AWS Certified Cloud Practitioner (CLF-C02)

Correct answer: B. Amazon Machine Image (AMI)

An Amazon Machine Image contains the template needed to launch a pre-configured EC2 instance, including the OS and software. On the exam, remember EBS is storage, Systems Manager manages infrastructure, and AppStream 2.0 streams applications to users.

Correct answer: C. Taking a backup of a database · E. Patching database software

With managed services like Amazon RDS, AWS handles database backups and patches the database software and operating system. A practical cue for shared responsibility: AWS manages anything of the service itself, while schemas, code auditing, and application security testing stay with the customer.

Correct answer: A. Automated backups · C. Software patching

RDS handles automated backups and automatic software patching for you, unlike a self-managed database on EC2. Exam cue: managed services remove OS-level tasks like patching and backups, but schema design and indexing remain the customer's responsibility.

Correct answer: A. Updating the firmware on the underlying EC2 hosts.

Under the shared responsibility model, AWS manages the infrastructure, including firmware on the physical EC2 host servers. Security groups, network ACLs, and patching guest operating systems or applications are always customer responsibilities.

Correct answer: A. AWS Trusted Advisor

Trusted Advisor includes a cost optimization check that flags underutilized EC2 instances based on CPU and network usage. Cost Explorer shows spending but not resource utilization, so it cannot identify idle or underused instances.

Correct answer: B. Migrate the database to Amazon RDS and enable the Multi-AZ feature.

RDS Multi-AZ maintains a synchronous standby replica in another Availability Zone and fails over automatically when the primary fails. Exam cue: Multi-AZ equals availability and failover, while Read Replicas serve scalability, not automatic recovery.

Correct answer: C. AWS Trusted Advisor

Trusted Advisor provides best practice recommendations across cost, performance, security, fault tolerance, and service limits. CloudWatch monitors metrics but does not recommend optimizations, and Inspector focuses on security assessments.

Correct answer: B. Create tags by department on the instances and then run a cost allocation report.

Tagging resources by department and activating cost allocation tags generates cost reports broken out by those tags. Billing alerts only signal threshold breaches, and Cost Explorer does not segment spend without tags applied.

Correct answer: C. Configure a scheduled scaling policy.

Scheduled scaling launches capacity at a specific date and time you define, which suits a known future sales event. Predictive scaling relies on historical trends and cannot account for a one-off event the model has never seen.

Correct answer: A. Amazon CloudFront

CloudFront is a CDN that caches content at edge locations close to global users, cutting latency. Direct Connect provides a private dedicated link from on-premises to AWS and does not speed up access for worldwide end users.

Correct answer: A. AWS Software Development Kit

The AWS SDKs provide language-specific APIs for building AWS service features directly into an application. On the exam, remember the CLI is for command-line administration, not application integration, and the Code* services handle deployment pipelines.

Correct answer: A. Gain access to AWS security and compliance documents.

AWS Artifact provides on-demand downloads of AWS compliance reports such as SOC and PCI documents plus select agreements. A common trap is thinking Artifact generates your own assessment reports; it only supplies AWS-side audit artifacts.

Correct answer: C. AWS Cloud Development Kit (AWS CDK)

The AWS CDK lets you define infrastructure in familiar programming languages and synthesizes it into CloudFormation templates. Distinguish it from the Code* family, which covers source control, reviews, and pipelines rather than infrastructure definitions.

Correct answer: A. Amazon CloudFront · D. AWS Global Accelerator

CloudFront caches content at edge locations and Global Accelerator routes traffic over the AWS backbone, both cutting latency for global users. Direct Connect only helps a single fixed location reach AWS privately, so it fails the distributed-users test.

Correct answer: A. AWS CodeCommit

AWS CodeCommit is the managed, Git-based source control service in the AWS developer tools family. CodeDeploy handles deployments and CodePipeline orchestrates release pipelines, so neither stores repositories.

Correct answer: D. AWS Step Functions

AWS Step Functions coordinates AWS services into serverless workflows with a visual console that tracks each step's status. Lambda runs code on events but does not provide visual workflow orchestration or built-in step tracking.

Correct answer: A. Create an Amazon EC2 Auto Scaling group and configure an Elastic Load Balancer.

An Auto Scaling group with an Elastic Load Balancer automatically matches capacity to variable demand while maintaining availability. Sizing for peak traffic wastes money during low-demand periods, defeating cost-effectiveness.

Correct answer: A. AWS Cost Explorer

AWS Cost Explorer provides visual reports for analyzing and managing costs and usage over time. AWS Budgets sets alerts against spending thresholds but is not designed for exploring historical cost and usage trends.

Correct answer: B. Amazon Simple Notification Service (Amazon SNS)

Amazon SNS uses a push-based publish/subscribe model to fan out messages to thousands of subscribers simultaneously. SQS is pull-based queueing for decoupling components, not broadcast pub/sub delivery.

Correct answer: C. Availability Zones.

A VPC spans all Availability Zones in its Region, and you place subnets in each one for high availability. Note that only one internet gateway can be attached per VPC, so that option fails.

Correct answer: D. Dedicated Hosts

Dedicated Hosts give you a specific physical server, which satisfies licensing and compliance requirements. Dedicated Instances only isolate hardware at the instance level, so you don't control which physical server is used.

Correct answer: A. Create IAM policies based on least privilege principles. · E. Enable multi-factor authentication for users.

Least-privilege IAM policies and multi-factor authentication are core AWS security best practices. Remember that roles cannot be attached to IAM groups, and IAM is a global service with no regional users.

Correct answer: B. AWS Batch · D. AWS Elastic Beanstalk

AWS Batch and AWS Elastic Beanstalk are both compute services: Batch runs batch computing jobs, and Elastic Beanstalk deploys and scales web applications. CloudTrail is for auditing, Inspector for security assessment, and EFS is file storage, so none of those count as compute.

Correct answer: B. Create budgets and receive notifications if current or forecasted usage exceeds the budgets.

AWS Budgets, part of the AWS Cost Management tools, lets you create budgets and get alerts when actual or forecasted usage exceeds them. Moving S3 data to another storage class is done with S3 lifecycle policies, not cost management tools.

Correct answer: D. Amazon CloudWatch

Amazon CloudWatch collects performance metrics like CPU and network utilization for EC2 instances and lets you set alarms. CloudTrail records API calls for auditing, so think metrics versus audit logs when choosing between these two.

Correct answer: D. Launch the instances across multiple Availability Zones in a single AWS Region.

Spreading instances across multiple Availability Zones in one Region behind a load balancer provides high availability. A load balancer cannot span multiple Regions, and Spot versus Reserved pricing has no effect on availability.

Correct answer: C. Cost Allocation Tags

Cost allocation tags label resources by project or department so costs show up grouped in Cost Explorer and the cost allocation report. Consolidated billing only aggregates spending across accounts, not per project.

Correct answer: D. Amazon Aurora

Amazon Aurora is MySQL-compatible, scales storage automatically up to large capacities, and includes automated backups. DynamoDB and DocumentDB are NoSQL databases, so they cannot host a MySQL database.

Correct answer: A. Fast provisioning of resources · D. Scalable compute capacity

Fast provisioning and scalable compute capacity are core cloud advantages that deliver speed and agility. Lower cost is real but relates to cost optimization, not agility, so it's the strongest distractor here.

Correct answer: C. Amazon CloudWatch · E. AWS CloudTrail

CloudTrail records account API activity and CloudWatch collects operational and billing metrics, so both reveal account activity. Trusted Advisor gives best-practice recommendations but does not log activity, which makes it the common wrong pick.

Correct answer: A. Anticipate failure. · B. Perform operations as code.

Anticipating failure and performing operations as code are both explicit operational excellence design principles. Manual operations and static procedures are the opposite of that pillar's guidance.

Correct answer: B. Making programmatic calls to AWS from AWS APIs.

IAM access keys authenticate programmatic requests to AWS APIs, the CLI, and SDKs. Console sign-in uses a user name and password, which is the most tempting wrong option.

Correct answer: D. AWS Data Exchange

AWS Data Exchange lets customers find, subscribe to, and use third-party data products in the cloud. Glue and Data Pipeline move and transform data but do not provide a marketplace for subscribing to external datasets.

Correct answer: B. Amazon OpenSearch Service

Amazon OpenSearch Service provides managed search and analytics, ideal for keyword-based lookups across large content sets. EC2 could host a custom search stack but adds management overhead and no built-in search capability.

Correct answer: B. Convertible Reserved Instances

Convertible Reserved Instances can be exchanged for a different instance family, OS, or tenancy during the term. Standard Reserved Instances offer a bigger discount but lock the configuration, so they fail this requirement.

Correct answer: C. Availability Zone management

Under the shared responsibility model, AWS solely manages the global infrastructure, including Availability Zones. Patch management is split depending on the service, and data access controls always belong to the customer.

Correct answer: A. Amazon EC2

Only EC2 allows OS-level access, which the scripting requirement demands, even though it means more management work. RDS would minimize overhead but blocks shell access, making it the trap answer here.

Correct answer: A. Access keys

Access keys are the long-term credentials used to sign CLI and API requests programmatically. A user name and password only work for console sign-in, so it is the classic distractor.

Correct answer: B. Changing the account name. · D. Changing AWS Support plans.

Tasks that require the AWS account root user include changing the account name and changing AWS Support plans. A handy exam cue: root user tasks are rare and account-level, while S3 encryption and CloudTrail log viewing can all be delegated to IAM users or roles.

Correct answer: A. They may benefit from lower unit pricing for aggregated usage. · C. They will receive one bill for the accounts in the Organization.

Consolidated billing in AWS Organizations provides one bill for all accounts and combines usage so volume discounts, Reserved Instance discounts, and Savings Plans can be shared. The strongest distractor, a fixed discount, fails because discounts come from volume tiers and commitments, not a flat rate.

Correct answer: A. It is not necessary to enter into long term contracts.

A core value proposition of AWS is pay-as-you-go pricing with no long-term contracts required, though optional commitments earn discounts. Remember the shared responsibility model: AWS never secures your applications, and customers cannot access data centers or pick hardware.

Correct answer: C. Rehost the applications on Amazon EC2 instances that are right-sized.

