AWS
AWS Certified Cloud Practitioner (CLF-C02)
Question 321 of 381Historically, IT departments had to over-provision for peak demand. IT professionals may bring this legacy mindset to the table when they build their cloud infrastructure leading to over-provisioned resources and unnecessary costs. Right-sizing of resources is necessary to reduce infrastructure costs while still using cloud functionality optimally. Which feature of the AWS Cloud refers to right-sizing the resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Elasticity
Elasticity is correct because it refers to the ability to automatically scale resources up or down to match current demand, preventing costly over-provisioning. Horizontal scaling only adds capacity, whereas elasticity actively contracts resources when demand drops.
Question 322 of 381A company provides you with a completed product that is run and managed by the company itself. As a customer, you only use the product without worrying about maintaining or managing the product. Which cloud computing model does this kind of product belong to?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Software as a Service (SaaS)
Software as a Service provides a completed product run and managed by the service provider, requiring no underlying maintenance. Web-based email is a classic example, whereas infrastructure and platform models require you to manage operating systems or applications.
Question 323 of 381A company wants to establish a private, dedicated connection between AWS and its on-premises data center. Which AWS service is the right choice for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Direct Connect
AWS Direct Connect establishes a private, dedicated network connection from your on-premises data center to AWS. Site-to-Site VPN also connects networks but routes encrypted traffic over the public internet instead of a dedicated line.
Question 324 of 381As a Cloud Practitioner, which of the following credentials would you recommend for signing in to the AWS Management Console to meet security best practices? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. IAM Username and password · E. Multi Factor Authentication (MFA)
To securely sign in to the AWS Management Console, you should use an IAM username and password, supplemented by Multi-Factor Authentication. Access keys are strictly for programmatic access via the CLI or SDKs and should never be used for console sign-ins.
Question 325 of 381As an AWS Cloud Practitioner, you have been tasked to find examples of AWS Cloud solution designs. Which service/feature would you recommend?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Architecture Center
The AWS Architecture Center provides reference architecture diagrams, vetted solutions, and Well-Architected best practices. For the exam, remember that the AWS Marketplace is a software catalog, while Trusted Advisor provides real-time cost and security checks.
Question 326 of 381AWS Support offers five support plans for its customers. Which of the following features are covered as part of the AWS Basic Support Plan? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. One-on-one responses to account and billing questions · C. Service health checks
The AWS Basic Support plan covers one-on-one responses for account and billing questions, service health checks, and access to support forums. Use-case guidance and diagnostic tools are only available on Developer, Business, and Enterprise support plans.
Question 327 of 381Which feature/functionality will help you organize your AWS resources, manage and automate tasks on large numbers of resources at a time?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS Resource Groups
AWS Resource Groups let you organize and manage multiple AWS resources as a single unit for bulk automation tasks. Tags are just metadata properties, while Organizations manage multiple AWS accounts rather than individual resources.
Question 328 of 381Which of the following is the responsibility of the customer when running applications using AWS Lambda?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Writing and maintaining the function code and its dependencies
Under the shared responsibility model, customers must write and maintain their own AWS Lambda function code and dependencies. AWS automatically handles the underlying infrastructure, operating system, and runtime environments for the service.
Question 329 of 381Which of the following statements are true about AWS Shared Responsibility Model? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest operating system and applications · C. AWS trains AWS employees, but a customer must train their own employees
AWS handles infrastructure patching, while customers must patch their guest operating systems and applications. AWS trains its own employees, but the customer is strictly responsible for training their own internal staff on cloud security.
Question 330 of 381By default, which of the following events are logged by AWS CloudTrail?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Management events
By default, AWS CloudTrail logs management events, which capture control plane operations within your account. Data events and CloudTrail Insights events incur additional charges and must be explicitly enabled on your trail.
Question 331 of 381A media company uses Amazon Simple Storage Service (Amazon S3) for storing all its data. Which storage class should it consider for cost-optimal storage of the data that has random access patterns?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)
Amazon S3 Intelligent-Tiering automatically moves data between access tiers to optimize costs when access patterns are unknown or unpredictable. S3 Standard is only for frequently accessed data, while Standard-IA applies retrieval fees.
