AWS Certified Cloud Practitioner (CLF-C02) Practice Test – 381 Free Exam Questions with Answers

Correct answer: D. Replatform

Replatforming involves moving to a managed cloud service like Amazon RDS to reduce operational overhead without rewriting applications. Rehosting is a distractor that simply lifts and shifts servers to EC2, retaining all management burdens.

Correct answer: A. Infrastructure as a Service (IaaS)

Amazon EC2 represents Infrastructure as a Service because it provides foundational computing resources where you manage the operating system and applications. Remember that Elastic Beanstalk is PaaS, while fully managed products like Rekognition fit the SaaS category.

Correct answer: B. Amazon Elastic File System (Amazon EFS)

EFS provides a scalable file system that can be concurrently accessed by hundreds of EC2 instances. EBS is a strong distractor, but volumes can only be attached to a single instance, and object storage like S3 cannot handle direct file appends.

Correct answer: B. A Network Address Translation gateway (NAT gateway) is managed by AWS · C. A Security Group can have allow rules only

A Security Group is stateful and only supports allow rules, while a NAT Gateway is a fully managed AWS service. Remember that Network ACLs are stateless and support both allow and deny rules, and a NAT instance is managed by the customer.

Correct answer: B. Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Amazon S3 Standard-Infrequent Access is designed for data accessed less frequently but requiring rapid retrieval. While Glacier is cheaper, it is for archives and does not offer rapid access, making Standard-IA the correct choice for this use case.

Correct answer: B. Leverage agile methods to rapidly iterate and evolve · C. Organize your teams around products and value streams

The AWS Cloud Adoption Framework recommends leveraging agile methods and organizing teams around products. This approach shifts organizations away from bureaucratic designs to become more responsive to customer inquiries and feedback.

Correct answer: D. Layer 7

AWS Web Application Firewall inspects HTTP and HTTPS requests to protect against web exploits. This traffic operates at the Application layer, which is Layer 7 of the OSI model. AWS Shield is typically used for Layer 3 and Layer 4 protection.

Correct answer: D. Agility

Agility in the AWS Cloud refers to the ability to rapidly develop, test, and launch new features. Because cloud resources are available on-demand, companies can quickly iterate without waiting for hardware provisioning.

Correct answer: A. Replacing faulty hardware of Amazon EC2 instances · C. Operating the infrastructure layer, the operating system and the platform for the Amazon S3 service

Under the Shared Responsibility Model, AWS is responsible for the security of the cloud infrastructure. This includes physical hardware replacement and managing abstracted services like S3. Customers remain responsible for IAM roles and S3 bucket policies.

Correct answer: D. AWS Lambda

AWS Lambda is a serverless compute service that runs code without provisioning servers. Unlike EC2, EMR, or Elastic Beanstalk, you do not manage the underlying instances, making it the only serverless option on this list.

Correct answer: B. Amazon DynamoDB · C. Amazon Elastic Compute Cloud (Amazon EC2) · E. Amazon Relational Database Service (Amazon RDS)

Amazon EC2, Amazon RDS, and Amazon DynamoDB support reservations to optimize costs for predictable workloads. Services like Amazon S3 and AWS Lambda follow pay-as-you-go pricing and do not offer reservation discounts.

Correct answer: D. Weighted routing

Weighted routing allows you to distribute traffic across multiple resources by assigning specific proportional values. Use latency-based routing when your priority is sending users to the fastest responding region instead.

Correct answer: B. AWS Business Support

Business Support is the lowest tier offering contextual architectural guidance for specific use cases. A strong distractor is Enterprise Support, which provides proactive consultative reviews and a Technical Account Manager.

Correct answer: A. Amazon Simple Storage Service (Amazon S3) · D. Amazon DynamoDB

Amazon S3 and DynamoDB are the only services supporting gateway endpoints. Other supported services use interface endpoints powered by PrivateLink, which use elastic network interfaces instead of route table modifications.

Correct answer: C. AWS CloudTrail

AWS CloudTrail records account-specific API actions for auditing user activity and compliance. AWS Config is a strong distractor, but it specifically evaluates resource configuration changes rather than account-level API events.

Correct answer: B. Amazon S3 Glacier Deep Archive

S3 Glacier Deep Archive has the longest retrieval time, taking up to 48 hours for standard requests. Glacier Flexible Retrieval is a common distractor, but its maximum expedited retrieval time is only five minutes.

Correct answer: B. AWS Elastic Load Balancing (ELB)

Elastic Load Balancing distributes incoming traffic across multiple registered targets like EC2 instances. AWS Auto Scaling is a strong distractor, but it only adjusts the number of instances rather than routing requests.

Correct answer: D. AWS Global Accelerator · E. Amazon Route 53

AWS Shield Advanced provides expanded DDoS protection for Route 53 and Global Accelerator, along with CloudFront, Elastic Load Balancing, and EC2. Be careful with API Gateway and Elastic Beanstalk, as they are covered by Shield Standard, not Advanced.

Correct answer: B. Data center hardware infrastructure expenditure · E. Data center physical security expenditure

Migrating to AWS shifts data center hardware and physical security costs from fixed capital expenses to variable operational expenses. Software licenses and personnel salaries remain unaffected by this infrastructure transition, making them incorrect choices here.

Correct answer: C. Leverage AWS Professional Services to accelerate the infrastructure migration · D. Utilize AWS Partner Network (APN) to build a custom solution for this infrastructure migration

AWS Professional Services and the AWS Partner Network provide the expert consulting needed to accelerate and build custom infrastructure migration solutions. Standard AWS Support and Trusted Advisor cannot execute complex migrations, and forums lack official migration authority.

Correct answer: D. AWS Budgets

AWS Budgets lets you set custom reservation utilization or coverage targets and triggers alerts when usage drops below your defined threshold. Trusted Advisor offers general best practices, while CloudTrail simply logs API actions without cost monitoring capabilities.

Correct answer: A. AWS Basic Support · E. AWS Developer Support

The Basic and Developer Support plans only provide access to the core Trusted Advisor checks for service limits and basic security. Business and Enterprise support tiers unlock the full suite of Trusted Advisor best practice checks across all categories.

Correct answer: C. The company would not be charged for this data transfer

Data transfer between AWS services within the same region is free, so moving data between EC2 and S3 incurs no transfer charges. Watch out for outbound data transfer to the public internet, as AWS aggregates and charges for that specific traffic.

Correct answer: A. Contact AWS Abuse Team

The AWS Abuse team is the correct contact for reporting prohibited behaviors, such as malicious attacks originating from AWS-owned IP addresses. Standard AWS Support handles technical issues and cannot process abuse reports or enforce prohibited usage violations.

Correct answer: C. Use Access Key ID and Secret Access Key to access AWS resources programmatically

Access keys, consisting of an access key ID and a secret access key, authenticate programmatic requests via the API or CLI. Remember that MFA secures console logins but cannot directly authenticate programmatic requests without specialized temporary credential configurations.

Correct answer: B. Configure the database in RDS Multi-AZ deployment with automatic failover to the standby

Multi-AZ deployments provide high availability via a synchronous standby instance and an automatic failover mechanism. RDS keeps the same endpoint after failover, allowing the application to reconnect seamlessly. Read replicas require manual promotion and do not use a standby.

Correct answer: B. AWS Compute Optimizer

Compute Optimizer uses machine learning to analyze historical utilization and recommend optimal resource configurations for instances, volumes, and functions. Cost Explorer is a strong distractor, but it focuses on visualizing past spending and broad cost trends rather than active performance rightsizing.

Correct answer: C. AWS Pricing Calculator

The AWS Pricing Calculator estimates monthly bills by modeling services before deployment. Cost Explorer is a strong distractor, but it analyzes historical spending and existing resources rather than forecasting costs for new infrastructure.

Correct answer: A. Use Amazon Transcribe to convert speech to text for downstream analysis. Then use Amazon Polly to convey the text results via speech

Amazon Transcribe converts speech into text for analytics, while Amazon Polly turns text into lifelike speech. Amazon Translate is a distractor because it handles language-to-language translation, not speech recognition or text-to-speech.

Correct answer: A. Trade capital expense for variable expense · E. Benefit from massive economies of scale · F. Go global in minutes and deploy applications in multiple regions around the world with just a few clicks

Trading capital expense for variable expense, benefiting from massive economies of scale, and going global in minutes are all core advantages of cloud computing. The incorrect options describe the rigid capacity planning and heavy upfront costs of traditional infrastructure.

Correct answer: A. Amazon DynamoDB with global tables

Amazon DynamoDB global tables provide an active-active cross-region configuration for a fully managed NoSQL database. DAX only provides in-memory caching for a single region, while Aurora multi-master is a relational database rather than a NoSQL solution.

Correct answer: D. Amazon Macie

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data stored in Amazon S3 buckets. AWS Secrets Manager is for storing credentials securely, not for automatically scanning and identifying sensitive data within files.

Correct answer: D. EBS volume can be attached to a single instance in the same Availability Zone (AZ) whereas EFS file system can be mounted on instances across multiple Availability Zones (AZ)

An EBS volume is attached to a single instance within the same Availability Zone, whereas an EFS file system can be mounted across multiple instances and zones. EFS provides regional scalability, distinguishing it from the strictly zonal EBS volumes.

Correct answer: A. Amazon Simple Notification Service (SNS) · B. Amazon Simple Queue Service (SQS)

Amazon SNS and Amazon SQS are managed messaging services designed to decouple and scale microservices by handling communication between components. AWS Lambda and EC2 execute code, while Step Functions simply coordinate workflows rather than acting as a decoupling message broker.

Correct answer: D. Trade capital expense for variable expense · E. Eliminate guessing on your infrastructure capacity needs

The cloud allows you to trade upfront capital expenses for pay-as-you-go variable expenses while eliminating the need to guess infrastructure capacity. Options involving on-premises hardware or early capacity decisions represent traditional IT bottlenecks, not cloud benefits.

Correct answer: D. The AWS Product Team automatically

Amazon Aurora is a managed service where AWS handles the underlying infrastructure. The AWS Product Team automatically patches the operating system and database components. Customers cannot use Systems Manager or SSH into the underlying instances.

Correct answer: C. AWS Direct Connect

AWS Direct Connect establishes a dedicated, private network connection from on-premises environments to AWS. Remember that Site-to-Site VPN traffic also technically goes over the public internet, even though it encrypts the data in transit.

Correct answer: B. EC2 Reserved Instance (RI)

EC2 Reserved Instances provide significant discounts for long-term commitments without the risk of interruption. Spot Instances cost less but can be terminated, making them unsuitable for workloads requiring continuous uptime.

Correct answer: C. Use AWS Organizations to manage AWS accounts of all units and then share the reserved EC2 instances amongst all units

AWS Organizations allows you to centrally manage multiple accounts and enables Reserved Instance sharing across them. Cost Explorer and Trusted Advisor offer cost visibility and recommendations but cannot execute resource sharing.

Correct answer: B. Amazon Simple Storage Service (Amazon S3) · E. Amazon Elastic File System (Amazon EFS)

Amazon S3 provides object storage, while Amazon EFS provides managed file storage. For the exam, remember that EC2 is strictly a compute service, and SNS and SQS handle messaging, not storage.

