AWS
AWS Certified Cloud Practitioner (CLF-C02)
Question 257 of 381According to the AWS Well-Architected Framework, which of the following actions is recommended in the Security pillar?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Use AWS Key Management Service (AWS KMS) to encrypt data
Using AWS KMS to encrypt data is a core best practice for protecting data at rest and in transit under the Security pillar. Cost Explorer maps to Cost Optimization, while CloudFormation automates infrastructure provisioning rather than enforcing encryption.
Question 258 of 381Adding more CPU or RAM to an Amazon Elastic Compute Cloud (Amazon EC2) instance represents which of the following?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Vertical scaling
Upgrading the resources of a single instance, such as adding CPU or RAM, is known as vertical scaling. Horizontal scaling involves adding more instances to a fleet to handle increased load.
Question 259 of 381A data science team would like to build Machine Learning models for its projects. Which AWS service can it use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon SageMaker
Amazon SageMaker provides a fully managed environment for data scientists to build, train, and deploy custom machine learning models. Polly and Comprehend are pre-trained AI services for specific tasks rather than model-building platforms.
Question 260 of 381An e-commerce company would like to build a chatbot for its customer service using Natural Language Understanding (NLU). As a Cloud Practitioner, which AWS service would you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Lex
Amazon Lex is the dedicated service for building conversational chatbots, utilizing natural language understanding and speech recognition. Do not confuse this with Amazon Comprehend, which analyzes text for sentiment and key phrases but does not build interactive voice interfaces.
Question 261 of 381A company is planning to implement chaos engineering to expose any blind spots that can disrupt the resiliency of the application. Which AWS service will help implement this requirement with the least effort?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AWS Fault Injection Simulator (AWS FIS)
AWS Fault Injection Simulator is the managed service designed specifically for chaos engineering, allowing you to safely inject disruptions to test system resiliency. Security services like Amazon Inspector and GuardDuty focus on vulnerability assessments and threat detection, not performance testing.
Question 262 of 381Which AWS service allows you to quickly and easily add user sign-up, sign-in, and access control to web and mobile applications?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Cognito
Amazon Cognito is specifically designed to add user sign-up, sign-in, and access control features to your mobile and web applications. Remember that IAM manages internal AWS console permissions, whereas Cognito handles external consumer-facing application identities.
Question 263 of 381A media company wants to enable customized content suggestions for the users of its movie streaming platform. Which AWS service can provide these personalized recommendations based on historic data?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Personalize
Amazon Personalize uses machine learning to deliver real-time customized recommendations based on historical user data. Avoid confusing this with Amazon SageMaker, which is a broader platform requiring you to build and train custom machine learning models from scratch.
Question 264 of 381An enterprise is planning to move one of its older applications from its local data center to AWS. The IT team wants the fastest migration path and has decided not to update the application code or make any architectural changes. Which migration strategy is the most appropriate for this scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Rehost
Rehosting, or lift and shift, moves applications exactly as they are without code changes, providing the fastest migration path. Replatforming requires minor optimizations, while refactoring requires extensive architectural redesign, both violating the requirement for no modifications.
Question 265 of 381A corporation would like to simplify access management to multiple AWS accounts as well as facilitate AWS Single Sign-On (AWS SSO) access to its AWS accounts. As a Cloud Practitioner, which AWS service would you use for this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS IAM Identity Center
AWS IAM Identity Center is the correct choice because it manages workforce access to multiple accounts and applications from a central location. This service is the direct successor to AWS Single Sign-On.
Question 266 of 381An organization would like to copy data across different Availability Zones (AZs) using Amazon EBS snapshots. Where are Amazon EBS snapshots stored in the AWS Cloud?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Simple Storage Service (Amazon S3)
Amazon EBS snapshots are stored in Amazon S3, providing a durable, incremental backup of your volume data. Remember that EC2 provides compute, EFS is for active shared file storage, and RDS handles relational databases rather than acting as snapshot storage.