Question 332 of 381A university provides access to AWS services for its students to submit their research data for analysis. The university is looking at the most cost-effective approach for recovering from disasters and it can tolerate data loss of a few hours. Which disaster recovery strategy is well-suited for this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Backup and restore strategy
A backup and restore strategy is the most cost-effective disaster recovery approach and perfectly accommodates tolerating a few hours of data loss. Pilot light, warm standby, and multi-site strategies offer lower recovery times but cost significantly more.
Question 333 of 381Which of the following are NoSQL database services from AWS? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. Amazon Neptune · E. Amazon DocumentDB
Amazon Neptune and Amazon DocumentDB are correct because they are fully managed NoSQL database services that store data as graphs and documents. Remember that Amazon RDS and Aurora are relational databases, making them incorrect choices for NoSQL questions.
Question 334 of 381Which of the following use-cases can be solved using the Amazon Forecast service?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Predict the web traffic of a website for the next few weeks
Amazon Forecast is correct because it uses machine learning to predict future time-series data like web traffic. For the exam, associate Forecast exclusively with time-series predictions, whereas Amazon Personalize is used for product recommendations.
Question 335 of 381AWS Web Application Firewall (AWS WAF) can be deployed on which of the following services?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon CloudFront, Application Load Balancer, Amazon API Gateway, AWS AppSync
Amazon CloudFront, Application Load Balancer, Amazon API Gateway, and AWS AppSync are correct because AWS WAF integrates directly with these services to filter web traffic. Remember that WAF cannot be deployed directly on Amazon EC2 instances without an intermediary load balancer.
Question 336 of 381A weather-tracking application is built using Amazon DynamoDB. The performance of the application has been consistently good. But lately, the team has realized that during holidays and travel seasons, the load on the application is high and the read requests consume most of the database resources, thereby drastically increasing the overall application latency. Which feature/service will help resolve this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon DynamoDB Accelerator
Amazon DynamoDB Accelerator is correct because it is a fully managed in-memory cache built specifically to reduce DynamoDB read latency. While ElastiCache provides general caching, AWS recommends using the purpose-built DynamoDB Accelerator for DynamoDB workloads.
Question 337 of 381A financial services company needs to retain its data for 10 years to meet compliance norms. Which Amazon Simple Storage Service (Amazon S3) storage class is the best fit for this use case considering that the data has to be stored at a minimal cost?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon S3 Glacier Deep Archive
Amazon S3 Glacier Deep Archive is the lowest-cost storage class, explicitly designed for long-term retention and compliance needs spanning seven to ten years. Standard-IA is more expensive for long-term storage, making Deep Archive the definitive choice when minimizing cost is the primary objective.
Question 338 of 381Which of the following is the least effort way to encrypt data for AWS services only in your AWS account using AWS Key Management Service (KMS)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Use AWS managed master keys that are automatically created in your account for each service
AWS managed keys are automatically created in your account for integrated services, providing encryption with the absolute least administrative effort. Customer managed keys require manual policy configuration, and AWS owned keys are completely invisible and shared across multiple accounts.
Question 339 of 381A manufacturing company is looking at a service that can offer AWS infrastructure, AWS services, APIs, and tools to its on-premises data center for running low latency applications. Which of the following service/tool is the best fit for the given requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Outposts
AWS Outposts delivers native AWS infrastructure, services, and APIs directly into your on-premises data centers to support hybrid workloads requiring ultra-low latency. Contrast this with Local Zones, which extend AWS infrastructure into major metropolitan areas rather than your private facilities.
Question 340 of 381Which of the following will help you control the incoming traffic to an Amazon EC2 instance?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Security Group
A security group acts as a virtual firewall at the instance level to control incoming and outgoing traffic. A network ACL secures the entire subnet, while route tables only dictate where network traffic is directed.
Question 341 of 381A security group has been changed in an AWS account, and the manager of the account has asked you to find out the details of the user who changed it. As a Cloud Practitioner, which AWS service will you use to fetch the necessary information?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS CloudTrail
AWS CloudTrail records user activity and API calls, making it the correct choice for auditing account changes like modified security groups. Amazon Inspector assesses vulnerabilities, while Trusted Advisor offers best practice checks.