For a cost-effective migration of legacy applications, rehosting onto right-sized EC2 instances is the fastest and cheapest approach that works as-is. Dedicated hosts cost more, Lambda requires rearchitecting, and S3 static hosting only serves static content.

Correct answer: C. Ability to go global quickly. · D. Fast provisioning of IT resources.

Going global quickly and provisioning IT resources fast are two of the six advantages of cloud computing. Watch for absolutes in distractors: words like all in outsource all operational risk signal a wrong answer, and customers never control physical data center infrastructure.

Correct answer: C. AWS Management Console · E. AWS CloudFormation

You can launch an ElastiCache cluster through the AWS Management Console or automate it with AWS CloudFormation templates. Exam cue: the console, CLI, SDKs, and CloudFormation are the standard ways to provision resources, while Concierge support only assists Enterprise plan customers.

Correct answer: D. Amazon EC2

Amazon EC2 is infrastructure as a service, so customers must patch the guest operating system and any installed software themselves. Lambda, Fargate, and DynamoDB are all serverless or fully managed, meaning AWS handles the underlying infrastructure and patching.

Correct answer: B. Remove single points of failure · D. Loose coupling

Removing single points of failure and designing for loose coupling are core cloud architectural design principles from the Well-Architected guidance. Customized hardware is not possible in the cloud, and the other options are not design principles the cloud enables.

Correct answer: A. Limit access privileges according to the principal of least privilege. · D. Enable encryption for the application data at rest.

Applying least privilege permissions and encrypting data at rest are fundamental AWS security best practices. Full admin access and disabling encryption in transit both weaken security rather than improve it.

Correct answer: A. Amazon EC2

Since the IT department will manage the database itself, self-managed EC2 with installed database software is the right fit. Managed options like RDS would be better if AWS handled administration, but RDS is not offered as a choice here.

Correct answer: A. AWS Trusted Advisor

Trusted Advisor includes service quota checks that alert you when utilization approaches limits, prompting an increase request. The Health Dashboard covers outages and events, while Cost Explorer only shows spending, not quotas.

Correct answer: D. Amazon RDS Multi-AZ deployment

RDS Multi-AZ provides automatic failover to a standby in another Availability Zone, directly supporting reliability. Match each option to a pillar: WebACL is security, IOPS tuning is performance efficiency, and CloudFormation is operational excellence.

Correct answer: D. Elasticity

Elasticity means provisioning resources that scale with actual demand, eliminating both underutilization and shortage. High availability and fault tolerance address resilience, not the waste caused by idle on-premises capacity.

Correct answer: C. Amazon Elastic Block Store (EBS)

EBS provides block storage volumes that serve as EC2 root volumes holding the operating system. Remember EFS is for shared network file mounts, S3 is object storage accessed via API, and an AMI is only a launch template.

Correct answer: D. Principal

The Principal element identifies the user, account, or service that the policy allows or denies. For the exam, keep the mapping simple: Action is the permission, Resource is the target ARN, and Condition adds restrictions.

Correct answer: A. Run the batch workload in parallel across multiple Amazon EC2 instances.

Horizontal scaling across multiple EC2 instances lets the batch workload be split in parallel, keeping processing time stable as volume grows. A bigger instance type is vertical scaling and eventually hits limits as the workload doubles monthly.

Correct answer: A. Implement loosely coupled services.

Breaking a monolith into microservices is the classic example of implementing loosely coupled services in the Well-Architected performance efficiency pillar. The other options are real cloud design principles but do not match the refactoring described.

Correct answer: C. Amazon MSK

Amazon MSK is the fully managed Apache Kafka service, so the firm gets Kafka without managing brokers or ZooKeeper. Kinesis also does real-time streaming, but the requirement explicitly names Kafka compatibility.

Correct answer: B. The speed at which AWS resources can be created. · D. The ability to experiment quickly.

Agility on AWS means resources are provisioned in minutes, so teams can experiment and develop quickly at low cost. Elasticity and eliminating wasted capacity are cost and scaling benefits, not agility itself.

Correct answer: A. Economies of scale.

Aggregated usage from hundreds of thousands of customers gives AWS economies of scale, which lowers unit prices over time. Pay-as-you-go pricing is a customer benefit, not the driver behind price reductions.

Correct answer: A. AWS Outposts

AWS Outposts brings AWS infrastructure and services into your on-premises data center, letting you extend a VPC there. Direct Connect only provides a private low-latency network link and does not extend the VPC itself, which is the key wording cue to watch for.

Correct answer: C. Virtually unlimited

Amazon S3 provides virtually unlimited storage with no limit on total volume or number of objects. Just remember the per-object maximum is 5 TB, a commonly tested detail that is different from the overall capacity question asked here.

Correct answer: A. Configure a firewall in front of resources.

Placing a firewall, such as AWS WAF or a security group layer, in front of resources reduces the attack surface and helps mitigate DDoS attacks. CloudWatch, CloudTrail, and the Health Dashboard are monitoring tools that detect issues but do not actively block traffic.

Correct answer: D. AWS Web Application Firewall (WAF)

AWS WAF can protect websites hosted outside AWS when they sit behind an Application Load Balancer with on-premises servers registered by IP address. Route tables, security groups, and network ACLs only work inside a VPC.

Correct answer: C. AWS Partner Solutions

AWS Partner Solutions, formerly Quick Starts, provide automated deployments of popular technologies using CloudFormation with best-practice architecture guides. CloudFormation is the underlying tool, but the packaged accelerators with deployment instructions are the resource being asked about.

Correct answer: D. Customers should rotate access keys regularly.

Regularly rotating access keys is the documented IAM security best practice because it limits exposure if a key is compromised. AWS never rotates customer keys automatically; that responsibility belongs to the customer.

Correct answer: B. Amazon Macie

Amazon Macie uses machine learning and pattern matching to discover and help protect sensitive data such as PII in Amazon S3 buckets. GuardDuty is the strongest distractor, but it detects threats and malicious activity rather than scanning content for sensitive data.

Correct answer: C. AWS CloudTrail

AWS CloudTrail records API-level account activity, including who terminated the RDS instance, capturing user identity and event details. CloudWatch monitors performance metrics, while Inspector and Trusted Advisor handle security assessments and best-practice checks, not audit trails.

Correct answer: B. A secret access key · E. An access key ID

Programmatic CLI access requires the access key ID and secret access key, which together authenticate AWS API requests. Public or private keys relate to encryption and EC2 key pairs, and IAM roles delegate access rather than configuring local CLI credentials.

Correct answer: A. Strong password policies · C. AWS Multi-Factor Authentication (AWS MFA)

Strong password policies and MFA directly strengthen Management Console sign-in security. Security groups control instance traffic, Secrets Manager stores credentials for applications, and ACM issues TLS certificates, none of which protect console logins.

Correct answer: D. Maintaining server-side encryption.

Under the shared responsibility model, the customer handles encryption of data in the cloud, including server-side encryption choices. Physical networking, hardware firewalls, and data center security fall to AWS as part of security of the cloud.

Correct answer: D. Auto Scaling

Auto Scaling automatically adds or removes compute capacity as demand changes, matching resources to load. Load balancing only distributes traffic, while high availability and fault tolerance describe resilience goals, not capacity adjustment mechanisms.

Correct answer: C. AWS Artifact

AWS Artifact provides on-demand access to AWS compliance reports and agreements directly from the console. Remember ACM handles SSL certificates and Security Hub manages security posture; Artifact is the exam keyword for audit and compliance documents.

Correct answer: D. AWS Direct Connect

AWS Direct Connect provides a private, dedicated physical link between on-premises and AWS, delivering consistent bandwidth since it bypasses the internet. A Managed VPN runs over the public internet, so its performance cannot be guaranteed as consistent.

Correct answer: C. Provide physical security for Availability Zones. · E. Patch the operating system of Amazon S3.

AWS owns security of the cloud, meaning physical security of Availability Zones and patching of managed services like S3's underlying platform. Customers handle their own data, encryption, and IAM permissions, so those distractors sit on the customer's side.

Correct answer: C. The failure of a single component should not affect the application.

High availability means no single point of failure; one component failing should not bring the application down. Overprovisioning peak capacity wastes money, and a monolithic component actually creates a single point of failure.

Correct answer: A. AWS Snowball

AWS Snowball uses a physical device to move large datasets, so a 70 TB transfer avoids the unreliable internet entirely. DataSync transfers over the network, Storage Gateway connects on-premises storage to cloud, and Glacier is an archival storage class, not a transfer service.

Correct answer: A. Infrastructure as a Service (IaaS)

EC2 gives you raw compute, storage, and networking you manage yourself, which is the definition of Infrastructure as a Service. On the exam, remember the ladder: EC2 equals IaaS, Elastic Beanstalk equals PaaS, and Lambda maps to serverless or FaaS.

Correct answer: C. Pay-as-you-go pricing

Pay-as-you-go pricing replaces upfront capital expense with variable expense tied only to what you consume. Economies of scale sounds tempting, but that benefit is about lower unit costs from aggregate usage, not swapping fixed for variable costs.

Correct answer: A. Host a static website · D. Media hosting

Amazon S3 is object storage commonly used to host static websites and media files. Message queues need SQS, caching needs ElastiCache, and operating systems require block storage like EBS, not object storage.

Correct answer: C. Capital expenses are replaced with variable expenses · E. Increased agility

Moving to AWS replaces upfront capital expenses with pay-as-you-go variable expenses and increases agility. Security remains a shared responsibility, and customers never control the physical infrastructure.

Correct answer: C. Amazon DynamoDB

Amazon DynamoDB is AWS's managed NoSQL key-value database, making it the right replacement. RDS is relational, Redshift is data warehousing, and QLDB is a ledger database, so none fit a NoSQL workload.

Correct answer: C. One or more physical data centers

An Availability Zone consists of one or more discrete data centers with redundant power and networking inside a Region. A completely isolated geographic location describes a Region, and edge locations serve CloudFront caching.

Correct answer: A. AWS Lambda · B. Amazon ECS

AWS Lambda runs serverless functions and Amazon ECS runs containers, so both provide compute. EFS is file storage, CloudHSM manages keys, and DynamoDB is a database service.

Correct answer: A. AWS Global Accelerator · D. Amazon CloudFront

CloudFront caches content at edge locations and Global Accelerator routes users over the AWS backbone, both cutting global latency. Direct Connect helps one fixed site, not a worldwide user base.

