses the requirement to organize, characterize, and search large numbers of images.
Not this one. Try another answer.
Why C is wrong
Amazon Aurora is a relational database service, not for image analysis.
Not this one. Try another answer.
Why D is wrong
Amazon QuickSight is a business intelligence and visualization tool, not for image recognition.
Question 81 Play from 2:17:21
Who is responsible for the security of this data, according to the AWS shared responsibility model?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Under the AWS shared responsibility model, the company is responsible for security of data in transit and at rest for data transfer between on-premises and AWS. AWS manages the infrastructure security, but the customer must secure their data, encryption keys, access controls, and application-level security. The company must implement encryption, network security, and authentication mechanisms.
Not this one. Try another answer.
Why B is wrong
AWS is responsible for the security of the cloud infrastructure, not the data itself or how customers use it.
Not this one. Try another answer.
Why C is wrong
Firewall vendors are third-party tools; responsibility still lies with the company implementing and configuring them.
Not this one. Try another answer.
Why D is wrong
AWS Marketplace partners sell solutions but do not assume security responsibility for customer data transfers.
Question 82 Play from 2:19:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application Discovery Service helps discover applications and dependencies but does not provide centralized progress tracking.
Not this one. Try another answer.
Why B is wrong
Application Migration Service is used to perform the actual migration of servers, not to track overall migration progress.
Not this one. Try another answer.
Why C is wrong
Service Catalog is for provisioning and managing approved IT services, not for tracking migrations.
Right, D is the answer.
Why D is right
AWS Migration Hub provides a single location to track and manage the progress of application migrations across multiple AWS and on-premises environments. It aggregates migration data and provides dashboards and reports for visibility into migration status, making it the dedicated service for this purpose.
Question 83 Play from 2:20:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Security pillar addresses data protection, access control, and threat prevention, not automatic recovery.
Not this one. Try another answer.
Why B is wrong
Performance Efficiency pillar focuses on optimizing compute, memory, and network resources, not recovery mechanisms.
Not this one. Try another answer.
Why C is wrong
Operational Excellence pillar covers operational procedures and monitoring, not automatic recovery from interruptions.
Right, D is the answer.
Why D is right
The Reliability pillar of the AWS Well-Architected Framework explicitly focuses on a workload's ability to recover automatically from failures and continue functioning. It encompasses fault tolerance, automatic recovery mechanisms, and resilience to service interruptions. Security focuses on data protection; Performance Efficiency focuses on resource optimization; and Operational Excellence focuses on running workloads effectively.
Question 84 Play from 2:22:33
Which AWS service will meet the requirement?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon Inspector is for assessing security vulnerabilities in EC2 instances and applications, not for identifying sensitive data.
Right, B is the answer.
Why B is right
Amazon Macie is an AWS service specifically designed to discover, classify, and protect sensitive data in AWS. It uses machine learning and pattern matching to identify personally identifiable information (PII) and other sensitive data types, making it the appropriate choice for identifying sensitive data across large datasets.
Not this one. Try another answer.
Why C is wrong
AWS IAM manages access and permissions but does not identify sensitive data within stored information.
Not this one. Try another answer.
Why D is wrong
Amazon CloudWatch is for monitoring and logging application and infrastructure metrics, not for discovering sensitive data.
Question 85 Play from 2:24:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Agility refers to speed of deployment and innovation, not resource utilization efficiency.
Right, B is the answer.
Why B is right
Elasticity is the ability to scale resources up and down based on demand, which allows companies to provision only the capacity needed and eliminate underutilized resources. This dynamic scaling ensures CPU capacity is used efficiently without paying for unused resources, directly addressing underutilized CPU capacity.
Not this one. Try another answer.
Why C is wrong
Reliability ensures systems function correctly but does not address underutilized capacity.
Not this one. Try another answer.
Why D is wrong
Durability ensures data persistence but is unrelated to CPU capacity utilization.
Question 86 Play from 2:25:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
VPC Flow Logs is the AWS service that captures detailed information about network traffic flowing in and out of network interfaces in a VPC. It provides logs of IP traffic and is essential for troubleshooting connectivity issues and monitoring traffic patterns. Amazon Inspector is for security assessment, route tables define traffic routing, and CloudTrail logs AWS API calls.
Not this one. Try another answer.
Why B is wrong
Amazon Inspector is a vulnerability assessment service that identifies security issues, not for capturing network traffic.
Not this one. Try another answer.
Why C is wrong
VPC route tables define how traffic is routed between subnets and networks, not capture traffic information.
Not this one. Try another answer.
Why D is wrong
AWS CloudTrail logs API calls and account activities, not VPC network traffic itself.
Question 87 Play from 2:27:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon SNS is a messaging service for notifications but is not specifically designed to track AWS service issues.
Right, B is the answer.
Why B is right
AWS Health Dashboard is the primary service designed to provide RSS feeds and notifications about AWS service health, maintenance events, and issues affecting your resources. It allows companies to subscribe to updates about service status in their region.
Not this one. Try another answer.
Why C is wrong
AWS Config tracks resource configurations and compliance but does not provide RSS feeds for service status updates.
Not this one. Try another answer.
Why D is wrong
AWS CodeCommit is a version control service and has no role in tracking service health or issues.
Question 88 Play from 2:29:12
Which pillar of the AWS Well-Architected Framework is supported by these goals?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reliability focuses on system recovery and availability, not primarily on information protection and risk mitigation.
Right, B is the answer.
Why B is right
The Security pillar of the AWS Well-Architected Framework encompasses protecting cloud information, systems, and assets, performing risk assessments, implementing security controls, and establishing mitigation strategies to ensure confidentiality and integrity.
Not this one. Try another answer.
Why C is wrong
Operational excellence emphasizes efficient operations, monitoring, and management practices rather than security protection.
Not this one. Try another answer.
Why D is wrong
Performance efficiency focuses on compute, storage, and resource optimization, not security risk management.
Question 89 Play from 2:30:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An Internet Gateway enables internet access, not VPN connections; VPN connections require a VPN Gateway.
Right, B is the answer.
Why B is right
An Internet Gateway is a VPC component that enables communication between instances within a VPC and the internet. It provides a route for internet-routable traffic and serves as a target for internet-destined traffic in routing tables.
Not this one. Try another answer.
Why C is wrong
Internet Gateways do not impose bandwidth constraints; they simply enable connectivity.
Not this one. Try another answer.
Why D is wrong
Internet Gateways do not perform load balancing; that function is provided by Elastic Load Balancers.
Question 90 Play from 2:32:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AWS is responsible for maintaining the underlying hardware and hypervisor for EC2 instances.
Right, B is the answer.
Why B is right
Under the AWS shared responsibility model, customers are responsible for application data security, including data encryption, access controls, and protecting sensitive information. AWS handles the security of the infrastructure itself, while customers secure their data and applications running on AWS resources.
Not this one. Try another answer.
Why C is wrong
AWS is responsible for physical security of data centers as part of their infrastructure security.
Not this one. Try another answer.
Why D is wrong
AWS is responsible for maintaining VPC infrastructure components; customers configure and manage their VPC settings.
Question 91 Play from 2:34:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon EBS volumes persist by default and can be retained even after instance termination unless explicitly deleted.
Right, B is the answer.
Why B is right
Amazon EC2 instance store provides ephemeral block-level storage that is physically attached to the host computer and is deleted when the instance stops or terminates. EBS volumes persist by default even after instance termination, EFS is a persistent file system, and S3 is persistent object storage.
Not this one. Try another answer.
Why C is wrong
Amazon EFS is a persistent file system that persists independently of EC2 instance lifecycle.
Not this one. Try another answer.
Why D is wrong
Amazon S3 is persistent object storage that remains available indefinitely unless manually deleted.
Question 92 Play from 2:36:09
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Amazon S3 provides highly durable object storage with 11 nines of durability (99.999999999%), designed specifically for storing and retrieving large amounts of unstructured data reliably and securely at scale.
Not this one. Try another answer.
Why B is wrong
Amazon EFS is a file system service for shared file access, not object storage.
Not this one. Try another answer.
Why C is wrong
Amazon EBS provides block storage for EC2 instances, not object storage.
Not this one. Try another answer.
Why D is wrong
Amazon FSx is a managed file system service, not object storage.
Question 93 Play from 2:37:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon S3 charges for storage capacity, data transfer, and requests.
Right, B is the answer.
Why B is right
AWS Identity and Access Management (IAM) is always provided at no charge. There are no costs for creating users, groups, roles, or policies, making it a foundational service available to all AWS accounts.
Not this one. Try another answer.
Why C is wrong
Elastic Load Balancers incur hourly charges and data processing fees.
Not this one. Try another answer.
Why D is wrong
AWS WAF charges per web ACL and per rule evaluated.
Question 94 Play from 2:39:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Physical security of the underlying infrastructure is AWS's responsibility in the managed service model.
Not this one. Try another answer.
Why B is wrong
AWS is responsible for patching and maintaining the DynamoDB service as a fully managed database.
Right, C is the answer.
Why C is right
Under the AWS Shared Responsibility Model, customers are responsible for controlling access to DynamoDB tables through IAM policies, application-level controls, and access management. AWS is responsible for the physical security of the infrastructure, patching and maintaining the DynamoDB service itself, and managing encryption at rest. While encryption can be customer-managed with KMS, the fundamental responsibility for providing encryption is AWS's as part of the managed service.
Not this one. Try another answer.
Why D is wrong
Encryption at rest in DynamoDB is provided and maintained by AWS; customers may manage encryption keys but not the encryption service itself.
Question 95 Play from 2:41:07
Which AWS service will meet these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Amazon SageMaker is a machine learning service, not designed for creating visualization dashboards.
Not this one. Try another answer.
Why B is wrong
Amazon Rekognition analyzes images and videos for object detection, not for data visualization dashboards.
Right, C is the answer.
Why C is right
Amazon QuickSight is AWS's business analytics and visualization service designed to create interactive dashboards and gain insights from data. Amazon SageMaker is for machine learning, Amazon Rekognition is for image and video analysis, and Amazon Kinesis is for real-time data streaming, none are designed for interactive dashboard creation.
Not this one. Try another answer.
Why D is wrong
Amazon Kinesis is a real-time data streaming service, not designed for interactive dashboard creation.
Question 96 Play from 2:42:48
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS CloudTrail is the primary service for auditing and logging API activity across AWS accounts. It records all API calls made to AWS services, providing a complete history of account activity, user actions, and resource changes. This is essential for compliance, security monitoring, and troubleshooting. Inspector, WAF, and Config serve different purposes (vulnerability assessment, web protection, and configuration tracking respectively).
Not this one. Try another answer.
Why B is wrong
Amazon Inspector is used for vulnerability assessments of EC2 instances and applications, not API auditing.
Not this one. Try another answer.
Why C is wrong
AWS WAF protects web applications from common web exploits, not for auditing API activity.
Not this one. Try another answer.
Why D is wrong
AWS Config tracks configuration changes of AWS resources but does not audit API calls system-wide.
Question 97 Play from 2:44:38
Which AWS service or feature can meet this requirement?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. It allows you to create rules to filter and block malicious requests based on patterns and signatures. AWS Shield protects against DDoS attacks, Network ACLs filter traffic at the subnet level, and Security Groups filter at the instance level, but none of these provide SQL injection protection like WAF does.
Not this one. Try another answer.
Why B is wrong
AWS Shield protects against DDoS attacks, not SQL injection.
Not this one. Try another answer.
Why C is wrong
Network ACLs operate at Layer 4 and cannot inspect application-level attacks like SQL injection.
Not this one. Try another answer.
Why D is wrong
Security Groups control traffic based on IP and ports, not application-layer attack patterns.
Question 98 Play from 2:46:20
Which AWS Well-Architected Framework pillar represents these requirements?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reliability focuses on system availability and fault tolerance, not management overhead reduction.
Right, B is the answer.
Why B is right
Operational Excellence is the pillar focused on running workloads effectively, reducing management overhead, and improving processes through automation and best practices. This pillar emphasizes operational procedures, monitoring, and continuous improvement. Reliability ensures availability, Performance Efficiency optimizes resource utilization, and Cost Optimization minimizes spending, none of these directly address reducing management overhead and improving operational processes.
Not this one. Try another answer.
Why C is wrong
Performance Efficiency optimizes compute and resource utilization, not operational processes.
Not this one. Try another answer.
Why D is wrong
Cost Optimization focuses on minimizing spending, not improving management and operational processes.
Question 99 Play from 2:48:10
Which AWS service will meet these requirements?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Amazon Lightsail is specifically designed to provide pre-configured application stacks with templates for popular applications. It offers easy-to-use virtual private servers with pre- installed software stacks, making it ideal for users who want simplified cloud deployment without deep infrastructure knowledge. While EC2 can run workloads, it requires manual configuration and is not pre-configured.
Not this one. Try another answer.
Why B is wrong
Amazon Athena is a query service for analyzing data in S3, not for running application stacks.
Not this one. Try another answer.
Why C is wrong
AWS Outposts extends AWS infrastructure on-premises but doesn't provide pre-configured application stacks.
Not this one. Try another answer.
Why D is wrong
Amazon EC2 requires manual configuration and is not pre-configured for application stacks.
Question 100 Play from 2:49:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Security pillar focuses on protecting information and systems, not on making frequent changes.
Not this one. Try another answer.
Why B is wrong
The Cost Optimization pillar focuses on avoiding or eliminating unneeded costs.
Right, C is the answer.
Why C is right
The Operational Excellence pillar emphasizes the ability to frequently make small, incremental, and reversible changes to the cloud architecture. This allows for rapid iteration, quick recovery from failures, and continuous improvement. Security focuses on protecting systems, Cost Optimization on reducing expenses, and Performance Efficiency on resource utilization, none of which specifically emphasize frequent, small, reversible changes.
Not this one. Try another answer.
Why D is wrong
The Performance Efficiency pillar focuses on using computing resources efficiently, not on making frequent reversible changes.
Transcript
Play from 00:00 Question 1. A company wants to run a simulation for 3 years without interruptions. Which Amazon EC2 instance purchasing option will meet these requirements MOST cost-effectively? Here are the options. Option A. Spot Instances. Option B. Reserved Instances. Option C. Dedicated Hosts. Option D. On-Demand Instances. Pause the video now if you want time to think about the answer.