Correct answer: D. AWS Artifact

AWS Artifact is the central portal for on-demand access to security and compliance reports like HIPAA documents. Trusted Advisor checks infrastructure against best practices but does not provide compliance artifacts.

Correct answer: B. Amazon Inspector

Amazon Inspector performs automated security assessments to check EC2 instances for unintended network exposure and software vulnerabilities. GuardDuty focuses on account-level threat detection, while Macie discovers sensitive data.

Correct answer: C. Each Availability Zone (AZ) consists of one or more discrete data centers · D. Each AWS Region consists of a minimum of three Availability Zones (AZ)

An AWS Region contains at least three Availability Zones, and each Zone consists of one or more discrete data centers. If an option claims a Region has only two Zones, it contradicts the current infrastructure baseline.

Correct answer: D. AWS Shield Standard

AWS Shield Standard is automatically enabled for all AWS customers at no extra cost to protect against common DDoS attacks. Shield Advanced requires a paid subscription for specialized support and enhanced protection.

Correct answer: C. AWS X-Ray

AWS X-Ray helps developers analyze, debug, and trace requests through distributed serverless microservices. CloudFormation provisions the infrastructure but cannot provide deep application performance tracing.

Correct answer: A. Dedicated Host

Dedicated Hosts provide physical servers dedicated to your account, allowing you to use existing server-bound software licenses like Microsoft or Oracle. Dedicated Instances run on single-tenant hardware but lack the physical instance visibility needed for licenses.

Correct answer: A. Amazon Redshift

Amazon Redshift is a managed petabyte-scale data warehouse service used for large-scale data storage and analysis. AWS Glue handles extract, transform, and load operations, while DMS specifically handles database migrations rather than storage.

Correct answer: A. Fault tolerance is achieved by a scale up operation

Scaling up means adding resources to a single machine, which creates a single point of failure. Fault tolerance requires scaling out across multiple instances, ensuring remaining instances handle traffic if one fails.

Correct answer: A. AWS Enterprise Support · E. AWS Business Support

Both Business and Enterprise Support plans include guidance, configuration, and troubleshooting for third-party software and operating systems. The Basic and Developer tiers limit you to general architectural guidance or account issues, excluding deeper interoperability support.

Correct answer: C. Partial upfront payment option with standard 3-years term

Reserved Instances offer the highest discounts for the longest commitments and largest upfront payments. However, the option missing a three-year all-upfront choice makes the partial upfront option conditionally correct based on the available selections. A three-year term always yields bigger savings than one year.

Correct answer: A. Instance Store

Instance Store provides direct access to hardware disks, offering the fast I/O needed for computation without additional storage fees. EBS is a strong distractor, but it incurs extra costs and does not match the raw physical performance of attached hardware.

Correct answer: D. AWS Shield

AWS Shield is a managed service specifically designed to protect applications from distributed denial of service attacks. While CloudWatch monitors metrics and alerts you to anomalies, Shield actively provides the mitigation needed to stop the attack traffic.

Correct answer: D. customer managed key (CMK)

Customer managed keys in AWS KMS give you complete control over your encryption keys, including their policies and rotation. AWS managed keys are handled by the service itself, meaning you cannot explicitly create or manage their underlying policies.

Correct answer: B. Configuration Management

Configuration management is a shared control where AWS secures its infrastructure while customers secure their own guest operating systems. Physical hardware maintenance and guaranteeing data separation between customers remain strictly the responsibility of AWS.

Correct answer: B. AWS Software Developer Kit (SDK)

The correct answer works because the AWS Software Development Kit provides language-specific APIs to interact with AWS services programmatically. The Command Line Interface is a unified tool for terminal management, but it is not designed to integrate directly into application source code.

Correct answer: A. The AWS account must be able to operate as a standalone account. Only then it can be removed from AWS organizations

The correct answer works because a member account must have the required billing and contact details to operate as a standalone account before removal. Service Control Policies do not block deletion; they simply stop applying once the account leaves the organization.

Correct answer: B. Enable client-side encryption using AWS encryption SDK

The correct answer works because client-side encryption ensures data is securely encrypted before it ever leaves your local environment for Amazon S3. Server-side encryption options are incorrect because they only protect data after it reaches the AWS servers.

Correct answer: C. Physical and Environmental controls

The correct answer works because AWS manages the physical security and environmental controls of the data centers under the shared responsibility model. Patching guest operating systems and configuring applications remain strict responsibilities of the customer.

Correct answer: A. APN Consulting Partner

An APN Consulting Partner provides professional services to help companies design and migrate applications to AWS. While APN Technology Partners provide software solutions, they do not offer the direct professional management asked for here.

Correct answer: C. 60 seconds

Linux EC2 instances have a 60-second minimum billing duration, so terminating after 30 seconds still incurs a one-minute charge. Windows instances historically had a higher minimum, but Linux per-second billing requires this minute minimum.

Correct answer: C. AWS PrivateLink

AWS PrivateLink provides private connectivity between VPCs and supported AWS services without traversing the public internet. While Transit Gateway connects networks privately, remember that an Internet Gateway explicitly enables public access, contradicting the scenario requirements.

Correct answer: D. AWS CloudTrail Logs

CloudTrail encrypts log files by default using Amazon S3 managed keys when delivering to your bucket. Other storage options like EBS, EFS, and RDS are strong distractors, but they require manual configuration to enable encryption at rest.

Correct answer: A. Engineer · C. Chief Technology Officer (CTO)

The correct answer works because the platform perspective focuses on infrastructure provisioning and includes roles like the Chief Technology Officer and engineers. Remember that business leaders like the Chief Information Officer map to the business perspective instead.

Correct answer: A. Then, credit two is applied to the remaining $900 of Amazon EC2 usage · D. Credit one is applied, which expires in July, to the Amazon EC2 charge which leaves you with a $900 Amazon EC2 charge and a $500 Amazon S3 charge

AWS applies credits chronologically by expiration date, meaning the July credit is consumed first. Since both Amazon S3 and EC2 are eligible, the system applies it to the EC2 charge first. The remaining December credit is then applied to the remaining EC2 usage.

Correct answer: B. 90

Spot instances allow you to take advantage of unused EC2 capacity at a steep discount. For the exam, remember that spot instances offer up to a ninety percent discount compared to standard on-demand pricing.

Correct answer: C. Amazon Elastic Container Service (Amazon ECS) – Fargate launch type

The Fargate launch type for Amazon ECS is correct because it is a serverless compute engine that removes the need to provision and manage underlying servers. For the exam, associate Fargate with serverless containers, whereas the EC2 launch type requires you to manage the infrastructure.

Correct answer: B. Envision

The Envision phase focuses on demonstrating how cloud adoption accelerates business outcomes and ties directly to strategic goals. For the exam, associate Align with addressing capability gaps, Launch with delivering pilot initiatives, and Scale with expanding production workloads.

Correct answer: D. AWS Trusted Advisor

AWS Trusted Advisor evaluates your AWS environment against established best practices for cost optimization, security, and performance. While Amazon Inspector is the stronger distractor, it strictly scans applications for code vulnerabilities rather than broader architectural improvements.

Correct answer: A. Amazon Athena

Amazon Athena is a serverless query service that allows you to analyze data directly in S3 using standard SQL without complex setups. While Amazon Redshift is a strong distractor, it is a full data warehouse requiring data loading rather than direct analysis.

Correct answer: B. Amazon DynamoDB

Amazon DynamoDB is a fast NoSQL database service that supports flexible schemas alongside key-value and document data models. Relational database options like Amazon Relational Database Service require rigid, predefined table structures that cannot easily adapt.

Correct answer: A. You can automatically deploy AWS Shield when a DDoS attack is detected

AWS Auto Scaling cannot automatically deploy AWS Shield during an attack because Shield must be configured independently as a dedicated service. Remember that Auto Scaling strictly handles capacity by adjusting instance counts, removing unhealthy resources, and integrating load balancers.

Correct answer: B. On-demand Instance

On-Demand Instances offer maximum flexibility without requiring upfront payments or long-term commitments while guaranteeing continuous operation. Spot Instances are the strongest distractor, but they carry a strict risk of interruption, which violates the specific requirement.

Correct answer: A. IAM User

The correct answer works because access key IDs and secret access keys act as long-term credentials directly tied to an IAM user for programmatic access. Remember that IAM roles use temporary security tokens instead of long-term keys, making them ideal for cross-account access or granting permissions to AWS services.

Correct answer: C. AWS Health – Your Account Health Dashboard

Your Account Health Dashboard works because it provides a personalized view of service events directly impacting your specific AWS resources. Remember that the Service Health Dashboard only shows the general global status of AWS services, while CloudWatch monitors your application and resource performance metrics.

Correct answer: D. AWS Marketplace

AWS Marketplace works because it serves as a digital catalog where you can easily find, purchase, and immediately deploy third-party software solutions. The other options fail because they handle infrastructure provisioning, configuration auditing, or operational management rather than software sales and distribution.

Correct answer: C. AWS Organizations

AWS Organizations works because it lets you centrally manage multiple accounts, enabling consolidated billing under a single payment method. The other options fail because Cost Explorer and Budgets only analyze or track spending, while Secrets Manager securely stores application credentials.

Correct answer: C. Amazon RDS Multi-AZ enhances database availability

Multi-AZ deployment works because it automatically provisions a synchronous standby replica in a different availability zone to ensure high availability. Remember that read replicas, not standby instances, are used to improve read performance, and deploying across regions is required to survive regional failures.

Correct answer: A. AWS Acceptable Use Policy

The AWS Acceptable Use Policy describes prohibited uses of AWS web services. Do not confuse this with Trusted Advisor, which provides best practice checks, not acceptable use rules.

Correct answer: B. Amazon DynamoDB

Amazon DynamoDB is a serverless NoSQL database that scales automatically with minimal operational overhead. Neptune is for graph databases, while RDS requires more management overhead compared to DynamoDB.

Correct answer: C. AWS Systems Manager Session Manager

AWS Systems Manager Session Manager provides shell access without opening inbound ports or managing SSH keys. EC2 Instance Connect still requires port 22 to be open, making it incorrect here.

Correct answer: B. Latency-based routing

Latency-based routing directs users to the AWS endpoint with the lowest network delay. Weighted routing distributes traffic by percentages, and failover routing is for disaster recovery scenarios.

Correct answer: C. AWS Elastic Beanstalk

AWS Elastic Beanstalk automatically handles deployment and capacity provisioning while retaining full access to underlying resources. EC2 requires manual deployment, and CloudFormation requires explicit resource templates.

Correct answer: A. Database encryption

Under the Shared Responsibility Model, the customer manages data security, including database encryption. AWS handles the underlying infrastructure, server hardware, and operating system patching for managed services.

Correct answer: C. Use Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) to store the thumbnails

Amazon S3 One Zone-Infrequent Access is the most cost-effective tier for rarely accessed, easily regenerable data needing immediate retrieval. Standard-IA is more expensive because it stores data across multiple Availability Zones.

Correct answer: D. Security Group acts as a firewall at the instance level whereas Network Access Control List (Network ACL) acts as a firewall at the subnet level

Security groups operate at the instance level to control traffic, while network ACLs operate at the subnet level. Remember this exam cue: security groups are stateful, whereas network ACLs are stateless.