Correct answer: C. AWS CodeCommit

AWS CodeCommit is the fully managed source control service that hosts secure Git-based repositories. On the exam, remember the Code-family roles: CodeBuild compiles, CodeDeploy deploys, and CodePipeline orchestrates the release pipeline.

Correct answer: D. AWS Trusted Advisor

Trusted Advisor runs security checks that flag security group rules allowing unrestricted 0.0.0.0/0 access on risky ports. CloudTrail audits API calls and VPC Flow Logs capture traffic metadata, but neither directly identifies overly permissive rules.

Correct answer: B. Updating the guest operating system on Amazon EC2 instances.

Patching the guest operating system on EC2 is security in the cloud, which the customer owns. For managed services like Lambda, DynamoDB, and API Gateway, AWS maintains the underlying infrastructure and operating systems.

Correct answer: D. AWS Storage Gateway

AWS Storage Gateway is the hybrid storage service connecting on-premises applications to cloud storage. Direct Connect provides a dedicated network link, not storage, so it is the strongest distractor to watch for.

Correct answer: B. Agility

Agility refers to the cloud's ability to provision resources in minutes, enabling rapid iteration and faster time to market. Elasticity addresses scaling with demand, not the speed of delivering new functionality.

Correct answer: C. Security group

A security group acts as a virtual firewall at the instance level, controlling inbound and outbound traffic for an EC2 instance. Remember that network ACLs operate at the subnet level, while WAF and Shield protect web applications, not instances.

Correct answer: B. Design for failure.

Deploying across multiple Availability Zones embodies the design-for-failure principle, because the workload survives an outage in one zone. Elasticity is the tempting distractor, but that comes from Auto Scaling, not multi-AZ deployment.

Correct answer: D. Amazon ECS

Amazon ECS runs and manages Docker containers on a managed cluster. ECR only stores container images, and it does not run them, so it is the strongest distractor here.

Correct answer: D. AWS Personal Health Dashboard

The AWS Personal Health Dashboard gives alerts and remediation guidance for events affecting your own resources, including proactive notice of scheduled activities. The Service Health Dashboard only shows general regional service status with no personalization.

Correct answer: A. You receive a single bill for multiple accounts · B. You can combine usage and share volume pricing discounts

Consolidated billing gives one bill for all accounts and combines usage so you share volume discounts and Reserved Instance savings. There are no per-account or per-user fees, which rules out both fee-based options.

Correct answer: B. AWS Billing Conductor

AWS Billing Conductor lets you create billing groups, apply custom pricing rules, and generate a distinct CUR per group for showback or chargeback. Cost Explorer and Budgets only track and alert on actual spending.

Correct answer: B. Increased productivity for application development teams. · E. Less staff time is required to launch new workloads.

The cloud removes heavy infrastructure management, so development teams are more productive and new workloads take less staff time. Watch for reversed distractors like increased time to market or higher acquisition costs.

Correct answer: C. AWS Activate for Startups

AWS Activate provides startups with credits, training, and technical support to build on AWS. AWS Educate targets students, and the Partner Network is for established consulting and technology partners.

Correct answer: B. Protect data in transit and at rest. · C. Monitor, alert, and audit actions and changes to AWS resources.

Protecting data in transit and at rest and monitoring, alerting, and auditing actions are both core security pillar design principles. Options like analyzing expenditures and operations as code belong to cost optimization and operational excellence instead, so watch the pillar match.

Correct answer: A. AWS IAM role

An IAM role attached to the EC2 instance delivers temporary credentials automatically, avoiding long-term keys. Access keys are long-lived credentials that should never be embedded in code, which is the classic trap in this question.

Correct answer: B. Amazon Simple Email Service (Amazon SES)

Amazon SES is purpose-built for sending transactional email like order confirmations and password resets. SNS pushes pub-sub notifications but is not optimized for email delivery, making SES the clear choice here.

Correct answer: A. Amazon EMR

Amazon EMR provides a managed Hadoop framework for processing vast amounts of data on EC2 and S3. Athena is serverless SQL querying of S3 data, and Redshift is a data warehouse, so the Hadoop keyword pins EMR.

Correct answer: B. Consolidated billing

Consolidated billing in AWS Organizations combines multiple accounts into one monthly bill from a payer account. Cost Explorer and the Cost and Usage Report only visualize or itemize costs; they do not produce a single bill.

Correct answer: A. AWS Shield

AWS Shield provides always-on managed DDoS protection in Standard and Advanced tiers. GuardDuty detects threats like unusual API activity but does not mitigate volumetric DDoS attacks, so match DDoS to Shield on the exam.

Correct answer: B. AWS Budgets

AWS Budgets lets you set custom cost and usage limits and receive alerts when actual or forecasted amounts exceed thresholds. Cost Explorer analyzes past spending but cannot trigger threshold alerts, so alerts signal Budgets.

Correct answer: D. AWS Organizations consolidated billing.

Consolidated billing in AWS Organizations combines usage across all accounts so the company earns volume pricing tier discounts. Service control policies only restrict permissions, and Reserved Instances are a pricing model rather than a billing mechanism.

Correct answer: B. Purchase Amazon EC2 Reserved Instances. · D. Implement Auto Scaling groups to add and remove instances based on demand.

Reserved Instances cut long-term compute costs, and Auto Scaling matches capacity to demand so you avoid paying for idle servers. AWS Budgets sends alerts but does not actually stop spending, so it is not a true cost-optimization action.

Correct answer: C. Estimate savings when comparing the AWS Cloud to an on-premises environment

The TCO Calculator estimates cost savings of running workloads on AWS versus an on-premises environment. Distinguish it from the AWS Pricing Calculator, which estimates monthly bills for planned AWS resources.

Correct answer: B. Elasticity · C. Pay-as-you-go pricing

Elasticity lets resources scale with highly variable demand, and pay-as-you-go means you only pay for what is consumed. Reliability and high availability concern resilience, not cost efficiency for fluctuating workloads.

Correct answer: D. AWS Trust & Safety team

Abuse of AWS-owned IP addresses, such as flooding attempts, should be reported to the AWS Trust and Safety team via the abuse form. A Technical Account Manager supports your own workloads, not external abuse reports.

Correct answer: C. Virtual Private Network

A VPN establishes an encrypted connection over the internet between an on-premises network and AWS. Watch for VPC as a distractor; it is the virtual network itself, not the secure link to your data center.

Correct answer: C. Updating Amazon EC2 host firmware

AWS is responsible for security of the cloud, including the physical hosts and their firmware. Everything listed otherwise, like OS patching, permissions, and data encryption, is the customer's responsibility in the cloud.

Correct answer: D. Economies of scale

Aggregating usage from hundreds of thousands of customers lets AWS achieve economies of scale and pass the savings on as lower prices. Pay-as-you-go is a billing model, not the driver behind repeated price reductions.

Correct answer: D. AWS Marketplace

AWS Marketplace is the digital catalog for finding and buying third-party software that runs on AWS. License Manager only tracks licenses you already own; it does not sell software.

Correct answer: D. Amazon EC2

Snowball Edge devices natively support running Amazon EC2 instances with sbe instance types for edge computing. Trusted Advisor, SMS, and DMS are management and migration services, not local Snowball workloads.

Correct answer: A. AWS Glue

AWS Glue is a serverless extract, transform, and load service that moves data between sources like S3 and target destinations. Amazon Kinesis handles real-time streaming, while EMR and Redshift focus on big data processing and warehousing rather than managed ETL.

Correct answer: B. AWS CloudHSM

AWS CloudHSM provides dedicated single-tenant hardware security modules for key generation and management to meet strict compliance requirements. KMS manages keys but uses shared, managed infrastructure, so the keyword dedicated hardware points to CloudHSM.

Correct answer: A. AWS makes it easy to implement high availability. · E. AWS can accommodate large changes in application demand.

High availability across Availability Zones and elastic scaling for demand changes are direct cloud advantages. AWS only patches infrastructure, not your application code, and never auto-replicates data globally, so those distractors fail under shared responsibility.

Correct answer: B. Amazon EventBridge

Amazon EventBridge is the serverless event bus that can trigger a Step Functions workflow in response to EC2 instance state-change events. Remember EventBridge for event-driven automation; Fargate is container compute and SageMaker is machine learning.

Correct answer: A. Users can stop guessing about resource capacity. · D. Users can stop spending money on the maintenance of data centers.

Two of the six advantages of cloud computing are trading capital expense for variable expense and stopping capacity guessing. AWS manages security OF the cloud, not all security IN the cloud, and cloud bills vary with usage.

Correct answer: D. High availability

High availability means a system keeps operating through component failures with minimal downtime. Scalability and elasticity are about handling changes in demand, not surviving failures, so they are the tempting wrong picks.

Correct answer: C. AWS Artifact

AWS Artifact provides on-demand downloads of AWS security and compliance reports such as SOC and PCI documents. Exam cue: Artifact equals audit reports; Inspector equals automated vulnerability assessments.

Correct answer: B. Operational excellence

Performing operations as code, including infrastructure as code, is a core design principle of the operational excellence pillar. The other pillars focus on performance, security, or recovering from failures rather than how operations are run.

Correct answer: D. Amazon GuardDuty

Amazon GuardDuty provides intelligent, continuous threat detection across accounts using machine learning on logs. Detective investigates findings after the fact, Shield handles DDoS, and Macie discovers sensitive data, so GuardDuty is the fit.

Correct answer: B. AWS Cloud9

AWS Cloud9 is a cloud-based IDE that lets you write, run, and debug code from a browser with no local setup. CodeStar and CodeBuild handle development workflows and builds, not an in-browser IDE, so they fail the requirement.

Correct answer: D. IAM User

Access key IDs and secret access keys are long-term credentials attached to an IAM user for programmatic calls. Remember, IAM roles use temporary credentials and groups and policies cannot hold access keys at all.

Correct answer: D. Firewall configuration

Firewall configuration, such as security groups and network ACLs, is security in the cloud and belongs to the customer. Exam cue: anything you can configure in the console is usually your responsibility, not AWS's.

Correct answer: B. Encrypting traffic on the AWS backbone between global and regional AWS facilities. · C. Scanning AWS service endpoints for vulnerabilities.