The correct answer is B. Reserved Instances. Reserved Instances provide the most cost-effective option for a 3-year commitment with continuous runtime. They offer substantial discounts (up to 72%) compared to On-Demand pricing when committing to a specific term. For a predictable 3-year workload, Reserved Instances are designed specifically for this scenario. Now, why are the other options incorrect? Option A is incorrect. Spot Instances are unsuitable for continuous 3-year operations as they can be interrupted with short notice. Option C is incorrect. Dedicated Hosts are for licensing requirements and specific compliance needs, not general cost optimization. Option D is incorrect. On-Demand Instances are the most expensive option for long-term, continuous workloads. Therefore, B, Reserved Instances, is the correct answer.
Play from 01:40 Question 2. Which AWS service gives users the ability to deploy highly repeatable infrastructure configurations? Here are the options. Option A. AWS CloudFormation. Option B. AWS CodeDeploy. Option C. AWS CodeBuild. Option D. AWS Systems Manager. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS CloudFormation. AWS CloudFormation is the service that enables users to define and deploy infrastructure using code templates (Infrastructure as Code). CloudFormation allows highly repeatable, consistent infrastructure deployments by codifying resource configurations in JSON or YAML templates that can be version-controlled and reused. Now, why are the other options incorrect? Option B is incorrect. AWS CodeDeploy is a deployment service focused on automating application deployments to instances, not defining infrastructure configurations. Option C is incorrect. AWS CodeBuild is a build service that compiles source code and runs tests, not for deploying infrastructure configurations. Option D is incorrect. AWS Systems Manager provides operational tools for managing resources, but is not the primary service for deploying repeatable infrastructure configurations. Therefore, A, AWS CloudFormation, is the correct answer.
Play from 03:29 Question 3. Which AWS service will help a company plan a migration to AWS by collecting the configuration, usage, and behavior data of on-premises data centers? Here are the options. Option A. AWS Resource Groups. Option B. AWS Application Discovery Service. Option C. AWS Service Catalog. Option D. AWS Systems Manager. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Application Discovery Service. AWS Application Discovery Service collects configuration, usage, and behavior data from on-premises data centers to help plan and execute migrations to AWS. Resource Groups manages AWS resources by tags, Service Catalog provides curated product portfolios, and Systems Manager handles operational tasks, none of which specifically target discovery for migration planning. Now, why are the other options incorrect? Option A is incorrect. AWS Resource Groups organizes and manages AWS resources based on tags, not for discovery of on-premises infrastructure. Option C is incorrect. AWS Service Catalog provides curated IT service offerings, not discovery of on-premises data center configurations. Option D is incorrect. AWS Systems Manager handles operational management tasks across resources, not discovery for migration planning. Therefore, B, AWS Application Discovery Service, is the correct answer.
Show full transcriptShow less
Play from 05:24 Question 4. Which AWS service or tool provides users with a graphical interface that they can use to manage AWS services? Here are the options. Option A. AWS Copilot. Option B. AWS CLI. Option C. AWS Management Console. Option D. AWS software development kits (SDKs). Pause the video now if you want time to think about the answer.
The correct answer is C. AWS Management Console. The AWS Management Console is the web-based graphical user interface that allows users to manage and interact with AWS services. It provides a visual dashboard for accessing and configuring AWS resources without requiring command-line knowledge. Now, why are the other options incorrect? Option A is incorrect. AWS Copilot is a command-line tool for containerized applications, not a graphical interface for general AWS service management. Option B is incorrect. AWS CLI is a command-line interface, not a graphical interface. Option D is incorrect. AWS SDKs are programming libraries for developers to build applications, not a graphical management interface. Therefore, C, AWS Management Console, is the correct answer.
Play from 07:03 Question 5. Which AWS service or tool will monitor AWS resources and applications in real time? Here are the options. Option A. AWS Trusted Advisor. Option B. Amazon CloudWatch. Option C. AWS CloudTrail. Option D. AWS Cost Explorer. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon CloudWatch. Amazon CloudWatch is the AWS service that monitors AWS resources and applications in real time. It collects and tracks metrics, logs, and events from AWS services and applications, providing real-time visibility into resource performance and health. Now, why are the other options incorrect? Option A is incorrect. AWS Trusted Advisor provides recommendations for cost optimization, security, and performance based on best practices, not real-time monitoring. Option C is incorrect. AWS CloudTrail logs API calls and account activity for compliance and auditing purposes, not for real-time resource monitoring. Option D is incorrect. AWS Cost Explorer analyzes and visualizes historical and forecasted AWS spending patterns, not real-time resource monitoring. Therefore, B, Amazon CloudWatch, is the correct answer.
Play from 08:44 Question 6. A company wants to set up a secure network connection from on premises to the AWS Cloud within 1 week. Which solution will meet these requirements? Here are the options. Option A. AWS Direct Connect. Option B. Amazon VPC. Option C. AWS Site-to-Site VPN. Option D. Edge location. Pause the video now if you want time to think about the answer.
The correct answer is C. AWS Site-to-Site VPN. AWS Site-to-Site VPN can be set up quickly, typically within days or hours, providing an encrypted network connection between on-premises infrastructure and AWS. It requires minimal setup compared to AWS Direct Connect, which involves physical infrastructure provisioning and can take weeks to months to implement, making Site-to-Site VPN the correct choice for a 1-week timeline. Now, why are the other options incorrect? Option A is incorrect. AWS Direct Connect requires physical provisioning and coordination with telecommunications providers, taking 4-8 weeks to establish. Option B is incorrect. Amazon VPC is a foundational networking service but is not a connectivity solution from on-premises to AWS. Option D is incorrect. Edge locations are CloudFront content delivery nodes and are not relevant to establishing on-premises-to-AWS connectivity. Therefore, C, AWS Site-to-Site VPN, is the correct answer.
Play from 10:34 Question 7. A development team wants to deploy multiple test environments for an application in a fast, repeatable manner. Which AWS service should the team use? Here are the options. Option A. Amazon EC2. Option B. AWS CloudFormation. Option C. Amazon QuickSight. Option D. Amazon Elastic Container Service (Amazon ECS). Pause the video now if you want time to think about the answer.
The correct answer is B. AWS CloudFormation. AWS CloudFormation is the correct service for deploying multiple test environments in a fast, repeatable manner. It allows teams to define infrastructure as code using templates, enabling consistent and automated deployment of entire application stacks across multiple environments. While EC2 can be used to create instances, it requires manual configuration. ECS is for container orchestration, and QuickSight is for business analytics. Now, why are the other options incorrect? Option A is incorrect. EC2 requires manual configuration of each instance and does not provide template-based repeatable deployments. Option C is incorrect. Amazon QuickSight is a business intelligence and data visualization service, not for environment deployment. Option D is incorrect. Amazon ECS is for container orchestration, not for defining and deploying entire infrastructure environments. Therefore, B, AWS CloudFormation, is the correct answer.
Play from 12:27 Question 8. A company needs to migrate a PostgreSQL database from on-premises to Amazon RDS. Which AWS service or tool should the company use to meet this requirement? Here are the options. Option A. Cloud Adoption Readiness Tool. Option B. AWS Migration Hub. Option C. AWS Database Migration Service (AWS DMS). Option D. AWS Application Migration Service. Pause the video now if you want time to think about the answer.
The correct answer is C. AWS Database Migration Service (AWS DMS). AWS Database Migration Service (AWS DMS) is specifically designed for migrating databases from on-premises or other cloud sources to AWS. It supports PostgreSQL and provides schema conversion, continuous data replication, and minimal downtime migration capabilities, making it the ideal tool for this PostgreSQL to RDS migration. Now, why are the other options incorrect? Option A is incorrect. Cloud Adoption Readiness Tool assesses organizational cloud readiness but does not perform database migrations. Option B is incorrect. AWS Migration Hub is a central location to track migration progress but is not the tool that performs the actual database migration. Option D is incorrect. AWS Application Migration Service is designed for migrating applications, not specifically for database migrations from on-premises. Therefore, C, AWS Database Migration Service (AWS DMS), is the correct answer.
Play from 14:29 Question 9. A company wants to maintain bandwidth throughput and provide a more consistent network experience than public internet-based connections. Which AWS service should the company choose? Here are the options. Option A. AWS VPN. Option B. AWS Direct Connect. Option C. Amazon Connect. Option D. Amazon CloudFront. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Direct Connect. AWS Direct Connect provides a dedicated network connection from your premises to AWS, delivering consistent network performance, lower bandwidth costs, and higher reliability compared to internet-based connections. It maintains consistent throughput and provides a more stable network experience than public internet, which is subject to variable latency and congestion. Now, why are the other options incorrect? Option A is incorrect. AWS VPN uses the public internet and does not provide the consistent bandwidth throughput and dedicated connection that Direct Connect offers. Option C is incorrect. Amazon Connect is a cloud-based contact center service, not a network connectivity solution. Option D is incorrect. Amazon CloudFront is a content delivery network for caching and distributing content, not for maintaining bandwidth throughput to AWS. Therefore, B, AWS Direct Connect, is the correct answer.
Play from 16:14 Question 10. Which AWS service or feature gives users the ability to provision AWS infrastructure programmatically? Here are the options. Option A. AWS Cloud Development Kit (AWS CDK). Option B. Amazon CodeGuru. Option C. AWS Config. Option D. AWS CodeCommit. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Cloud Development Kit (AWS CDK). AWS Cloud Development Kit (CDK) allows users to define and provision AWS infrastructure programmatically using familiar programming languages. It abstracts CloudFormation templates and enables code-based infrastructure definition, which is the definition of Infrastructure as Code. Now, why are the other options incorrect? Option B is incorrect. Amazon CodeGuru is a code review and profiling service for application quality improvement, not infrastructure provisioning. Option C is incorrect. AWS Config is a service for compliance monitoring and configuration tracking, not infrastructure provisioning. Option D is incorrect. AWS CodeCommit is a source code repository service, not an infrastructure provisioning tool. Therefore, A, AWS Cloud Development Kit (AWS CDK), is the correct answer.
Play from 17:54 Question 11. Which option is AWS responsible for under the AWS shared responsibility model? Here are the options. Option A. Network and firewall configuration. Option B. Client-side data encryption. Option C. Management of user permissions. Option D. Hardware and infrastructure. Pause the video now if you want time to think about the answer.
The correct answer is D. Hardware and infrastructure. Under the AWS shared responsibility model, AWS is responsible for the security of the cloud itself, which includes the physical hardware, infrastructure, and the underlying systems that support AWS services. Customers are responsible for security in the cloud, including their network configuration, data encryption, and user permission management. Now, why are the other options incorrect? Option A is incorrect. Network and firewall configuration is the customer's responsibility for their resources and applications. Option B is incorrect. Client-side data encryption is the customer's responsibility to implement before data reaches AWS. Option C is incorrect. Management of user permissions and IAM policies is the customer's responsibility to configure and maintain. Therefore, D, Hardware and infrastructure, is the correct answer.
Play from 19:34 Question 12. A company wants to receive alerts to monitor its overall operating costs for its AWS public cloud infrastructure. Which AWS offering will meet these requirements? Here are the options. Option A. Amazon EventBridge. Option B. Compute Savings Plans. Option C. AWS Budgets. Option D. Migration Evaluator. Pause the video now if you want time to think about the answer.
The correct answer is C. AWS Budgets. AWS Budgets allows companies to set custom cost budgets and receive alerts when costs approach or exceed those thresholds. It provides proactive monitoring of overall operating costs and enables organizations to track spending against planned budgets. Now, why are the other options incorrect? Option A is incorrect. Amazon EventBridge is an event routing service for application integration, not a cost monitoring tool. Option B is incorrect. Compute Savings Plans provide discounted pricing for committed compute usage but don't provide monitoring or alerts for overall costs. Option D is incorrect. Migration Evaluator assesses on-premises costs and migration projections but isn't designed for ongoing cost monitoring and alerts. Therefore, C, AWS Budgets, is the correct answer.
Play from 21:13 Question 13. A company with multiple accounts and teams wants to set up a new multi-account AWS environment. Which AWS service supports this requirement? Here are the options. Option A. AWS CloudFormation. Option B. AWS Control Tower. Option C. AWS Config. Option D. Amazon Virtual Private Cloud (Amazon VPC). Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Control Tower. AWS Control Tower is specifically designed to set up and govern multi-account AWS environments. It automates account creation, applies preventive and detective guardrails, and provides centralized management, making it the ideal service for establishing a new multi-account structure. Now, why are the other options incorrect? Option A is incorrect. AWS CloudFormation is for infrastructure-as-code and resource provisioning, not multi-account governance setup. Option C is incorrect. AWS Config monitors and audits resource configurations but doesn't set up multi- account structures. Option D is incorrect. Amazon VPC is for network isolation and architecture, not multi-account environment setup and governance. Therefore, B, AWS Control Tower, is the correct answer.
Play from 22:54 Question 14. A company has an AWS account. The company wants to audit its password and access key rotation details for compliance purposes. Which AWS service or tool will meet this requirement? Here are the options. Option A. IAM Access Analyzer. Option B. AWS Artifact. Option C. IAM credential report. Option D. AWS Audit Manager. Pause the video now if you want time to think about the answer.
The correct answer is C. IAM credential report. The IAM credential report is a CSV file that contains details about password and access key rotation for all IAM users in an account. It specifically shows when credentials were created, last used, and when they last changed, making it the ideal tool for compliance auditing of credential rotation details. Now, why are the other options incorrect? Option A is incorrect. IAM Access Analyzer is used to identify external access and policies, not credential rotation tracking. Option B is incorrect. AWS Artifact provides compliance documentation and certifications, not specific credential rotation audit data. Option D is incorrect. AWS Audit Manager is for managing compliance audit frameworks and evidence collection, not specifically for credential rotation reporting. Therefore, C, IAM credential report, is the correct answer.
Play from 24:43 Question 15. Which AWS service or feature allows a company to have its own logically isolated section of the AWS Cloud? Here are the options. Option A. AWS VPN. Option B. Availability Zones. Option C. Amazon Virtual Private Cloud (Amazon VPC). Option D. AWS Regions. Pause the video now if you want time to think about the answer.