Question 267 of 381A company would like to create a private, high bandwidth network connection between its on-premises data centers and AWS Cloud. As a Cloud Practitioner, which of the following options would you recommend?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Direct Connect
AWS Direct Connect establishes a dedicated, private network connection from on-premises environments to AWS, bypassing the public internet. Site-to-Site VPN also connects networks but routes traffic over the public internet rather than a private, high-bandwidth line.
Question 268 of 381Which AWS service can be used to subscribe to an RSS feed to be notified of the status of all AWS service interruptions?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Health Dashboard - Service Health
The AWS Health Dashboard provides the overall status of all AWS services and offers an RSS feed for service interruptions. Do not confuse this with the Account Health Dashboard, which only provides personalized alerts for events directly impacting your specific AWS resources.
Question 269 of 381A production company with predictable usage would like to reduce the cost of its Amazon Elastic Compute Cloud (Amazon EC2) instances by using Reserved Instances (RI). Which of the following length terms are available for Amazon EC2 Reserved Instances (RI)? (Select Two)
Select 2 answers.
Show answer & explanation
Correct answer: B. 1 year · C. 3 years
Standard and Convertible Reserved Instances for Amazon EC2 are available in one-year and three-year term commitments for a significant discount. For the exam, remember that AWS does not offer six-month, two-year, or five-year reservation terms for standard pricing discounts.
Question 270 of 381According to the AWS Shared Responsibility Model, which of the following is the responsibility of the customer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Firewall & networking configuration of Amazon Elastic Compute Cloud (Amazon EC2)
Under the Shared Responsibility Model, customers are responsible for security in the cloud, including configuring firewalls and networking for EC2 instances. AWS manages security of the cloud itself, meaning AWS handles physical hardware and the underlying infrastructure for managed services like DynamoDB.
Question 271 of 381A startup would like to monitor its cost on the AWS Cloud and would like to choose an optimal Savings Plan. As a cloud practitioner, which AWS service would you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Cost Explorer
AWS Cost Explorer lets you visualize your costs and provides actionable Savings Plan recommendations. While AWS Budgets sends alerts when you exceed your spending limits, it does not generate specific Savings Plan optimization recommendations.
Question 272 of 381A company would like to separate costs for AWS services by department for cost allocation. Which of the following is the simplest way to achieve this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Create tags for each department
Applying resource tags to designate specific departments is the simplest and most effective way to allocate and separate AWS costs. Creating multiple AWS accounts for different departments complicates billing, whereas using tags on a single account streamlines cost tracking.
Question 273 of 381Which of the following criteria are used to calculate the charge for Amazon EBS volumes? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: A. Provisioned IOPS · E. Volume type
EBS pricing is driven by volume type, provisioned storage space, and provisioned IOPS. Data transfer into AWS is free, and the EC2 instance type a volume attaches to does not affect the EBS price.
Question 274 of 381A Cloud Practitioner would like to centrally view, manage, and operate nodes to quickly identify any issues that might impact applications using those resources. Which AWS service can help with this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Systems Manager
AWS Systems Manager provides a central hub to view operational data, automate management tasks, and quickly identify issues across your nodes. Trusted Advisor provides high-level best practice checks rather than operational node control.
Question 275 of 381A company needs a secure online data transfer service that can automate ongoing transfers from on-premises systems into AWS while providing support for incremental data backups. Which AWS service is an optimal fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS DataSync
AWS DataSync automates and accelerates online data transfers between on-premises storage and AWS, fully supporting incremental transfers. Snowball devices are for offline migrations, whereas Storage Gateway connects on-premises apps to cloud storage.
Question 276 of 381Which AWS serverless service allows you to prepare data for analytics?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Glue
AWS Glue is a serverless extract, transform, and load service specifically designed to prepare and clean data for analytics. Amazon Athena and Redshift query the prepared data, while EMR handles big data processing frameworks.
Question 277 of 381Which AWS tool can provide best practice recommendations for performance, service limits, and cost optimization?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Trusted Advisor
AWS Trusted Advisor evaluates your account against AWS best practices, offering recommendations for cost optimization, performance, security, and service limits. Amazon CloudWatch monitors resource performance but does not provide actionable best practice checks.