AWS owns its global network and service endpoints, so protecting backbone traffic and scanning endpoints for vulnerabilities fall under security of the cloud. Security group rules and S3 encryption are customer configurations, so those distractors fail.

Correct answer: A. Rightsize all the EC2 instances that are used in the deployment

Rightsizing instances to match actual workload demand directly reduces cost since you pay for provisioned capacity. Consolidated billing and CloudFormation help with management, not with making the workload itself cheaper.

Correct answer: C. Amazon Cognito.

Amazon Cognito adds sign-up and sign-in to web and mobile apps and supports social identity providers like Google, Facebook, and Apple. IAM only handles AWS identities, so it cannot authenticate external app users.

Correct answer: B. Access keys

Access keys, made up of an access key ID and secret access key, authenticate programmatic API and CLI calls. Do not confuse them with key pairs, which are used to log in to Amazon EC2 instances.

Correct answer: C. Create a custom IAM policy.

AWS managed policies are read-only, so the solution is creating a customer managed policy with the extra permissions. Remember, service control policies restrict rather than grant permissions, so that option fails.

Correct answer: D. Download the reports from AWS Artifact.

AWS Artifact provides on-demand downloads of AWS security and compliance reports like SOC and PCI, so no human contact is required. Remember that Artifact gives you AWS's own compliance documents, while AWS Config tracks your own resources.

Correct answer: D. Standard Reserved Instances

A steady, right-sized workload running for a full year fits Standard Reserved Instances, which give the deepest discount with a one-year term. Spot is cheaper per hour but can be interrupted, and Convertible RIs trade savings for flexibility that is not needed here.

Correct answer: A. AWS CloudTrail

AWS CloudTrail records user and API activity across the account, answering who did what and when. CloudWatch monitors performance and metrics, not user actions, so it fails the auditing requirement in the wording.

Correct answer: D. VPC Flow Logs

VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, and can be sent to CloudWatch Logs or S3. CloudTrail only logs API calls, not network packet-level traffic.

Correct answer: B. IAM Group

An IAM Group is a collection of users, and policies attached to the group apply to every member, making bulk permission assignment easy. A role is assumed temporarily and is not the way to attach permissions to many users at once.

Correct answer: C. Configure AWS Config with the resource types

AWS Config records resource inventory, configuration history, and configuration changes, which is exactly what compliance auditing of your own resources requires. Artifact covers AWS's compliance reports, and CloudTrail only tracks API activity.

Correct answer: B. Amazon CloudFront

Amazon CloudFront is a CDN that caches S3 static content at edge locations close to users, delivering low latency worldwide. Global Accelerator is the strongest distractor, but it routes traffic over the AWS network and does not cache content.

Correct answer: D. AWS Trusted Advisor

AWS Trusted Advisor includes security checks that flag security groups with unrestricted access on any port. VPC Flow Logs is the tempting distractor, but it only records IP traffic; it doesn't analyze security group rules for you.

Correct answer: D. AWS Systems Manager

AWS Systems Manager provides a unified interface for operational data across AWS services plus automation for operational tasks. CloudWatch monitors metrics and logs but does not automate operational tasks across resources.

Correct answer: A. IAM Role

IAM roles are the entity used to grant permissions to AWS services without permanent credentials. IAM policies define permissions but must be attached to a role; you never assign a policy directly to a service.

Correct answer: C. Edge locations

CloudFront delivers content through a global network of edge locations, routing each request to the lowest-latency location. Exam cue: CloudFront equals edge locations, while Regions and AZs are for running workloads.

Correct answer: B. Internet gateway

An internet gateway is the VPC component that allows inbound traffic from the internet to reach resources in the VPC. A NAT gateway only enables outbound internet access from private subnets, never inbound.

Correct answer: A. AWS Pricing Calculator.

AWS Pricing Calculator estimates costs for planned workloads before you build them. Cost Explorer and the Cost and Usage Report analyze past or current spend, not pre-deployment estimates for new workloads.

Correct answer: D. AWS Regions

AWS Regions are a core component of AWS Global Infrastructure, along with Availability Zones and edge locations. For the exam, remember that Organizations, LightSail, and Alexa are services or account-management tools, not physical infrastructure components.

Correct answer: A. AWS IAM Access Analyzer.

AWS IAM Access Analyzer identifies resources shared with external entities, such as S3 buckets and IAM roles, helping detect unintended access. Control Tower handles multi-account governance, so it does not find externally shared resources.

Correct answer: D. Trade fixed expenses for variable expenses.

Trading fixed capital expenses for variable pay-as-you-go expenses is one of the six advantages of cloud computing. The other options describe trades you never make, since cloud benefits like security and agility are not traded away.

Correct answer: B. Amazon GuardDuty

Amazon GuardDuty provides intelligent threat detection and continuous monitoring for malicious or unauthorized activity. Exam cue: GuardDuty detects threats, Shield protects against DDoS, and KMS or CloudHSM manage encryption keys.

Correct answer: C. Per second

EC2 Linux instances, including Amazon Linux 2, are billed per second with a 60-second minimum. Exam cue: remember Linux bills per second, while Windows instances historically bill per hour, and EBS storage bills per GB provisioned.

Correct answer: A. Cost of application software licenses.

Application software licenses remain the customer's responsibility under the shared responsibility model. AWS owns the hardware, power, and data center physical security, so those costs never fall on the customer.

Correct answer: C. Elasticity

Elasticity is the hallmark cloud architectural benefit, scaling resources up and down automatically with demand. Vertical scalability exists on-premises too, so it is not a distinguishing benefit of the cloud.

Correct answer: B. Design for failure

Auto Scaling with health check replacement plus a load balancer is the classic example of designing for failure and expecting components to fail. Decoupling is done with queues or messaging services like SQS, not load balancers.

Correct answer: B. Tag each business unit's resources, then filter by unit in Cost Explorer.

Cost allocation tags let you break down spend by business unit and filter those tags in Cost Explorer. Splitting by Region or VPC is unnecessary, and the coverage report is a Savings Plans feature, not a general billing view.

Correct answer: D. Amazon CloudFront · E. AWS Shield

CloudFront edge locations cache content close to users, and AWS Shield runs at the edge to absorb DDoS attacks. Direct Connect is a private physical connection into AWS, so it is not tied to edge locations.

Correct answer: C. On-Demand Capacity Reservation with Savings Plan

On-Demand Capacity Reservations with a Savings Plan guarantee capacity in a specific Availability Zone while lowering cost for the predictable Monday schedule. Spot Instances are cheapest but can be interrupted with two minutes' notice, which fails the mission-critical requirement.

Correct answer: C. AWS Direct Connect

AWS Direct Connect provides a dedicated private connection with consistent bandwidth and performance between on-premises and AWS. Site-to-Site VPN is the common distractor, but it runs over the public internet, so performance varies.

Correct answer: B. Amazon ElastiCache

Amazon ElastiCache is an in-memory data store delivering sub-millisecond read latency, ideal for caching in front of critical applications. Amazon RDS is a solid database but cannot guarantee single-millisecond response times.

Correct answer: B. Amazon Simple Storage Service (Amazon S3).

Amazon S3 object storage covers backup and restore, data lakes, and archival use cases in a single service with lifecycle policies. EFS and EBS are the usual distractors, but they serve file and block storage workloads respectively.

Correct answer: D. Amazon CloudWatch

Amazon CloudWatch collects metrics and alarms to monitor operational health and support right-sizing for cost optimization. AWS CloudTrail records API audit events, not real-time performance or health metrics.

Correct answer: C. AWS Organizations

AWS Organizations enables consolidated billing, so combined usage across accounts reaches volume discount tiers faster. Cost Explorer and AWS Budgets only report and alert on spend, never apply discounts.

Correct answer: C. Amazon Simple Queue Service (Amazon SQS)

Amazon SQS is the classic decoupling service, letting producers and consumers operate independently through a managed queue. SNS could also loosely decouple components, but for the exam, queue-based decoupling with SQS is the expected answer.

Correct answer: D. AWS Organizations

AWS Organizations provides centralized management and automated creation of multiple AWS accounts through its API. IAM manages users and roles inside one account and cannot create accounts, making it the strongest wrong choice.

Correct answer: B. 4hrs, 5mins, and 6 seconds

Linux EC2 instances on On-Demand, Reserved, and Spot models are billed per second after a one-minute minimum, so the exact runtime is charged. Watch for options that round up to the nearest minute or hour, which reflects the older billing model.

Correct answer: B. By launching and terminating instances as needed

EC2 Auto Scaling adds capacity by launching instances when demand rises and terminates them when it falls, maintaining availability. Distributing connections is the load balancer's job, and instance types are not changed automatically.

Correct answer: D. Elasticity

Elasticity means acquiring resources when needed and releasing them when not, which enables quick scaling up and down. Pay-as-you-go is about the billing model, not the ability to scale capacity rapidly.

Correct answer: A. The AWS infrastructure consists of isolated AWS Regions with independent Availability Zones that are connected with low-latency networking and redundant power supplies.

Regions contain multiple isolated Availability Zones, each with redundant power and low-latency networking, giving high availability and fault tolerance. Remember Regions contain AZs, never the reverse, which eliminates option C.

Correct answer: B. Reserve capacity · C. Reduced cost

Reserved Instances provide a discount for a 1- or 3-year commitment and can reserve capacity in a specific Availability Zone. Don't confuse them with Dedicated Hosts; Reserved Instances are a pricing model, not dedicated hardware.

Correct answer: C. There is no need to manage operating systems

Amazon RDS is a managed service, so AWS handles the operating system, patching, and backups. Remember that RDS still requires some database administration and only supports specific engines, not any database.

Correct answer: B. AWS Transit Gateway

AWS Transit Gateway acts as a central hub that connects VPCs and on-premises networks, including inter-Region peering across the AWS global network. PrivateLink provides private connectivity but does not connect VPCs across multiple Regions.

Correct answer: A. Amazon RedShift · E. Amazon DynamoDB

Amazon Redshift and DynamoDB both offer reserved capacity for significant discounts, alongside EC2, RDS, and ElastiCache. Exam cue: only compute or capacity-based services can be reserved; S3, Lambda, and CloudWatch are pure pay-as-you-go.

Correct answer: C. Amazon MemoryDB

Amazon MemoryDB for Redis is a Redis-compatible, durable in-memory database that delivers sub-millisecond latency for caching, session stores, and analytics. On the exam, remember DynamoDB offers single-digit millisecond performance, not the Redis compatibility and sub-millisecond speeds described here.