The correct answer is C. Amazon Virtual Private Cloud (Amazon VPC). Amazon Virtual Private Cloud (VPC) allows users to provision a logically isolated section of the AWS Cloud with complete network control. It enables custom IP ranges, subnets, and security controls within a private cloud environment. Now, why are the other options incorrect? Option A is incorrect. AWS VPN provides secure connectivity between on-premises and AWS but does not provision an isolated section of the cloud itself. Option B is incorrect. Availability Zones are physical locations within regions but do not represent logically isolated sections that users control. Option D is incorrect. AWS Regions are geographic areas containing multiple Availability Zones but do not provide logical isolation controlled by individual users. Therefore, C, Amazon Virtual Private Cloud (Amazon VPC), is the correct answer.
Play from 26:33 Question 16. A company wants to integrate its online shopping website with social media login credentials. Which AWS service can the company use to make this integration? Here are the options. Option A. AWS Directory Service. Option B. AWS Identity and Access Management (IAM). Option C. Amazon Cognito. Option D. AWS IAM Identity Center (AWS Single Sign-On). Pause the video now if you want time to think about the answer.
The correct answer is C. Amazon Cognito. Amazon Cognito is designed to enable user authentication and authorization, including integration with external identity providers such as social media platforms (Facebook, Google, Amazon, Apple). It allows companies to add sign-up, sign-in, and access control to web and mobile applications using social media credentials. Now, why are the other options incorrect? Option A is incorrect. AWS Directory Service manages Microsoft Active Directory, not social media integration. Option B is incorrect. AWS IAM manages AWS service access and is not designed for customer-facing social media authentication. Option D is incorrect. AWS IAM Identity Center (Single Sign-On) is for enterprise workforce identity management, not customer social media login integration. Therefore, C, Amazon Cognito, is the correct answer.
Play from 28:20 Question 17. Which option is an AWS Cloud Adoption Framework (AWS CAF) platform perspective capability? Here are the options. Option A. Data architecture. Option B. Data protection. Option C. Data governance. Option D. Data science. Pause the video now if you want time to think about the answer.
The correct answer is A. Data architecture. The AWS Cloud Adoption Framework includes six perspectives: Business, People, Governance, Platform, Security, and Operations. The Platform perspective encompasses technical capabilities including data architecture, which involves designing systems for data flow, storage, processing, and integration. Data architecture is a core platform capability. Now, why are the other options incorrect? Option B is incorrect. Data protection is a capability within the Security perspective, not the Platform perspective. Option C is incorrect. Data governance is a capability within the Governance perspective, not the Platform perspective. Option D is incorrect. Data science is not a standard AWS CAF capability; it may be part of organizational practices but is not a recognized CAF perspective capability. Therefore, A, Data architecture, is the correct answer.
Play from 29:58 Question 18. What are the benefits of consolidated billing for AWS Cloud services? (Choose two.) Here are the options. Option A. Volume discounts. Option B. A minimal additional fee for use. Option C. One bill for multiple accounts. Option D. Installment payment options. Option E. Custom cost and usage budget creation. Pause the video now if you want time to think about the answer.
The correct answers are A. Volume discounts, and C. One bill for multiple accounts. Consolidated billing provides two key benefits: it combines multiple AWS accounts under one bill (option C), and it qualifies the entire organization for volume discounts based on aggregate usage across all accounts (option A). These are the primary advantages that organizations gain by consolidating their AWS billing. Now, why are the other options incorrect? Option B is incorrect. Consolidated billing does not incur minimal additional fees; it is a free feature that can actually reduce costs. Option D is incorrect. Installment payment options are not a benefit of consolidated billing and are not directly related to it. Option E is incorrect. Custom cost and usage budget creation is a feature of AWS Budgets, not specifically a benefit of consolidated billing. Therefore, A and C are the correct answers.
Play from 31:40 Question 19. A company is planning to migrate to the AWS Cloud. The company wants to identify measurable business outcomes that will explain the value of the company's decision to migrate. Which phase of the cloud transformation journey includes these activities? Here are the options. Option A. Envision. Option B. Align. Option C. Scale. Option D. Launch. Pause the video now if you want time to think about the answer.
The correct answer is A. Envision. The Envision phase of the cloud transformation journey focuses on identifying business outcomes, defining the vision for cloud migration, and establishing measurable goals. This foundational phase establishes the strategic value and business case for cloud adoption before proceeding with alignment and execution. Now, why are the other options incorrect? Option B is incorrect. Align focuses on preparing people, processes, and technology for migration execution. Option C is incorrect. Scale involves expanding successful implementations across the organization. Option D is incorrect. Launch is the execution phase where actual migration workloads begin. Therefore, A, Envision, is the correct answer.
Play from 33:12 Question 20. A user needs to quickly deploy a nonrelational database on AWS. The user does not want to manage the underlying hardware or the database software. Which AWS service can be used to accomplish this? Here are the options. Option A. Amazon RDS. Option B. Amazon DynamoDB. Option C. Amazon Aurora. Option D. Amazon Redshift. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon DynamoDB. Amazon DynamoDB is a fully managed, serverless nonrelational database service that requires no infrastructure or database software management. Users define tables and DynamoDB handles all underlying operations, scaling, and availability. Amazon RDS is relational, Aurora is relational, and Redshift is for data warehousing, none of these meet the nonrelational requirement. Now, why are the other options incorrect? Option A is incorrect. Amazon RDS is a relational database service, not a nonrelational database. Option C is incorrect. Amazon Aurora is a relational database engine, not a nonrelational database. Option D is incorrect. Amazon Redshift is a data warehouse service optimized for analytics, not a general- purpose nonrelational database. Therefore, B, Amazon DynamoDB, is the correct answer.
Play from 34:56 Question 21. Which cloud concept is demonstrated by using AWS Cost Explorer? Here are the options. Option A. Rightsizing. Option B. Reliability. Option C. Resilience. Option D. Modernization. Pause the video now if you want time to think about the answer.
The correct answer is A. Rightsizing. AWS Cost Explorer is a tool that analyzes spending patterns and identifies opportunities to optimize costs, which directly demonstrates the concept of rightsizing, adjusting resource sizes and types to match actual usage patterns and reduce unnecessary spending. Now, why are the other options incorrect? Option B is incorrect. Reliability refers to the ability of a system to function correctly and recover from failures, which Cost Explorer doesn't directly demonstrate. Option C is incorrect. Resilience is about a system's ability to withstand and recover from disruptions, not a cost optimization concept that Cost Explorer illustrates. Option D is incorrect. Modernization involves updating applications and infrastructure to newer technologies; while Cost Explorer can support modernization decisions, it primarily demonstrates rightsizing. Therefore, A, Rightsizing, is the correct answer.
Play from 36:34 Question 22. A user wants to invoke an AWS Lambda function when an Amazon EC2 instance enters the “stopping” state. Which AWS service is appropriate for this use case? Here are the options. Option A. Amazon EventBridge. Option B. AWS Config. Option C. Amazon Simple Notification Service (Amazon SNS). Option D. AWS CloudFormation. Pause the video now if you want time to think about the answer.
The correct answer is A. Amazon EventBridge. Amazon EventBridge is designed to route events from AWS services to target services like Lambda functions. It can detect when EC2 instances enter specific states (such as 'stopping') and automatically invoke Lambda functions in response. AWS Config tracks configuration changes; SNS sends notifications but isn't the primary service for state- based triggering; CloudFormation provisions infrastructure. Now, why are the other options incorrect? Option B is incorrect. AWS Config monitors configuration compliance and changes, not state transitions that trigger Lambda. Option C is incorrect. SNS sends notifications but is not the primary service for detecting EC2 state changes and invoking Lambda. Option D is incorrect. CloudFormation is for infrastructure provisioning and management, not event routing. Therefore, A, Amazon EventBridge, is the correct answer.
Play from 38:23 Question 23. Which AWS services or features form the AWS Cloud global infrastructure? (Choose two.) Here are the options. Option A. Availability Zones. Option B. Amazon ElastiCache. Option C. AWS Regions. Option D. Amazon S3. Option E. Amazon VPC. Pause the video now if you want time to think about the answer.
The correct answers are A. Availability Zones, and C. AWS Regions. AWS Regions and Availability Zones are the foundational components of AWS's global infrastructure. Regions are geographic areas containing multiple Availability Zones for redundancy and latency optimization. ElastiCache, S3, and VPC are services or resources that run within this infrastructure but are not components of it. Now, why are the other options incorrect? Option B is incorrect. Amazon ElastiCache is a caching service that runs within the infrastructure, not part of it. Option D is incorrect. Amazon S3 is a storage service that utilizes the infrastructure but is not a component of it. Option E is incorrect. Amazon VPC is a networking service that runs within the infrastructure, not a foundational component. Therefore, A and C are the correct answers.
Play from 40:03 Question 24. A company wants the ability to automatically acquire resources as needed and release the resources when they are no longer needed. Which cloud concept describes this functionality? Here are the options. Option A. Availability. Option B. Elasticity. Option C. Durability. Option D. Reliability. Pause the video now if you want time to think about the answer.
The correct answer is B. Elasticity. Elasticity describes the ability of cloud infrastructure to automatically scale resources up or down based on demand, acquiring resources when needed and releasing them when no longer required. This is a core characteristic of cloud computing. Now, why are the other options incorrect? Option A is incorrect. Availability refers to the uptime and accessibility of services, not the automatic scaling of resources. Option C is incorrect. Durability refers to the long-term protection and preservation of data, not resource scaling. Option D is incorrect. Reliability refers to the consistent performance and fault tolerance of systems, not automatic resource acquisition and release. Therefore, B, Elasticity, is the correct answer.
Play from 41:39 Question 25. Which option is a shared control between AWS and the customer, according to the AWS shared responsibility model? Here are the options. Option A. Configuration management. Option B. Physical and environmental controls. Option C. Data integrity authentication. Option D. Identity and access management. Pause the video now if you want time to think about the answer.
The correct answer is A. Configuration management. The AWS shared responsibility model lists patch management, configuration management, and awareness and training as shared controls. AWS configures its infrastructure devices, while customers configure their own guest operating systems, databases and applications. Now, why are the other options incorrect? Option B is incorrect. Physical and environmental controls are inherited controls that AWS handles entirely. Option C is incorrect. Data integrity authentication is a customer-specific control. Option D is incorrect. Identity and access management is not one of the shared controls listed in the model; customers manage their own users and permissions. Therefore, A, Configuration management, is the correct answer.
Play from 43:14 Question 26. Which AWS services or features provide high availability and low latency by enabling failover across different AWS Regions? (Choose two.) Here are the options. Option A. Amazon Route 53. Option B. Network Load Balancer. Option C. Amazon S3 Transfer Acceleration. Option D. AWS Global Accelerator. Option E. Application Load Balancer. Pause the video now if you want time to think about the answer.
The correct answers are A. Amazon Route 53, and D. AWS Global Accelerator. Amazon Route 53 is a DNS service that enables failover across different AWS Regions by routing traffic to healthy endpoints. AWS Global Accelerator uses Anycast IP addresses and edge locations to direct traffic to the nearest optimal endpoint across Regions, providing both high availability and low latency. Both services explicitly support cross-Region failover and latency-based routing. Now, why are the other options incorrect? Option B is incorrect. Network Load Balancer distributes traffic within a Region or across availability zones but does not provide cross-Region failover. Option C is incorrect. Amazon S3 Transfer Acceleration optimizes data transfer speed to S3 but does not provide high availability failover across Regions. Option E is incorrect. Application Load Balancer operates at Layer 7 for application-level routing within a Region or across zones but not across Regions for failover. Therefore, A and D are the correct answers.
Play from 45:08 Question 27. Which guideline is a well-architected design principle for building cloud applications? Here are the options. Option A. Keep static data closer to compute resources. Option B. Provision resources for peak capacity. Option C. Design for automated recovery from failure. Option D. Use tightly coupled components. Pause the video now if you want time to think about the answer.
The correct answer is C. Design for automated recovery from failure. Designing for automated recovery from failure is a core principle of the AWS Well- Architected Framework's Reliability pillar. This principle emphasizes building systems that can automatically detect and recover from failures without manual intervention. Keeping data closer to compute is not a standard principle, provisioning for peak capacity is wasteful and contradicts elasticity, and tightly coupled components violate design best practices. Now, why are the other options incorrect? Option A is incorrect. This is not a well-architected principle; moving data closer to compute adds complexity without clear benefit. Option B is incorrect. Provisioning for peak capacity is inefficient; cloud design should use auto-scaling instead. Option D is incorrect. Tightly coupled components violate the principle of loose coupling that enables scalability and resilience. Therefore, C, Design for automated recovery from failure, is the correct answer.
Play from 46:52 Question 28. Which maintenance task is the customer’s responsibility, according to the AWS shared responsibility model? Here are the options. Option A. Physical connectivity among Availability Zones. Option B. Network switch maintenance. Option C. Hardware updates and firmware patches. Option D. Amazon EC2 updates and security patches. Pause the video now if you want time to think about the answer.
The correct answer is D. Amazon EC2 updates and security patches. Under the AWS shared responsibility model, customers are responsible for security and maintenance of the guest operating system, applications, and data on EC2 instances, including applying security patches and updates to the EC2 instances themselves. AWS manages the physical infrastructure, networking, and hypervisor layer. Now, why are the other options incorrect? Option A is incorrect. Physical connectivity among Availability Zones is AWS's responsibility as part of infrastructure management. Option B is incorrect. Network switch maintenance is AWS's responsibility as part of infrastructure management. Option C is incorrect. Hardware updates and firmware patches to the underlying physical infrastructure are AWS's responsibility. Therefore, D, Amazon EC2 updates and security patches, is the correct answer.
Play from 48:33 Question 29. A user wants to allow applications running on an Amazon EC2 instance to make calls to other AWS services. The access granted must be secure. Which AWS service or feature should be used? Here are the options. Option A. Security groups. Option B. AWS Firewall Manager. Option C. IAM roles. Option D. IAM user SSH keys. Pause the video now if you want time to think about the answer.