Question 342 of 381A company is looking at real-time processing of streaming big data for their ad-tech platform. Which of the following AWS services is the right choice for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon Kinesis Data Streams
Amazon Kinesis Data Streams is the correct choice because it is purpose-built to continuously capture and process real-time streaming data. For the exam, remember Kinesis handles streaming data, whereas Amazon Redshift and EMR are used for batch processing and data warehousing.
Question 343 of 381A team manager needs data about the changes that have taken place for AWS resources in his account during the past two weeks. Which AWS service can help get this data?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Config
AWS Config is the correct service because it records and evaluates the configurations of your AWS resources over time. Do not confuse this with CloudTrail, which records API calls and user activity for auditing who made a change.
Question 344 of 381Which of the following AWS services will help provision a logically isolated network for your AWS resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Virtual Private Cloud (Amazon VPC)
Amazon Virtual Private Cloud is correct because it provisions an isolated virtual network where you can launch AWS resources securely. For the exam, associate basic network isolation directly with Amazon VPC.
Question 345 of 381Which of the following AWS services can be used to continuously monitor both malicious activities as well as unauthorized behavior to protect your AWS accounts and workloads?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is an intelligent threat detection service that monitors for malicious activity. Security Hub aggregates findings, while Detective investigates existing issues.
Question 346 of 381Which free tool helps to review the state of your workloads and compares them to the latest AWS architectural best practices after you have answered a series of questions about your workload?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Well-Architected Tool
The AWS Well-Architected Tool is correct because it provides a structured way to review your workloads against architectural best practices. Trusted Advisor optimizes infrastructure but does not evaluate workload architecture.
Question 347 of 381An organization is looking to break down its AWS spending so that each department and project can be accurately charged for the resources they consume. Which AWS feature or service is the best fit for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS cost allocation tags
AWS cost allocation tags are correct because they let you assign metadata to resources for granular billing visibility. While the Cost and Usage Report displays spending, those reports depend completely on these tags to organize the data.
Question 348 of 381A company is moving its on-premises application to AWS Cloud. The application uses in-memory caches for running custom workloads. Which Amazon Elastic Compute Cloud (Amazon EC2) instance type is the right choice for the given requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Memory Optimized instance types
Memory optimized instances are correct because they deliver fast performance for workloads processing large data sets in memory. On the exam, immediately map in-memory databases and caches to this instance family.
Question 349 of 381Per the AWS Shared Responsibility Model, management of which of the following AWS services is the responsibility of the customer?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon Elastic Compute Cloud (Amazon EC2)
Under the shared responsibility model, EC2 is an infrastructure as a service offering, so you must manage the guest operating system and its security. For abstracted services like S3 and DynamoDB, AWS handles the underlying infrastructure and operating systems entirely.
Question 350 of 381An e-learning company wants to build a knowledge graph by leveraging a fully managed database. Which of the following is the best fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon Neptune
Amazon Neptune is a fully managed graph database optimized for storing billions of relationships, making it perfect for building knowledge graphs. RDS and DocumentDB handle relational and document workloads respectively, not highly connected graph datasets.
Question 351 of 381Which of the following are the security best practices suggested by AWS for Identity and Access Management (IAM)? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Do not share security credentials between accounts, use IAM roles instead · E. When you create IAM policies, grant the least privileges required to perform a task
Applying least privilege and using IAM roles instead of sharing credentials are foundational AWS security best practices. You should never share root user credentials, and MFA protects an account rather than distributing root access to multiple users.
Question 352 of 381Amazon Simple Queue Service (Amazon SQS)
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon Simple Queue Service (SQS)
Amazon Simple Queue Service allows you to decouple applications by storing messages securely until the downstream application processes them. Simple Notification Service uses a push mechanism, which risks message loss if the receiving application is unavailable.
Question 353 of 381An e-commerce company needs to generate custom reports and graphs every week for analyzing product sales data. The company is looking at a tool/service that will help them analyze this data using interactive dashboards with minimal effort. The dashboards also need to be accessible from any device. Which AWS tool/service will you recommend for this use-case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Quicksight
Amazon QuickSight is a serverless business intelligence service that lets you create and publish interactive, machine-learning-powered dashboards accessible from any device. Athena runs SQL queries but does not build visual dashboards, and SageMaker is meant for machine learning models.