Correct answer: A. Compute, Storage and Outbound Data Transfer

Compute, storage, and outbound data transfer are correct because these are the three fundamental pricing drivers across AWS services. As a practical exam cue, remember that inbound data transfer is typically free, which immediately eliminates any option pairing compute and storage with inbound traffic.

Correct answer: D. Only outbound data transfer is charged

Only outbound data transfer is charged because AWS does not bill for data incoming from the internet into its regions. Outbound data is aggregated and billed at region specific tiered rates, making inbound transfer a consistently free service across standard exam scenarios.

Correct answer: A. High Availability

High availability is correct because deploying resources across multiple Availability Zones ensures your architecture can withstand a single data center failure. Scaling out involves adding more instances to handle increased load, whereas multi AZ focuses strictly on resilience and uptime.

Correct answer: B. AWS Auto Scaling

AWS Auto Scaling automatically adjusts compute capacity to match demand, ensuring steady performance at the lowest possible cost. Cost Explorer is only a reporting tool for visualizing past spending, so it lacks the capability to actively scale your resources.

Correct answer: D. An Amazon Virtual Private Cloud (Amazon VPC) spans all of the Availability Zones (AZ) in the Region whereas a subnet spans only one Availability Zone (AZ) in the Region

A virtual private cloud spans all Availability Zones within a specific Region, providing a broad isolated network boundary. In contrast, a subnet must be confined to a single Availability Zone to provide highly available architectural designs.

Correct answer: D. Amazon MQ

Amazon MQ is a managed broker service for ActiveMQ and RabbitMQ, designed specifically for easily migrating existing messaging applications to AWS. Use SQS and SNS when building brand new cloud-native applications rather than lifting and shifting legacy code.

Correct answer: C. Elasticity

Elasticity refers to the ability to acquire resources as needed and release them when they are no longer required, matching capacity to dynamic demand. Reliability and durability describe system uptime and data protection, not dynamic resource scaling.

Correct answer: A. Amazon Elastic Container Registry (Amazon ECR)

Amazon Elastic Container Registry is a fully managed service used to store, manage, and deploy Docker container images securely. Do not confuse this with Amazon ECS, which actually runs and orchestrates the containers rather than storing the images.

Correct answer: C. AWS Web Application Firewall (AWS WAF)

The Web Application Firewall protects web applications from common exploits like SQL injection and cross-site scripting by filtering malicious traffic. GuardDuty focuses on broader account threat detection, lacking specific layer seven application filtering capabilities.

Correct answer: B. AWS Budgets

AWS Budgets allows you to set custom cost or usage budgets and trigger alerts when thresholds are exceeded. As a helpful exam tip, AWS Cost Explorer is used for visualizing historical data rather than triggering proactive billing alerts.

Correct answer: B. Amazon Simple Notification Service (SNS) · D. Amazon CloudWatch

Amazon CloudWatch monitors metrics like CPU utilization and can trigger alarms, which then use Amazon SNS to send email notifications. SQS is a queue service and CloudTrail tracks API activity, so they do not fit operational metric alerting.

Correct answer: D. AWS Config

AWS Config continuously monitors and records resource configurations, allowing you to track historical changes and map dependencies. CloudTrail records API account activity rather than tracking state changes of the resources themselves.

Correct answer: C. Amazon FSx for Windows File Server

Amazon FSx for Windows File Server provides fully managed shared storage using the native SMB protocol, designed specifically for Windows environments. Amazon EFS uses NFS and is built primarily for Linux-based workloads.

Correct answer: C. AWS Enterprise Support

AWS Enterprise Support provides a designated Technical Account Manager to coordinate proactive guidance and access to subject matter experts. For the exam, remember that Enterprise On-Ramp only provides access to a pool of Technical Account Managers, rather than a dedicated one.

Correct answer: B. AWS Health Dashboard – service health

The AWS Health Dashboard service health view displays the general status and availability of all AWS services across all Regions. Be sure to distinguish this from your account health, which provides personalized alerts about events impacting your specific resources.

Correct answer: C. AWS CloudHSM

AWS CloudHSM provides dedicated hardware security modules for cryptographic operations, meeting strict compliance controls. Remember that Key Management Service uses shared underlying hardware, so it does not satisfy strict regulatory mandates requiring single-tenant hardware.

Correct answer: B. Amazon Inspector

Amazon Inspector automatically assesses deployed applications for vulnerabilities and deviations from established security best practices. Trusted Advisor is the stronger distractor here, but remember it evaluates global infrastructure optimizations rather than scanning application code.

Correct answer: D. AWS Web Application Firewall (AWS WAF)

AWS Web Application Firewall allows you to create rules that block or allow web requests based on geographic location. AWS Shield is a strong distractor, but it only provides managed protection against distributed denial of service attacks without geo-blocking capabilities.

Correct answer: A. AWS Virtual Private Network (VPN) · C. AWS Direct Connect

Both AWS Virtual Private Network and AWS Direct Connect establish secure network connections between your on-premises data centers and the AWS cloud. Be careful choosing an Internet Gateway, as it only enables communication between instances and the public internet.

Correct answer: A. AWS Management Console · D. AWS Software Development Kit (SDK) · E. AWS Command Line Interface (AWS CLI)

The correct options work because the management console, command line interface, and software development kits are the three primary methods for programmatically or interactively managing AWS services. A helpful exam cue is to distinguish management interfaces from specific infrastructure tools like Systems Manager or Secrets Manager, which manage individual resources.

Correct answer: C. Amazon Simple Storage Service (Amazon S3) is object based storage, Amazon Elastic Block Store (Amazon EBS) is block based storage and Amazon Elastic File System (Amazon EFS) is file based storage

The correct answer works because it accurately aligns the storage types with their defining characteristics across the core storage services. A practical exam cue is remembering that S3 stores objects, EBS attaches as block volumes to EC2 instances, and EFS provides shared file systems.

Correct answer: D. It is highly recommended to enable Multi-Factor Authentication (MFA) for root user account · E. Root user access credentials are the email address and password used to create the AWS account

The correct options work because the root user is created using a specific email and password, and securing it with multi-factor authentication is a critical best practice. A key exam cue is that root user permissions cannot be restricted by IAM policies, so the credentials must be locked away securely.

Correct answer: C. AWS Local Zones

Local Zones place select AWS services like compute and storage closer to major population centers, delivering the required low latency for local users. However, because Wavelength specifically targets ultra-low latency mobile applications via telecom networks, it is also a defensible choice for local latency requirements.

Correct answer: B. Amazon EMR

Amazon EMR works because it is a managed cluster platform specifically designed to process vast amounts of data using big data frameworks like Apache Hadoop. A practical exam cue is to associate EMR with big data, whereas AWS Batch is meant for scheduling standard computing jobs.

Correct answer: B. Amazon Eventbridge · E. AWS Lambda

Amazon EventBridge can trigger an AWS Lambda function on a specific schedule for a serverless solution. EC2 is not serverless, and Step Functions orchestrates workflows rather than acting as a standalone scheduler.

Correct answer: C. Quickly resize photos to create thumbnails

Amazon Rekognition cannot resize photos or create thumbnails, as it is strictly for image and video analysis. You would use a compute service like Lambda for image manipulation tasks.

Correct answer: A. AWS Web Application Firewall (AWS WAF) · B. AWS Shield · F. Amazon CloudFront with Amazon Route 53

AWS Shield, AWS WAF, and the combination of Amazon CloudFront with Amazon Route 53 are correct because they provide managed DDoS protection, layer seven filtering, and edge network resilience. Services like Amazon Inspector or Trusted Advisor evaluate vulnerabilities and best practices but do not actively block traffic.

Correct answer: B. AWS Business Support

AWS Business Support is correct because it is the lowest tier offering twenty four seven phone, email, and chat access for production workloads. Developer Support only provides email during business hours, while Enterprise tiers provide the same access but at a higher cost.

Correct answer: C. AWS Global Accelerator

AWS Global Accelerator is correct because it leverages the highly available AWS global network to route traffic efficiently to optimal regional endpoints. While CloudFront also uses edge locations, it is primarily a content delivery network caching content rather than optimizing non HTTP traffic paths.

Correct answer: B. Amazon Elastic Compute Cloud (Amazon EC2)

Amazon EC2 is correct because it provides secure, resizable virtual servers with per second billing and full access to the operating system. As an exam cue, remember that serverless options like Lambda abstract the OS entirely, whereas containers require additional management overhead.

Correct answer: C. AWS Identity and Access Management (AWS IAM) · E. AWS Auto Scaling

AWS Identity and Access Management and AWS Auto Scaling are correct because neither carries an additional service charge beyond the underlying resources they manage. Services like EC2, S3, and DynamoDB incur usage costs, making IAM and Auto Scaling reliable free utilities on the exam.

Correct answer: A. Performance and capacity management

Performance and capacity management is correct because the Operations perspective of the AWS Cloud Adoption Framework focuses on maintaining reliable cloud service delivery. For the exam, align vulnerability management with Security, and remember that Operations handles day to day health monitoring.

Correct answer: C. Tape Gateway, File Gateway and Volume Gateway

AWS Storage Gateway offers three gateway types: Tape Gateway, File Gateway, and Volume Gateway. For the exam, remember that Block Gateway and Object Gateway are fabricated distractors, as the valid service only provides file, volume, and tape storage interfaces.

Correct answer: B. Edge Location Management

Under the Shared Responsibility Model, AWS is responsible for the security of the cloud, including managing physical infrastructure like edge locations. Customers remain fully responsible for protecting their data, configuring identity access, and managing encryption.

Correct answer: B. Amazon Rekognition

Amazon Rekognition is classified as Software as a Service because it provides a complete, fully managed product ready for immediate use. EC2 represents Infrastructure as a Service, while Elastic Beanstalk is Platform as a Service, where you simply upload application code.

Correct answer: A. Hybrid deployment

A hybrid deployment connects existing on-premises infrastructure to the cloud. For the exam, remember that purely cloud-based is an all-in-cloud deployment, while on-premises virtualization is a private deployment.

Correct answer: B. Amazon Elastic File System (Amazon EFS)

Amazon EFS provides scalable, shared file storage that can be mounted across multiple EC2 instances in different Availability Zones. EBS volumes are restricted to a single instance normally, making it a poor choice for concurrent multi-instance file sharing.

Correct answer: C. AWS Lambda lets you run code without provisioning or managing servers · E. You pay for the compute time you consume for AWS Lambda

AWS Lambda is a serverless compute service that runs code without requiring server management, charging only for actual compute time consumed. You cannot access the underlying operating system or install databases directly on it.

Correct answer: B. AWS Identity and Access Management (AWS IAM) · D. Amazon CloudFront

AWS Identity and Access Management and Amazon CloudFront operate globally rather than within a single region. A practical exam cue is that IAM is managed globally, while Amazon S3 uses a global namespace but stores data regionally.

Correct answer: A. Cost Optimization · B. Reliability

Cost Optimization and Reliability are both official pillars of the AWS Well-Architected Framework. The other valid pillars are Operational Excellence, Security, Performance Efficiency, and Sustainability, while elasticity and scalability are general cloud characteristics.

Correct answer: A. AWS Identity and Access Management (IAM)

AWS Identity and Access Management securely controls access to services and resources across your account. While WAF and Shield protect against network attacks, IAM provides the foundational resource-level security by managing permissions.