The correct answer is C. IAM roles. IAM roles are the secure mechanism for granting EC2 instances permissions to call other AWS services. Roles use temporary security credentials that are automatically rotated and do not require hardcoded credentials in application code. Security groups (A) control network traffic, not API permissions. AWS Firewall Manager (B) manages firewall rules. IAM user SSH keys (D) are for authentication to instances, not for service-to-service authorization. Now, why are the other options incorrect? Option A is incorrect. Security groups control network access at the instance level, not API permissions for calling other AWS services. Option B is incorrect. AWS Firewall Manager is for managing firewall policies across accounts, not for granting EC2 service permissions. Option D is incorrect. SSH keys are for authenticating to EC2 instances, not for authorizing API calls to other AWS services. Therefore, C, IAM roles, is the correct answer.
Play from 50:33 Question 30. A company wants to save costs by archiving data that is no longer frequently accessed by end users. Which Amazon S3 feature will meet this requirement? Here are the options. Option A. S3 Versioning. Option B. S3 Lifecycle. Option C. S3 Object Lock. Option D. S3 Inventory. Pause the video now if you want time to think about the answer.
The correct answer is B. S3 Lifecycle. S3 Lifecycle policies automatically transition objects between storage classes based on age and access patterns. This allows companies to move infrequently accessed data to cheaper storage tiers like S3 Glacier or S3 Deep Archive, directly addressing the cost- saving requirement for archiving older data. Now, why are the other options incorrect? Option A is incorrect. S3 Versioning maintains multiple versions of objects but does not archive or reduce costs for infrequently accessed data. Option C is incorrect. S3 Object Lock prevents object deletion and is designed for compliance, not for cost optimization through archiving. Option D is incorrect. S3 Inventory generates reports about objects but does not automatically archive or transition data between storage classes. Therefore, B, S3 Lifecycle, is the correct answer.
Play from 52:19 Question 31. Which of the following is an AWS value proposition that describes a user’s ability to scale infrastructure based on demand? Here are the options. Option A. Speed of innovation. Option B. Resource elasticity. Option C. Decoupled architecture. Option D. Global deployment. Pause the video now if you want time to think about the answer.
The correct answer is B. Resource elasticity. Resource elasticity directly refers to the ability to automatically scale infrastructure up or down based on demand. This is a core AWS value proposition that allows customers to provision resources dynamically without over-provisioning or under-provisioning, optimizing both performance and cost. Now, why are the other options incorrect? Option A is incorrect. Speed of innovation describes rapid development cycles and access to new services, not scaling capabilities. Option C is incorrect. Decoupled architecture is about system design patterns, not the ability to scale based on demand. Option D is incorrect. Global deployment refers to geographic distribution of infrastructure, not to scaling responsiveness to demand. Therefore, B, Resource elasticity, is the correct answer.
Play from 53:55 Question 32. A company needs to perform data processing once a week that typically takes about 5 hours to complete. Which AWS service should the company use for this workload? Here are the options. Option A. AWS Lambda. Option B. Amazon EC2. Option C. AWS CodeDeploy. Option D. AWS Wavelength. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon EC2. Amazon EC2 is the most appropriate service for a periodic 5-hour data processing job. EC2 instances can be launched on-demand for the weekly job and terminated after completion, providing cost efficiency for long-running batch workloads. AWS Lambda has a 15-minute timeout limit, making it unsuitable for 5-hour jobs. CodeDeploy is for application deployment, and Wavelength is for edge computing. Now, why are the other options incorrect? Option A is incorrect. AWS Lambda has a maximum execution timeout of 15 minutes, far too short for a 5-hour data processing job. Option C is incorrect. AWS CodeDeploy is an application deployment service, not designed for data processing workloads. Option D is incorrect. AWS Wavelength is for edge computing in 5G networks, not for standard batch data processing. Therefore, B, Amazon EC2, is the correct answer.
Play from 55:41 Question 33. An independent software vendor wants to deliver and share its custom Amazon Machine Images (AMIs) to prospective customers. Which AWS service will meet these requirements? Here are the options. Option A. AWS Marketplace. Option B. AWS Data Exchange. Option C. Amazon EC2. Option D. AWS Organizations. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Marketplace. AWS Marketplace is the service that allows vendors to share and sell custom AMIs to prospective customers. It provides a platform for independent software vendors to package and distribute their solutions as AMIs with integrated billing and licensing. Now, why are the other options incorrect? Option B is incorrect. AWS Data Exchange is for sharing data products, not for distributing custom AMIs. Option C is incorrect. Amazon EC2 is the compute service itself but is not a platform for sharing AMIs to external customers. Option D is incorrect. AWS Organizations manages multiple AWS accounts but is not designed for sharing AMIs with external customers. Therefore, A, AWS Marketplace, is the correct answer.
Play from 57:21 Question 34. Which AWS service can create a private network connection from on premises to the AWS Cloud? Here are the options. Option A. AWS Config. Option B. Virtual Private Cloud (Amazon VPC). Option C. AWS Direct Connect. Option D. Amazon Route 53. Pause the video now if you want time to think about the answer.
The correct answer is C. AWS Direct Connect. AWS Direct Connect creates a dedicated private network connection from an on-premises data center to AWS infrastructure, providing consistent network performance, reduced latency, and enhanced security compared to internet-based connections. Now, why are the other options incorrect? Option A is incorrect. AWS Config monitors and records AWS resource configurations, not network connectivity. Option B is incorrect. VPC is for creating virtual networks within AWS, not for on-premises to AWS connections. Option D is incorrect. Route 53 is a DNS service for domain name resolution, not for establishing private network connections. Therefore, C, AWS Direct Connect, is the correct answer.
Play from 58:53 Question 35. A company is building a web application using AWS. Which AWS service will help prevent network layer DDoS attacks against the web application? Here are the options. Option A. AWS WAF. Option B. AWS Firewall Manager. Option C. Amazon GuardDuty. Option D. AWS Shield. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS Shield. AWS Shield is the dedicated DDoS protection service that provides both standard (automatic) and advanced protection against DDoS attacks at the network and transport layers. It is specifically designed to protect AWS resources from DDoS attacks and is the primary service for this purpose. Now, why are the other options incorrect? Option A is incorrect. AWS WAF protects against application layer (Layer 7) attacks, not network layer DDoS attacks. Option B is incorrect. AWS Firewall Manager is for centralized management of firewall rules across accounts, not primary DDoS protection. Option C is incorrect. Amazon GuardDuty detects malicious activity and threats but is not specifically designed for DDoS attack prevention. Therefore, D, AWS Shield, is the correct answer.
Play from 1:00:35 Question 36. A company must be able to develop, test, and launch an application in the AWS Cloud quickly. Which advantage of cloud computing will meet these requirements? Here are the options. Option A. Stop guessing capacity. Option B. Trade fixed expense for variable expense. Option C. Achieve economies of scale. Option D. Increase speed and agility. Pause the video now if you want time to think about the answer.
The correct answer is D. Increase speed and agility. Increased speed and agility directly addresses the ability to quickly develop, test, and launch applications. Cloud computing enables rapid provisioning of resources without waiting for hardware procurement, reducing time-to-market. While the other options are valid cloud benefits, they do not specifically relate to development, testing, and launch speed. Now, why are the other options incorrect? Option A is incorrect. Stopping capacity guessing relates to elasticity, not development/launch speed. Option B is incorrect. Trading fixed for variable expenses is about cost structure, not development speed. Option C is incorrect. Economies of scale relate to overall AWS cost efficiency, not application launch speed. Therefore, D, Increase speed and agility, is the correct answer.
Play from 1:02:15 Question 37. What does the concept of agility mean in AWS Cloud computing? (Choose two.) Here are the options. Option A. The speed at which AWS resources are implemented. Option B. The speed at which AWS creates new AWS Regions. Option C. The ability to experiment quickly. Option D. The elimination of wasted capacity. Option E. The low cost of entry into cloud computing. Pause the video now if you want time to think about the answer.
The correct answers are A. The speed at which AWS resources are implemented, and C. The ability to experiment quickly. Agility in AWS Cloud computing refers to the speed of implementation and the ability to experiment quickly. Option A is correct because resources can be deployed in minutes. Option C is correct because the cloud enables rapid experimentation and iteration without large upfront investments. Options B, D, and E describe other AWS benefits (region expansion, capacity management, and affordability) but not agility specifically. Now, why are the other options incorrect? Option B is incorrect. AWS Region creation is an AWS responsibility, not a measure of customer agility. Option D is incorrect. Elimination of wasted capacity relates to efficiency and cost optimization, not agility. Option E is incorrect. Low cost of entry describes affordability or accessibility, not agility. Therefore, A and C are the correct answers.
Play from 1:04:07 Question 38. A company plans to migrate to AWS and wants to create cost estimates for its AWS use cases. Which AWS service or tool can the company use to meet these requirements? Here are the options. Option A. AWS Pricing Calculator. Option B. Amazon CloudWatch. Option C. AWS Cost Explorer. Option D. AWS Budgets. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Pricing Calculator. AWS Pricing Calculator is specifically designed for creating cost estimates for AWS use cases before deployment. It allows companies to model their anticipated AWS usage, select services, configure parameters, and generate detailed cost projections. Now, why are the other options incorrect? Option B is incorrect. Amazon CloudWatch is a monitoring and observability service for tracking metrics and logs of running resources, not for pre-deployment cost estimation. Option C is incorrect. AWS Cost Explorer is used to analyze historical and current spending of already-deployed resources, not to estimate costs for planned migrations. Option D is incorrect. AWS Budgets is used to set spending alerts and track against budgets for existing resource usage, not to create initial cost estimates. Therefore, A, AWS Pricing Calculator, is the correct answer.
Play from 1:05:53 Question 39. Which AWS service provides command line access to AWS tools and resources directly from a web browser? Here are the options. Option A. AWS CloudHSM. Option B. AWS CloudShell. Option C. Amazon WorkSpaces. Option D. AWS Cloud Map. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS CloudShell. AWS CloudShell provides a web browser-based shell with AWS CLI and other tools pre- installed, allowing direct command-line access to AWS resources without needing to install or configure tools locally. Now, why are the other options incorrect? Option A is incorrect. CloudHSM is a hardware security module service for key management, not command-line access. Option C is incorrect. WorkSpaces provides desktop virtualization, not a command-line shell environment. Option D is incorrect. Cloud Map is a service registry for discovering AWS resources, not a command-line access tool. Therefore, B, AWS CloudShell, is the correct answer.
Play from 1:07:17 Question 40. Which AWS service or tool gives users the ability to connect with AWS and deploy resources programmatically? Here are the options. Option A. Amazon QuickSight. Option B. AWS PrivateLink. Option C. AWS Direct Connect. Option D. AWS SDKs. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS SDKs. AWS SDKs (Software Development Kits) are libraries that enable developers to write code in various programming languages to connect with AWS services and deploy resources programmatically. They provide the primary means for programmatic interaction with AWS APIs. Now, why are the other options incorrect? Option A is incorrect. Amazon QuickSight is a business intelligence tool for data visualization and analytics, not for programmatic resource deployment. Option B is incorrect. AWS PrivateLink enables private connectivity between AWS services and on-premises networks, but doesn't provide programmatic resource deployment capabilities. Option C is incorrect. AWS Direct Connect establishes dedicated network connections to AWS, but is not the tool for programmatic resource deployment. Therefore, D, AWS SDKs, is the correct answer.
Play from 1:08:58 Question 41. A company wants to develop an accessibility application that will convert text into audible speech. Which AWS service will meet this requirement? Here are the options. Option A. Amazon MQ. Option B. Amazon Polly. Option C. Amazon Neptune. Option D. Amazon Timestream. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon Polly. Amazon Polly is an AI service that converts text into natural-sounding speech (text-to- speech), making it ideal for accessibility applications. Amazon MQ is a message broker, Neptune is a graph database, and Timestream is for time-series data, none provide text- to-speech capabilities. Now, why are the other options incorrect? Option A is incorrect. Amazon MQ is a message broker service for application messaging. Option C is incorrect. Amazon Neptune is a graph database service for data queries. Option D is incorrect. Amazon Timestream is a time-series database service for metrics and events. Therefore, B, Amazon Polly, is the correct answer.
Play from 1:10:27 Question 42. Which AWS services or features give users the ability to create a network connection between two VPCs? (Choose two.) Here are the options. Option A. VPC endpoints. Option B. Amazon Route 53. Option C. VPC peering. Option D. AWS Direct Connect. Option E. AWS Transit Gateway. Pause the video now if you want time to think about the answer.
The correct answers are C. VPC peering, and E. AWS Transit Gateway. C. VPC peering E. AWS Transit Gateway VPC peering creates a direct network connection between two VPCs, allowing resources in each VPC to communicate as if they were on the same network. AWS Transit Gateway provides a centralized hub for connecting multiple VPCs and on-premises networks, effectively enabling communication between VPCs. VPC endpoints allow private access to AWS services but connect within a single VPC, Route 53 is a DNS service without network connectivity functionality, and Direct Connect connects on-premises networks to AWS rather than VPCs to each other. Now, why are the other options incorrect? Option A is incorrect. VPC endpoints enable private connections to AWS services from within a VPC, not connections between VPCs. Option B is incorrect. Amazon Route 53 is a DNS service for domain management and does not provide network connectivity between VPCs. Option D is incorrect. AWS Direct Connect connects on-premises corporate networks to AWS, not VPCs to each other. Therefore, C and E are the correct answers.
Play from 1:12:32 Question 43. A company has deployed several public applications behind Application Load Balancers. The company wants to improve the performance of the applications. Which AWS service will meet these requirements? Here are the options. Option A. AWS Global Accelerator. Option B. Amazon Connect. Option C. Amazon ElastiCache. Option D. Amazon CloudWatch. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Global Accelerator. AWS Global Accelerator improves application performance by routing user traffic through AWS's optimized global network infrastructure, reducing latency and improving availability for geographically distributed users accessing applications behind load balancers. Now, why are the other options incorrect? Option B is incorrect. Amazon Connect is a cloud-based contact center service for customer communications Option C is incorrect. Amazon ElastiCache caches data to reduce database load but doesn't improve ALB application performance Option D is incorrect. Amazon CloudWatch monitors applications but does not improve performance Therefore, A, AWS Global Accelerator, is the correct answer.
