AWS
AWS Certified Cloud Practitioner (CLF-C02)
Question 1 of 381An organization is currently operating MySQL databases on its own on-premises servers. To reduce the operational burden of database maintenance and management, the organization wants to move to a fully managed AWS database offering. Which migration strategy best aligns with this goal?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Replatform
Replatforming involves moving to a managed cloud service like Amazon RDS to reduce operational overhead without rewriting applications. Rehosting is a distractor that simply lifts and shifts servers to EC2, retaining all management burdens.
Question 2 of 381Which type of cloud computing does Amazon Elastic Compute Cloud (EC2) represent?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Infrastructure as a Service (IaaS)
Amazon EC2 represents Infrastructure as a Service because it provides foundational computing resources where you manage the operating system and applications. Remember that Elastic Beanstalk is PaaS, while fully managed products like Rekognition fit the SaaS category.
Question 3 of 381A data analytics company is running a proprietary batch analytics application on AWS and wants to use a storage service which would be accessed by hundreds of EC2 instances simultaneously to append data to existing files. As a Cloud Practitioner, which AWS service would you suggest for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Elastic File System (Amazon EFS)
EFS provides a scalable file system that can be concurrently accessed by hundreds of EC2 instances. EBS is a strong distractor, but volumes can only be attached to a single instance, and object storage like S3 cannot handle direct file appends.
Question 4 of 381Which of the following statements are CORRECT regarding the AWS VPC service? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. A Network Address Translation gateway (NAT gateway) is managed by AWS · C. A Security Group can have allow rules only
A Security Group is stateful and only supports allow rules, while a NAT Gateway is a fully managed AWS service. Remember that Network ACLs are stateless and support both allow and deny rules, and a NAT instance is managed by the customer.
Question 5 of 381A company needs a storage solution for a project wherein the data is accessed less frequently but needs rapid access when required. Which S3 storage class is the MOST cost-effective for the given use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Amazon S3 Standard-Infrequent Access is designed for data accessed less frequently but requiring rapid retrieval. While Glacier is cheaper, it is for archives and does not offer rapid access, making Standard-IA the correct choice for this use case.
Question 6 of 381According to the AWS Cloud Adoption Framework (AWS CAF), what are two tasks that a company should perform when planning to migrate to the AWS Cloud and aiming to become more responsive to customer inquiries and feedback as part of their organizational transformation? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. Leverage agile methods to rapidly iterate and evolve · C. Organize your teams around products and value streams
The AWS Cloud Adoption Framework recommends leveraging agile methods and organizing teams around products. This approach shifts organizations away from bureaucratic designs to become more responsive to customer inquiries and feedback.
Question 7 of 381AWS Web Application Firewall (WAF) offers protection from common web exploits at which layer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Layer 7
AWS Web Application Firewall inspects HTTP and HTTPS requests to protect against web exploits. This traffic operates at the Application layer, which is Layer 7 of the OSI model. AWS Shield is typically used for Layer 3 and Layer 4 protection.
Question 8 of 381A company wants to move to AWS cloud and release new features with quick iterations by utilizing relevant AWS services whenever required. Which of the following characteristics of AWS Cloud does it want to leverage?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Agility
Agility in the AWS Cloud refers to the ability to rapidly develop, test, and launch new features. Because cloud resources are available on-demand, companies can quickly iterate without waiting for hardware provisioning.
Question 9 of 381According to the AWS Shared Responsibility Model, which of the following are responsibilities of AWS? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Replacing faulty hardware of Amazon EC2 instances · C. Operating the infrastructure layer, the operating system and the platform for the Amazon S3 service
Under the Shared Responsibility Model, AWS is responsible for the security of the cloud infrastructure. This includes physical hardware replacement and managing abstracted services like S3. Customers remain responsible for IAM roles and S3 bucket policies.
Question 10 of 381Which of the following is a serverless AWS service?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Lambda
AWS Lambda is a serverless compute service that runs code without provisioning servers. Unlike EC2, EMR, or Elastic Beanstalk, you do not manage the underlying instances, making it the only serverless option on this list.
Question 11 of 381Which of the following AWS services support reservations to optimize costs? (Select three)
Select 3 answers.
Show answer & explanation
Correct answer: B. Amazon DynamoDB · C. Amazon Elastic Compute Cloud (Amazon EC2) · E. Amazon Relational Database Service (Amazon RDS)
Amazon EC2, Amazon RDS, and Amazon DynamoDB support reservations to optimize costs for predictable workloads. Services like Amazon S3 and AWS Lambda follow pay-as-you-go pricing and do not offer reservation discounts.