Correct answer: C. Amazon Cognito.

Amazon Cognito supports SAML 2.0 federation for managed application sign-in, matching the requirement. A test-taker could argue IAM SAML federation or IAM Identity Center also fit, so watch the wording about managed application access.

Correct answer: C. AWS Amplify · E. AWS AppSync

AWS Amplify and AWS AppSync both support building scalable web and mobile apps with real-time updates and offline capabilities. Amazon API Gateway is the strongest distractor, but it only manages APIs and does not offer offline features by itself.

Correct answer: B. Included Technical Account Manager

The Enterprise Support plan is the only tier that includes a designated Technical Account Manager. For the exam, remember TAM plus 15-minute response for business-critical issues equals Enterprise Support.

Correct answer: B. Can be used to identify objects in an image

Amazon Rekognition uses deep learning to detect objects, scenes, faces, and text in images. It does not transcode, resize, or compress media, so those options fail on the service's core purpose.

Correct answer: A. You provision only what you need and adjust to peak load

Cloud economics center on provisioning only what you need and elastically scaling to meet peak load, so you avoid over-provisioning capital expense. Free data transfer is the trap; inbound is free but outbound transfer is charged.

Correct answer: B. AWS CloudFormation · C. AWS Elastic Beanstalk

CloudFormation and Elastic Beanstalk are the classic automation answers for infrastructure and application deployment. Note that AWS Lambda also enables automation through serverless functions, so some test-takers could argue for it, but the intended pair is B and C.

Correct answer: B. AWS Organizations

AWS Organizations uses service control policies to centrally restrict the maximum available API actions across all member accounts. IAM policies grant permissions but do not centrally control actions across accounts the way SCPs do, which is the key distinction on the exam.

Correct answer: B. AWS AppConfig

AWS AppConfig deploys application configuration changes with validation checks and controlled rollout, without code changes or service restarts. CloudFormation provisions infrastructure, not runtime application configuration with validators, so it does not fit this scenario.

Correct answer: C. Block the IP on the inbound rule of a network ACL.

Network ACLs support explicit deny rules, so you can block a specific inbound IP address at the subnet level. Security groups are allow-only, so they cannot explicitly block individual IPs, which makes any option involving security groups incorrect.

Correct answer: C. Store passwords in AWS Secrets Manager.

AWS Secrets Manager is purpose-built for storing, rotating, and retrieving credentials like passwords securely. An S3 bucket, even encrypted, lacks built-in rotation and access controls designed specifically for secrets.

Correct answer: B. Buckets · E. Objects

Amazon S3 stores data as objects inside buckets, which are the two core building blocks of the service. Directories, block devices, and file systems belong to file and block storage offerings like EFS and EBS, not S3.

Correct answer: C. AWS Compute Optimizer

AWS Compute Optimizer uses machine learning on historical usage to recommend optimal resources that lower cost and improve performance. Cost Explorer and Budgets only track and manage spending, while Trusted Advisor gives best-practice checks without ML-based sizing.

Correct answer: B. Deploy into multiple Availability Zones · D. Design for fault tolerance

Deploying across multiple Availability Zones and designing for fault tolerance are core cloud design principles. Close coupling, monolithic architectures, and single-AZ deployments all increase the blast radius of a single failure.

Correct answer: B. Open a production system down support case

A production system down case is the correct severity for a Business support plan outage, with a one-hour response target. Business-critical system down, the concierge team, and a dedicated TAM are exclusive to the Enterprise support plan.

Correct answer: C. Dedicated Hosts

Dedicated Hosts give you a physical server fully dedicated to your use, which lets you use per-core software licenses from vendors like Microsoft or Oracle. On-Demand and Reserved Instances are shared tenancy models, so they don't satisfy per-core license requirements.

Correct answer: B. Reliability

Resilience, consistent correct operation, and timely recovery from failures are the definition of the Reliability pillar. Operational excellence is about running and improving systems day to day, not recovering from failures, so it fails here.

Correct answer: D. AWS Shield

AWS Shield is the managed DDoS protection service, with Standard always-on and Advanced tiers. GuardDuty detects threats and Inspector scans for vulnerabilities, but neither mitigates DDoS attacks.

Correct answer: C. AWS CloudTrail

AWS CloudTrail records API calls, including who made them, from which IP, and when, so it identifies the user who stopped the EC2 instance. CloudWatch monitors metrics, and VPC Flow Logs only capture network traffic, not user identity.

Correct answer: B. Amazon Cognito

Amazon Cognito adds user sign-up, sign-in, and access control to web and mobile apps, scaling to millions of users. Directory Service manages Active Directory, while Artifact handles compliance documents, not application authentication.

Correct answer: C. Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors accounts and workloads for malicious activity and unauthorized behavior. Inspector finds vulnerabilities and Macie discovers sensitive data in S3, so neither fits threat monitoring.

Correct answer: B. By automatically scaling resources based on demand

Elasticity means resources automatically scale up and down with demand, so you only pay for what you need at any moment. Don't confuse it with loose coupling, which is reducing interdependencies between components, or with reserved capacity pricing.

Correct answer: D. AWS CloudTrail

CloudTrail records AWS API calls, including who made them, from where, and when, making it the go-to audit tool. Detective analyzes security findings for investigations but doesn't provide the API call history itself; Inspector scans for vulnerabilities.

Correct answer: A. Reserved Instances

Reserved Instances offer steep discounts for steady, non-interruptible workloads with a one or three year commitment. Spot is cheaper but can be interrupted with two minutes' notice, and Dedicated Hosts address licensing needs rather than general savings.

Correct answer: D. AWS Direct Connect

Direct Connect provides a dedicated private physical link from on-premises to AWS that bypasses the internet entirely. Exam cue: VPN options are encrypted but still traverse the public internet, so they fail the 'avoid the internet' requirement.

Correct answer: B. Amazon RDS for SQL Server

RDS for SQL Server is a like-for-like managed migration target, cutting operational overhead without refactoring code. SQL Server on EC2 keeps you managing the OS and database yourself, while DynamoDB would force a costly NoSQL redesign.

Correct answer: B. Reduced operational overhead

Fully managed services shift patching, setup, and maintenance to AWS, reducing operational overhead. Watch the backup distractor: you generally still configure backups yourself, and managed services actually reduce your control and flexibility.

Correct answer: C. AWS Application Discovery Service

Application Discovery Service gathers configuration and usage data from on-premises servers specifically to plan migrations to AWS. Systems Manager manages hybrid resources operationally, but it doesn't produce migration planning inventory.

Correct answer: C. Amazon Redshift

Amazon Redshift is a fully managed data warehouse purpose-built for analytics using standard SQL. Remember the exam cue: Redshift equals data warehouse and OLAP, while RDS handles OLTP workloads and Athena queries S3 data.

Correct answer: B. By pooling usage across multiple accounts to achieve a pricing tier discount

Consolidated billing pools usage across all accounts in an organization, which unlocks volume discounts and shares Reserved Instance and Savings Plans benefits. A consolidated view of billing is helpful but does not actually lower costs, so that distractor fails.

Correct answer: B. Amazon ElastiCache

Amazon ElastiCache sits in front of a database and serves frequently requested data from in-memory cache, boosting read performance. RDS is the backend database itself, not an add-on that accelerates requests to another database.

Correct answer: D. AWS Storage Gateway

AWS Storage Gateway provides hybrid storage that connects on-premises applications to AWS cloud storage through standard protocols. Exam cue: hybrid equals Storage Gateway, while S3 cross-region replication and CloudFront stay entirely within the cloud.

Correct answer: D. Amazon FSx for Windows File Server.

Amazon FSx for Windows File Server provides fully managed file storage with native SMB protocol support. Key cue: SMB means Windows so choose FSx for Windows, while EFS uses NFS for Linux workloads.

Correct answer: B. Installing patches on Windows operating systems · C. Implementing IAM password policies

Under the shared responsibility model, customers patch operating systems they manage, like Windows on EC2, and configure their own IAM password policies. Network devices, data center access controls, and disk disposal are AWS's responsibility because they are part of the physical infrastructure.

Correct answer: D. Reduce interdependencies so a failure in one component does not cascade to other components

Loose coupling means reducing interdependencies so a failure or change in one component does not cascade to others. Automatic scaling describes elasticity, and automating infrastructure with code describes infrastructure as code, so those distractors describe different concepts.

Correct answer: B. AWS are responsible for the security of regions and availability zones

AWS is responsible for security of the cloud, which includes the global infrastructure such as regions and Availability Zones. Encrypting customer data is the customer's job, and patching storage systems is AWS's job, since customers never touch the underlying hardware.

Correct answer: C. Website capacity can expand or contract as website traffic changes. · D. The company can take advantage of the pay-as-you-go pricing model.

Moving to AWS gives elasticity, so website capacity can expand and contract with traffic, plus pay-as-you-go pricing instead of upfront hardware costs. Encryption is not automatic by default, and AWS does not guarantee the lowest pricing model or improve search engine rankings.

Correct answer: C. Amazon EFS

Amazon EFS is a managed NFS file system that can be mounted by thousands of EC2 instances across multiple Availability Zones at the same time. EBS attaches to a single instance as block storage, S3 is object storage, and instance store is ephemeral block storage.

Correct answer: C. Amazon Kendra

Amazon Kendra is an ML-powered enterprise search service that answers natural language questions across large document sets. Comprehend analyzes text sentiment and entities, Lex builds chatbots, and Elasticsearch is keyword search, not ML-based natural language answers.

Correct answer: C. Amazon CloudWatch

CloudWatch collects billing metrics and lets you create alarms that trigger when estimated charges exceed a threshold. Trusted Advisor gives best-practice guidance, CloudTrail logs API activity, and QuickSight is a business intelligence dashboarding tool.

Correct answer: C. AWS Health API

The AWS Health API is available to Business, Enterprise On-Ramp, and Enterprise Support customers. The concierge and a dedicated technical account manager require Enterprise Support, and the DDoS Response Team comes with Shield Advanced, not a support plan.

Correct answer: C. Securing the virtualization layer · E. Patching the operating system on Amazon RDS instances

AWS secures the virtualization layer and patches the operating system for managed services like RDS. On EC2 the customer patches the OS, and customers also handle IAM password policies plus security group and network ACL configuration.