Play from 1:14:13 Question 44. Which AWS Cloud deployment model uses AWS Outposts as part of the application deployment infrastructure? Here are the options. Option A. On-premises. Option B. Serverless. Option C. Cloud-native. Option D. Hybrid. Pause the video now if you want time to think about the answer.
The correct answer is D. Hybrid. Hybrid cloud deployment model uses AWS Outposts as part of the infrastructure. AWS Outposts brings AWS services and infrastructure to on-premises environments, creating a true hybrid deployment where applications and data can reside both in AWS and on- premises. This is distinct from pure on-premises, serverless, or cloud-native deployments. Now, why are the other options incorrect? Option A is incorrect. On-premises deployments do not use AWS services or Outposts. Option B is incorrect. Serverless is a computing model, not a deployment model that specifically incorporates Outposts. Option C is incorrect. Cloud-native typically refers to applications designed for cloud environments, not hybrid infrastructures with Outposts. Therefore, D, Hybrid, is the correct answer.
Play from 1:15:40 Question 45. Which of the following can be components of a VPC in the AWS Cloud? (Choose two.) Here are the options. Option A. Amazon API Gateway. Option B. Amazon S3 buckets and objects. Option C. AWS Storage Gateway. Option D. Internet gateway. Option E. Subnet. Pause the video now if you want time to think about the answer.
The correct answers are D. Internet gateway, and E. Subnet. An Internet Gateway enables communication between resources in a VPC and the internet, and a Subnet is a logical subdivision of a VPC that groups resources. These are both core VPC components. API Gateway is a service for API management not a VPC component. S3 buckets are regional services outside the VPC. AWS Storage Gateway is a hybrid storage service, not a VPC component. Now, why are the other options incorrect? Option A is incorrect. Amazon API Gateway is a service for managing APIs, not a VPC component. Option B is incorrect. S3 buckets and objects are regional services; while they can be accessed from a VPC, they are not components of it. Option C is incorrect. AWS Storage Gateway is a hybrid storage appliance service, not a VPC component. Therefore, D and E are the correct answers.
Play from 1:17:22 Question 46. A company wants to migrate its NFS on-premises workload to AWS. Which AWS Storage Gateway type should the company use to meet this requirement? Here are the options. Option A. Tape Gateway. Option B. Volume Gateway. Option C. Amazon FSx File Gateway. Option D. Amazon S3 File Gateway. Pause the video now if you want time to think about the answer.
The correct answer is D. Amazon S3 File Gateway. Amazon S3 File Gateway presents NFS and SMB file shares on premises and stores the files as objects in Amazon S3. That makes it the Storage Gateway type used to move NFS workloads to AWS. Now, why are the other options incorrect? Option A is incorrect. Tape Gateway presents a virtual tape library for backups, not NFS file shares. Option B is incorrect. Volume Gateway presents iSCSI block volumes, not NFS file shares. Option C is incorrect. FSx File Gateway provides SMB access to Amazon FSx for Windows File Server and does not support NFS. Therefore, D, Amazon S3 File Gateway, is the correct answer.
Play from 1:18:56 Question 47. A company wants a unified tool to provide a consistent method to interact with AWS services. Which AWS service or tool will meet this requirement? Here are the options. Option A. AWS CLI. Option B. Amazon Elastic Container Service (Amazon ECS). Option C. AWS Cloud9. Option D. AWS Virtual Private Network (AWS VPN). Pause the video now if you want time to think about the answer.
The correct answer is A. AWS CLI. The AWS CLI (Command Line Interface) provides a unified, consistent method to interact with all AWS services from the command line. It offers a single tool that works across all AWS services with standardized syntax and commands. Now, why are the other options incorrect? Option B is incorrect. Amazon ECS is a container orchestration service, not a unified tool for interacting with AWS services. Option C is incorrect. AWS Cloud9 is an IDE for development, not a unified tool for general AWS service interaction. Option D is incorrect. AWS VPN provides secure network connectivity, not a method to interact with AWS services. Therefore, A, AWS CLI, is the correct answer.
Play from 1:20:38 Question 48. Which AWS service or tool can be used to capture information about inbound and outbound traffic in an Amazon VPC? Here are the options. Option A. VPC Flow Logs. Option B. Amazon Inspector. Option C. VPC endpoint services. Option D. NAT gateway. Pause the video now if you want time to think about the answer.
The correct answer is A. VPC Flow Logs. VPC Flow Logs is the AWS service specifically designed to capture information about inbound and outbound traffic in a VPC. It provides detailed network traffic logs that can be used for monitoring, troubleshooting, and security analysis. Now, why are the other options incorrect? Option B is incorrect. Inspector is for vulnerability assessment of EC2 instances and applications, not network traffic capture Option C is incorrect. VPC endpoint services are for private connectivity to AWS services, not traffic monitoring Option D is incorrect. NAT gateway is for translating private IP addresses for outbound traffic, not capturing traffic information Therefore, A, VPC Flow Logs, is the correct answer.
Play from 1:22:13 Question 49. A company wants to identify Amazon S3 buckets that are shared with another AWS account. Which AWS service or feature will meet these requirements? Here are the options. Option A. AWS Lake Formation. Option B. IAM credential report. Option C. Amazon CloudWatch. Option D. IAM Access Analyzer. Pause the video now if you want time to think about the answer.
The correct answer is D. IAM Access Analyzer. IAM Access Analyzer is specifically designed to identify and analyze resource access, including cross-account access to resources like S3 buckets. It uses automated reasoning to validate IAM policies and can generate findings showing which external accounts have access to your resources, making it the ideal service for this requirement. Now, why are the other options incorrect? Option A is incorrect. Lake Formation is for data lake setup and management, not for analyzing cross-account bucket sharing. Option B is incorrect. IAM credential reports show user credentials and access keys, not bucket sharing or cross-account access patterns. Option C is incorrect. CloudWatch monitors metrics and logs but does not analyze or report on cross-account resource access permissions. Therefore, D, IAM Access Analyzer, is the correct answer.
Play from 1:24:00 Question 50. Which AWS services or tools can identify rightsizing opportunities for Amazon EC2 instances? (Choose two.) Here are the options. Option A. AWS Cost Explorer. Option B. AWS Billing Conductor. Option C. Amazon CodeGuru. Option D. Amazon SageMaker. Option E. AWS Compute Optimizer. Pause the video now if you want time to think about the answer.
The correct answers are A. AWS Cost Explorer, and E. AWS Compute Optimizer. AWS Cost Explorer and AWS Compute Optimizer are the primary AWS services for identifying EC2 rightsizing opportunities. Cost Explorer provides cost analysis and trending data that can reveal underutilized instances, while Compute Optimizer specifically analyzes EC2 instance metrics and provides rightsizing recommendations based on actual usage patterns. Together they enable organizations to optimize instance types and sizes for cost efficiency. Now, why are the other options incorrect? Option B is incorrect. AWS Billing Conductor is used for setting up billing groups and custom pricing, not for identifying rightsizing opportunities. Option C is incorrect. Amazon CodeGuru analyzes code quality and application performance, not EC2 instance utilization patterns. Option D is incorrect. Amazon SageMaker is a machine learning service for building and training models, not for EC2 infrastructure optimization. Therefore, A and E are the correct answers.
Play from 1:26:03 Question 51. A company is planning to migrate its application to the AWS Cloud. Which AWS tool or set of resources should the company use to analyze and assess its readiness for migration? Here are the options. Option A. AWS Cloud Adoption Framework (AWS CAF). Option B. AWS Pricing Calculator. Option C. AWS Well-Architected Framework. Option D. AWS Budgets. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Cloud Adoption Framework (AWS CAF). The AWS Cloud Adoption Framework (AWS CAF) is specifically designed to help organizations assess their readiness for cloud migration by evaluating people, processes, and technology across multiple perspectives. It provides a structured approach to understanding gaps and planning migration strategies. The other options serve different purposes: pricing calculator estimates costs, Well-Architected Framework guides architecture decisions, and Budgets tracks spending. Now, why are the other options incorrect? Option B is incorrect. AWS Pricing Calculator is used to estimate cloud costs, not to assess migration readiness. Option C is incorrect. AWS Well-Architected Framework provides guidance on building secure, high-performing systems after migration, not for assessing initial readiness. Option D is incorrect. AWS Budgets is a cost management tool for tracking spending, not for assessing migration readiness. Therefore, A, AWS Cloud Adoption Framework (AWS CAF), is the correct answer.
Play from 1:28:08 Question 52. Which AWS service or tool provides recommendations to help users get rightsized Amazon EC2 instances based on historical workload usage data? Here are the options. Option A. AWS Pricing Calculator. Option B. AWS Compute Optimizer. Option C. AWS App Runner. Option D. AWS Systems Manager. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Compute Optimizer. AWS Compute Optimizer analyzes historical workload usage data and provides recommendations for right-sizing EC2 instances, helping to optimize performance and cost. It uses machine learning to identify underutilized or overutilized instances and suggests appropriate instance types. This directly addresses the requirement to get rightsized instances based on usage data. Now, why are the other options incorrect? Option A is incorrect. AWS Pricing Calculator is used for estimating costs, not for analyzing workload data and providing rightsizing recommendations. Option C is incorrect. AWS App Runner is a container application service, not a tool for EC2 instance optimization analysis. Option D is incorrect. AWS Systems Manager is for operational management and does not provide EC2 rightsizing recommendations. Therefore, B, AWS Compute Optimizer, is the correct answer.
Play from 1:29:56 Question 53. A company wants an AWS service to provide product recommendations based on its customer data. Which AWS service will meet this requirement? Here are the options. Option A. Amazon Polly. Option B. Amazon Personalize. Option C. Amazon Comprehend. Option D. Amazon Rekognition. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon Personalize. Amazon Personalize is an AWS machine learning service specifically designed to deliver personalized recommendations based on customer data and behavior. It analyzes historical customer interactions to generate product recommendations tailored to individual users. The other services serve different purposes: Polly converts text to speech, Comprehend performs natural language processing for text analysis, and Rekognition analyzes images and video. Now, why are the other options incorrect? Option A is incorrect. Amazon Polly is a text-to-speech service, not designed for generating product recommendations. Option C is incorrect. Amazon Comprehend analyzes text sentiment and content, not customer purchasing patterns for recommendations. Option D is incorrect. Amazon Rekognition performs image and video analysis, not customer behavior analysis for recommendations. Therefore, B, Amazon Personalize, is the correct answer.
Play from 1:31:42 Question 54. A company has a website on AWS. The company wants to deliver the website to a worldwide audience and provide low-latency response times for global users. Which AWS service will meet these requirements? Here are the options. Option A. AWS CloudFormation. Option B. Amazon CloudFront. Option C. Amazon ElastiCache. Option D. Amazon DynamoDB. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) designed specifically to deliver content with low latency to users worldwide. It caches content at edge locations globally and is the standard solution for providing fast, geographically distributed website access. Now, why are the other options incorrect? Option A is incorrect. AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not for content delivery. Option C is incorrect. Amazon ElastiCache is an in-memory cache for application performance, not for global content delivery to end users. Option D is incorrect. Amazon DynamoDB is a database service, not a content delivery mechanism for websites. Therefore, B, Amazon CloudFront, is the correct answer.
Play from 1:33:23 Question 55. Which AWS Cloud benefit gives a company the ability to quickly deploy cloud resources to access compute, storage, and database infrastructures in a matter of minutes? Here are the options. Option A. Elasticity. Option B. Cost savings. Option C. Agility. Option D. Reliability. Pause the video now if you want time to think about the answer.
The correct answer is C. Agility. Agility is the AWS cloud benefit that enables companies to quickly deploy resources in minutes. It refers to the speed and ease of provisioning compute, storage, and database infrastructures without lengthy procurement or setup times. Now, why are the other options incorrect? Option A is incorrect. Elasticity refers to the ability to scale resources up or down, not the speed of initial deployment. Option B is incorrect. Cost savings is a benefit but does not directly address the speed of resource deployment. Option D is incorrect. Reliability refers to system uptime and availability, not deployment speed. Therefore, C, Agility, is the correct answer.
Play from 1:34:48 Question 56. A company wants to grant users in one AWS account access to resources in another AWS account. The users do not currently have permission to access the resources. Which AWS service will meet this requirement? Here are the options. Option A. IAM group. Option B. IAM role. Option C. IAM tag. Option D. IAM Access Analyzer. Pause the video now if you want time to think about the answer.
The correct answer is B. IAM role. IAM roles are the appropriate mechanism for granting cross-account access. By creating a role in the target account with appropriate permissions and establishing a trust relationship with the source account, users in one account can assume that role to access resources in another account. This is the standard AWS pattern for multi-account access scenarios. Now, why are the other options incorrect? Option A is incorrect. IAM groups are used to manage permissions within a single AWS account and cannot be used to grant access across accounts. Option C is incorrect. IAM tags are metadata labels used to organize and manage resources; they do not grant permissions or enable cross-account access. Option D is incorrect. IAM Access Analyzer is a tool for validating and monitoring resource policies and access configurations; it does not grant cross-account access itself. Therefore, B, IAM role, is the correct answer.
Play from 1:36:36 Question 57. A company wants to use a serverless compute service for an application. Which AWS service will meet this requirement? Here are the options. Option A. AWS Lambda. Option B. AWS CloudFormation. Option C. AWS Elastic Beanstalk. Option D. Elastic Load Balancing. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Lambda. AWS Lambda is AWS's serverless compute service that automatically scales, requires no server provisioning, and charges only for code execution time. It is the primary AWS service for serverless computing requirements. Now, why are the other options incorrect? Option B is incorrect. AWS CloudFormation is an infrastructure-as-code service for provisioning and managing AWS resources, not a compute service. Option C is incorrect. AWS Elastic Beanstalk is a managed platform-as-a-service that still requires infrastructure provisioning and management, not a serverless solution. Option D is incorrect. Elastic Load Balancing is a networking service for distributing traffic across instances and does not provide compute functionality. Therefore, A, AWS Lambda, is the correct answer.