Question 278 of 381Which of the following AWS services can be used to generate, use, and manage encryption keys on the AWS Cloud?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS CloudHSM
AWS CloudHSM provides dedicated hardware security modules in the cloud, allowing you to securely generate, store, and manage your own cryptographic encryption keys. Remember that Secrets Manager protects application credentials like database passwords, whereas CloudHSM handles the actual cryptographic hardware boundary.
Question 279 of 381Which AWS service can be used to view the most comprehensive billing details for the past month?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Cost & Usage Report (AWS CUR)
The AWS Cost and Usage Report provides the most comprehensive and granular billing details available, publishing hourly resource data directly into an Amazon S3 bucket. Contrast this with AWS Cost Explorer, which is better suited for high-level visual forecasting and trend analysis.
Question 280 of 381Which service or tool will you use to create and provide trusted users with temporary security credentials that can control access to your AWS resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Security Token Service (AWS STS)
The AWS Security Token Service generates temporary, limited-privilege credentials for federated or IAM users to securely access your resources. While Amazon Cognito handles web and mobile user identity pools, STS is the underlying mechanism for dispensing short-term access tokens.
Question 281 of 381A company using a hybrid cloud would like to store secondary backup copies of the on-premises data. Which Amazon S3 Storage Class would you use for a cost-optimal yet rapid access solution?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Amazon S3 One Zone-Infrequent Access is the optimal choice for secondary backup copies because it stores data in a single availability zone, reducing costs while maintaining rapid access. Standard-IA offers multi-zone resilience, making it unnecessarily expensive for easily recreatable or secondary data.
Question 282 of 381The IT infrastructure at a university is deployed on the AWS Cloud and is experiencing a read-intensive workload. As a Cloud Practitioner, which AWS service would you use to take the load off databases?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon ElastiCache
Amazon ElastiCache sits in front of your database to serve frequent read requests from fast in-memory data stores, significantly reducing database load. Standard databases like Amazon RDS handle persistent storage, while EMR and Glue process big data analytics.
Question 283 of 381According to the AWS Well-Architected Framework, which of the following statements are recommendations in the Operational Excellence pillar? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. Make frequent, small, reversible changes · D. Anticipate failure
The Operational Excellence pillar emphasizes making frequent, small, reversible changes and anticipating failure. Use this practical cue to separate the pillars: Security focuses on traceability, Reliability on automatic recovery, and Performance Efficiency on serverless architectures.
Question 284 of 381A company would like to define a set of rules to manage objects cost-effectively between Amazon Simple Storage Service (Amazon S3) storage classes. As a Cloud Practitioner, which Amazon S3 feature would you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Simple Storage Service (Amazon S3) Lifecycle configuration
S3 Lifecycle configurations automatically transition objects between storage classes to manage costs effectively over time. Avoid confusing this with Cross-Region Replication, which is used for compliance and disaster recovery across different geographic regions.
Question 285 of 381Which AWS tool/service will help you define your cloud infrastructure using popular programming languages such as Python and JavaScript?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Cloud Development Kit (AWS CDK)
The Cloud Development Kit lets you define cloud infrastructure using familiar programming languages like Python. Contrast this with CloudFormation, which requires writing declarative templates using JSON or YAML instead of traditional code.
Question 286 of 381A research lab needs to be notified in case of a configuration change for security and compliance reasons. Which AWS service can assist with this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AWS Config
AWS Config is the correct choice because it continuously monitors and records resource configurations, allowing you to trigger alerts for compliance changes. Trusted Advisor provides high-level best practice checks but lacks granular configuration state tracking.
Question 287 of 381A production company would like to establish an AWS managed virtual private network (VPN) service between its on-premises network and AWS. Which item needs to be set up on the company's side?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. A customer gateway
A customer gateway represents the physical or software appliance on your side of a Site-to-Site VPN connection. The virtual private gateway resides on the AWS side, so remember that you always manage the customer endpoint hardware.