Correct answer: C. Elasticity

Elasticity means dynamically adding or removing resources to match demand, which horizontal EC2 scaling demonstrates directly. High availability is about resilience across failure domains, and agility refers to how quickly you can experiment and deliver.

Correct answer: A. AWS Budgets

AWS Budgets lets you set cost or usage budgets and receive alerts when actual or forecasted spending exceeds your threshold. Cost Explorer and the Cost and Usage Report are for visualizing and analyzing spend, not threshold-based alerting.

Correct answer: A. AWS Enterprise Support · B. AWS Enterprise On-Ramp Support

Enterprise Support gives a 15-minute response for business-critical system down, and Enterprise On-Ramp gives under 30 minutes, so both meet the requirement. Business Support only guarantees one hour for production system down, which misses the target.

Correct answer: A. An access key ID and secret access key · D. A password for access to the management console

IAM users can have a console password plus an access key ID and secret access key for programmatic access. Key pairs belong to EC2 login, not IAM identities, so that common distractor is wrong.

Correct answer: A. Data is not replicated outside of a region unless you configure it

AWS does not automatically copy your data out of a Region; cross-Region replication is something you explicitly configure per service. Remember the distractor about Availability Zones, since replication even within a Region depends on how each service stores data.

Correct answer: A. Amazon Route 53 · B. Amazon CloudFront

Route 53 and CloudFront are the classic global AWS services, operating across the worldwide infrastructure rather than a single Region. EC2, VPC, and RDS are all regional resources you provision in specific Regions or Availability Zones.

Correct answer: D. Amazon CloudWatch Logs Insights.

CloudWatch Logs Insights lets you run interactive queries to search and analyze log data. Log streams merely store the log events, while anomaly detection and EventBridge handle metrics and event routing rather than log querying.

Correct answer: C. Groups can contain users only and cannot be nested. · E. A user can be a member of multiple groups.

IAM groups are flat, containing only users with no nesting, and a user can belong to up to several groups at once. Watch for the nesting distractor, since IAM has no group-within-group hierarchy like some directory services do.

Correct answer: C. Nothing, IAM is global

IAM is a global service, so users and policies work in every Region without any configuration changes. Remember that IAM, Route 53, CloudFront, and WAF are global, unlike most AWS services, which are regional.

Correct answer: C. Access Advisor

The IAM Access Advisor tab shows service last accessed data, letting you spot and remove permissions that are never used. The other Advisor-named options are fabricated distractors that do not exist in IAM.

Correct answer: C. Security

The shared responsibility model is addressed within the Security pillar of the Well-Architected Framework. The other pillars cover running workloads, resource efficiency, and failure recovery, but not the division of security duties.

Correct answer: A. Facility operations costs · E. Hardware procurement teams

Facility operations costs and hardware procurement teams apply only to on-premises environments and are eliminated in AWS. Licensing and database administration costs still exist in the cloud, so they are relevant to both sides of the comparison.

Correct answer: D. Amazon CloudFront

Amazon CloudFront is a CDN that caches content at edge locations worldwide, bringing it closer to global users. ElastiCache only accelerates database reads and is not a global edge-caching service, so it does not fit the worldwide scope.

Correct answer: A. Pay for what you use

AWS uses pay-as-you-go pricing, so you only pay for the resources you actually consume. Capital purchases and long-term commitments describe traditional on-premises spending, and AWS never requires you to outsource all IT operations.

Correct answer: C. Just start deploying resources in the additional region

AWS regions are immediately available to every account, so you just start deploying resources in the new region. Remember IAM is global, so no separate account, IAM setup, or application is ever needed to expand regionally.

Correct answer: D. AWS Audit Manager

AWS Audit Manager continuously audits AWS usage and automates evidence collection for risk and compliance assessments against regulations. AWS Artifact only provides on-demand compliance reports and agreements, not continuous auditing.

Correct answer: C. Setup consolidated billing between the accounts · E. Create an AWS Organization configuration linking the accounts

Consolidated billing through AWS Organizations lets unused Reserved Instance benefits apply across all linked accounts, cutting costs. Note the two answers overlap conceptually since consolidated billing is a feature of Organizations, but both achieve the shared RI benefit. Spot instances risk interruption and placement groups don't affect price.

Correct answer: A. Use AWS Managed Services to provision, run, and support the company infrastructure.

AWS Managed Services takes over provisioning, running, and supporting infrastructure, which directly offloads operational work. Overprovisioning violates cloud best practices, and ECS only helps containerized workloads rather than general migrations.

Correct answer: D. AWS Organizations

AWS Organizations lets you centrally create and manage multiple AWS accounts, including automated account creation through its API. QuickSight is business intelligence and LightSail offers simple virtual servers, so neither fits account management.

Correct answer: A. AWS Launch Wizard

AWS Launch Wizard provides a guided experience for sizing, configuring, and deploying third-party applications such as SQL Server Always On and SAP. CloudFormation provisions resources from templates but offers no guided application sizing.

Correct answer: C. Customers to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for selected services

AWS permits penetration testing against your own infrastructure without prior approval for a defined list of services like EC2, RDS, and Lambda. Testing anything outside that list still requires AWS authorization, which is the common trap here.

Correct answer: D. AWS IAM

IAM groups let you attach permission policies once and apply them to all member users. STS only issues temporary credentials and Cognito handles app-user authentication, so neither manages policies for AWS groups.

Correct answer: A. Amazon SageMaker

SageMaker is the managed service where you can bring, train, and deploy your own machine learning algorithms. Forecast offers pretrained time-series forecasting only, and Artifact and Data Pipeline are unrelated to machine learning workloads.

Correct answer: D. Managing the encryption options on the S3 bucket.

Under the Shared Responsibility Model, the customer controls security 'in' the cloud, including S3 bucket settings such as encryption options. AWS owns the infrastructure and operating system layers beneath S3, so those options describe AWS responsibilities, not the customer's.

Correct answer: B. Amazon Step Functions · C. Amazon SQS

Amazon SQS and Step Functions both enable asynchronous integration, where components communicate through queues or workflows without waiting for an immediate response. Route 53 is DNS, CloudFormation provisions infrastructure, and Auto Scaling handles capacity, not coupling.

Correct answer: D. Create and use an AWS CloudFormation template.

CloudFormation templates define infrastructure as code, so you can redeploy the same stack quickly and reliably across multiple Regions. AMIs are Region-specific and CodeStar focuses on application delivery toolchains, not multi-Region infrastructure provisioning.

Correct answer: D. Design for failure

Designing for failure means assuming components will break and building in resilience, a core Well-Architected principle. The reverse-wording trap is think servers, not services, when AWS actually recommends the opposite, favoring managed and serverless services.

Correct answer: B. Facility equipment installation · C. Data center security costs

A TCO analysis should include infrastructure costs that disappear in the cloud, such as facility equipment installation and data center security. Salaries, marketing, and application development largely continue whether workloads run on-premises or in the cloud.

Correct answer: C. AWS Concierge

The Concierge Support Team, included with Enterprise Support, are billing and account experts for enterprise customers. Exam cue: memorize the Enterprise plan perks, Concierge plus TAM, since the Billing option name is the tempting distractor here.

Correct answer: B. AWS Config

AWS Config records resource configurations and maintains a configuration history with versions over time. Remember the cue: Service Catalog governs approved IT products, Artifact holds compliance reports, and Inspector runs security assessments.

Correct answer: D. AWS Shield Advanced

AWS Shield Advanced adds DDoS protection plus 24/7 access to the AWS DDoS Response Team for support during attacks. WAF is the strongest distractor, but it filters web traffic and doesn't include expert response assistance.

Correct answer: A. Dedicated Hosts

Dedicated Hosts give you a physical server dedicated to your use, so you can apply your existing per-socket or per-core software licenses. Reserved Instances offer billing discounts for committed use but still run on shared hardware, so BYOL visibility isn't guaranteed.

Correct answer: D. AWS Health Dashboard

The AWS Health Dashboard issues alerts and remediation guidance when AWS events may affect your resources. Trusted Advisor is the strongest distractor, but it optimizes cost, performance, and security in your own account rather than reporting AWS service events.

Correct answer: D. AWS CloudFormation

AWS CloudFormation provisions a collection of related AWS resources in an orderly, predictable way using templates, which is infrastructure as code. Elastic Beanstalk is the closest distractor, but it deploys application code onto managed infrastructure rather than defining the infrastructure itself.

Correct answer: D. An access key ID · E. A secret access key

Programmatic access requires both parts of an access key, the access key ID and the secret access key, used together like a username and password. A user ID alone identifies a user but cannot authenticate CLI or API requests.

Correct answer: D. AWS Resource Access Manager (AWS RAM)

AWS Resource Access Manager securely shares resources like subnets and Route 53 zones across accounts or within your organization. AWS Organizations is the top distractor because it consolidates accounts for billing and policies but does not itself share resources.

Correct answer: B. AWS Management Console · E. AWS Command Line Tools

IAM identities can be managed through the AWS Management Console, the command line tools, the SDKs, and the IAM HTTPS API. CloudWatch is the key distractor since it monitors resources and workloads rather than managing identities.

Correct answer: A. Both non-root and root volumes

All EBS volume types, both root and non-root, support encryption at launch time using KMS keys, and it can be set as an account default. Any option restricting encryption to one volume class is outdated or simply false.

Correct answer: B. EC2 Dedicated Hosts

EC2 Dedicated Hosts provide a physical server fully dedicated to you, enabling per-socket and per-core license reuse on isolated hardware. Dedicated Instances run on single-tenant hardware but lack host-level visibility, so BYOL is not supported there.

Correct answer: B. Enable automatic patching for the instances using the Amazon RDS console

Amazon RDS is a managed service, so enabling automatic patching through the RDS console lets AWS apply security patches during a maintenance window. Systems Manager patches EC2 instances, not RDS, and AWS Config only audits configurations.

Correct answer: D. Installing firmware updates on host servers

Under the Shared Responsibility Model, AWS manages the underlying infrastructure, including firmware on host servers. Customers handle security groups, encryption settings, and bucket policies for their own resources.

Correct answer: B. AWS IoT Core

AWS IoT Core lets connected devices securely exchange messages with cloud applications and other devices at massive scale. The other options handle desktops, directories, or migrations and have no device connectivity role.