Play from 1:38:13 Question 58. A company has developed a new In-house application. The company does not have a way to determine or predict the usage demand that the application will create. Which AWS Cloud computing benefit is the company seeking? Here are the options. Option A. Easy to use. Option B. Cost-effective. Option C. Secure. Option D. Scalable and high performance. Pause the video now if you want time to think about the answer.
The correct answer is D. Scalable and high performance. When a company cannot predict usage demand, they need the ability to scale resources up and down elastically to match actual demand, and maintain high performance regardless of load. This is the fundamental benefit of cloud scalability and high performance, the ability to automatically adjust capacity without predicting requirements in advance. Now, why are the other options incorrect? Option A is incorrect. Easy to use refers to user interface simplicity, not the ability to handle unpredictable demand. Option B is incorrect. Cost-effectiveness alone doesn't address the challenge of unpredictable demand; scalability does. Option C is incorrect. Security is important but doesn't directly address the challenge of handling unknown usage patterns. Therefore, D, Scalable and high performance, is the correct answer.
Play from 1:39:54 Question 59. Which options are AWS Cloud Adoption Framework (AWS CAF) security perspective capabilities? (Choose two.) Here are the options. Option A. Observability. Option B. Incident and problem management. Option C. Incident response. Option D. Infrastructure protection. Option E. Availability and continuity. Pause the video now if you want time to think about the answer.
The correct answers are C. Incident response, and D. Infrastructure protection. C. Incident response D. Infrastructure protection The AWS Cloud Adoption Framework security perspective includes capabilities focused on protecting infrastructure and responding to incidents. Incident response and infrastructure protection are core security perspective capabilities that address threat detection, remediation, and secure resource deployment. These align with the security pillar's focus on protecting data, systems, and assets. Now, why are the other options incorrect? Option A is incorrect. Observability is primarily an operational capability, not a security perspective capability. Option B is incorrect. Incident and problem management is part of the operations perspective, not the security perspective. Option E is incorrect. Availability and continuity are operational and business continuity concerns, not core security perspective capabilities. Therefore, C and D are the correct answers.
Play from 1:41:46 Question 60. A company wants to query its server logs to gain insights about its customers’ experiences. Which AWS service will store this data MOST cost-effectively? Here are the options. Option A. Amazon Aurora. Option B. Amazon Elastic File System (Amazon EFS). Option C. Amazon Elastic Block Store (Amazon EBS). Option D. Amazon S3. Pause the video now if you want time to think about the answer.
The correct answer is D. Amazon S3. Amazon S3 is the most cost-effective solution for storing and querying large volumes of server logs. S3 offers low storage costs, lifecycle policies for archiving, and integrates with query services like Amazon Athena for analytics without requiring database infrastructure. Aurora, EFS, and EBS are all more expensive options designed for different use cases (relational databases, file systems, and block storage respectively) and would be wasteful for log data that primarily needs to be stored and occasionally queried. Now, why are the other options incorrect? Option A is incorrect. Aurora is a relational database service designed for transactional workloads, not cost-effective for log storage and analysis. Option B is incorrect. EFS is a managed file system service with higher costs than S3 and is not optimized for log analytics. Option C is incorrect. EBS provides block storage volumes attached to EC2 instances and is far more expensive than S3 for log data storage. Therefore, D, Amazon S3, is the correct answer.
Play from 1:43:47 Question 61. A company needs to check for IAM access keys that have not been rotated recently. Which AWS service should the company use to meet this requirement? Here are the options. Option A. AWS WAF. Option B. AWS Shield. Option C. Amazon Cognito. Option D. AWS Trusted Advisor. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS Trusted Advisor. AWS Trusted Advisor is a service that provides recommendations across multiple categories including security, and it specifically checks for IAM access keys that have not been rotated recently. AWS WAF protects against web attacks, AWS Shield provides DDoS protection, and Amazon Cognito handles user authentication, none of these check access key rotation. Now, why are the other options incorrect? Option A is incorrect. AWS WAF protects web applications from malicious traffic, not for auditing IAM access keys. Option B is incorrect. AWS Shield is a DDoS protection service, not for checking access key rotation. Option C is incorrect. Amazon Cognito manages user authentication and identity, not IAM access key audits. Therefore, D, AWS Trusted Advisor, is the correct answer.
Play from 1:45:29 Question 62. Which AWS service or feature allows users to create new AWS accounts, group multiple accounts to organize workflows, and apply policies to groups of accounts? Here are the options. Option A. AWS Identity and Access Management (IAM). Option B. AWS Trusted Advisor. Option C. AWS CloudFormation. Option D. AWS Organizations. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS Organizations. AWS Organizations is specifically designed to create and manage multiple AWS accounts, consolidate billing, apply policies across account groups, and organize workflows. It provides the account creation, grouping, and policy application capabilities described in the requirement. Now, why are the other options incorrect? Option A is incorrect. AWS IAM manages users and permissions within individual accounts, not account creation or organization. Option B is incorrect. AWS Trusted Advisor provides best practice recommendations, not account management or policy application. Option C is incorrect. AWS CloudFormation is an infrastructure-as-code service for deploying resources, not for managing AWS accounts. Therefore, D, AWS Organizations, is the correct answer.
Play from 1:47:18 Question 63. A company wants to monitor for misconfigured security groups that are allowing unrestricted access to specific ports. Which AWS service will meet this requirement? Here are the options. Option A. AWS Trusted Advisor. Option B. Amazon CloudWatch. Option C. Amazon GuardDuty. Option D. AWS Health Dashboard. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS Trusted Advisor. AWS Trusted Advisor is the correct service for identifying misconfigured security groups. It performs security checks including detection of security groups allowing unrestricted access to specific ports. Trusted Advisor provides actionable recommendations to improve security posture across AWS accounts. Now, why are the other options incorrect? Option B is incorrect. CloudWatch is for monitoring metrics and logs, not for security configuration assessments. Option C is incorrect. GuardDuty detects malicious activity and threats, not misconfigurations like overly permissive security groups. Option D is incorrect. AWS Health Dashboard shows service health status and events, not security configuration issues. Therefore, A, AWS Trusted Advisor, is the correct answer.
Play from 1:49:00 Question 64. Which cloud transformation journey phase of the AWS Cloud Adoption Framework (AWS CAF) focuses on demonstrating how the cloud helps accelerate business outcomes? Here are the options. Option A. Scale. Option B. Envision. Option C. Align. Option D. Launch. Pause the video now if you want time to think about the answer.
The correct answer is B. Envision. The Envision phase of the AWS Cloud Adoption Framework focuses on demonstrating how cloud adoption will help accelerate business outcomes. It involves creating a vision for cloud transformation, identifying business benefits, and establishing initial business cases. This foundational phase comes before Align, Launch, and Scale phases. Now, why are the other options incorrect? Option A is incorrect. Scale is a later phase focused on expanding cloud adoption across the organization after successful launches. Option C is incorrect. Align is about getting stakeholder alignment and establishing governance, not demonstrating business outcomes. Option D is incorrect. Launch involves executing specific cloud migration and implementation projects, not demonstrating overall outcomes. Therefore, B, Envision, is the correct answer.
Play from 1:50:35 Question 65. Which VPC component can a company use to set up a virtual firewall at the Amazon EC2 instance level? Here are the options. Option A. Network ACL. Option B. Security group. Option C. Route table. Option D. NAT gateway. Pause the video now if you want time to think about the answer.
The correct answer is B. Security group. A security group acts as a virtual firewall at the EC2 instance level, controlling inbound and outbound traffic to individual instances. Security groups are stateful and allow granular control over network access to specific instances, making them the appropriate choice for instance-level firewall functionality. Now, why are the other options incorrect? Option A is incorrect. Network ACLs operate at the subnet level, not the instance level, and are stateless. Option C is incorrect. Route tables determine how network traffic is directed within a VPC; they do not provide firewall functionality. Option D is incorrect. NAT gateways enable instances in private subnets to initiate outbound traffic but do not function as a firewall. Therefore, B, Security group, is the correct answer.
Play from 1:52:11 Question 66. A company needs to set up dedicated network connectivity between its on-premises data center and the AWS Cloud. The network cannot use the public internet. Which AWS service or feature will meet these requirements? Here are the options. Option A. AWS Transit Gateway. Option B. AWS VPN. Option C. Amazon CloudFront. Option D. AWS Direct Connect. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS Direct Connect. AWS Direct Connect provides dedicated physical network connectivity between on- premises data centers and AWS without using the public internet. It offers consistent network performance and security. AWS VPN uses the internet, Transit Gateway coordinates multiple connections, and CloudFront is for content delivery. Now, why are the other options incorrect? Option A is incorrect. AWS Transit Gateway is for connecting multiple networks but still uses public internet connectivity. Option B is incorrect. AWS VPN establishes connections over the public internet, which violates the requirement. Option C is incorrect. Amazon CloudFront is a content delivery network, not for dedicated on-premises connectivity. Therefore, D, AWS Direct Connect, is the correct answer.
Play from 1:53:58 Question 67. Which of the following is entirely the responsibility of AWS, according to the AWS shared responsibility model? Here are the options. Option A. Security awareness and training. Option B. Development of an IAM password policy. Option C. Patching of the guest operating system. Option D. Physical and environmental controls. Pause the video now if you want time to think about the answer.
The correct answer is D. Physical and environmental controls. Physical and environmental controls, such as data center security, power systems, cooling, and physical access, are entirely AWS's responsibility under the shared responsibility model. Customers have no control over these infrastructure elements. Now, why are the other options incorrect? Option A is incorrect. Security awareness and training is a customer responsibility to educate their own staff. Option B is incorrect. IAM password policy development is the customer's responsibility to configure for their users. Option C is incorrect. Patching the guest operating system is the customer's responsibility; AWS only patches the host hypervisor. Therefore, D, Physical and environmental controls, is the correct answer.
Play from 1:55:34 Question 68. Which options are AWS Cloud Adoption Framework (AWS CAF) cloud transformation journey recommendations? (Choose two.) Here are the options. Option A. Envision phase. Option B. Align phase. Option C. Assess phase. Option D. Mobilize phase. Option E. Migrate and modernize phase. Pause the video now if you want time to think about the answer.
The correct answers are A. Envision phase, and B. Align phase. The AWS CAF cloud transformation journey includes the Envision phase (identifying transformation opportunities), Align phase (identifying skills and organizational gaps), Assess phase (detailed discovery and planning), Mobilize phase (building the foundation), and Migrate and Modernize phase (executing migration). The Envision and Align phases are foundational stages for cloud transformation recommendations. Now, why are the other options incorrect? Option C is incorrect. Assess is a phase but not one of the two primary recommendations for the overall journey. Option D is incorrect. Mobilize is a phase but not one of the two primary recommendations for the overall journey. Option E is incorrect. Migrate and Modernize is an execution phase, not one of the two primary recommendations. Therefore, A and B are the correct answers.
Play from 1:57:17 Question 69. Which cloud concept is demonstrated by using AWS Compute Optimizer? Here are the options. Option A. Security validation. Option B. Rightsizing. Option C. Elasticity. Option D. Global reach. Pause the video now if you want time to think about the answer.
The correct answer is B. Rightsizing. AWS Compute Optimizer analyzes AWS resource utilization and provides recommendations to optimize instance types and sizes, which is the definition of rightsizing. It helps match compute resources to actual workload requirements to improve performance and reduce costs. Now, why are the other options incorrect? Option A is incorrect. Security validation is not the primary function of Compute Optimizer; security assessment is handled by other services like Inspector. Option C is incorrect. Elasticity refers to scaling resources up or down automatically, which is not Compute Optimizer's primary function. Option D is incorrect. Global reach describes AWS's infrastructure distribution, not a capability demonstrated by Compute Optimizer. Therefore, B, Rightsizing, is the correct answer.
Play from 1:58:51 Question 70. Which of the following are economic benefits of using the AWS Cloud? (Choose two.) Here are the options. Option A. Consumption-based pricing. Option B. Perpetual licenses. Option C. Economies of scale. Option D. AWS Enterprise Support at no additional cost. Option E. Bring-your-own-hardware model. Pause the video now if you want time to think about the answer.
The correct answers are A. Consumption-based pricing, and C. Economies of scale. A. Consumption-based pricing C. Economies of scale Consumption-based pricing means customers pay only for what they use without upfront capital expenditure, reducing costs. Economies of scale allow AWS to spread infrastructure costs across millions of customers, reducing per-unit costs that benefit individual customers. Perpetual licenses require upfront investment, AWS Enterprise Support has additional costs, and bring-your-own-hardware contradicts cloud benefits. Now, why are the other options incorrect? Option B is incorrect. Perpetual licenses require large upfront capital investments, contrary to cloud economic benefits. Option D is incorrect. AWS Enterprise Support is not included at no additional cost; it requires a separate paid subscription. Option E is incorrect. Bring-your-own-hardware is not a cloud benefit and contradicts the purpose of using cloud infrastructure. Therefore, A and C are the correct answers.
Play from 2:00:40 Question 71. A company needs to provision uninterruptible Amazon EC2 instances, when needed, and pay for compute capacity by the second. Which EC2 instance purchasing option will meet these requirements? Here are the options. Option A. Reserved Instances. Option B. Spot Instances. Option C. On-Demand Instances. Option D. Dedicated Instances. Pause the video now if you want time to think about the answer.
The correct answer is C. On-Demand Instances. On-Demand Instances provide the required uninterruptible service with per-second billing. They offer flexibility without interruption risk or long-term commitments, making them suitable for applications needing guaranteed availability and predictable pricing. Now, why are the other options incorrect? Option A is incorrect. Reserved Instances require long-term commitments and upfront payments Option B is incorrect. Spot Instances are interruptible and can be terminated with short notice, violating the uninterruptible requirement Option D is incorrect. Dedicated Instances are for compliance/licensing but don't address the billing-by-the-second requirement Therefore, C, On-Demand Instances, is the correct answer.
Play from 2:02:15 Question 72. Which AWS Cloud Adoption Framework (AWS CAF) capabilities belong to the governance perspective? (Choose two.) Here are the options. Option A. Program and project management. Option B. Product management. Option C. Portfolio management. Option D. Risk management. Option E. Event management. Pause the video now if you want time to think about the answer.