Question 354 of 381As part of a flexible pricing model, AWS offers two types of Savings Plans. Which of the following are the Savings Plans from AWS?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Compute Savings Plans, EC2 Instance Savings Plans
AWS offers Compute Savings Plans and EC2 Instance Savings Plans to provide flexible pricing in exchange for a usage commitment. Compute plans apply broadly to Fargate and Lambda, while EC2 Instance plans offer deeper discounts tied to a specific instance family in a region.
Question 355 of 381Which tool/service will help you get a forecast of your spending for the next 12 months?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS Cost Explorer
AWS Cost Explorer lets you view historical usage data and provides a forecast of your expected spending for the next twelve months. The Pricing Calculator estimates costs for new architectures, whereas Cost Explorer analyzes existing account spend.
Question 356 of 381A blogging company is looking for an easy-to-use solution to host WordPress blogs. The company needs a cost-effective, readily available solution without the need to manage the configurations for servers or databases. Which AWS service will help achieve this functionality?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon Lightsail
Amazon Lightsail provides a low, predictable monthly price and pre-configured blueprints, making it the easiest way to deploy and manage WordPress without server overhead. Standard EC2 requires manual configuration, and S3 cannot host dynamic PHP applications like WordPress.
Question 357 of 381Which of the following statements are correct regarding Amazon API Gateway? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. API Gateway can be configured to send data directly to Amazon Kinesis Data Stream · D. Amazon API Gateway can call an AWS Lambda function to create the front door of a serverless application
Amazon API Gateway securely routes requests to AWS Lambda, serving as the front door for serverless applications. It can also integrate directly with services like Kinesis; be aware that cached API responses are still counted as API calls for billing.
Question 358 of 381Which of the following statements are correct regarding the AWS Control Tower and Service Control Policies? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. Service Control Policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization · D. AWS Control Tower is an AWS native service providing a pre-defined set of blueprints and guardrails to help customers implement a landing zone for new AWS accounts
AWS Control Tower provides a pre-configured landing zone, and Service Control Policies manage the maximum available permissions in an organization. A key exam cue is that SCPs act as guardrails to set permission limits but do not actually grant any permissions themselves.
Question 359 of 381A company is looking at a service/tool to automate and minimize the time spent on keeping the server images up-to-date. These server images are used by Amazon Elastic Compute Cloud (Amazon EC2) instances as well as the on-premises systems. Which AWS service will help achieve the company's need?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Amazon EC2 Image Builder
Amazon EC2 Image Builder is correct because it automates the creation, testing, and deployment of secure server images for AWS and on-premises use. An Amazon Machine Image is simply the resulting artifact, not the automated pipeline tool that keeps images updated.
Question 360 of 381A Cloud Practitioner wants to use CIDR block notation when providing an IP address range. Which of the following AWS network services/utilities allow this feature? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: A. Network access control list (network ACL) · E. Security group
Security groups and network access control lists are correct because both virtual private cloud firewall features allow the use of CIDR block notation to manage traffic. Services like Amazon S3 and AWS Lambda do not use CIDR blocks for direct IP configuration.
Question 361 of 381A financial consulting company is looking for automated reference deployments, that will speed up the process of deploying its financial solutions on AWS Cloud. The reference deployment should be able to deploy most of the well-known functions of financial services and leave space for customizations, if necessary. Which AWS service will help achieve this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Partner Solutions(formerly Quick Starts)
AWS Partner Solutions are correct because they provide customizable, automated reference deployments built by AWS experts to accelerate cloud adoption. While AWS CloudFormation provisions resources, Partner Solutions specifically offer pre-built architectural templates for quick deployment.
Question 362 of 381A gaming company needs compute and storage services close to edge locations in order to ensure ultra-low latency for end-users and devices that connect through mobile networks. Which AWS service is the best fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS Wavelength
AWS Wavelength is the correct choice because it embeds compute and storage services directly within communication service provider data centers at the 5G network edge. For the exam, associate Wavelength with 5G and mobile devices, whereas Outposts brings AWS infrastructure directly into your own private data centers.