Question 288 of 381An engineering team would like to cost-effectively run hundreds of thousands of batch computing workloads on AWS. As a Cloud Practitioner, which AWS service would you use for this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Batch
AWS Batch dynamically provisions the optimal compute resources to run hundreds of thousands of batch computing workloads efficiently. While Lambda handles smaller event-driven tasks, AWS Batch is purpose-built for massive scale processing.
Question 289 of 381According to the AWS Shared Responsibility Model, which of the following are the responsibilities of AWS? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. Data center security · D. Network operability
Under the Shared Responsibility Model, AWS handles security of the cloud, including physical data center security and network operability. Customers must handle security in the cloud, which includes patching guest operating systems and configuring access.
Question 290 of 381What is the primary use case for Amazon GuardDuty?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Detecting malicious activity and threats in your AWS accounts and workloads
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. For the exam, do not confuse this with the Web Application Firewall, which actively blocks common web exploits.
Question 291 of 381Which AWS service can inspect Amazon CloudFront distributions running on any HTTP web server?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Web Application Firewall (AWS WAF)
AWS WAF protects web applications by inspecting HTTP requests forwarded to Amazon CloudFront. This allows you to block malicious traffic at the edge locations before it ever reaches your origin servers.
Question 292 of 381Which of the following are the advantages of using the AWS Cloud? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: D. Stop guessing about capacity · E. Increase speed and agility
Stop guessing capacity and increase speed and agility are core advantages of cloud computing. Remember that cloud computing shifts expenses from upfront capital expenditures to flexible operational expenses.
Question 293 of 381Which AWS service can be used to send, store, and receive messages between software components at any volume to decouple application tiers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Amazon Simple Queue Service (Amazon SQS)
Amazon Simple Queue Service securely decouples application tiers by letting you send, store, and receive messages between software components. Simple Notification Service is pub/sub and pushes messages, whereas queues pull and retain them.
Question 294 of 381Which Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling feature can help with fault tolerance?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Replacing unhealthy Amazon EC2 instances
Amazon EC2 Auto Scaling improves fault tolerance by automatically detecting and replacing unhealthy instances to maintain application availability. Distributing load is a feature of Elastic Load Balancing, which works alongside Auto Scaling but serves a different purpose.
Question 295 of 381Which of the following statements is an AWS best practice when architecting for the Cloud?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Automation
Automation is a core AWS architectural best practice because it improves system stability and operational efficiency. For the exam, associate the other options with anti-patterns: AWS promotes loose coupling, services over servers, and security as the top priority.
Question 296 of 381Which of the following options are the benefits of using AWS Elastic Load Balancing (ELB)? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: D. High availability · E. Fault tolerance
Elastic Load Balancing provides high availability and fault tolerance by automatically distributing incoming traffic across multiple healthy targets. It does not provide storage, and while it helps optimize resource use, its primary value is resilience, not direct cost reduction.
Question 297 of 381Which of the following AWS Support plans is the MOST cost-effective when getting enhanced technical support by Cloud Support Engineers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Business Support
AWS Business Support is the most cost-effective plan that provides enhanced technical support from Cloud Support Engineers. Enterprise Support also offers this but is significantly more expensive, while Developer and Basic tiers do not provide full engineer access.
Question 298 of 381Which types of monitoring can be provided by Amazon CloudWatch? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: B. Resource utilization · C. Application performance
Amazon CloudWatch provides visibility into resource utilization and application performance for AWS workloads. Remember that CloudTrail records API access, while the AWS Health Dashboard shows the overall availability of regional AWS services.
Question 299 of 381Which of the following AWS Identity and Access Management (AWS IAM) Security Tools allows you to review permissions granted to an IAM user?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Identity and Access Management (IAM) access advisor
IAM access advisor displays the service permissions granted to a user and when they were last accessed, helping you identify unnecessary permissions. The credentials report only lists credential status, such as password or key rotation, not the attached permissions.