Question 12 of 381Which AWS Route 53 routing policy would you use to route traffic to multiple resources and also choose how much traffic is routed to each resource?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Weighted routing
Weighted routing allows you to distribute traffic across multiple resources by assigning specific proportional values. Use latency-based routing when your priority is sending users to the fastest responding region instead.
Question 13 of 381Which AWS Support plan provides architectural guidance contextual to your specific use-cases?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Business Support
Business Support is the lowest tier offering contextual architectural guidance for specific use cases. A strong distractor is Enterprise Support, which provides proactive consultative reviews and a Technical Account Manager.
Question 14 of 381Which of the following AWS services support VPC Gateway Endpoints for a private connection from a VPC? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Amazon Simple Storage Service (Amazon S3) · D. Amazon DynamoDB
Amazon S3 and DynamoDB are the only services supporting gateway endpoints. Other supported services use interface endpoints powered by PrivateLink, which use elastic network interfaces instead of route table modifications.
Question 15 of 381A financial services company wants to ensure that its AWS account activity meets governance, compliance, and auditing norms. As a Cloud Practitioner, which AWS service would you recommend for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS CloudTrail
AWS CloudTrail records account-specific API actions for auditing user activity and compliance. AWS Config is a strong distractor, but it specifically evaluates resource configuration changes rather than account-level API events.
Question 16 of 381Which of the following Amazon S3 storage classes takes the most time to retrieve data (also known as first byte latency)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon S3 Glacier Deep Archive
S3 Glacier Deep Archive has the longest retrieval time, taking up to 48 hours for standard requests. Glacier Flexible Retrieval is a common distractor, but its maximum expedited retrieval time is only five minutes.
Question 17 of 381Which of the following AWS services should be used to automatically distribute incoming traffic across multiple targets?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Elastic Load Balancing (ELB)
Elastic Load Balancing distributes incoming traffic across multiple registered targets like EC2 instances. AWS Auto Scaling is a strong distractor, but it only adjusts the number of instances rather than routing requests.
Question 18 of 381AWS Shield Advanced provides expanded DDoS attack protection for web applications running on which of the following resources? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: D. AWS Global Accelerator · E. Amazon Route 53
AWS Shield Advanced provides expanded DDoS protection for Route 53 and Global Accelerator, along with CloudFront, Elastic Load Balancing, and EC2. Be careful with API Gateway and Elastic Beanstalk, as they are covered by Shield Standard, not Advanced.
Question 19 of 381An IT company is planning to migrate from an on-premises environment to AWS Cloud. Which of the following expense areas would result in cost savings when the company moves to AWS Cloud? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. Data center hardware infrastructure expenditure · E. Data center physical security expenditure
Migrating to AWS shifts data center hardware and physical security costs from fixed capital expenses to variable operational expenses. Software licenses and personnel salaries remain unaffected by this infrastructure transition, making them incorrect choices here.
Question 20 of 381A startup wants to migrate its data and applications from the on-premises data center to AWS Cloud. Which of the following options can be used by the startup to help with this migration? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. Leverage AWS Professional Services to accelerate the infrastructure migration · D. Utilize AWS Partner Network (APN) to build a custom solution for this infrastructure migration
AWS Professional Services and the AWS Partner Network provide the expert consulting needed to accelerate and build custom infrastructure migration solutions. Standard AWS Support and Trusted Advisor cannot execute complex migrations, and forums lack official migration authority.
Question 21 of 381Which AWS service will help you receive alerts when the reservation utilization falls below the defined threshold?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Budgets
AWS Budgets lets you set custom reservation utilization or coverage targets and triggers alerts when usage drops below your defined threshold. Trusted Advisor offers general best practices, while CloudTrail simply logs API actions without cost monitoring capabilities.
Question 22 of 381Which of the following AWS Support plans provide access to only core checks from the AWS Trusted Advisor Best Practice Checks? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. AWS Basic Support · E. AWS Developer Support
The Basic and Developer Support plans only provide access to the core Trusted Advisor checks for service limits and basic security. Business and Enterprise support tiers unlock the full suite of Trusted Advisor best practice checks across all categories.