Correct answer: D. Network Access Control List

A Network ACL acts as a firewall at the subnet level, filtering traffic entering and leaving the subnet. Remember the exam cue: security groups attach to instances, while NACLs attach to subnets.

Correct answer: D. AWS Regions

AWS Regions are separate geographic areas, so replicating data across Regions is the standard disaster recovery approach. Availability Zones sit within a single Region, and edge locations are for CloudFront caching, not data replication.

Correct answer: A. Reliability

Deploying across multiple Availability Zones is a Reliability practice, matching the pillar's ability to recover from failures and disruptions. Performance efficiency is about using the right resource types, not fault tolerance.

Correct answer: D. AWS Trusted Advisor

AWS Trusted Advisor provides real-time recommendations including cost optimization, performance, and security checks. AWS Artifact is for compliance documents, and Inspector performs security assessments, not cost advice.

Correct answer: C. Amazon DynamoDB Accelerator (DAX)

DAX is the managed in-memory cache purpose-built for DynamoDB, cutting response times from milliseconds to microseconds. ElastiCache is also in-memory but is a separate general-purpose service, not a DynamoDB feature.

Correct answer: D. AWS Lambda

AWS Lambda is the serverless compute service that runs code as functions in response to events without managing servers. Amazon ECS and EKS are container services, so they are not serverless function platforms.

Correct answer: A. You can create one or more subnets within each availability zone

A subnet lives entirely within a single availability zone, and you can create many subnets in each AZ. Remember the exam cue that subnets never span multiple AZs.

Correct answer: A. Enables Internet communications for instances in public subnets

An internet gateway allows instances with public IP addresses in public subnets to communicate with the internet. Watch out for the private subnet option, which requires a NAT gateway instead of an internet gateway.

Correct answer: A. Use Cross-Region Replication (CRR) to copy to another region

Cross-Region Replication copies objects to a bucket in a different AWS Region, protecting against regional disasters. Lifecycle transitions, Glacier archiving, and MFA Delete all keep the data in the same Region, so they fail the requirement.

Correct answer: D. Amazon S3

Amazon S3 is object storage where each object is stored as data with a key and metadata. For the exam, remember EBS is block storage, EFS is file storage, and DynamoDB is a key-value database, not object storage.

Correct answer: A. S3 buckets configured for cross-region replication can be owned by a single AWS account or by different accounts

Replication buckets can be owned by the same AWS account or by different accounts, in the same or different Regions. Remember both source and destination buckets must have versioning enabled, which rules out the disabled-versioning option.

Correct answer: A. Being highly available

Deploying across multiple Availability Zones makes an application highly available by tolerating the failure of a single zone. Elasticity would require Auto Scaling, and global reach involves multiple Regions, not just AZs.

Correct answer: A. AWS Direct Connect Gateway

A Direct Connect gateway extends a Direct Connect connection privately to VPCs in multiple Regions. Managed VPN is the common distractor, but it runs over the public internet, so it isn't a private connection.

Correct answer: B. AMIs · C. Elastic IP addresses

AMIs let you quickly launch replacement instances, and Elastic IP addresses can be remapped to a healthy instance after a failure, which together support fault tolerance. Tags, ARNs, and block device mappings are metadata constructs with no recovery role.

Correct answer: B. Managed MySQL database · C. Virtual Private Server

Lightsail bundles virtual private servers and managed databases, including MySQL, along with storage, load balancing, and CDN distributions. It is borderline because Lightsail also offers block and object storage, so file storage could be defended depending on interpretation.

Correct answer: B. AWS Firewall Manager · D. AWS Network Firewall

AWS Firewall Manager centrally manages firewall rules across accounts and VPCs in AWS Organizations, and AWS Network Firewall provides managed network protections for VPCs. AWS WAF on its own is per-resource, not a cross-account central management solution.

Correct answer: B. Continuous scaling (scale out) · D. No servers to manage

Lambda is serverless, so there are no servers to manage, and it scales out automatically by running parallel function invocations. You cannot choose the operating system, since AWS manages the underlying compute environment.

Correct answer: B. Amazon FSx

Amazon FSx provides fully managed third-party file systems such as FSx for Windows File Server and FSx for Lustre with native compatibility. EFS is AWS's own managed NFS file system, not a third-party one.

Correct answer: A. Grant least privilege

Granting least privilege means giving only the permissions required to perform a task when writing IAM policies. The other options are valid IAM best practices but do not address minimum permissions.

Correct answer: A. Point-in-time recovery

Point-in-time recovery uses transaction logs uploaded to S3, letting you restore an RDS instance to any second within the retention period, down to 5-minute granularity. Snapshots are point-in-time copies but lack that fine-grained restore ability.

Correct answer: A. Volume pricing discounts applied across multiple accounts · B. One bill provided for multiple accounts

Consolidated billing in AWS Organizations combines all member accounts into one bill and pools usage across accounts for volume pricing discounts. Linked accounts keep their management independence, which is a key feature of Organizations.

Correct answer: B. Replace an EC2 compute instance with AWS Lambda

Replacing EC2 with AWS Lambda removes capacity planning and charges only for actual compute time, which is a classic cost optimization move. Choosing the fastest instance or over-provisioning both increase spend rather than reduce it.

Correct answer: B. You can bring new applications to market faster · D. You don't need to worry about over provisioning as you can elastically scale

Elastic scaling eliminates over-provisioning, and the cloud's agility speeds up getting applications to market. You still patch your own operating systems, and application availability remains your responsibility under the shared model.

Correct answer: B. AWS Elastic Disaster Recovery

AWS Elastic Disaster Recovery minimizes downtime and data loss by replicating on-premises or cloud applications for fast recovery with economical storage and minimal compute. AWS Backup centralizes backups but is not a rapid application recovery service.

Correct answer: A. Use Amazon CloudFront to get the content closer to users

Amazon CloudFront caches video content at edge locations worldwide, minimizing latency for global viewers. S3 Transfer Acceleration accelerates uploads, not playback, and the EBS cross-region replication option does not exist as described.

Correct answer: B. AWS Artifact

AWS Artifact is the self-service portal for on-demand compliance reports like SOC and PCI, plus agreements such as the BAA. The other options are not real AWS services.

Correct answer: C. Each subnet in a VPC is mapped to all AZs in the region

A subnet is mapped to exactly one availability zone, never to all AZs in a region. The other statements about AZ design, such as independent failure zones and redundant networking, are all true.

Correct answer: A. Data egress · D. Per GB/month storage fee

S3 Standard charges a per GB per month storage fee plus data transfer out of S3, which is the egress. Retrieval fees and minimum capacity charges apply to IA and Glacier classes, and data ingress is free.

Correct answer: D. Using Route 53 health checks

Route 53 health checks monitor the health and performance of endpoints and can trigger DNS failover. CloudWatch is the tempting distractor, but it monitors metrics and alarms rather than application health for Route 53 routing.

Correct answer: D. AWS Quick Start reference deployments

Quick Starts are prebuilt CloudFormation deployments of popular solutions you can launch and use right away. Elastic Beanstalk is the main distractor, but it requires you to bring and manage your own application code.

Correct answer: D. Amazon Elastic Load Balancing

Elastic Load Balancing distributes traffic across multiple targets, which spreads load and adds fault tolerance to the architecture. CloudFront is a CDN for caching content at edge locations, so it does not add fault tolerance to backend instances.

Correct answer: A. Elastic Container Registry

Amazon Elastic Container Registry, or ECR, is the fully managed Docker container image registry that integrates with ECS. The other names are distractors that do not exist as AWS services.

Correct answer: D. Amazon CloudWatch Logs

Amazon CloudWatch Logs monitors, stores, and provides access to log files from EC2 instances, CloudTrail, and other sources. CloudTrail only records account API activity, so it is not a general log file service.

Correct answer: B. Amazon Machine Image

An Amazon Machine Image packages the template information needed to launch standardized EC2 instances. Golden Image is a general industry term, not an actual AWS feature name.

Correct answer: A. Amazon DynamoDB DAX

DynamoDB Accelerator, DAX, is a managed in-memory cache for DynamoDB that improves read performance from milliseconds to microseconds. SQS handles message queuing, not caching, so it fails the data-caching requirement.

Correct answer: C. Amazon S3 · E. Amazon CloudFront

CloudFront caches content at edge locations worldwide, cutting latency for global users, and S3 commonly serves as its origin for static content. ElastiCache is a defensible distractor but only speeds up database access, not global delivery.

Correct answer: B. Amazon EFS · C. Amazon EBS

EBS provides block storage volumes and EFS provides shared file storage, so both can store files. S3 is the obvious distractor-shaped gap here, but it is not offered; LightSail is a compute service, not a storage option.

Correct answer: C. Volume based discounts when you use more services · D. Reduced cost for reserved capacity

AWS lowers effective prices through volume-based discounts as usage grows and through reduced rates for reserved capacity like one or three year commitments. Inbound data transfer is already free, so a reduction there isn't a pricing reward.

Correct answer: A. Public

The public cloud offers pure pay-as-you-go pricing, no upfront CAPEX, and high elasticity to scale with demand. Private and on-premises models are CAPEX-heavy with limited elasticity, and hybrid still includes private infrastructure.

Correct answer: A. Developer

The Developer Support plan offers email-only access to Cloud Support Associates during business hours. Basic has no support cases, while Business and Enterprise add 24×7 phone and chat with Cloud Support Engineers.

Correct answer: B. APN Consulting Partners

APN Consulting Partners are professional services firms that help customers design, build, migrate, and manage workloads on AWS. A Technical Account Manager guides a single enterprise account rather than doing the build work.

Correct answer: A. Automatic scaling using services such as AWS Auto Scaling · B. Add more instances as demand increases

Horizontal scaling means adding more instances, which AWS Auto Scaling can do automatically as demand grows. Adding CPU or RAM to an existing instance is vertical scaling, and it is limited by the maximum instance size and often requires a restart.

Correct answer: B. Use an AWS Transit Gateway

AWS Transit Gateway acts as a network transit hub that connects multiple VPCs and on-premises networks, including across Regions with inter-Region peering. Direct Connect alone connects to a single VPC or gateway, so it does not scale to multiple VPCs in different Regions on its own.