Question 300 of 381Which of the following statements is the MOST accurate when describing AWS Elastic Beanstalk?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. It is a Platform as a Service (PaaS) that allows you to deploy and scale web applications and services
AWS Elastic Beanstalk is a Platform as a Service offering that automatically handles deployment, capacity provisioning, and scaling for web applications. Distinguish it from CloudFormation, which is an Infrastructure as Code tool used to model and provision resources.
Question 301 of 381A company needs to keep sensitive data in its own data center due to compliance but would still like to deploy resources using AWS. Which cloud deployment model does this refer to?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Hybrid Cloud
A hybrid cloud deployment connects AWS cloud resources with your existing on-premises infrastructure. Remember that private cloud refers to an isolated environment running solely within AWS, while hybrid specifically mixes on-premises data centers and the public cloud.
Question 302 of 381An engineering team is new to the AWS Cloud and would like to launch a dev/test environment with low monthly pricing. Which AWS service can address this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon LightSail
Amazon Lightsail is a virtual private server service designed for easy deployment at a low, predictable monthly price, making it ideal for beginners. Standard EC2 requires more networking configuration, making it overly complex for simple dev/test environments.
Question 303 of 381Which of the following statements is CORRECT regarding the scope of an Amazon Virtual Private Cloud (VPC)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. A VPC spans all Availability Zones (AZs) within an AWS region
A Virtual Private Cloud spans all Availability Zones within a single, specific AWS Region. Remember that a subnet is confined to a single Availability Zone, while the overarching VPC operates at the regional level.
Question 304 of 381Which security control tool can be used to deny traffic from a specific IP address?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Network Access Control List (network ACL)
A network access control list can explicitly deny traffic from specific IP addresses at the subnet level. A practical exam cue is that security groups are stateful and only allow rules, so you must use stateless network ACLs to explicitly block bad IP addresses.
Question 305 of 381Which of the following options is NOT a feature of Amazon Inspector?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Track configuration changes
Tracking resource configuration changes is the primary function of AWS Config. Amazon Inspector focuses on automated security assessments, scanning for software vulnerabilities, and checking for unintended network accessibility.
Question 306 of 381Which of the following statements is INCORRECT regarding Amazon EBS Elastic Volumes?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon EBS Elastic Volumes can be bound to several Availability Zones (AZs)
Elastic Block Store volumes are locked to a specific Availability Zone and cannot natively span multiple zones. To move data across zones, you must take a snapshot and restore it. Remember that at the foundational level, standard volumes attach to a single instance at a time.
Question 307 of 381A multinational company has just moved its infrastructure to AWS Cloud and has employees traveling to different offices around the world. How should the company set the AWS accounts?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. There is nothing to do, AWS Identity and Access Management (AWS IAM) is a global service
Identity and Access Management is a global service, meaning user identities and roles are available across all regions without any extra configuration. Resist the trap of creating regional accounts or users, and never share credentials between employees.
Question 308 of 381The development team at a company manages 300 microservices and it is now trying to automate the code reviews to improve the code quality. Which tool/service is the right fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon CodeGuru
Amazon CodeGuru uses machine learning to automate code reviews and identify expensive lines of code, perfectly fitting this requirement. Rule out CodeBuild because it only compiles code and runs tests without providing intelligent recommendations.
Question 309 of 381A company would like to optimize Amazon Elastic Compute Cloud (Amazon EC2) costs. Which of the following actions can help with this task? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: B. Purchase Amazon EC2 Reserved instances (RIs) · D. Set up Auto Scaling groups to align the number of instances with the demand
Reserved Instances offer discounts for steady workloads, while Auto Scaling matches capacity to live demand to eliminate waste. Vertical scaling often costs more without trimming excess capacity, and support plans do not directly lower compute fees.
Question 310 of 381A company would like to reserve Amazon Elastic Compute Cloud (Amazon EC2) compute capacity for three years to reduce costs. The company also plans to increase their workloads during this period. As a Cloud Practitioner, which Amazon Elastic Compute Cloud (Amazon EC2) reserved instance (RI) type would you recommend?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Convertible reserved instance (RI)
Convertible Reserved Instances allow you to exchange instances to adapt to changing workloads over a three-year term. Standard Reserved Instances offer larger discounts but lock you into specific instance families without flexibility.