Correct answer: B. Read Replicas in Amazon Relational Database Service (Amazon RDS) · E. Elastic Load Balancing (ELB)

Adding RDS Read Replicas and using Elastic Load Balancing are classic examples of horizontal scaling because they add more instances to distribute traffic. Upgrading instance sizes or adding CPUs are vertical scaling methods instead.

Correct answer: A. Amazon Elastic Block Store (Amazon EBS), AWS Lambda functions · B. Amazon Elastic Compute Cloud (Amazon EC2) instances, Amazon EC2 Auto Scaling groups

AWS Compute Optimizer analyzes historical metrics to recommend optimal configurations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. For your exam, remember that Compute Optimizer does not cover object or file storage services.

Correct answer: A. Spot Instance

Spot Instances are ideal for flexible workloads that can tolerate interruptions, offering steep discounts compared to On-Demand pricing. As a practical exam cue, always match the phrase 'can be interrupted' directly to Spot Instances to find the most cost-effective option.

Correct answer: B. Cost Optimization · C. Service Limits

Trusted Advisor inspects your AWS environment and recommends best practices across five pillars: cost optimization, performance, security, fault tolerance, and service limits. For the exam, remember that Trusted Advisor specifically tracks service limits to help you avoid throttling.

Correct answer: D. AWS Cost & Usage Report (AWS CUR)

The AWS Cost and Usage Report publishes comprehensive billing data into an S3 bucket and allows you to break down costs hourly. Cost Explorer is the strongest distractor, but it only provides visual dashboards rather than detailed raw data exports.

Correct answer: A. A security group is stateful, that is, it automatically allows the return traffic · D. A network access control list (network ACL) contains a numbered list of rules and evaluates these rules in the increasing order while deciding whether to allow the traffic

Security groups are stateful, automatically allowing return traffic regardless of inbound rules. Network access control lists are stateless, meaning you must explicitly allow return traffic, and they evaluate numbered rules sequentially from lowest to highest.

Correct answer: D. AWS Lambda

AWS Lambda is a serverless compute service that runs code in response to events like S3 object uploads. While Simple Queue Service can receive S3 event notifications, it cannot execute code itself, making Lambda the correct choice.

Correct answer: C. Operational Excellence

The Operational Excellence pillar champions running and monitoring systems, which includes managing infrastructure as code. For your exam, associate the practice of automating operational procedures and infrastructure deployments directly with this specific pillar.

Correct answer: D. Number of requests for the AWS Lambda function · E. The time it takes for the AWS Lambda function to execute

AWS Lambda bills you based on the total number of requests and the execution duration of your code. The deployment package size only affects storage limits, while your programming language runtime choice has no impact on the final price.

Correct answer: B. Amazon Redshift

Amazon Redshift is the correct choice because it is a fully managed data warehouse designed specifically for running complex analytical queries. For the exam, remember that traditional databases like Amazon RDS handle transactional workloads, whereas Redshift targets analytics and reporting.

Correct answer: C. Use Amazon CloudWatch Logs for both the Amazon Elastic Compute Cloud (Amazon EC2) instance and the on-premises servers

Amazon CloudWatch Logs is correct because it can monitor and store log files from both Amazon EC2 instances and on-premises servers, creating a centralized location. Be careful not to choose AWS CloudTrail, which specifically records API activity for AWS accounts rather than application server logs.

Correct answer: D. Amazon S3 Glacier Flexible Retrieval

Amazon S3 Glacier Flexible Retrieval is the correct choice because it provides low-cost storage designed specifically for long-term archiving and backups. For the exam, use One Zone-Infrequent Access for rarely accessed but quickly needed data, and use Glacier classes when immediate retrieval is unnecessary.

Correct answer: D. Use Amazon CloudFront to improve the performance of your website

Amazon CloudFront caches your static website files at edge locations globally, significantly reducing latency for international users. S3 Transfer Acceleration is for uploads, not downloads, making it the strongest distractor for this scenario.

Correct answer: A. AWS Transit Gateway

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs, simplifying complex network topologies. VPC peering is a weaker distractor because it requires separate connections for each pair and lacks transitive routing.

Correct answer: B. Read Replica improves database scalability

Amazon RDS Read Replicas improve database scalability by offloading read traffic from the primary instance. Do not confuse this with Multi-AZ deployments, which provide high availability and durability instead of scaling.

Correct answer: C. Auto Scaling group scales out and adds more number of Amazon EC2 instances to match an increase in demand · E. Auto Scaling group scales in and reduces the number of Amazon EC2 instances to match a decrease in demand

Auto Scaling groups scale horizontally by adding instances during scale out and removing instances during scale in. Upgrading to larger instance sizes is scaling vertically, which Auto Scaling groups do not handle automatically.

Correct answer: D. Amazon GuardDuty

Amazon GuardDuty is an intelligent threat detection service that continuously monitors for malicious activity across your AWS accounts. CloudTrail records API activity for auditing, but it does not actively detect threats.

Correct answer: B. AWS Region

An AWS Region is a physical geographic location hosting AWS data centers, forming the foundation of the AWS Global Infrastructure. VPCs and subnets are logical customer constructs you build inside those regions.

Correct answer: B. Use S3 cross-region replication (S3 CRR) to replicate data between distant AWS Regions

S3 Cross-Region Replication asynchronously copies your objects to a bucket in a different region, meeting compliance needs efficiently. Writing custom Lambda functions or EC2 scripts is a distractor that requires unnecessary operational overhead.

Correct answer: A. Operating system patches and updates of an Amazon Elastic Compute Cloud (Amazon EC2) instance · D. Managing IAM users and roles

Under the Shared Responsibility Model, customers handle security in the cloud, including EC2 operating system patches and IAM management. AWS is responsible for the global network security and protecting the underlying physical infrastructure.

Correct answer: A. AWS CodeDeploy

AWS CodeDeploy is correct because it specifically automates software deployments to both Amazon EC2 instances and on-premises servers. Remember that AWS CodePipeline only orchestrates the overall continuous delivery workflow by integrating various tools, while AWS CodeCommit securely hosts the source code repositories.

Correct answer: A. AWS is responsible for Security 'of' the Cloud · C. For abstracted services like Amazon S3, AWS operates the infrastructure layer, the operating system, and platforms

AWS is responsible for security of the cloud, managing the physical infrastructure and host operating systems. For abstracted services like S3, AWS fully manages the underlying platform, whereas customers handle guest operating systems and application security.

Correct answer: B. Amazon S3 Versioning

Amazon S3 Versioning is the right choice because it preserves, retrieves, and restores every variant of an object, directly protecting against accidental deletion or overwrites. Lifecycle rules move data between storage classes, while Transfer Acceleration simply improves upload speeds.

Correct answer: C. Software as a service (SaaS)

Gmail represents Software as a Service because it provides a complete, fully managed application directly to the end user over the internet. For the exam, associate SaaS with finished applications managed entirely by the provider, whereas IaaS and PaaS require you to build or manage components.

Correct answer: A. Amazon S3 Glacier Deep Archive

Amazon S3 Glacier Deep Archive is the lowest-cost storage class, explicitly designed for long-term retention of data to meet strict regulatory compliance. While Glacier Flexible Retrieval is also for archives, it costs slightly more than the Deep Archive tier.

Correct answer: C. Amazon Kendra

Amazon Kendra is an intelligent search service that uses machine learning to extract precise answers from unstructured data like PDFs and text files. Remember that Comprehend only extracts insights and entities from text, whereas Kendra functions as a natural language search engine.

Correct answer: C. AWS Knowledge Center

The AWS Knowledge Center provides actionable solutions to the most frequent requests and common problems faced by AWS customers. The Support Center is a strong distractor, but it is used to open and manage technical support cases rather than browse self-service articles.

Correct answer: B. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

S3 One Zone-Infrequent Access stores data in a single Availability Zone, giving it the lowest availability of all S3 classes. Standard and Intelligent-Tiering span multiple Availability Zones, while Glacier is primarily designed for long-term archival.

Correct answer: C. Failover routing

Failover routing routes traffic to a secondary resource only when the primary resource fails health checks, creating an active-passive setup. Weighted routing splits traffic proportionally, which is used for load balancing or testing rather than simple failover.

Correct answer: B. Amazon ElastiCache

ElastiCache is a fully managed in-memory data store that delivers microsecond latency for caching and real-time workloads. RDS relies on disk-backed storage, and DynamoDB is a serverless NoSQL database, so neither provides true in-memory performance.

Correct answer: B. Amazon Machine Image (AMI)

An Amazon Machine Image provides the required template information to launch an instance, including the operating system. EBS provides block storage, EFS provides file storage, and Lambda runs serverless code without requiring a launch template.

Correct answer: C. AWS Database Migration Service (AWS DMS) · E. AWS Snowball

Database Migration Service and Snowball directly facilitate large-scale data migration into AWS. Direct Connect and Site-to-Site VPN establish network connectivity but require you to provide the actual transfer mechanisms.

Correct answer: D. Maintain versions of an AWS Lambda function

Maintaining function versions is the correct answer because managing code and platform configurations remains the customer's responsibility under the shared responsibility model. AWS manages the underlying infrastructure and runtime environments, so patching operating systems or networking components is handled automatically by the provider.

Correct answer: C. AWS Storage Gateway · E. Amazon Simple Storage Service (Amazon S3)

Amazon S3 and AWS Storage Gateway both have encryption enabled automatically by default to protect your data. For the exam, remember that you must manually enable encryption on other storage services like EBS and EFS.

Correct answer: D. Instance Store · E. Amazon Elastic Block Store (Amazon EBS)

Instance Store and Amazon Elastic Block Store provide block-level storage. For the exam, remember that S3 is object storage, EFS is file storage, and ECS is a container orchestration service, not a storage type.

Correct answer: B. Amazon WAF

Amazon WAF is a web application firewall that lets you create geographic match conditions to block traffic from specific countries. Shield protects against DDoS attacks but does not handle geographic restrictions.

Correct answer: D. Virtual Multi-Factor Authentication (MFA) device

A virtual MFA device runs on a smartphone or tablet, generating time-based codes without requiring physical hardware. Hardware MFA and U2F security keys require carrying a separate physical device, which defeats the travel preference.

Correct answer: C. US East (N. Virginia) – us-east-1

CloudWatch billing metric data is always stored in the US East N. Virginia Region, representing worldwide charges. A common exam trap is assuming billing data is stored in the region where the resources are actually provisioned.

Correct answer: B. AWS Config

AWS Config records resource configurations over time, enabling compliance auditing and historical troubleshooting. CloudTrail tracks API calls and user activity, while Config focuses specifically on the state of the resources themselves.

Correct answer: C. AWS Health Dashboard – Your account health

The AWS Health Dashboard alerts you to events affecting your specific resources and provides remediation guidance. Trusted Advisor offers general best practice checks, whereas the Health Dashboard is targeted to your exact account resources.

Correct answer: B. Rotate credentials regularly · D. Enable multi-factor authentication (MFA) for all users

Rotating credentials regularly and enabling multi-factor authentication are fundamental IAM security best practices. Always apply least privilege and never share account credentials or root user access keys.

Correct answer: C. Storing files in an accessible location to satisfy audit requirements

EFS Standard Infrequent Access offers lower costs for files accessed less frequently while remaining readily accessible for audits. It is a multi-zone file system, whereas One Zone is for single availability zone storage.