Question 23 of 381The DevOps team at an IT company is moving 500 GB of data from an EC2 instance to an S3 bucket in the same region. Which of the following scenario captures the correct charges for this data transfer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The company would not be charged for this data transfer
Data transfer between AWS services within the same region is free, so moving data between EC2 and S3 incurs no transfer charges. Watch out for outbound data transfer to the public internet, as AWS aggregates and charges for that specific traffic.
Question 24 of 381A cyber forensics team has detected that AWS owned IP-addresses are being used to carry out malicious attacks. As this constitutes prohibited use of AWS services, which of the following is the correct solution to address this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Contact AWS Abuse Team
The AWS Abuse team is the correct contact for reporting prohibited behaviors, such as malicious attacks originating from AWS-owned IP addresses. Standard AWS Support handles technical issues and cannot process abuse reports or enforce prohibited usage violations.
Question 25 of 381Which of the following is a recommended way to provide programmatic access to AWS resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Use Access Key ID and Secret Access Key to access AWS resources programmatically
Access keys, consisting of an access key ID and a secret access key, authenticate programmatic requests via the API or CLI. Remember that MFA secures console logins but cannot directly authenticate programmatic requests without specialized temporary credential configurations.
Question 26 of 381An e-commerce company has deployed an RDS database in a single Availability Zone (AZ). The engineering team wants to ensure that in case of an AZ outage, the database should continue working on the same endpoint without any manual administrative intervention. Which of the following solutions can address this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Configure the database in RDS Multi-AZ deployment with automatic failover to the standby
Multi-AZ deployments provide high availability via a synchronous standby instance and an automatic failover mechanism. RDS keeps the same endpoint after failover, allowing the application to reconnect seamlessly. Read replicas require manual promotion and do not use a standby.
Question 27 of 381A company wants to identify the optimal AWS resource configuration for its workloads so that the company can reduce costs and increase workload performance. Which of the following services can be used to meet this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Compute Optimizer
Compute Optimizer uses machine learning to analyze historical utilization and recommend optimal resource configurations for instances, volumes, and functions. Cost Explorer is a strong distractor, but it focuses on visualizing past spending and broad cost trends rather than active performance rightsizing.
Question 28 of 381A startup wants to set up its IT infrastructure on AWS Cloud. The CTO would like to get an estimate of the monthly AWS bill based on the AWS services that the startup wants to use. As a Cloud Practitioner, which AWS service would you suggest for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Pricing Calculator
The AWS Pricing Calculator estimates monthly bills by modeling services before deployment. Cost Explorer is a strong distractor, but it analyzes historical spending and existing resources rather than forecasting costs for new infrastructure.
Question 29 of 381A unicorn startup is building an analytics application with support for a speech-based interface. The application will accept speech-based input from users and then convey results via speech. As a Cloud Practitioner, which solution would you recommend for the given use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Use Amazon Transcribe to convert speech to text for downstream analysis. Then use Amazon Polly to convey the text results via speech
Amazon Transcribe converts speech into text for analytics, while Amazon Polly turns text into lifelike speech. Amazon Translate is a distractor because it handles language-to-language translation, not speech recognition or text-to-speech.
Question 30 of 381Which of the following are the advantages of cloud computing? (Select three)
Select 3 answers.
Show answer & explanation
Correct answer: A. Trade capital expense for variable expense · E. Benefit from massive economies of scale · F. Go global in minutes and deploy applications in multiple regions around the world with just a few clicks
Trading capital expense for variable expense, benefiting from massive economies of scale, and going global in minutes are all core advantages of cloud computing. The incorrect options describe the rigid capacity planning and heavy upfront costs of traditional infrastructure.
Question 31 of 381A company wants to improve the resiliency of its flagship application so it wants to move from its traditional database system to a managed AWS NoSQL database service to support active-active configuration in both the East and West US AWS regions. The active-active configuration with cross-region support is the prime criteria for any database solution that the company considers. Which AWS database service is the right fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Amazon DynamoDB with global tables
Amazon DynamoDB global tables provide an active-active cross-region configuration for a fully managed NoSQL database. DAX only provides in-memory caching for a single region, while Aurora multi-master is a relational database rather than a NoSQL solution.
Question 32 of 381A silicon valley based healthcare startup stores anonymized patient health data on Amazon S3. The CTO further wants to ensure that any sensitive data on S3 is discovered and identified to prevent any sensitive data leaks. As a Cloud Practitioner, which AWS service would you recommend addressing this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon Macie
Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data stored in Amazon S3 buckets. AWS Secrets Manager is for storing credentials securely, not for automatically scanning and identifying sensitive data within files.