The correct answers are A. Program and project management, and D. Risk management. The Governance perspective of AWS CAF includes Program and Project Management (for managing governance initiatives) and Risk Management (for identifying and mitigating governance-related risks). Both are core governance capabilities for ensuring compliance and organizational alignment. Now, why are the other options incorrect? Option B is incorrect. Product Management belongs to the Business perspective, not Governance. Option C is incorrect. Portfolio Management belongs to the Business perspective, not Governance. Option E is incorrect. Event Management is not a standard AWS CAF capability; it is not part of the Governance perspective. Therefore, A and D are the correct answers.
Play from 2:03:45 Question 73. A company wants to build, train, and deploy machine learning (ML) models. Which AWS service can the company use to meet this requirement? Here are the options. Option A. Amazon Personalize. Option B. Amazon Comprehend. Option C. Amazon Forecast. Option D. Amazon SageMaker. Pause the video now if you want time to think about the answer.
The correct answer is D. Amazon SageMaker. Amazon SageMaker is a fully managed service that provides the complete toolset to build, train, and deploy machine learning models. It supports the entire ML workflow from data preparation through model deployment and monitoring. While Amazon Personalize, Comprehend, and Forecast are specialized ML services, they are pre-built for specific use cases rather than general-purpose ML development platforms. Now, why are the other options incorrect? Option A is incorrect. Amazon Personalize is a specialized service for building recommendation systems, not a general ML development platform. Option B is incorrect. Amazon Comprehend is a pre-built service for natural language processing tasks, not for building custom ML models. Option C is incorrect. Amazon Forecast is a specialized service for time series forecasting, not a general ML development platform. Therefore, D, Amazon SageMaker, is the correct answer.
Play from 2:05:34 Question 74. Which combination of AWS services can be used to move a commercial relational database to an Amazon-managed open-source database? (Choose two.) Here are the options. Option A. AWS Database Migration Service (AWS DMS). Option B. AWS software development kits (SDKs). Option C. AWS Schema Conversion Tool. Option D. AWS Systems Manager. Option E. Amazon EMR. Pause the video now if you want time to think about the answer.
The correct answers are A. AWS Database Migration Service (AWS DMS), and C. AWS Schema Conversion Tool. AWS Database Migration Service (AWS DMS) is used to migrate data from commercial relational databases to Amazon-managed open-source databases, while AWS Schema Conversion Tool converts the database schema from the source commercial database format to the target open-source database format. Together, these tools handle both schema conversion and data migration. Now, why are the other options incorrect? Option B is incorrect. AWS SDKs are development tools, not specifically designed for database migration. Option D is incorrect. AWS Systems Manager is for operational management, not database migration. Option E is incorrect. Amazon EMR is for big data processing, not for migrating traditional relational databases. Therefore, A and C are the correct answers.
Play from 2:07:26 Question 75. Which AWS benefit is demonstrated by on-demand technology services that enable companies to replace upfront fixed expenses with variable expenses? Here are the options. Option A. High availability. Option B. Economies of scale. Option C. Pay-as-you-go pricing. Option D. Global reach. Pause the video now if you want time to think about the answer.
The correct answer is C. Pay-as-you-go pricing. Pay-as-you-go pricing is the AWS benefit that directly replaces upfront fixed capital expenses with variable operational expenses. Users pay only for the resources they consume without long-term commitments, allowing companies to avoid large capital expenditures and scale costs with actual usage. Now, why are the other options incorrect? Option A is incorrect. High availability is a technical capability of AWS services, not a financial benefit related to expense structure. Option B is incorrect. Economies of scale relate to AWS's efficiency in operating infrastructure, which may lower overall costs, but don't directly address the replacement of fixed with variable expenses. Option D is incorrect. Global reach is a geographic capability of AWS, not a pricing model or expense management benefit. Therefore, C, Pay-as-you-go pricing, is the correct answer.
Play from 2:09:10 Question 76. Which options are AWS Cloud Adoption Framework (AWS CAF) perspectives? (Choose two.) Here are the options. Option A. Cloud fluency. Option B. Security. Option C. Change acceleration. Option D. Architecture. Option E. Business. Pause the video now if you want time to think about the answer.
The correct answers are B. Security, and E. Business. The AWS Cloud Adoption Framework (AWS CAF) defines six perspectives: Business, People, Governance, Platform, Security, and Operations. Business and Security are two of these core perspectives used to align organizational strategy with cloud adoption initiatives. Now, why are the other options incorrect? Option A is incorrect. Cloud fluency is not an official AWS CAF perspective. Option C is incorrect. Change acceleration is not one of the six AWS CAF perspectives. Option D is incorrect. Architecture is not a primary AWS CAF perspective; Platform is the infrastructure-focused perspective. Therefore, B and E are the correct answers.
Play from 2:10:41 Question 77. A company wants to continuously improve processes and procedures to deliver business value. Which pillar of the AWS Well-Architected Framework does this goal represent? Here are the options. Option A. Performance efficiency. Option B. Operational excellence. Option C. Reliability. Option D. Sustainability. Pause the video now if you want time to think about the answer.
The correct answer is B. Operational excellence. Operational excellence is the pillar focused on continuously improving processes, procedures, and practices to deliver business value. It emphasizes monitoring, automation, and iterative improvement. Performance efficiency addresses optimization of resources, Reliability focuses on system stability and recovery, and Sustainability concerns environmental impact, none directly address continuous process improvement for business value. Now, why are the other options incorrect? Option A is incorrect. Performance efficiency addresses optimizing resource utilization, not improving processes and procedures. Option C is incorrect. Reliability focuses on system availability and fault tolerance, not process improvement. Option D is incorrect. Sustainability addresses minimizing environmental impact of cloud usage. Therefore, B, Operational excellence, is the correct answer.
Play from 2:12:22 Question 78. A company wants to migrate its database to a managed AWS service that is compatible with PostgreSQL. Which AWS services will meet these requirements? (Choose two.) Here are the options. Option A. Amazon Athena. Option B. Amazon RDS. Option C. Amazon EC2. Option D. Amazon DynamoDB. Option E. Amazon Aurora. Pause the video now if you want time to think about the answer.
The correct answers are B. Amazon RDS, and E. Amazon Aurora. Amazon RDS (B) supports PostgreSQL as a managed relational database engine, and Amazon Aurora (E) is a MySQL and PostgreSQL-compatible managed database built for high performance and availability. Both services provide fully managed PostgreSQL-compatible databases with automated backups, patching, and scaling capabilities. Now, why are the other options incorrect? Option A is incorrect. Amazon Athena is a query service for analyzing data in S3 using SQL, not a PostgreSQL-compatible database. Option C is incorrect. Amazon EC2 is a compute service; while PostgreSQL can be installed on EC2, it is not a managed AWS database service. Option D is incorrect. Amazon DynamoDB is a NoSQL document database, not compatible with PostgreSQL. Therefore, B and E are the correct answers.
Play from 2:14:08 Question 79. Which AWS service helps deliver highly available applications with fast failover for multi- Region and Multi-AZ architectures? Here are the options. Option A. AWS WAF. Option B. AWS Global Accelerator. Option C. AWS Shield. Option D. AWS Direct Connect. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Global Accelerator. AWS Global Accelerator provides fast failover capabilities for multi-Region and Multi-AZ architectures by directing traffic to optimal endpoints and enabling rapid failover between regions and availability zones, ensuring high availability for applications. Now, why are the other options incorrect? Option A is incorrect. AWS WAF is a web application firewall for protection against web exploits, not for failover. Option C is incorrect. AWS Shield is a DDoS protection service, not specifically designed for multi-Region failover. Option D is incorrect. AWS Direct Connect is for dedicated network connections, not for providing failover capabilities across multiple regions. Therefore, B, AWS Global Accelerator, is the correct answer.
Play from 2:15:49 Question 80. Which AWS service should a company use to organize, characterize, and search large numbers of images? Here are the options. Option A. Amazon Transcribe. Option B. Amazon Rekognition. Option C. Amazon Aurora. Option D. Amazon QuickSight. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon Rekognition. Amazon Rekognition is AWS's machine learning service specifically designed to analyze images and videos. It can organize, characterize, search, and extract insights from large volumes of images, including object detection, facial recognition, and content moderation. This directly addresses the requirement to organize, characterize, and search large numbers of images. Now, why are the other options incorrect? Option A is incorrect. Amazon Transcribe converts speech to text, not for image organization. Option C is incorrect. Amazon Aurora is a relational database service, not for image analysis. Option D is incorrect. Amazon QuickSight is a business intelligence and visualization tool, not for image recognition. Therefore, B, Amazon Rekognition, is the correct answer.
Play from 2:17:21 Question 81. A company needs to transfer data between an Amazon S3 bucket and an on-premises application. Who is responsible for the security of this data, according to the AWS shared responsibility model? Here are the options. Option A. The company. Option B. AWS. Option C. Firewall vendor. Option D. AWS Marketplace partner. Pause the video now if you want time to think about the answer.
The correct answer is A. The company. Under the AWS shared responsibility model, the company is responsible for security of data in transit and at rest for data transfer between on-premises and AWS. AWS manages the infrastructure security, but the customer must secure their data, encryption keys, access controls, and application-level security. The company must implement encryption, network security, and authentication mechanisms. Now, why are the other options incorrect? Option B is incorrect. AWS is responsible for the security of the cloud infrastructure, not the data itself or how customers use it. Option C is incorrect. Firewall vendors are third-party tools; responsibility still lies with the company implementing and configuring them. Option D is incorrect. AWS Marketplace partners sell solutions but do not assume security responsibility for customer data transfers. Therefore, A, The company, is the correct answer.
Play from 2:19:07 Question 82. Which AWS service provides a single location to track the progress of application migrations? Here are the options. Option A. AWS Application Discovery Service. Option B. AWS Application Migration Service. Option C. AWS Service Catalog. Option D. AWS Migration Hub. Pause the video now if you want time to think about the answer.
The correct answer is D. AWS Migration Hub. AWS Migration Hub provides a single location to track and manage the progress of application migrations across multiple AWS and on-premises environments. It aggregates migration data and provides dashboards and reports for visibility into migration status, making it the dedicated service for this purpose. Now, why are the other options incorrect? Option A is incorrect. Application Discovery Service helps discover applications and dependencies but does not provide centralized progress tracking. Option B is incorrect. Application Migration Service is used to perform the actual migration of servers, not to track overall migration progress. Option C is incorrect. Service Catalog is for provisioning and managing approved IT services, not for tracking migrations. Therefore, D, AWS Migration Hub, is the correct answer.
Play from 2:20:49 Question 83. Which pillar of the AWS Well-Architected Framework focuses on the ability to recover automatically from service interruptions? Here are the options. Option A. Security. Option B. Performance efficiency. Option C. Operational excellence. Option D. Reliability. Pause the video now if you want time to think about the answer.
The correct answer is D. Reliability. The Reliability pillar of the AWS Well-Architected Framework explicitly focuses on a workload's ability to recover automatically from failures and continue functioning. It encompasses fault tolerance, automatic recovery mechanisms, and resilience to service interruptions. Security focuses on data protection; Performance Efficiency focuses on resource optimization; and Operational Excellence focuses on running workloads effectively. Now, why are the other options incorrect? Option A is incorrect. Security pillar addresses data protection, access control, and threat prevention, not automatic recovery. Option B is incorrect. Performance Efficiency pillar focuses on optimizing compute, memory, and network resources, not recovery mechanisms. Option C is incorrect. Operational Excellence pillar covers operational procedures and monitoring, not automatic recovery from interruptions. Therefore, D, Reliability, is the correct answer.
Play from 2:22:33 Question 84. A company hosts a large amount of data in AWS. The company wants to identify if any of the data should be considered sensitive. Which AWS service will meet the requirement? Here are the options. Option A. Amazon Inspector. Option B. Amazon Macie. Option C. AWS Identity and Access Management (IAM). Option D. Amazon CloudWatch. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon Macie. Amazon Macie is an AWS service specifically designed to discover, classify, and protect sensitive data in AWS. It uses machine learning and pattern matching to identify personally identifiable information (PII) and other sensitive data types, making it the appropriate choice for identifying sensitive data across large datasets. Now, why are the other options incorrect? Option A is incorrect. Amazon Inspector is for assessing security vulnerabilities in EC2 instances and applications, not for identifying sensitive data. Option C is incorrect. AWS IAM manages access and permissions but does not identify sensitive data within stored information. Option D is incorrect. Amazon CloudWatch is for monitoring and logging application and infrastructure metrics, not for discovering sensitive data. Therefore, B, Amazon Macie, is the correct answer.
Play from 2:24:23 Question 85. Which characteristic of the AWS Cloud helps users eliminate underutilized CPU capacity? Here are the options. Option A. Agility. Option B. Elasticity. Option C. Reliability. Option D. Durability. Pause the video now if you want time to think about the answer.
The correct answer is B. Elasticity. Elasticity is the ability to scale resources up and down based on demand, which allows companies to provision only the capacity needed and eliminate underutilized resources. This dynamic scaling ensures CPU capacity is used efficiently without paying for unused resources, directly addressing underutilized CPU capacity. Now, why are the other options incorrect? Option A is incorrect. Agility refers to speed of deployment and innovation, not resource utilization efficiency. Option C is incorrect. Reliability ensures systems function correctly but does not address underutilized capacity. Option D is incorrect. Durability ensures data persistence but is unrelated to CPU capacity utilization. Therefore, B, Elasticity, is the correct answer.
Play from 2:25:52 Question 86. Which AWS service or feature gives users the ability to capture information about network traffic in a VPC? Here are the options. Option A. VPC Flow Logs. Option B. Amazon Inspector. Option C. VPC route tables. Option D. AWS CloudTrail. Pause the video now if you want time to think about the answer.