Correct answer: D. VPC Endpoint

A VPC endpoint privately connects your virtual private cloud to services like S3 without needing an internet gateway. Remember that S3 and DynamoDB use gateway endpoints, while most other services use interface endpoints.

Correct answer: B. Effect, Action

Effect and Action are mandatory elements within an IAM policy statement, defining whether access is allowed or denied and the specific operations. Elements like Sid and Condition are optional, providing extra logic or labeling.

Correct answer: D. Fix the Amazon S3 bucket policy

Fixing the Amazon S3 bucket policy resolves access issues by explicitly allowing the necessary public read permissions for website hosting. For the exam, remember that configuring static website hosting requires disabling block public access settings and attaching a valid bucket policy.

Correct answer: A. Deploy the Amazon Elastic Compute Cloud (Amazon EC2) instances across different Availability Zones (AZ) in the same AWS Region

Deploying Amazon EC2 instances across different Availability Zones in the same Region correctly improves availability by isolating workloads from localized failures. Remember that Availability Zones are physically separated data centers within a single Region, not spanning multiple Regions.

Correct answer: A. EC2 instances can access files on an Amazon Elastic File System (Amazon EFS) file system across many Availability Zones (AZ), Regions and VPCs

Amazon Elastic File System is a regional service natively accessible across multiple Availability Zones, VPCs, and even different Regions using peering connections. Distractors incorrectly restrict this access, but the service inherently provides broad, shared file storage for Linux-based workloads.

Correct answer: C. You must activate both AWS generated tags and user-defined tags separately before they can appear in Cost Explorer or on a cost allocation report · D. For each resource, each tag key must be unique, and each tag key can have only one value

Each tag key must be unique per resource and have exactly one value. Additionally, both user-defined and AWS-generated cost allocation tags must be individually activated in the billing console before they appear in Cost Explorer.

Correct answer: C. Identify objects in a photo

Amazon Rekognition identifies objects, people, text, and scenes in photos, acting as a ready-to-use machine learning feature. It does not handle basic image manipulation tasks like resizing or converting to greyscale, which require different image processing services.

Correct answer: C. Instance Store

An instance store provides temporary, high-speed block storage physically attached to the host computer, making it perfect for fast caches and scratch data. Block storage like EBS is persistent, but it cannot match the raw hardware speed needed for temporary data caching.

Correct answer: A. AWS Snowball

AWS Snowball provides physical devices to move massive datasets offline, bypassing the network constraints of limited bandwidth entirely. Direct Connect takes months to provision and still relies on high-capacity physical network lines, which fails the limited bandwidth constraint.

Correct answer: C. Usage budget · E. Reservation budget · F. Cost budget

AWS Budgets lets you create cost, usage, and reservation budgets to track your cloud spending and resource utilization. You can also track Savings Plans, but hardware, software, and resource budgets are not actual features tested on the exam.

Correct answer: D. Customer gateway · E. Virtual private gateway (VGW)

An AWS Site-to-Site VPN requires a virtual private gateway on the AWS side and a customer gateway representing your on-premises network hardware. Remember that an internet gateway simply allows public traffic into a VPC, while a NAT gateway handles private subnet outbound traffic.

Correct answer: B. AWS Cost Explorer · C. AWS Trusted Advisor

Trusted Advisor and Cost Explorer both identify underutilized instances right out of the box with automated rightsizing recommendations. CloudWatch requires manual configuration of alarms and metrics to monitor utilization, so it does not fit the requirement.

Correct answer: C. Business Perspective

The Business Perspective ensures IT investments align with business objectives and deliver measurable value. The Platform Perspective handles technical architecture, while the Governance Perspective focuses on risk and compliance management.

Correct answer: C. Amazon Elastic File System (Amazon EFS) · D. Amazon DynamoDB

DynamoDB and EFS provide built-in high availability by automatically replicating data across multiple availability zones. EBS volumes and subnets are confined to a single availability zone, meaning they require manual setup for resilience.

Correct answer: A. Create separate AWS accounts for development and production environments to receive separate invoices

Creating separate AWS accounts for each environment ensures you naturally receive separate monthly invoices. AWS Organizations actually consolidates billing into one central payer account, while Cost Explorer and tags only help visualize costs.

Correct answer: A. Amazon Elastic Container Service (Amazon ECS)

Amazon Elastic Container Service is correct because it allows you to run Docker containers while retaining direct access and control over the underlying servers. Contrast this with AWS Fargate, which is a serverless compute engine that removes the need to provision or manage any underlying infrastructure.

Correct answer: D. Penetration Testing

Penetration testing is the correct choice because AWS permits customers to perform security assessments on their own infrastructure without prior approval for several common services. Note that prohibited activities like network stress testing still strictly require special authorization from AWS.

Correct answer: A. Agility

Agility is correct because it specifically describes the cloud benefit of rapidly provisioning resources to accelerate development, testing, and launch cycles. Elasticity involves scaling resources dynamically based on real-time demand, whereas global deployment focuses on reducing latency worldwide.

Correct answer: C. AWS Shield Standard

AWS Shield Standard is automatically enabled for all AWS accounts at no extra cost, making its infrastructure security completely the responsibility of AWS. In contrast, services like WAF and Shield Advanced require customer configuration and management, placing them under customer responsibility.

Correct answer: C. You must use an Amazon Machine Image (AMI) from the same region as that of the Amazon EC2 instance. The region of the Amazon Machine Image (AMI) has no bearing on the performance of the Amazon EC2 instance

An Amazon Machine Image must exist in the same AWS Region where you plan to launch your EC2 instance. You can copy an image to the required region if needed, but the region itself only dictates deployment location and has no impact on instance performance.

Correct answer: A. AWS Lambda · E. Amazon Rekognition

AWS Lambda and Amazon Rekognition are regional services because they operate and maintain data within a specific geographic AWS Region. Remember that IAM, CloudFront, and WAF operate globally, meaning their configurations apply universally across all your active regions.

Correct answer: C. 72

Standard Reserved Instances offer a maximum discount of seventy-two percent compared to On-Demand Instance pricing. Memorize this specific seventy-two percent threshold for the exam, as it represents the upper limit of standard reservation savings.

Correct answer: C. AWS Shield Advanced offers protection against higher fees that could result from a DDoS attack

Shield Advanced includes cost protection, covering unanticipated scaling charges caused by a DDoS attack. The service requires an additional fee regardless of your support plan, so it is not a free inclusion for Business or Enterprise users.

Correct answer: A. Amazon Elastic Block Store (Amazon EBS) Snapshots are stored incrementally, which means you are billed only for the changed blocks stored · E. You will pay a fee each time you read from or write data stored on the Amazon Elastic File System (Amazon EFS) – Infrequent Access storage class

EBS snapshots are incremental, so you only pay for changed blocks. EFS Infrequent Access charges lower storage rates but applies access fees for reads and writes, optimizing costs for rarely accessed data.

Correct answer: C. The company should just start creating new resources in the destination AWS Region and then migrate the relevant data and applications into this new AWS Region

Regions are completely independent, so you must manually create new resources in the destination Region and migrate your data. AWS CloudFormation can deploy the new infrastructure, but it cannot automatically move existing data or applications across regions.

Correct answer: A. Performance Efficiency

The Performance Efficiency pillar focuses on selecting the right resource types and sizes to match your workload requirements. Cost Optimization does overlap with sizing, but it strictly prioritizes avoiding unnecessary spend.

Correct answer: B. AWS Cost Explorer

AWS Cost Explorer lets you visualize historical usage and provides forecasting to predict future costs and usage. AWS Budgets sends alerts based on thresholds, but it relies on data rather than being the primary forecasting interface.

Correct answer: A. AWS Systems Manager

AWS Systems Manager provides a unified interface to view operational data and automate tasks across both AWS and on-premises servers. CloudFormation handles infrastructure as code, while Config assesses resource configuration compliance.

Correct answer: B. Credentials Report

The IAM Credentials Report lists all users in your account alongside the status of their passwords, access keys, and MFA devices. Trusted Advisor checks infrastructure, but the credentials report is the designated compliance auditing tool.

Correct answer: C. Simple routing

Simple routing is the correct choice because it configures standard DNS records to route traffic directly to a single resource, like a web server. Choose weighted routing to split traffic across multiple resources instead.

Correct answer: A. One or more data centers in the same location

An Availability Zone consists of one or more discrete data centers within a specific AWS Region. For the exam, remember that multiple locations define a Region, while a single location with redundant power and networking defines an Availability Zone.

Correct answer: C. IAM role

Using an IAM role grants an Amazon EC2 instance temporary credentials to securely access a DynamoDB table. Avoid embedding long-term IAM user access keys directly in applications, as this creates a significant security risk.

Correct answer: C. Volume discounts for Amazon EC2 and Amazon S3 aggregated across the member AWS accounts · D. Share the reserved Amazon EC2 instances amongst the member AWS accounts

AWS Organizations offers consolidated billing, enabling volume discounts and shared Reserved Instances across member accounts. Management tasks like patching instances or provisioning Spot Instances are handled by management services, not Organizations.

Correct answer: B. AWS CodeDeploy

AWS CodeDeploy is the specific service that automates code deployments directly to compute services like Amazon EC2. Elastic Beanstalk is an end-to-end platform, while CodeBuild compiles code, and CloudFormation provisions resources.

Correct answer: A. Amazon Simple Storage Service (Amazon S3)

Amazon S3 is the most effortless way to host a static website by simply configuring bucket permissions. Glacier is for archiving, Storage Gateway connects on-premises systems, and file systems like EFS require attached compute resources.

Correct answer: A. Amazon DynamoDB

Amazon DynamoDB is the correct choice because it is a non-relational, schemaless database that easily handles flexible data structures. For the exam, remember that services like RDS, Aurora, and Redshift are relational databases that require a rigid, predefined schema.

Correct answer: B. Internet Gateway · E. Subnet

Subnets and Internet Gateways are fundamental networking components that exist directly inside an Amazon Virtual Private Cloud. As a quick exam tip, easily eliminate the distractors because API Gateway and Storage Gateway are standalone services, while objects belong to S3 buckets.

Correct answer: B. AWS Transit Gateway · C. AWS Direct Connect

AWS Transit Gateway provides a central hub to route traffic between multiple VPCs, and AWS Direct Connect provides a dedicated, private network path from on-premises data centers into AWS. Avoid VPC peering here because managing individual connections between many networks quickly becomes overly complex.

Correct answer: A. Enable multi-factor authentication (MFA) on all accounts · E. Analyze user access patterns and review AWS Identity and Access Management (AWS IAM) permissions

Under the shared responsibility model, customers are strictly responsible for their own security in the cloud, which includes enabling multi-factor authentication and analyzing user access patterns. AWS handles the security of the underlying infrastructure, managing global networks and compliance validation independently.

Correct answer: C. Amazon S3 Replication

Amazon S3 Replication automatically and asynchronously copies objects across buckets while perfectly retaining all original metadata. On the exam, remember that storage classes simply tier data, Transfer Acceleration speeds up edge uploads, and bucket policies only grant access rather than moving data.

Correct answer: A. Amazon Relational Database Service (Amazon RDS) · E. Amazon Elastic Compute Cloud (Amazon EC2)

Reserved Instances are available for compute services like Amazon EC2 and relational databases like Amazon RDS to provide a billing discount for committed usage. Services such as IAM are free, while S3 and CloudFront do not offer reserved capacity because they are strictly metered by usage.