Question 33 of 381Which of the following statements are CORRECT regarding the Availability Zone (AZ) specific characteristics of Amazon Elastic Block Store (EBS) and Amazon Elastic File System (Amazon EFS) storage types?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. EBS volume can be attached to a single instance in the same Availability Zone (AZ) whereas EFS file system can be mounted on instances across multiple Availability Zones (AZ)
An EBS volume is attached to a single instance within the same Availability Zone, whereas an EFS file system can be mounted across multiple instances and zones. EFS provides regional scalability, distinguishing it from the strictly zonal EBS volumes.
Question 34 of 381Which AWS services can be used to decouple components of a microservices based application on AWS Cloud? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Amazon Simple Notification Service (SNS) · B. Amazon Simple Queue Service (SQS)
Amazon SNS and Amazon SQS are managed messaging services designed to decouple and scale microservices by handling communication between components. AWS Lambda and EC2 execute code, while Step Functions simply coordinate workflows rather than acting as a decoupling message broker.
Question 35 of 381What are the advantages that AWS Cloud offers over a traditional on-premises IT infrastructure? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: D. Trade capital expense for variable expense · E. Eliminate guessing on your infrastructure capacity needs
The cloud allows you to trade upfront capital expenses for pay-as-you-go variable expenses while eliminating the need to guess infrastructure capacity. Options involving on-premises hardware or early capacity decisions represent traditional IT bottlenecks, not cloud benefits.
Question 36 of 381Which of the following entities applies patches to the underlying OS for Amazon Aurora?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. The AWS Product Team automatically
Amazon Aurora is a managed service where AWS handles the underlying infrastructure. The AWS Product Team automatically patches the operating system and database components. Customers cannot use Systems Manager or SSH into the underlying instances.
Question 37 of 381Which of the following AWS services can be used to connect a company's on-premises environment to a VPC without using the public internet?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Direct Connect
AWS Direct Connect establishes a dedicated, private network connection from on-premises environments to AWS. Remember that Site-to-Site VPN traffic also technically goes over the public internet, even though it encrypts the data in transit.
Question 38 of 381A startup wants to provision an EC2 instance for the lowest possible cost for a long-term duration but needs to make sure that the instance would never be interrupted. As a Cloud Practitioner, which of the following options would you recommend?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. EC2 Reserved Instance (RI)
EC2 Reserved Instances provide significant discounts for long-term commitments without the risk of interruption. Spot Instances cost less but can be terminated, making them unsuitable for workloads requiring continuous uptime.
Question 39 of 381A company uses reserved EC2 instances across multiple units with each unit having its own AWS account. However, some of the units under-utilize their reserved instances while other units need more reserved instances. As a Cloud Practitioner, which of the following would you recommend as the most cost-optimal solution?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Use AWS Organizations to manage AWS accounts of all units and then share the reserved EC2 instances amongst all units
AWS Organizations allows you to centrally manage multiple accounts and enables Reserved Instance sharing across them. Cost Explorer and Trusted Advisor offer cost visibility and recommendations but cannot execute resource sharing.
Question 40 of 381Which of the following are the storage services offered by the AWS Cloud? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. Amazon Simple Storage Service (Amazon S3) · E. Amazon Elastic File System (Amazon EFS)
Amazon S3 provides object storage, while Amazon EFS provides managed file storage. For the exam, remember that EC2 is strictly a compute service, and SNS and SQS handle messaging, not storage.
Question 41 of 381A medical research startup wants to understand the compliance of AWS services concerning HIPAA guidelines. Which AWS service can be used to review the HIPAA compliance and governance-related documents on AWS?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Artifact
AWS Artifact is the central portal for on-demand access to security and compliance reports like HIPAA documents. Trusted Advisor checks infrastructure against best practices but does not provide compliance artifacts.
Question 42 of 381A company runs an application on a fleet of EC2 instances. The company wants to automate the traditional maintenance job of running timely assessments and checking for OS vulnerabilities. As a Cloud Practitioner, which service will you suggest for this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Inspector
Amazon Inspector performs automated security assessments to check EC2 instances for unintended network exposure and software vulnerabilities. GuardDuty focuses on account-level threat detection, while Macie discovers sensitive data.