The correct answer is A. VPC Flow Logs. VPC Flow Logs is the AWS service that captures detailed information about network traffic flowing in and out of network interfaces in a VPC. It provides logs of IP traffic and is essential for troubleshooting connectivity issues and monitoring traffic patterns. Amazon Inspector is for security assessment, route tables define traffic routing, and CloudTrail logs AWS API calls. Now, why are the other options incorrect? Option B is incorrect. Amazon Inspector is a vulnerability assessment service that identifies security issues, not for capturing network traffic. Option C is incorrect. VPC route tables define how traffic is routed between subnets and networks, not capture traffic information. Option D is incorrect. AWS CloudTrail logs API calls and account activities, not VPC network traffic itself. Therefore, A, VPC Flow Logs, is the correct answer.
Play from 2:27:33 Question 87. Which AWS service can companies use to subscribe to RSS feeds for updates about all AWS service issues? Here are the options. Option A. Amazon Simple Notification Service (Amazon SNS). Option B. AWS Health Dashboard. Option C. AWS Config. Option D. AWS CodeCommit. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Health Dashboard. AWS Health Dashboard is the primary service designed to provide RSS feeds and notifications about AWS service health, maintenance events, and issues affecting your resources. It allows companies to subscribe to updates about service status in their region. Now, why are the other options incorrect? Option A is incorrect. Amazon SNS is a messaging service for notifications but is not specifically designed to track AWS service issues. Option C is incorrect. AWS Config tracks resource configurations and compliance but does not provide RSS feeds for service status updates. Option D is incorrect. AWS CodeCommit is a version control service and has no role in tracking service health or issues. Therefore, B, AWS Health Dashboard, is the correct answer.
Play from 2:29:12 Question 88. A company wants to protect its AWS Cloud information, systems, and assets while performing risk assessment and mitigation tasks. Which pillar of the AWS Well-Architected Framework is supported by these goals? Here are the options. Option A. Reliability. Option B. Security. Option C. Operational excellence. Option D. Performance efficiency. Pause the video now if you want time to think about the answer.
The correct answer is B. Security. The Security pillar of the AWS Well-Architected Framework encompasses protecting cloud information, systems, and assets, performing risk assessments, implementing security controls, and establishing mitigation strategies to ensure confidentiality and integrity. Now, why are the other options incorrect? Option A is incorrect. Reliability focuses on system recovery and availability, not primarily on information protection and risk mitigation. Option C is incorrect. Operational excellence emphasizes efficient operations, monitoring, and management practices rather than security protection. Option D is incorrect. Performance efficiency focuses on compute, storage, and resource optimization, not security risk management. Therefore, B, Security, is the correct answer.
Play from 2:30:53 Question 89. What is the purpose of having an internet gateway within a VPC? Here are the options. Option A. To create a VPN connection to the VPC. Option B. To allow communication between the VPC and the internet. Option C. To impose bandwidth constraints on internet traffic. Option D. To load balance traffic from the internet across Amazon EC2 instances. Pause the video now if you want time to think about the answer.
The correct answer is B. To allow communication between the VPC and the internet. An Internet Gateway is a VPC component that enables communication between instances within a VPC and the internet. It provides a route for internet-routable traffic and serves as a target for internet-destined traffic in routing tables. Now, why are the other options incorrect? Option A is incorrect. An Internet Gateway enables internet access, not VPN connections; VPN connections require a VPN Gateway. Option C is incorrect. Internet Gateways do not impose bandwidth constraints; they simply enable connectivity. Option D is incorrect. Internet Gateways do not perform load balancing; that function is provided by Elastic Load Balancers. Therefore, B, To allow communication between the VPC and the internet, is the correct answer.
Play from 2:32:37 Question 90. Which option is a customer responsibility under the AWS shared responsibility model? Here are the options. Option A. Maintenance of underlying hardware of Amazon EC2 instances. Option B. Application data security. Option C. Physical security of data centers. Option D. Maintenance of VPC components. Pause the video now if you want time to think about the answer.
The correct answer is B. Application data security. Under the AWS shared responsibility model, customers are responsible for application data security, including data encryption, access controls, and protecting sensitive information. AWS handles the security of the infrastructure itself, while customers secure their data and applications running on AWS resources. Now, why are the other options incorrect? Option A is incorrect. AWS is responsible for maintaining the underlying hardware and hypervisor for EC2 instances. Option C is incorrect. AWS is responsible for physical security of data centers as part of their infrastructure security. Option D is incorrect. AWS is responsible for maintaining VPC infrastructure components; customers configure and manage their VPC settings. Therefore, B, Application data security, is the correct answer.
Play from 2:34:19 Question 91. Which type of AWS storage is ephemeral and is deleted when an Amazon EC2 instance is stopped or terminated? Here are the options. Option A. Amazon Elastic Block Store (Amazon EBS). Option B. Amazon EC2 instance store. Option C. Amazon Elastic File System (Amazon EFS). Option D. Amazon S3. Pause the video now if you want time to think about the answer.
The correct answer is B. Amazon EC2 instance store. Amazon EC2 instance store provides ephemeral block-level storage that is physically attached to the host computer and is deleted when the instance stops or terminates. EBS volumes persist by default even after instance termination, EFS is a persistent file system, and S3 is persistent object storage. Now, why are the other options incorrect? Option A is incorrect. Amazon EBS volumes persist by default and can be retained even after instance termination unless explicitly deleted. Option C is incorrect. Amazon EFS is a persistent file system that persists independently of EC2 instance lifecycle. Option D is incorrect. Amazon S3 is persistent object storage that remains available indefinitely unless manually deleted. Therefore, B, Amazon EC2 instance store, is the correct answer.
Play from 2:36:09 Question 92. Which AWS service provides highly durable object storage? Here are the options. Option A. Amazon S3. Option B. Amazon Elastic File System (Amazon EFS). Option C. Amazon Elastic Block Store (Amazon EBS). Option D. Amazon FSx. Pause the video now if you want time to think about the answer.
The correct answer is A. Amazon S3. Amazon S3 provides highly durable object storage with 11 nines of durability (99.999999999%), designed specifically for storing and retrieving large amounts of unstructured data reliably and securely at scale. Now, why are the other options incorrect? Option B is incorrect. Amazon EFS is a file system service for shared file access, not object storage. Option C is incorrect. Amazon EBS provides block storage for EC2 instances, not object storage. Option D is incorrect. Amazon FSx is a managed file system service, not object storage. Therefore, A, Amazon S3, is the correct answer.
Play from 2:37:37 Question 93. Which AWS service is always provided at no charge? Here are the options. Option A. Amazon S3. Option B. AWS Identity and Access Management (IAM). Option C. Elastic Load Balancers. Option D. AWS WAF. Pause the video now if you want time to think about the answer.
The correct answer is B. AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is always provided at no charge. There are no costs for creating users, groups, roles, or policies, making it a foundational service available to all AWS accounts. Now, why are the other options incorrect? Option A is incorrect. Amazon S3 charges for storage capacity, data transfer, and requests. Option C is incorrect. Elastic Load Balancers incur hourly charges and data processing fees. Option D is incorrect. AWS WAF charges per web ACL and per rule evaluated. Therefore, B, AWS Identity and Access Management (IAM), is the correct answer.
Play from 2:39:10 Question 94. Which option is a customer responsibility when using Amazon DynamoDB under the AWS Shared Responsibility Model? Here are the options. Option A. Physical security of DynamoDB. Option B. Patching of DynamoDB. Option C. Access to DynamoDB tables. Option D. Encryption of data at rest in DynamoDB. Pause the video now if you want time to think about the answer.
The correct answer is C. Access to DynamoDB tables. Under the AWS Shared Responsibility Model, customers are responsible for controlling access to DynamoDB tables through IAM policies, application-level controls, and access management. AWS is responsible for the physical security of the infrastructure, patching and maintaining the DynamoDB service itself, and managing encryption at rest. While encryption can be customer-managed with KMS, the fundamental responsibility for providing encryption is AWS's as part of the managed service. Now, why are the other options incorrect? Option A is incorrect. Physical security of the underlying infrastructure is AWS's responsibility in the managed service model. Option B is incorrect. AWS is responsible for patching and maintaining the DynamoDB service as a fully managed database. Option D is incorrect. Encryption at rest in DynamoDB is provided and maintained by AWS; customers may manage encryption keys but not the encryption service itself. Therefore, C, Access to DynamoDB tables, is the correct answer.
Play from 2:41:07 Question 95. A company wants to gain insights from its data and build interactive data visualization dashboards. Which AWS service will meet these requirements? Here are the options. Option A. Amazon SageMaker. Option B. Amazon Rekognition. Option C. Amazon QuickSight. Option D. Amazon Kinesis. Pause the video now if you want time to think about the answer.
The correct answer is C. Amazon QuickSight. Amazon QuickSight is AWS's business analytics and visualization service designed to create interactive dashboards and gain insights from data. Amazon SageMaker is for machine learning, Amazon Rekognition is for image and video analysis, and Amazon Kinesis is for real-time data streaming, none are designed for interactive dashboard creation. Now, why are the other options incorrect? Option A is incorrect. Amazon SageMaker is a machine learning service, not designed for creating visualization dashboards. Option B is incorrect. Amazon Rekognition analyzes images and videos for object detection, not for data visualization dashboards. Option D is incorrect. Amazon Kinesis is a real-time data streaming service, not designed for interactive dashboard creation. Therefore, C, Amazon QuickSight, is the correct answer.
Play from 2:42:48 Question 96. Which AWS service helps users audit API activity across their AWS account? Here are the options. Option A. AWS CloudTrail. Option B. Amazon Inspector. Option C. AWS WAF. Option D. AWS Config. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS CloudTrail. AWS CloudTrail is the primary service for auditing and logging API activity across AWS accounts. It records all API calls made to AWS services, providing a complete history of account activity, user actions, and resource changes. This is essential for compliance, security monitoring, and troubleshooting. Inspector, WAF, and Config serve different purposes (vulnerability assessment, web protection, and configuration tracking respectively). Now, why are the other options incorrect? Option B is incorrect. Amazon Inspector is used for vulnerability assessments of EC2 instances and applications, not API auditing. Option C is incorrect. AWS WAF protects web applications from common web exploits, not for auditing API activity. Option D is incorrect. AWS Config tracks configuration changes of AWS resources but does not audit API calls system-wide. Therefore, A, AWS CloudTrail, is the correct answer.
Play from 2:44:38 Question 97. A company needs to block SQL injection attacks. Which AWS service or feature can meet this requirement? Here are the options. Option A. AWS WAF. Option B. AWS Shield. Option C. Network ACLs. Option D. Security groups. Pause the video now if you want time to think about the answer.
The correct answer is A. AWS WAF. AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. It allows you to create rules to filter and block malicious requests based on patterns and signatures. AWS Shield protects against DDoS attacks, Network ACLs filter traffic at the subnet level, and Security Groups filter at the instance level, but none of these provide SQL injection protection like WAF does. Now, why are the other options incorrect? Option B is incorrect. AWS Shield protects against DDoS attacks, not SQL injection. Option C is incorrect. Network ACLs operate at Layer 4 and cannot inspect application-level attacks like SQL injection. Option D is incorrect. Security Groups control traffic based on IP and ports, not application-layer attack patterns. Therefore, A, AWS WAF, is the correct answer.
Play from 2:46:20 Question 98. A company wants to run its workloads in the AWS Cloud effectively, reduce management overhead, and improve processes. Which AWS Well-Architected Framework pillar represents these requirements? Here are the options. Option A. Reliability. Option B. Operational excellence. Option C. Performance efficiency. Option D. Cost optimization. Pause the video now if you want time to think about the answer.
The correct answer is B. Operational excellence. Operational Excellence is the pillar focused on running workloads effectively, reducing management overhead, and improving processes through automation and best practices. This pillar emphasizes operational procedures, monitoring, and continuous improvement. Reliability ensures availability, Performance Efficiency optimizes resource utilization, and Cost Optimization minimizes spending, none of these directly address reducing management overhead and improving operational processes. Now, why are the other options incorrect? Option A is incorrect. Reliability focuses on system availability and fault tolerance, not management overhead reduction. Option C is incorrect. Performance Efficiency optimizes compute and resource utilization, not operational processes. Option D is incorrect. Cost Optimization focuses on minimizing spending, not improving management and operational processes. Therefore, B, Operational excellence, is the correct answer.
Play from 2:48:10 Question 99. A company wants to use application stacks to run a workload in the AWS Cloud. The company wants to use pre-configured instances. Which AWS service will meet these requirements? Here are the options. Option A. Amazon Lightsail. Option B. Amazon Athena. Option C. AWS Outposts. Option D. Amazon EC2. Pause the video now if you want time to think about the answer.
The correct answer is A. Amazon Lightsail. Amazon Lightsail is specifically designed to provide pre-configured application stacks with templates for popular applications. It offers easy-to-use virtual private servers with pre- installed software stacks, making it ideal for users who want simplified cloud deployment without deep infrastructure knowledge. While EC2 can run workloads, it requires manual configuration and is not pre-configured. Now, why are the other options incorrect? Option B is incorrect. Amazon Athena is a query service for analyzing data in S3, not for running application stacks. Option C is incorrect. AWS Outposts extends AWS infrastructure on-premises but doesn't provide pre-configured application stacks. Option D is incorrect. Amazon EC2 requires manual configuration and is not pre-configured for application stacks. Therefore, A, Amazon Lightsail, is the correct answer.
Play from 2:49:54 Question 100. Which pillar of the AWS Well-Architected Framework aligns with the ability to make frequent, small, and reversible changes to AWS Cloud architecture? Here are the options. Option A. Security. Option B. Cost optimization. Option C. Operational excellence. Option D. Performance efficiency. Pause the video now if you want time to think about the answer.
The correct answer is C. Operational excellence. The Operational Excellence pillar emphasizes the ability to frequently make small, incremental, and reversible changes to the cloud architecture. This allows for rapid iteration, quick recovery from failures, and continuous improvement. Security focuses on protecting systems, Cost Optimization on reducing expenses, and Performance Efficiency on resource utilization, none of which specifically emphasize frequent, small, reversible changes. Now, why are the other options incorrect? Option A is incorrect. The Security pillar focuses on protecting information and systems, not on making frequent changes. Option B is incorrect. The Cost Optimization pillar focuses on avoiding or eliminating unneeded costs. Option D is incorrect. The Performance Efficiency pillar focuses on using computing resources efficiently, not on making frequent reversible changes. Therefore, C, Operational excellence, is the correct answer.