Correct answer: B. AWS Trusted Advisor

AWS Trusted Advisor is an account-level best practices tool that specifically checks for and flags underutilized Amazon EBS volumes to help optimize costs. While CloudWatch monitors performance metrics, it lacks the native account-wide cost analysis required to automatically identify these idle resources.

Correct answer: A. AWS Pricing Calculator

The AWS Pricing Calculator is designed to estimate potential cloud costs and model solutions before migration, helping compare on-premises infrastructure to AWS. Remember that Cost Explorer and Budgets are only used to track and monitor existing active account spending, not future estimates.

Correct answer: A. When you don't turn on user activity logging (AWS CloudTrail) · D. When you allow public access to Amazon S3 buckets

Trusted Advisor automatically checks for common security gaps like public S3 buckets and disabled CloudTrail logging. Sharing IAM credentials is an operational policy issue that the service cannot technically detect, whereas Glacier encrypts data by default.

Correct answer: A. Amazon S3 Transfer Acceleration (S3TA)

Amazon S3 Transfer Acceleration leverages CloudFront edge locations to speed up long-distance file uploads directly into a bucket. CloudFront only accelerates downloads to users, whereas Direct Connect requires physical setup.

Correct answer: A. Use Spot Instances for ad-hoc jobs that can be interrupted · C. Use Reserved Instances (RI) to run applications with a predictable usage over the next one year

Spot Instances provide the steepest discounts for stateless workloads that tolerate interruptions, while Reserved Instances offer billing discounts for predictable usage. On-Demand Instances offer no long-term savings, making them less cost-optimal.

Correct answer: A. AWS Global Accelerator provides static IP addresses that act as a fixed entry point to your applications · B. AWS Global Accelerator is a good fit for non-HTTP use cases

AWS Global Accelerator provides static IP addresses acting as fixed entry points and is specifically excellent for non-HTTP use cases like gaming or VoIP. Remember that it complements Elastic Load Balancing by routing traffic over the AWS global network.

Correct answer: A. AWS Lambda · E. AWS Fargate

AWS Lambda and AWS Fargate are the correct choices because both let you run applications without provisioning or managing underlying servers. For the exam, remember that EC2 and Elastic Beanstalk require server management, making them non-serverless options.

Correct answer: C. Amazon EC2 instance user data

Amazon EC2 user data is correct because it lets you pass bootstrap scripts to automate configuration tasks when launching an instance. Do not confuse this with instance metadata, which simply provides read-only information about the currently running instance.

Correct answer: A. Deploying the application across two AWS Regions improves availability

Deploying workloads across multiple geographic Regions directly increases fault tolerance and availability by isolating failures. For the exam, associate Regions with disaster recovery and global availability, whereas scaling capacity horizontally is handled within Availability Zones using Auto Scaling.

Correct answer: B. Sell Software as a Service (SaaS) solutions to AWS customers · C. AWS customer can buy software that has been bundled into customized Amazon Machine Image (AMIs) by the AWS Marketplace sellers

AWS Marketplace is a digital catalog where independent software vendors can sell pre-configured AMIs or Software as a Service solutions to AWS customers. Think of Marketplace as an app store for buying and selling deployable software, completely distinct from requesting dedicated network connections or buying compliance reports via Artifact.

Correct answer: A. AWS Fargate

AWS Fargate is a serverless compute engine specifically designed to run containers without managing underlying servers. Use this as an exam cue to link Fargate directly with container workloads, whereas Elastic Beanstalk is for broader application platform management.

Correct answer: D. Set up an IAM user with administrator permissions and do not use AWS account root user for administrative tasks · E. Enable multi-factor authentication (MFA) for the AWS account root user

Securing the root user involves enabling multi-factor authentication and delegating daily administrative duties to an IAM user instead. Remember that root access keys should never be created or shared, and the root account should be locked away for only a few highly specific tasks.

Correct answer: B. Massive economies of scale

Aggregating usage from hundreds of thousands of customers enables providers like AWS to achieve massive economies of scale, resulting in lower pay-as-you-go prices. For the exam, associate this specific phrasing directly with economies of scale, rather than general agility or capital expense reduction.

Correct answer: D. Amazon CloudWatch

Amazon CloudWatch is used to create actual billing alarms that trigger when your account costs exceed a defined monetary threshold. On the exam, distinguish this from AWS Budgets, which provides more flexible alerts based on your specific cost or usage forecasts.

Correct answer: A. Build loosely coupled components

Building loosely coupled components allows individual microservices to operate independently, which improves both system scalability and overall resilience. For the exam, always avoid monolithic or tightly coupled designs, and favor decoupling via queues or pub/sub messaging.

Correct answer: D. AWS Health Dashboard – Your account health

The AWS Health Dashboard provides personalized alerts and remediation guidance regarding your account and resource health, available across every support tier. Contrast this with the full Trusted Advisor checks and third-party software support, which require upgraded Business or Enterprise plans.

Correct answer: A. Amazon Translate

Amazon Translate is a neural machine translation service that easily converts text between languages, making it ideal for localizing subtitles. Do not confuse this with Transcribe, which handles speech to text, or Polly, which converts written text into spoken audio.

Correct answer: C. AWS CloudFormation

AWS CloudFormation uses StackSets to deploy infrastructure across multiple accounts and regions simultaneously using templates. AWS Config monitors resource compliance, and CodeDeploy handles application code, not foundational infrastructure provisioning.

Correct answer: D. AWS Artifact

AWS Artifact provides on-demand access to AWS security and compliance reports, including Payment Card Industry reports. For the exam, reliably associate any need for compliance documentation or audits directly with the AWS Artifact portal.

Correct answer: B. VPC Interface Endpoint

A VPC Interface Endpoint uses AWS PrivateLink to privately connect your VPC to supported services like Amazon SQS. A strong exam rule is that gateway endpoints only support Amazon S3 and DynamoDB, while other services rely on interface endpoints.

Correct answer: C. AWS Web Application Firewall (AWS WAF) can block all requests except the ones that you allow · D. AWS Web Application Firewall (AWS WAF) can check for the presence of SQL code that is likely to be malicious (known as SQL injection)

AWS WAF operates at Layer 7 to inspect web requests, allowing you to block malicious SQL injection attempts or restrict access to specific IP addresses. DDoS response team access is exclusive to Shield Advanced, and infrastructure attacks target lower layers.

Correct answer: A. AWS Business Support · B. AWS Enterprise Support

Both Business and Enterprise Support tiers provide programmatic API access to the AWS Support Center for case management. Developer and Basic tiers lack this API access, and Corporate Support is a distractor that does not exist.

Correct answer: C. Amazon EC2 Instance Connect

Amazon EC2 Instance Connect offers a secure, browser-based SSH client accessible across major operating systems. Standard SSH or PuTTY require standalone software, whereas Direct Connect is a dedicated physical network service.

Correct answer: B. U2F security key

A Universal 2nd Factor security key plugs into a USB port for authentication. Hardware and virtual devices typically generate codes, while SMS relies on text messages, so look for the USB characteristic to identify the correct option.

Correct answer: D. Application Load Balancer

The Application Load Balancer operates at Layer 7 and is designed for routing HTTP and HTTPS traffic. The Network Load Balancer handles lower-level TCP and UDP traffic, and System Load Balancer is a distractor.

Correct answer: A. Business

Business is one of the six core perspectives of the AWS Cloud Adoption Framework, alongside People, Governance, Platform, Security, and Operations. For the exam, use the memory trick that the framework completely avoids standard terms like architecture, process, or product to describe its perspectives.

Correct answer: C. AWS Lambda can be used to execute code in response to events such as updates to DynamoDB tables · D. AWS Lambda can be used for preprocessing of data before it is stored in Amazon S3 buckets

Lambda is a serverless compute service that runs code in response to events like DynamoDB streams, or it can easily process data before storing it in S3. You cannot install applications like databases or container services on it.

Correct answer: D. AWS Device Farm

AWS Device Farm is an application testing service that lets you test mobile apps across various real devices and operating systems. The other options handle application deployment or code pipelines instead of device testing.

Correct answer: D. AWS Budgets

AWS Budgets is the correct choice because it allows you to set custom reservation utilization or coverage targets and receive alerts when usage drops below your defined threshold. Use Cost Explorer to visualize data, but rely on Budgets for alerts.

Correct answer: B. On-Demand Instance

On-Demand Instances are the correct choice for short-term, spiky, and critical workloads because they require no upfront commitment and cannot be unexpectedly interrupted. Avoid Spot Instances for critical workloads since AWS can reclaim them with short notice.

Correct answer: A. Use Amazon S3 Block Public Access to ensure that all Amazon S3 resources stay private

Amazon S3 Block Public Access is the most efficient solution because it provides centralized controls to instantly ensure that all buckets and objects remain private. Custom Lambda functions might work, but native features are always preferred for efficiency.

Correct answer: A. Amazon S3 Intelligent-Tiering · B. Amazon S3 Standard

Amazon S3 Standard and S3 Intelligent-Tiering are correct because neither charges a data retrieval fee for accessing your objects. As a practical rule, expect retrieval fees on infrequent access tiers and Glacier archive classes to offset their lower storage costs.

Correct answer: B. Amazon Simple Storage Service (Amazon S3) is a key value based object storage service · C. Amazon Simple Storage Service (Amazon S3) stores data in a flat non-hierarchical structure

Amazon S3 is an object storage service that uses a flat, non-hierarchical structure rather than traditional file systems. It relies on key-value pairs, so you cannot install databases directly on it, making it very distinct from block storage.

Correct answer: C. Warm Standby strategy

A warm standby strategy runs a smaller, functional version of your environment in another region, allowing you to scale up quickly during a disaster. Pilot light lacks this immediate operational capacity, while multi-site active-active exceeds the cost requirements for non-mission-critical workloads.

Correct answer: A. VPC peering connection

VPC peering connects two VPCs directly, allowing private traffic routing between them as if they are in the same network. Site-to-Site VPN and Direct Connect link on-premises networks to AWS, while VPC endpoints only connect a VPC to AWS services.

Correct answer: A. Application software license costs

Under the shared responsibility model, AWS handles physical security, hardware, and facility power, while customers manage their own application software licenses. This division of labor frees companies from maintaining data centers. Hardware and facility costs never fall to the cloud customer.

Correct answer: D. Amazon Elastic Compute Cloud (Amazon EC2) · E. Amazon CloudFront

AWS Shield Advanced provides specialized DDoS protection for resources like Amazon CloudFront and Amazon EC2. These services sit at the edge or compute layers, unlike storage or deployment services like S3 or Elastic Beanstalk.

Correct answer: A. Amazon S3 Standard

Amazon S3 Standard has no minimum storage duration, making it ideal for frequently accessed data. Archival and infrequent access classes like Glacier and Standard-IA enforce minimum duration fees, so deleting objects early incurs prorated charges.

Correct answer: C. Amazon Simple Storage Service (Amazon S3)

Amazon S3 lifecycle rules transition older objects to cheaper storage classes or delete them entirely to optimize costs. Block storage like EBS and instance stores lack automated lifecycle tiering. Use this feature to manage data retention seamlessly.