Question 43 of 381Which of the following are correct statements regarding the AWS Global Infrastructure? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. Each Availability Zone (AZ) consists of one or more discrete data centers · D. Each AWS Region consists of a minimum of three Availability Zones (AZ)
An AWS Region contains at least three Availability Zones, and each Zone consists of one or more discrete data centers. If an option claims a Region has only two Zones, it contradicts the current infrastructure baseline.
Question 44 of 381Which security service of AWS is enabled for all AWS customers, by default, at no additional cost?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no extra cost to protect against common DDoS attacks. Shield Advanced requires a paid subscription for specialized support and enhanced protection.
Question 45 of 381The DevOps team at an e-commerce company is trying to debug performance issues for its serverless application built using a microservices architecture. As a Cloud Practitioner, which AWS service would you recommend addressing this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS X-Ray
AWS X-Ray helps developers analyze, debug, and trace requests through distributed serverless microservices. CloudFormation provisions the infrastructure but cannot provide deep application performance tracing.
Question 46 of 381A big data analytics company is moving its IT infrastructure from an on-premises data center to AWS Cloud. The company has some server-bound software licenses that it wants to use on AWS. As a Cloud Practitioner, which of the following EC2 instance types would you recommend to the company?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Dedicated Host
Dedicated Hosts provide physical servers dedicated to your account, allowing you to use existing server-bound software licenses like Microsoft or Oracle. Dedicated Instances run on single-tenant hardware but lack the physical instance visibility needed for licenses.
Question 47 of 381Which of the following is an AWS database service?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Amazon Redshift
Amazon Redshift is a managed petabyte-scale data warehouse service used for large-scale data storage and analysis. AWS Glue handles extract, transform, and load operations, while DMS specifically handles database migrations rather than storage.
Question 48 of 381Which of the following is an INCORRECT statement about scaling, a design principle of the Reliability pillar of the AWS Well-Architected Framework?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Fault tolerance is achieved by a scale up operation
Scaling up means adding resources to a single machine, which creates a single point of failure. Fault tolerance requires scaling out across multiple instances, ensuring remaining instances handle traffic if one fails.
Question 49 of 381Which of the following AWS Support plans provide access to guidance, configuration, and troubleshooting of AWS interoperability with third-party software? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. AWS Enterprise Support · E. AWS Business Support
Both Business and Enterprise Support plans include guidance, configuration, and troubleshooting for third-party software and operating systems. The Basic and Developer tiers limit you to general architectural guidance or account issues, excluding deeper interoperability support.
Question 50 of 381Which of the following is the MOST cost-effective option to purchase an EC2 Reserved Instance (RI)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Partial upfront payment option with standard 3-years term
Reserved Instances offer the highest discounts for the longest commitments and largest upfront payments. However, the option missing a three-year all-upfront choice makes the partial upfront option conditionally correct based on the available selections. A three-year term always yields bigger savings than one year.
Question 51 of 381A research group wants to use EC2 instances to run a scientific computation application that already has a fault tolerant architecture. The application needs high-performance hardware disks that provide fast I/O performance. As a Cloud Practitioner, which of the following storage options would you recommend as the MOST cost-effective solution?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Instance Store
Instance Store provides direct access to hardware disks, offering the fast I/O needed for computation without additional storage fees. EBS is a strong distractor, but it incurs extra costs and does not match the raw physical performance of attached hardware.
Question 52 of 381Which AWS Service can be used to mitigate a Distributed Denial of Service (DDoS) attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Shield
AWS Shield is a managed service specifically designed to protect applications from distributed denial of service attacks. While CloudWatch monitors metrics and alerts you to anomalies, Shield actively provides the mitigation needed to stop the attack traffic.
Question 53 of 381A company wants to have control over creating and using its own keys for encryption on AWS services. Which of the following can be used for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. customer managed key (CMK)
Customer managed keys in AWS KMS give you complete control over your encryption keys, including their policies and rotation. AWS managed keys are handled by the service itself, meaning you cannot explicitly create or manage their underlying policies.
Question 54 of 381Under the AWS Shared Responsibility Model, which of the following is a shared responsibility of both AWS and the customer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Configuration Management
Configuration management is a shared control where AWS secures its infrastructure while customers secure their own guest operating systems. Physical hardware maintenance and guaranteeing data separation between customers remain strictly the responsibility of AWS.
Question 55 of 381Which tool/service will help you access AWS services using programming language-specific APIs?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Software Developer Kit (SDK)
The correct answer works because the AWS Software Development Kit provides language-specific APIs to interact with AWS services programmatically. The Command Line Interface is a unified tool for terminal management, but it is not designed to integrate directly into application source code.