Question 311 of 381A brand-new startup would like to remove its need to manage the underlying infrastructure and focus on the deployment and management of its applications. Which type of cloud computing does this refer to?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Platform as a Service (PaaS)
Platform as a Service removes the need to manage underlying infrastructure, allowing you to focus entirely on deploying and managing applications. On the exam, remember the shared responsibility shift: IaaS gives you the most control, while SaaS provides a completed product managed by the provider.
Question 312 of 381A company would like to audit requests made to an Amazon S3 bucket. As a Cloud Practitioner, which Amazon S3 feature would you recommend addressing this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Simple Storage Service (Amazon S3) Access Logs
Amazon S3 server access logging provides detailed records of every request made to a bucket, making it the right choice for security and access audits. Bucket policies only control access permissions, and versioning simply preserves object variants.
Question 313 of 381A growing startup has trouble identifying and protecting sensitive data at scale. Which AWS fully managed service can assist with this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon Macie
Amazon Macie is a managed data security service that uses machine learning to automatically discover and protect sensitive data in S3 buckets. Remember that AWS Artifact only provides compliance reports, while Secrets Manager safeguards credentials.
Question 314 of 381Which of the following are best practices when using AWS Organizations? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: A. Create AWS accounts per department · B. Restrict account privileges using Service Control Policies (SCP)
Creating individual accounts for each department and restricting privileges with Service Control Policies are core best practices for governance and isolation. Avoid disabling CloudTrail or ignoring tags, as you need monitoring and proper billing categorization.
Question 315 of 381A startup would like to quickly deploy a popular technology on AWS. As a cloud practitioner, which AWS tool would you use for this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Partner Solutions (formerly Quick Starts)
AWS Partner Solutions provide automated reference deployments to help you quickly launch popular technologies using best practices. Note that AWS CodeDeploy is strictly for automating application code updates, whereas Partner Solutions deploy the entire infrastructure stack quickly.
Question 316 of 381A company would like to move its infrastructure to the AWS Cloud. Which of the following should be included in the Total Cost of Ownership (TCO) estimate? (Select TWO)
Select 2 answers.
Show answer & explanation
Correct answer: C. Server administration · E. Power/Cooling
Total Cost of Ownership calculations for cloud migration include IT labor for server administration and facility costs like power and cooling. The number of end-users or office electronics are not direct infrastructure TCO factors.
Question 317 of 381A Cloud Practitioner would like to deploy identical resources across all AWS regions and accounts using templates while estimating costs. Which AWS service can assist with this task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AWS CloudFormation
CloudFormation templates deploy standardized resources across accounts and regions while providing cost estimates for your stack. Avoid CodeDeploy since it only handles application code delivery, not the underlying infrastructure provisioning.
Question 318 of 381According to the AWS Shared Responsibility Model, which of the following is both the responsibility of AWS and the customer? (Select two)
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Configuration management
Shared controls like configuration management apply to both the infrastructure layer and customer layers in different contexts. While AWS manages its hardware configurations, customers must configure their own guest operating systems.
Question 319 of 381A company based in Sydney hosts its application on an Amazon EC2 instance in ap-southeast-2. They would like to deploy the same Amazon EC2 instances in eu-south-1. Which of the following AWS entities can address this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Machine Image (AMI)
An Amazon Machine Image contains the information required to launch an instance, allowing you to deploy identical configurations across different regions. Elastic Load Balancing distributes network traffic across existing instances, while an EBS snapshot only backs up block storage.
Question 320 of 381Which of the following services are provided by Amazon Route 53? (Select TWO)
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Health checks and monitoring
Amazon Route 53 is primarily a Domain Name System web service, but it also provides health checks and monitoring to route traffic reliably. Transfer acceleration is an Amazon S3 feature, and Route 53 routes traffic to load balancers rather than acting as one.
Study on mobile
Get CertPunch for iOS or Android.