Correct answer: D. Data transferred out to an Amazon Elastic Compute Cloud (Amazon EC2) instance, when the instance is in the same AWS Region as the S3 bucket · E. Data transferred in from the internet

S3 does not charge for data transferred into the service from the internet or for data sent to an EC2 instance in the same region. Data going out to other regions incurs standard transfer fees, while all storage classes charge for consumed capacity.

Correct answer: A. You can use both read replicas and multi-AZ deployment for disaster recovery

Both read replicas and Multi-AZ deployments can address disaster recovery needs. Remember that Multi-AZ primarily provides high availability, while read replicas are typically used for scaling read performance, though cross-Region replicas serve as excellent disaster recovery mechanisms.

Correct answer: D. Amazon EC2 Auto Scaling

Amazon EC2 Auto Scaling automatically adjusts the number of instances to handle current traffic demands. A practical exam cue is to associate Auto Scaling with adding or removing capacity, whereas load balancers strictly distribute incoming traffic across existing resources.

Correct answer: A. AWS bills five instances as Reserved Instances, and the remaining four instances as regular instances · E. Bob receives the cost-benefit from Susan's Reserved Instance (RI) only if he launches his instances in the same AWS Region where Susan purchased her Reserved Instances (RI)

Consolidated billing applies Reserved Instance discounts automatically to any matching instance in the organization. The discount applies region-wide, making the Availability Zone requirement in the original explanation a technical inaccuracy.

Correct answer: B. Amazon EC2 can scale with changing computing requirements · D. With Amazon EC2, developers can launch and terminate the instances anytime they need to

Amazon EC2 differs from traditional hosting because it easily scales with changing requirements and allows developers to launch or terminate instances at any time. For the exam, remember that EC2 provides flexible, on-demand compute capacity rather than fixed monthly contracts.

Correct answer: D. Amazon Elastic File System (Amazon EFS)

Amazon EFS provides an NFS file system accessible from both AWS and on-premises servers over a Direct Connect or VPN connection. S3 is also accessible on-premises but is an object store rather than a mountable file system. EBS and instance store attach directly to EC2.

Correct answer: D. To run any containerized workload with Amazon Elastic Container Service (Amazon ECS) that can be interrupted

Spot Instances offer deep discounts for interruptible workloads like flexible containerized tasks. They should not be used for critical workloads or scheduled jobs requiring guaranteed capacity, and they never support database installations.

Correct answer: D. Virtual private Cloud (VPC)

Amazon Virtual Private Cloud lets you provision a logically isolated section of the AWS Cloud where you can launch resources in a custom virtual network. Remember that subnets and network access control lists are features configured inside your VPC.

Correct answer: B. Use AWS Key Management Service (AWS KMS) to encrypt data

Using AWS KMS to encrypt data is a core best practice for protecting data at rest and in transit under the Security pillar. Cost Explorer maps to Cost Optimization, while CloudFormation automates infrastructure provisioning rather than enforcing encryption.

Correct answer: D. Vertical scaling

Upgrading the resources of a single instance, such as adding CPU or RAM, is known as vertical scaling. Horizontal scaling involves adding more instances to a fleet to handle increased load.

Correct answer: C. Amazon SageMaker

Amazon SageMaker provides a fully managed environment for data scientists to build, train, and deploy custom machine learning models. Polly and Comprehend are pre-trained AI services for specific tasks rather than model-building platforms.

Correct answer: B. Amazon Lex

Amazon Lex is the dedicated service for building conversational chatbots, utilizing natural language understanding and speech recognition. Do not confuse this with Amazon Comprehend, which analyzes text for sentiment and key phrases but does not build interactive voice interfaces.

Correct answer: A. AWS Fault Injection Simulator (AWS FIS)

AWS Fault Injection Simulator is the managed service designed specifically for chaos engineering, allowing you to safely inject disruptions to test system resiliency. Security services like Amazon Inspector and GuardDuty focus on vulnerability assessments and threat detection, not performance testing.

Correct answer: B. Amazon Cognito

Amazon Cognito is specifically designed to add user sign-up, sign-in, and access control features to your mobile and web applications. Remember that IAM manages internal AWS console permissions, whereas Cognito handles external consumer-facing application identities.

Correct answer: C. Amazon Personalize

Amazon Personalize uses machine learning to deliver real-time customized recommendations based on historical user data. Avoid confusing this with Amazon SageMaker, which is a broader platform requiring you to build and train custom machine learning models from scratch.

Correct answer: A. Rehost

Rehosting, or lift and shift, moves applications exactly as they are without code changes, providing the fastest migration path. Replatforming requires minor optimizations, while refactoring requires extensive architectural redesign, both violating the requirement for no modifications.

Correct answer: D. AWS IAM Identity Center

AWS IAM Identity Center is the correct choice because it manages workforce access to multiple accounts and applications from a central location. This service is the direct successor to AWS Single Sign-On.

Correct answer: C. Amazon Simple Storage Service (Amazon S3)

Amazon EBS snapshots are stored in Amazon S3, providing a durable, incremental backup of your volume data. Remember that EC2 provides compute, EFS is for active shared file storage, and RDS handles relational databases rather than acting as snapshot storage.

Correct answer: C. AWS Direct Connect

AWS Direct Connect establishes a dedicated, private network connection from on-premises environments to AWS, bypassing the public internet. Site-to-Site VPN also connects networks but routes traffic over the public internet rather than a private, high-bandwidth line.

Correct answer: D. AWS Health Dashboard – Service Health

The AWS Health Dashboard provides the overall status of all AWS services and offers an RSS feed for service interruptions. Do not confuse this with the Account Health Dashboard, which only provides personalized alerts for events directly impacting your specific AWS resources.

Correct answer: B. 1 year · C. 3 years

Standard and Convertible Reserved Instances for Amazon EC2 are available in one-year and three-year term commitments for a significant discount. For the exam, remember that AWS does not offer six-month, two-year, or five-year reservation terms for standard pricing discounts.

Correct answer: A. Firewall & networking configuration of Amazon Elastic Compute Cloud (Amazon EC2)

Under the Shared Responsibility Model, customers are responsible for security in the cloud, including configuring firewalls and networking for EC2 instances. AWS manages security of the cloud itself, meaning AWS handles physical hardware and the underlying infrastructure for managed services like DynamoDB.

Correct answer: C. AWS Cost Explorer

AWS Cost Explorer lets you visualize your costs and provides actionable Savings Plan recommendations. While AWS Budgets sends alerts when you exceed your spending limits, it does not generate specific Savings Plan optimization recommendations.

Correct answer: D. Create tags for each department

Applying resource tags to designate specific departments is the simplest and most effective way to allocate and separate AWS costs. Creating multiple AWS accounts for different departments complicates billing, whereas using tags on a single account streamlines cost tracking.

Correct answer: A. Provisioned IOPS · E. Volume type

EBS pricing is driven by volume type, provisioned storage space, and provisioned IOPS. Data transfer into AWS is free, and the EC2 instance type a volume attaches to does not affect the EBS price.

Correct answer: B. AWS Systems Manager

AWS Systems Manager provides a central hub to view operational data, automate management tasks, and quickly identify issues across your nodes. Trusted Advisor provides high-level best practice checks rather than operational node control.

Correct answer: D. AWS DataSync

AWS DataSync automates and accelerates online data transfers between on-premises storage and AWS, fully supporting incremental transfers. Snowball devices are for offline migrations, whereas Storage Gateway connects on-premises apps to cloud storage.

Correct answer: B. AWS Glue

AWS Glue is a serverless extract, transform, and load service specifically designed to prepare and clean data for analytics. Amazon Athena and Redshift query the prepared data, while EMR handles big data processing frameworks.

Correct answer: B. AWS Trusted Advisor

AWS Trusted Advisor evaluates your account against AWS best practices, offering recommendations for cost optimization, performance, security, and service limits. Amazon CloudWatch monitors resource performance but does not provide actionable best practice checks.

Correct answer: B. AWS CloudHSM

AWS CloudHSM provides dedicated hardware security modules in the cloud, allowing you to securely generate, store, and manage your own cryptographic encryption keys. Remember that Secrets Manager protects application credentials like database passwords, whereas CloudHSM handles the actual cryptographic hardware boundary.

Correct answer: C. AWS Cost & Usage Report (AWS CUR)

The AWS Cost and Usage Report provides the most comprehensive and granular billing details available, publishing hourly resource data directly into an Amazon S3 bucket. Contrast this with AWS Cost Explorer, which is better suited for high-level visual forecasting and trend analysis.

Correct answer: B. AWS Security Token Service (AWS STS)

The AWS Security Token Service generates temporary, limited-privilege credentials for federated or IAM users to securely access your resources. While Amazon Cognito handles web and mobile user identity pools, STS is the underlying mechanism for dispensing short-term access tokens.

Correct answer: B. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

Amazon S3 One Zone-Infrequent Access is the optimal choice for secondary backup copies because it stores data in a single availability zone, reducing costs while maintaining rapid access. Standard-IA offers multi-zone resilience, making it unnecessarily expensive for easily recreatable or secondary data.

Correct answer: C. Amazon ElastiCache

Amazon ElastiCache sits in front of your database to serve frequent read requests from fast in-memory data stores, significantly reducing database load. Standard databases like Amazon RDS handle persistent storage, while EMR and Glue process big data analytics.

Correct answer: B. Make frequent, small, reversible changes · D. Anticipate failure

The Operational Excellence pillar emphasizes making frequent, small, reversible changes and anticipating failure. Use this practical cue to separate the pillars: Security focuses on traceability, Reliability on automatic recovery, and Performance Efficiency on serverless architectures.

Correct answer: C. Amazon Simple Storage Service (Amazon S3) Lifecycle configuration

S3 Lifecycle configurations automatically transition objects between storage classes to manage costs effectively over time. Avoid confusing this with Cross-Region Replication, which is used for compliance and disaster recovery across different geographic regions.

Correct answer: B. AWS Cloud Development Kit (AWS CDK)

The Cloud Development Kit lets you define cloud infrastructure using familiar programming languages like Python. Contrast this with CloudFormation, which requires writing declarative templates using JSON or YAML instead of traditional code.

Correct answer: A. AWS Config

AWS Config is the correct choice because it continuously monitors and records resource configurations, allowing you to trigger alerts for compliance changes. Trusted Advisor provides high-level best practice checks but lacks granular configuration state tracking.

Correct answer: C. A customer gateway

A customer gateway represents the physical or software appliance on your side of a Site-to-Site VPN connection. The virtual private gateway resides on the AWS side, so remember that you always manage the customer endpoint hardware.

Correct answer: C. AWS Batch

AWS Batch dynamically provisions the optimal compute resources to run hundreds of thousands of batch computing workloads efficiently. While Lambda handles smaller event-driven tasks, AWS Batch is purpose-built for massive scale processing.

Correct answer: C. Data center security · D. Network operability

Under the Shared Responsibility Model, AWS handles security of the cloud, including physical data center security and network operability. Customers must handle security in the cloud, which includes patching guest operating systems and configuring access.

Correct answer: C. Detecting malicious activity and threats in your AWS accounts and workloads

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. For the exam, do not confuse this with the Web Application Firewall, which actively blocks common web exploits.

Correct answer: D. AWS Web Application Firewall (AWS WAF)

AWS WAF protects web applications by inspecting HTTP requests forwarded to Amazon CloudFront. This allows you to block malicious traffic at the edge locations before it ever reaches your origin servers.