Question 363 of 381Which of the following statements are true about AWS Elastic Beanstalk? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. There is no additional charge for AWS Elastic Beanstalk. You pay only for the underlying AWS resources that your application consumes · C. With AWS Elastic Beanstalk, you can quickly deploy and manage applications in the AWS Cloud without having to learn about the infrastructure that runs those applications
Elastic Beanstalk is a Platform as a Service offering that provisions capacity and manages infrastructure automatically without additional software charges. You only pay for the underlying resources. Remember that it fully supports Docker and automatically handles auto-scaling for your applications.
Question 364 of 381As part of log analysis, you have realized that one or more AWS-owned IP addresses are being used for port scanning your on-premises server. Which service/team should you connect to resolve this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Contact AWS Abuse team
The AWS Abuse team is the dedicated resource for reporting abusive behavior originating from AWS-owned IP addresses, such as port scanning or denial of service attacks. Standard AWS Support explicitly cannot process these reports, so always route malicious activity complaints directly to the abuse team.
Question 365 of 381A company is looking for ways to make its desktop applications available to the employees from browsers on their devices/laptops. Which AWS service will help achieve this requirement without having to procure servers or maintain infrastructure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Amazon AppStream 2.0
Amazon AppStream 2.0 streams desktop applications directly to users via a web browser, fully eliminating the need to procure backend servers or manage local infrastructure. Contrast this with Amazon WorkSpaces, which provisions an entire virtual desktop operating system environment.
Question 366 of 381Which AWS service is used to store and commit code privately and also offer features for version control?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS CodeCommit
AWS CodeCommit is a fully managed source control service that securely hosts private Git-based repositories. For the exam, easily distinguish the developer tools by remembering CodePipeline automates deployments, CodeBuild compiles code, and CodeCommit stores it.
Question 367 of 381Which of the following AWS services is delivered globally rather than regionally?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Amazon WorkSpaces
Amazon WorkSpaces is a managed desktop service that is delivered globally rather than being tied to a specific region. A practical exam cue is that services like Amazon S3, EFS, and Snowball are strictly regional resources.
Question 368 of 381Which of the following is a repository service that helps in maintaining application dependencies via integration with commonly used package managers and build tools like Maven, Gradle, npm, etc.?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AWS CodeArtifact
AWS CodeArtifact is a fully managed artifact repository service that securely stores, publishes, and shares software packages. CodeBuild compiles code, CodeCommit hosts repositories, and CodeStar manages projects, but only CodeArtifact handles package dependencies.
Question 369 of 381Which of the following represents the correct scenario where an Auto Scaling group's (ASG) predictive scaling can be effectively used to maintain the required number of AWS resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. To manage a workload that exhibits recurring load patterns that are specific to the day of the week or the time of day
Predictive scaling uses machine learning to forecast capacity needs based on historical load patterns like recurring daily or weekly traffic. Target tracking is the correct tool for maintaining a specific metric like CPU utilization or an SQS queue backlog.
Question 370 of 381Which of the following data sources are used by Amazon Detective to analyze events and identify potential security issues?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AWS CloudTrail logs, Amazon VPC Flow Logs, and Amazon GuardDuty findings
Amazon Detective ingests AWS CloudTrail logs, VPC Flow Logs, and Amazon GuardDuty findings to create a unified, interactive view of security data. GuardDuty must be enabled before using Detective, but Detective relies on these specific three sources.
Question 371 of 381Which of the following AWS services are offered free of cost? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: D. AWS Auto Scaling · E. AWS Elastic Beanstalk
There is no additional charge for AWS Elastic Beanstalk or AWS Auto Scaling, as you only pay for the underlying resources they provision. Elastic IPs, detailed monitoring, and Spot Instances all incur direct costs depending on their usage.
Question 372 of 381Due to regulatory guidelines, a company needs to encrypt data as it passes through the different layers of its AWS architecture. The company is reviewing the capabilities of the various AWS services and their encryption options. Which of the below services are encrypted by default and need no user intervention to enable encryption?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS CloudTrail Logs, Amazon S3 Glacier, AWS Storage Gateway
AWS CloudTrail logs, Amazon S3 Glacier, and AWS Storage Gateway encrypt data by default without requiring user configuration. For the exam, remember that services like Application Load Balancers and EC2 instance storage require manual configuration to enable encryption.