Correct answer: D. Testing recovery procedures · E. Automatically recovering from failure

Testing recovery procedures and automatically recovering from failure are core reliability design principles in the Well-Architected Framework. Adopting a consumption model and measuring efficiency belong to cost optimization and performance efficiency, not reliability.

Correct answer: D. You can scale up by moving to a larger instance size · E. You can scale up by increasing storage capacity

RDS scales vertically by moving to a larger instance size and by increasing storage capacity. EC2 Auto Scaling, Elastic Load Balancing, and AWS Auto Scaling do not apply to RDS instances; remember RDS scale-out is achieved with read replicas, not these services.

Correct answer: D. Lifecycle management

S3 Lifecycle management uses rules to transition objects between storage classes and expire them automatically. Bucket policies control access, versioning keeps object versions, and object sharing is unrelated to storage class transitions.

Correct answer: B. Amazon Lex

Amazon Lex builds conversational chatbots using voice and text with natural language understanding. Transcribe converts speech to text, Comprehend analyzes sentiment and entities, and Textract extracts data from scanned documents.

Correct answer: C. Setting up server-side encryption on an Amazon S3 bucket · D. Network and firewall configurations

Customers manage security in the cloud, including data encryption settings and network plus firewall configurations like security groups. RDS patching, compute availability, and physical data center security are AWS responsibilities under the shared responsibility model.

Correct answer: B. A Virtual Private Gateway

A Virtual Private Gateway is the VPN concentrator on the AWS side of a Site-to-Site VPN connection and is attached to the VPC. Remember the pairing: customer gateway is on your side, virtual private gateway is on the AWS side.

Correct answer: A. AWS Artifact

AWS Artifact is the self-service portal for on-demand access to AWS compliance reports and agreements like SOC and PCI documents. The Business Associate Addendum is only an agreement you accept inside Artifact, not the retrieval portal itself.

Correct answer: C. Spot Instances

Spot Instances use spare EC2 capacity and receive a two-minute warning before termination when AWS reclaims the capacity. On-Demand and Reserved Instances keep running without AWS-initiated interruption, making Spot the clear answer.

Correct answer: D. Resource groups

Resource groups let you organize and manage AWS resources that share one or more tags, so that is the correct choice. Tag groups, organization groups, and consolidation groups are not real AWS features, making them easy distractors to eliminate.

Correct answer: C. Bucket

Objects in Amazon S3 are stored in buckets, which are the top-level containers. S3 has a flat structure, so folders are just naming prefixes for grouping, not true containers like directories in a file system.

Correct answer: B. Amazon Macie

Amazon Macie uses machine learning and pattern matching to discover sensitive data such as PII in Amazon S3. GuardDuty finds threats through anomaly detection, Inspector scans for vulnerabilities, and Shield protects against DDoS attacks.

Correct answer: C. Ensuring that application data is encrypted at rest · D. Ensuring that users have received security training in the use of AWS services

Customers are responsible for security in the cloud, which includes encrypting their application data and training their users. Exam cue: anything physical, like data center access, hardware disposal, or NTP servers, belongs to AWS under security of the cloud.

Correct answer: C. Amazon QuickSight

Amazon QuickSight is a fully managed business intelligence service for creating and publishing interactive dashboards accessible from any device. Redshift is a data warehouse and Glue is an ETL service, so neither fits the dashboard requirement.

Correct answer: C. CloudWatch Logs

CloudWatch Logs lets you monitor and troubleshoot systems using existing system, application, and custom log files. CloudTrail Logs is the main distractor, but CloudTrail records API activity for auditing, not application log monitoring.

Correct answer: D. Automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, and IP addresses

Elastic Load Balancing automatically distributes incoming application traffic across multiple targets like EC2 instances, containers, and IP addresses. The other options describe Auto Scaling, Direct Connect, and Route 53 respectively.

Correct answer: A. AWS Step Functions

AWS Step Functions coordinates distributed application components as a visual workflow of steps. The strongest distractor, Amazon SWF, also coordinates tasks but offers no visual workflow, so remember the visual workflow keyword points to Step Functions.

Correct answer: B. Customers are responsible for networking traffic protection · C. AWS are responsible for networking infrastructure

Under the shared responsibility model, customers protect network traffic with security groups, ACLs, and encryption, while AWS maintains the underlying networking infrastructure. Compute infrastructure and edge locations are AWS responsibilities, not customer tasks.

Correct answer: C. AWS WAF

AWS WAF can block malicious requests using rules based on source IP addresses to protect web applications. GuardDuty only detects threats through analysis and alerts; it does not actively block traffic like a web application firewall does.

Correct answer: A. Amazon EBS volume

An Amazon EBS volume is a block-level storage device attached to an EC2 instance, like a virtual hard disk. EFS is shared file storage mounted over NFS, and S3 is object storage accessed through APIs, so neither fits the hard disk analogy.

Correct answer: B. Updating Amazon EC2 host firmware

Updating EC2 host firmware is security of the cloud, so AWS handles it. Customers handle granting access, encrypting data in transit, and patching guest operating systems, since those are all security in the cloud tasks.

Correct answer: D. Remove administrative permissions

You cannot remove administrative permissions from the root user, so that is not a best practice. Instead, protect root with MFA, keep access keys locked away, and never share its credentials.

Correct answer: A. It can be used to generate, use and manage encryption keys in the cloud

CloudHSM is a cloud-based hardware security module used to generate, use, and manage encryption keys. It is not a firewall, a PKI, or an S3 encryption feature; associate CloudHSM with FIPS-validated hardware key storage on the exam.

Correct answer: B. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users · D. Enables you to attach IAM permission policies to more than one user at a time

IAM groups let you attach permission policies to many users at once, simplifying permission management. Groups cannot be nested, cannot restrict subnets, and creating custom policies is an IAM policy feature, not a group benefit.

Correct answer: C. AWS Lambda

AWS Lambda runs code in response to events such as S3 uploads, making it the event-driven compute choice. EC2 and Elastic Beanstalk are always-on deployment platforms, and Open 3D Engine is a game engine, not event-driven compute.

Correct answer: A. Across Availability Zones

Deploying across Availability Zones protects against the failure of a single data center because each AZ is physically isolated with separate power and networking. Subnets alone don't help since multiple subnets can live in the same AZ.

Correct answer: A. Amazon DynamoDB

Amazon DynamoDB is a schema-less NoSQL database that scales dynamically with no downtime. The other options are relational or data warehouse services that require a defined schema and instance-based scaling.

Correct answer: B. Horizontal

EC2 Auto Scaling works horizontally by adding or removing instances as demand changes. Vertical scaling means resizing a single server, which Auto Scaling does not do, so that distractor fails.

Correct answer: D. Cloud computing allows you to swap variable expense for capital expense

Cloud computing trades capital expense for variable expense, not the other way around, so the stated option does not characterize it. Watch for reversed wording like this; it's a classic exam trick on the six advantages of cloud.

Correct answer: C. Sustainability · E. Operational excellence

The six Well-Architected pillars are operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Memorize the exact pillar names, since words like resilience and economics are close but wrong.

Correct answer: B. Charged for what you use · E. Logon using local user accounts

IAM is a free service and does not create local operating-system user accounts, so those two options are not IAM features. Identity federation, shared account access, and PCI DSS compliance support are all legitimate IAM capabilities covered on the exam.

Correct answer: C. Using an AWS access key and a secret key

Programmatic access from the CLI or SDKs requires an access key ID and secret access key to sign API requests. An EC2 key pair is only for logging in to instances, so don't confuse the two credential types.

Correct answer: D. Amazon RedShift

Amazon Redshift is a managed data warehouse purpose-built for running analytics with standard SQL and BI tools. RDS is for transactional workloads, while DynamoDB is NoSQL, so neither fits the analytics use case.

Correct answer: A. On Amazon S3

EBS snapshots are stored incrementally in Amazon S3, though you access and manage them through the EC2 console or API rather than directly. Remember that snapshots are point-in-time incremental backups of EBS volumes.

Correct answer: D. Reduce the cost of maintaining idle resources

With AWS you provision only what you need and scale elastically, which cuts the cost of idle resources. The cloud shifts spend toward operational expenditure, so the capital expenditure option states the opposite of reality.

Correct answer: A. User Data

User data lets you pass a shell script or cloud-init directive that runs automatically when an EC2 instance launches. Instance metadata only retrieves information about a running instance, so it can't execute anything.

Correct answer: B. Migrate the database onto an Amazon RDS instance

Amazon RDS is a managed MySQL-compatible service that handles backups, patching, and maintenance, reducing operational overhead. Running MySQL on EC2 still leaves the database and operating system management to you.

Correct answer: A. High availability is easier to implement due to built-in functionality for deploying read replicas and multi-AZ · B. Scalability is improved as it is quicker to implement and there is an abundance of capacity

RDS makes high availability and scalability easier through built-in Multi-AZ deployments, read replicas, and quick capacity changes. RDS is managed, so you lose OS control, engine choice is limited to supported engines, and cross-AZ or cross-region replication does incur costs.

Correct answer: B. Create budgets and receive notifications if current or forecasted usage exceeds the budgets · C. Break down AWS costs by day, service, and linked AWS account

AWS Budgets lets you set budgets with alerts on actual or forecasted spend, and Cost Explorer breaks costs down by day, service, and linked account. These tools do not automatically change pricing models, move S3 data, or broadly terminate resources, though Budgets Actions exist for limited cases.

Correct answer: B. Network Load Balancer (NLB)

A Network Load Balancer works at layer 4 and routes connections based on TCP information. Remember the exam cue: ALB is layer 7 HTTP/HTTPS, NLB is layer 4 TCP, and CLB spans both layers, while Route 53 is DNS rather than a load balancer.

Correct answer: D. Use AWS Config to generate an inventory of AWS resources · E. Use AWS CloudTrail to record AWS API calls into an auditable log file

AWS Config tracks resource configurations and inventories, while CloudTrail records API calls for auditing changes that affect reliability. GuardDuty detects threats rather than logging API activity, and Certificate Manager issues SSL/TLS certificates, not service catalogs.

Correct answer: A. All plans

Every AWS Support plan, including Basic, offers 24×7 access to customer service, documentation, whitepapers, and forums. A common trap is assuming only paid plans get around-the-clock support; technical support with faster response times is what differs by plan.