Correct answer: D. Stop guessing about capacity · E. Increase speed and agility

Stop guessing capacity and increase speed and agility are core advantages of cloud computing. Remember that cloud computing shifts expenses from upfront capital expenditures to flexible operational expenses.

Correct answer: A. Amazon Simple Queue Service (Amazon SQS)

Amazon Simple Queue Service securely decouples application tiers by letting you send, store, and receive messages between software components. Simple Notification Service is pub/sub and pushes messages, whereas queues pull and retain them.

Correct answer: B. Replacing unhealthy Amazon EC2 instances

Amazon EC2 Auto Scaling improves fault tolerance by automatically detecting and replacing unhealthy instances to maintain application availability. Distributing load is a feature of Elastic Load Balancing, which works alongside Auto Scaling but serves a different purpose.

Correct answer: B. Automation

Automation is a core AWS architectural best practice because it improves system stability and operational efficiency. For the exam, associate the other options with anti-patterns: AWS promotes loose coupling, services over servers, and security as the top priority.

Correct answer: D. High availability · E. Fault tolerance

Elastic Load Balancing provides high availability and fault tolerance by automatically distributing incoming traffic across multiple healthy targets. It does not provide storage, and while it helps optimize resource use, its primary value is resilience, not direct cost reduction.

Correct answer: D. AWS Business Support

AWS Business Support is the most cost-effective plan that provides enhanced technical support from Cloud Support Engineers. Enterprise Support also offers this but is significantly more expensive, while Developer and Basic tiers do not provide full engineer access.

Correct answer: B. Resource utilization · C. Application performance

Amazon CloudWatch provides visibility into resource utilization and application performance for AWS workloads. Remember that CloudTrail records API access, while the AWS Health Dashboard shows the overall availability of regional AWS services.

Correct answer: D. AWS Identity and Access Management (IAM) access advisor

IAM access advisor displays the service permissions granted to a user and when they were last accessed, helping you identify unnecessary permissions. The credentials report only lists credential status, such as password or key rotation, not the attached permissions.

Correct answer: D. It is a Platform as a Service (PaaS) that allows you to deploy and scale web applications and services

AWS Elastic Beanstalk is a Platform as a Service offering that automatically handles deployment, capacity provisioning, and scaling for web applications. Distinguish it from CloudFormation, which is an Infrastructure as Code tool used to model and provision resources.

Correct answer: A. Hybrid Cloud

A hybrid cloud deployment connects AWS cloud resources with your existing on-premises infrastructure. Remember that private cloud refers to an isolated environment running solely within AWS, while hybrid specifically mixes on-premises data centers and the public cloud.

Correct answer: C. Amazon LightSail

Amazon Lightsail is a virtual private server service designed for easy deployment at a low, predictable monthly price, making it ideal for beginners. Standard EC2 requires more networking configuration, making it overly complex for simple dev/test environments.

Correct answer: C. A VPC spans all Availability Zones (AZs) within an AWS region

A Virtual Private Cloud spans all Availability Zones within a single, specific AWS Region. Remember that a subnet is confined to a single Availability Zone, while the overarching VPC operates at the regional level.

Correct answer: B. Network Access Control List (network ACL)

A network access control list can explicitly deny traffic from specific IP addresses at the subnet level. A practical exam cue is that security groups are stateful and only allow rules, so you must use stateless network ACLs to explicitly block bad IP addresses.

Correct answer: A. Track configuration changes

Tracking resource configuration changes is the primary function of AWS Config. Amazon Inspector focuses on automated security assessments, scanning for software vulnerabilities, and checking for unintended network accessibility.

Correct answer: B. Amazon EBS Elastic Volumes can be bound to several Availability Zones (AZs)

Elastic Block Store volumes are locked to a specific Availability Zone and cannot natively span multiple zones. To move data across zones, you must take a snapshot and restore it. Remember that at the foundational level, standard volumes attach to a single instance at a time.

Correct answer: A. There is nothing to do, AWS Identity and Access Management (AWS IAM) is a global service

Identity and Access Management is a global service, meaning user identities and roles are available across all regions without any extra configuration. Resist the trap of creating regional accounts or users, and never share credentials between employees.

Correct answer: C. Amazon CodeGuru

Amazon CodeGuru uses machine learning to automate code reviews and identify expensive lines of code, perfectly fitting this requirement. Rule out CodeBuild because it only compiles code and runs tests without providing intelligent recommendations.

Correct answer: B. Purchase Amazon EC2 Reserved instances (RIs) · D. Set up Auto Scaling groups to align the number of instances with the demand

Reserved Instances offer discounts for steady workloads, while Auto Scaling matches capacity to live demand to eliminate waste. Vertical scaling often costs more without trimming excess capacity, and support plans do not directly lower compute fees.

Correct answer: B. Convertible reserved instance (RI)

Convertible Reserved Instances allow you to exchange instances to adapt to changing workloads over a three-year term. Standard Reserved Instances offer larger discounts but lock you into specific instance families without flexibility.

Correct answer: B. Platform as a Service (PaaS)

Platform as a Service removes the need to manage underlying infrastructure, allowing you to focus entirely on deploying and managing applications. On the exam, remember the shared responsibility shift: IaaS gives you the most control, while SaaS provides a completed product managed by the provider.

Correct answer: C. Amazon Simple Storage Service (Amazon S3) Access Logs

Amazon S3 server access logging provides detailed records of every request made to a bucket, making it the right choice for security and access audits. Bucket policies only control access permissions, and versioning simply preserves object variants.

Correct answer: D. Amazon Macie

Amazon Macie is a managed data security service that uses machine learning to automatically discover and protect sensitive data in S3 buckets. Remember that AWS Artifact only provides compliance reports, while Secrets Manager safeguards credentials.

Correct answer: A. Create AWS accounts per department · B. Restrict account privileges using Service Control Policies (SCP)

Creating individual accounts for each department and restricting privileges with Service Control Policies are core best practices for governance and isolation. Avoid disabling CloudTrail or ignoring tags, as you need monitoring and proper billing categorization.

Correct answer: D. AWS Partner Solutions (formerly Quick Starts)

AWS Partner Solutions provide automated reference deployments to help you quickly launch popular technologies using best practices. Note that AWS CodeDeploy is strictly for automating application code updates, whereas Partner Solutions deploy the entire infrastructure stack quickly.

Correct answer: C. Server administration · E. Power/Cooling

Total Cost of Ownership calculations for cloud migration include IT labor for server administration and facility costs like power and cooling. The number of end-users or office electronics are not direct infrastructure TCO factors.

Correct answer: A. AWS CloudFormation

CloudFormation templates deploy standardized resources across accounts and regions while providing cost estimates for your stack. Avoid CodeDeploy since it only handles application code delivery, not the underlying infrastructure provisioning.

Correct answer: A. Configuration management

Shared controls like configuration management apply to both the infrastructure layer and customer layers in different contexts. While AWS manages its hardware configurations, customers must configure their own guest operating systems.

Correct answer: C. Amazon Machine Image (AMI)

An Amazon Machine Image contains the information required to launch an instance, allowing you to deploy identical configurations across different regions. Elastic Load Balancing distributes network traffic across existing instances, while an EBS snapshot only backs up block storage.

Correct answer: B. Health checks and monitoring

Amazon Route 53 is primarily a Domain Name System web service, but it also provides health checks and monitoring to route traffic reliably. Transfer acceleration is an Amazon S3 feature, and Route 53 routes traffic to load balancers rather than acting as one.

Correct answer: C. Elasticity

Elasticity is correct because it refers to the ability to automatically scale resources up or down to match current demand, preventing costly over-provisioning. Horizontal scaling only adds capacity, whereas elasticity actively contracts resources when demand drops.

Correct answer: D. Software as a Service (SaaS)

Software as a Service provides a completed product run and managed by the service provider, requiring no underlying maintenance. Web-based email is a classic example, whereas infrastructure and platform models require you to manage operating systems or applications.

Correct answer: B. AWS Direct Connect

AWS Direct Connect establishes a private, dedicated network connection from your on-premises data center to AWS. Site-to-Site VPN also connects networks but routes encrypted traffic over the public internet instead of a dedicated line.

Correct answer: C. IAM Username and password · E. Multi Factor Authentication (MFA)

To securely sign in to the AWS Management Console, you should use an IAM username and password, supplemented by Multi-Factor Authentication. Access keys are strictly for programmatic access via the CLI or SDKs and should never be used for console sign-ins.

Correct answer: D. AWS Architecture Center

The AWS Architecture Center provides reference architecture diagrams, vetted solutions, and Well-Architected best practices. For the exam, remember that the AWS Marketplace is a software catalog, while Trusted Advisor provides real-time cost and security checks.

Correct answer: A. One-on-one responses to account and billing questions · C. Service health checks

The AWS Basic Support plan covers one-on-one responses for account and billing questions, service health checks, and access to support forums. Use-case guidance and diagnostic tools are only available on Developer, Business, and Enterprise support plans.

Correct answer: D. AWS Resource Groups

AWS Resource Groups let you organize and manage multiple AWS resources as a single unit for bulk automation tasks. Tags are just metadata properties, while Organizations manage multiple AWS accounts rather than individual resources.

Correct answer: D. Writing and maintaining the function code and its dependencies

Under the shared responsibility model, customers must write and maintain their own AWS Lambda function code and dependencies. AWS automatically handles the underlying infrastructure, operating system, and runtime environments for the service.

Correct answer: A. AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest operating system and applications · C. AWS trains AWS employees, but a customer must train their own employees

AWS handles infrastructure patching, while customers must patch their guest operating systems and applications. AWS trains its own employees, but the customer is strictly responsible for training their own internal staff on cloud security.

Correct answer: A. Management events

By default, AWS CloudTrail logs management events, which capture control plane operations within your account. Data events and CloudTrail Insights events incur additional charges and must be explicitly enabled on your trail.

Correct answer: C. Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)

Amazon S3 Intelligent-Tiering automatically moves data between access tiers to optimize costs when access patterns are unknown or unpredictable. S3 Standard is only for frequently accessed data, while Standard-IA applies retrieval fees.

Correct answer: B. Backup and restore strategy

A backup and restore strategy is the most cost-effective disaster recovery approach and perfectly accommodates tolerating a few hours of data loss. Pilot light, warm standby, and multi-site strategies offer lower recovery times but cost significantly more.

Correct answer: C. Amazon Neptune · E. Amazon DocumentDB

Amazon Neptune and Amazon DocumentDB are correct because they are fully managed NoSQL database services that store data as graphs and documents. Remember that Amazon RDS and Aurora are relational databases, making them incorrect choices for NoSQL questions.

Correct answer: A. Predict the web traffic of a website for the next few weeks

Amazon Forecast is correct because it uses machine learning to predict future time-series data like web traffic. For the exam, associate Forecast exclusively with time-series predictions, whereas Amazon Personalize is used for product recommendations.

Correct answer: D. Amazon CloudFront, Application Load Balancer, Amazon API Gateway, AWS AppSync

Amazon CloudFront, Application Load Balancer, Amazon API Gateway, and AWS AppSync are correct because AWS WAF integrates directly with these services to filter web traffic. Remember that WAF cannot be deployed directly on Amazon EC2 instances without an intermediary load balancer.