Question 373 of 381An e-commerce company has its on-premises data storage on an NFS file system that is accessed in parallel by multiple applications. The company is looking at moving the applications and data stores to AWS Cloud. Which storage service should the company use to move their files to AWS Cloud seamlessly if the application is hosted on Amazon Elastic Compute Cloud (Amazon EC2) instances?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Amazon Elastic File System (Amazon EFS)
Amazon Elastic File System is correct because it provides a scalable, fully managed Network File System for Linux. It allows parallel access from multiple EC2 instances, unlike block storage.
Question 374 of 381Which of the following statements are true about AWS Regions and Availability Zones (AZ)? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. All traffic between Availability Zones (AZ) is encrypted · D. Each AWS Region consists of multiple, isolated, and physically separate Availability Zones (AZ) within a geographic area
Each AWS Region has multiple isolated Availability Zones, and traffic moving between these zones is always encrypted. A strong exam tip is remembering that Regions represent geographic areas, while logical data center groups are Availability Zones.
Question 375 of 381Which AWS service allows you to connect any number of IoT devices to the cloud without requiring you to provision or manage servers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. AWS IoT Core
AWS IoT Core is a managed service that lets you connect billions of IoT devices to the cloud without managing servers. Amazon Connect is a cloud contact center service, while AWS IoT Gateway is a fabricated distractor for this exam.
Question 376 of 381A company has defined a baseline that mentions the number of AWS resources to be used for different stages of application testing. However, the company realized that employees are not adhering to the guidelines and provisioning additional resources via API calls, resulting in higher testing costs. Which AWS service will help the company raise alarms whenever the baseline resource numbers are crossed?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AWS CloudTrail Insights
CloudTrail Insights analyzes management events to detect unusual API call volumes, helping you identify unexpected resource provisioning. While AWS Config can also trigger alerts for non-compliant resources, CloudTrail specifically targets anomalous API activity.
Question 377 of 381A company is planning to move their traditional CRM application running on MySQL to an AWS database service. Which database service is the right fit for this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Amazon Aurora
Amazon Aurora is a fully managed relational database engine compatible with MySQL, making it the right choice for migrating an existing MySQL application. DynamoDB is for NoSQL, while Neptune handles graph databases, so neither fits a MySQL workload.
Question 378 of 381A healthcare company wants to implement a continuous replication based disaster recovery mechanism and provide fast, reliable recovery of physical, virtual, and cloud-based servers into AWS Cloud. Which of the following represents the best-fit solution for this use case?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. CloudEndure Disaster Recovery
CloudEndure Disaster Recovery is correct because it provides continuous block-level replication for fast recovery of physical and virtual servers. While AWS Elastic Disaster Recovery has largely replaced it on current exams, CloudEndure remains the classic correct term here.
Question 379 of 381Which of the following points have to be considered when choosing an AWS Region for a service? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: C. Compliance and Data Residency guidelines of the AWS Region should match your business requirements · E. AWS Region chosen should be geographically closer to the user base that utilizes the hosted AWS services
Data residency compliance and geographic proximity to end users are the two primary drivers when selecting an AWS Region for your workloads. All regions offer high availability, and Availability Zone distances are standardized, so focus purely on legal requirements and latency when answering.
Question 380 of 381Which of the following services/tools offers a user-friendly graphical user interface to manage AWS Snowball devices without a need for command-line interface or REST APIs?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. AWS OpsHub
AWS OpsHub provides a graphical user interface to easily manage AWS Snowball devices. You can unlock devices, transfer data, and launch edge applications without needing command-line tools or REST APIs. The other services manage file transfers or track configurations.
Question 381 of 381Which of the following statements are correct regarding the health monitoring and reporting capabilities supported by AWS Elastic Beanstalk? (Select two)
Select 2 answers.
Show answer & explanation
Correct answer: B. With basic health reporting, the AWS Elastic Beanstalk service does not publish any metrics to Amazon CloudWatch · C. The AWS Elastic Beanstalk health monitoring can determine that the environment's Auto Scaling group is available and has a minimum of at least one instance
Basic health reporting verifies the Auto Scaling group has at least one instance and does not publish metrics to CloudWatch. For single instances, health is determined by Amazon EC2 status checks, not load balancer settings.
Study on mobile
Get CertPunch for iOS or Android.