Question 56 of 381Which of the following is CORRECT regarding removing an AWS account from AWS Organizations?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The AWS account must be able to operate as a standalone account. Only then it can be removed from AWS organizations
The correct answer works because a member account must have the required billing and contact details to operate as a standalone account before removal. Service Control Policies do not block deletion; they simply stop applying once the account leaves the organization.
Question 57 of 381A web application stores all of its data on Amazon S3 buckets. A client has mandated that data be encrypted before sending it to Amazon S3. Which of the following is the right technique for encrypting data as needed by the customer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Enable client-side encryption using AWS encryption SDK
The correct answer works because client-side encryption ensures data is securely encrypted before it ever leaves your local environment for Amazon S3. Server-side encryption options are incorrect because they only protect data after it reaches the AWS servers.
Question 58 of 381A multi-national company has just moved its infrastructure from its on-premises data center to AWS Cloud. As part of the shared responsibility model, AWS is responsible for which of the following?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Physical and Environmental controls
The correct answer works because AWS manages the physical security and environmental controls of the data centers under the shared responsibility model. Patching guest operating systems and configuring applications remain strict responsibilities of the customer.
Question 59 of 381A multi-national corporation wants to get expert professional advice on migrating to AWS and managing their applications on AWS Cloud. Which of the following entities would you recommend for this engagement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. APN Consulting Partner
An APN Consulting Partner provides professional services to help companies design and migrate applications to AWS. While APN Technology Partners provide software solutions, they do not offer the direct professional management asked for here.
Question 60 of 381An intern at an IT company provisioned a Linux based On-demand EC2 instance with per-second billing but terminated it within 30 seconds as he wanted to provision another instance type. What is the duration for which the instance would be charged?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. 60 seconds
Linux EC2 instances have a 60-second minimum billing duration, so terminating after 30 seconds still incurs a one-minute charge. Windows instances historically had a higher minimum, but Linux per-second billing requires this minute minimum.
Question 61 of 381An organization needs to securely access AWS services and establish private connectivity between its Virtual Private Clouds (VPCs) and supported AWS services without using the public internet. Which AWS services can meet this requirement? (Select two)
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS PrivateLink
AWS PrivateLink provides private connectivity between VPCs and supported AWS services without traversing the public internet. While Transit Gateway connects networks privately, remember that an Internet Gateway explicitly enables public access, contradicting the scenario requirements.
Question 62 of 381Which of the following AWS services has encryption enabled by default?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS CloudTrail Logs
CloudTrail encrypts log files by default using Amazon S3 managed keys when delivering to your bucket. Other storage options like EBS, EFS, and RDS are strong distractors, but they require manual configuration to enable encryption at rest.
Question 63 of 381Which options are common stakeholder roles for the AWS Cloud Adoption Framework (AWS CAF) platform perspective? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Engineer · C. Chief Technology Officer (CTO)
The correct answer works because the platform perspective focuses on infrastructure provisioning and includes roles like the Chief Technology Officer and engineers. Remember that business leaders like the Chief Information Officer map to the business perspective instead.
Question 64 of 381A Project Manager, working on AWS for the first time, is confused about how credits are used in AWS. There are two credits available in the manager's account. Credit one is for $100, expires July 2022, and can be used for either Amazon S3 or Amazon EC2. Credit two is for $50, expires December 2022, and can be used only for Amazon EC2. The manager's AWS account has incurred two charges: $1000 for Amazon EC2 and $500 for Amazon S3. What will be the outcome on the overall bill once the credits are used? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Then, credit two is applied to the remaining $900 of Amazon EC2 usage · D. Credit one is applied, which expires in July, to the Amazon EC2 charge which leaves you with a $900 Amazon EC2 charge and a $500 Amazon S3 charge
AWS applies credits chronologically by expiration date, meaning the July credit is consumed first. Since both Amazon S3 and EC2 are eligible, the system applies it to the EC2 charge first. The remaining December credit is then applied to the remaining EC2 usage.
Question 65 of 381Compared to the on-demand instance prices, what is the highest possible discount offered for spot instances?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. 90
Spot instances allow you to take advantage of unused EC2 capacity at a steep discount. For the exam, remember that spot instances offer up to a ninety percent discount compared to standard on-demand pricing.
Study on mobile
Get CertPunch for iOS or Android.