AWS Cloud Practitioner — All Questions

Which statement best describes the primary financial benefit of moving from an on-premises data center to the AWS Cloud?

• a.It trades large upfront capital expenses for variable operating expenses that scale with usage✓
• b.It guarantees that monthly bills will never change month to month
• c.It eliminates all costs associated with running applications
• d.It removes the need to monitor how many resources you consume

Cloud computing lets organizations avoid large upfront investments in hardware (CapEx) and instead pay only for the resources they actually use (OpEx). This variable cost model scales up or down with demand. Costs are not eliminated, and usage should still be monitored.

A company can provision hundreds of servers in minutes and release them just as quickly when demand drops. Which cloud benefit does this describe?

• a.Fixed capacity planning
• b.Manual hardware procurement
• c.Agility and elasticity✓
• d.Long-term data-center leasing

Elasticity is the ability to acquire resources as you need them and release them when you no longer need them, in minutes rather than weeks. Combined with agility, this lets teams experiment and innovate faster than with traditional infrastructure.

Because AWS aggregates usage from hundreds of thousands of customers, it can pass lower per-unit prices on to each customer. What is this advantage called?

• a.Elastic load balancing
• b.Economies of scale✓
• c.Fault tolerance
• d.High availability

Massive aggregated usage lets AWS achieve higher economies of scale, which translates into lower pay-as-you-go pricing for customers. Individual organizations could not achieve the same purchasing power on their own.

Which of the following is a pillar of the AWS Well-Architected Framework?

• a.Vendor lock-in
• b.Operational excellence✓
• c.Marketing effectiveness
• d.Headcount reduction

The Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Operational excellence focuses on running and monitoring systems to deliver business value.

Which Well-Architected pillar focuses on using computing resources efficiently and avoiding unnecessary spending?

• a.Operational excellence
• b.Security
• c.Reliability
• d.Cost optimization✓

The cost optimization pillar helps you run systems that deliver business value at the lowest price point, such as by choosing the right pricing model and eliminating idle resources. Reliability and security address different concerns.

A newer pillar of the AWS Well-Architected Framework addresses the long-term environmental impact of cloud workloads. Which pillar is this?

• a.Sustainability✓
• b.Compatibility
• c.Portability
• d.Scalability

Sustainability is the sixth pillar, added to help customers understand and minimize the environmental impacts of running cloud workloads. It encourages maximizing utilization and reducing the resources required.

What does the term 'high availability' mean for a system running in the cloud?

• a.The system remains operational and accessible for a very high percentage of time✓
• b.The system can only be accessed by administrators
• c.The system uses the cheapest possible resources
• d.The system stores data in a single location

High availability means a system is designed to stay up and reachable with minimal downtime, often by removing single points of failure. On AWS this is commonly achieved by spreading resources across multiple Availability Zones.

Which deployment model describes running some workloads on-premises while integrating with services in the AWS Cloud?

• a.Pure public cloud
• b.Serverless deployment
• c.Hybrid cloud✓
• d.Multi-region deployment

A hybrid deployment connects cloud resources with on-premises infrastructure, often used when data must remain local or during a gradual migration. A pure cloud model runs everything in the cloud.

Which of the following best defines scalability in the context of cloud computing?

• a.The ability of a system to handle increased load by adding resources✓
• b.The ability to restrict user permissions
• c.The ability to encrypt data at rest
• d.The ability to generate monthly invoices

Scalability is a system's capacity to grow to meet increased demand, either by adding more resources (horizontal) or larger resources (vertical). Elasticity extends this by automatically scaling in and out with demand.

A startup wants to launch a product globally without building data centers in each country. How does the AWS global infrastructure help?

• a.It lets the company deploy applications close to users in many geographic Regions✓
• b.It forces all traffic through one physical building
• c.It removes the ability to choose where data is stored
• d.It requires the company to pick a single country for all users

AWS operates Regions around the world, so companies can deploy applications near their users to reduce latency and meet local requirements. Customers choose which Regions to use for their workloads.

Which statement correctly contrasts vertical scaling with horizontal scaling?

• a.Both terms mean the same thing
• b.Vertical scaling increases the size of a single resource; horizontal scaling adds more resources✓
• c.Horizontal scaling only applies to databases
• d.Vertical scaling adds more instances; horizontal scaling makes an instance smaller

Vertical scaling (scaling up) increases the capacity of an individual resource, such as moving to a larger instance type. Horizontal scaling (scaling out) adds more resources, such as more instances behind a load balancer.

Which characteristic of cloud computing allows a developer to obtain compute and storage resources without human interaction with the provider?

• a.On-demand self-service✓
• b.Measured billing
• c.Resource pooling
• d.Broad network access

On-demand self-service means users can provision resources automatically through a console or API whenever needed, without contacting the provider. This is a defining feature of cloud computing.

How does the cloud improve an organization's ability to experiment and innovate?

• a.Low-cost, fast provisioning lowers the risk and cost of trying new ideas✓
• b.It mandates that every experiment run in a physical lab
• c.It prevents teams from deleting resources
• d.It requires a multi-year commitment before any test can begin

Because resources can be spun up quickly and released when done, the cost of failure is low. Teams can test ideas rapidly and shut them down without wasted hardware, encouraging innovation.

Which Well-Architected pillar is primarily concerned with a workload's ability to recover from failures and meet demand?

• a.Performance efficiency
• b.Reliability✓
• c.Cost optimization
• d.Sustainability

The reliability pillar focuses on ensuring a workload performs its intended function correctly and consistently, including recovering from disruptions and dynamically acquiring resources to meet demand.

A company no longer wants to spend time racking, stacking, and powering servers so it can focus on its customers. Which cloud value proposition does this reflect?

• a.Stop spending money running and maintaining data centers✓
• b.Paying more for less capacity
• c.Increasing time spent on undifferentiated tasks
• d.Guaranteeing zero latency worldwide

A key benefit of cloud is to stop spending money on the undifferentiated heavy lifting of running data centers and instead focus on projects that differentiate the business, such as serving customers.

Which cloud computing service model provides virtualized computing resources such as servers, storage, and networking that the customer manages?

• a.Infrastructure as a Service (IaaS)✓
• b.Software as a Service (SaaS)
• c.Platform as a Service (PaaS)
• d.Function as a Service

IaaS provides the fundamental building blocks of cloud IT (compute, storage, networking) and gives the customer the most control over the resources. SaaS delivers a finished application, while PaaS manages the underlying infrastructure for you.

Which of the following is an example of the Software as a Service (SaaS) model?

• a.A raw block storage volume
• b.A bare virtual machine you must configure yourself
• c.A physical network switch
• d.A ready-to-use, web-based email application✓

SaaS delivers a complete, managed application that the customer simply uses, such as web-based email. The provider handles the underlying infrastructure, platform, and application maintenance.

What is meant by 'loose coupling' as an architectural best practice in the cloud?

• a.Designing components so a failure in one has limited impact on others✓
• b.Making every component depend directly on every other component
• c.Running all code on a single large server
• d.Avoiding the use of any managed services

Loosely coupled architectures reduce interdependencies so that a change or failure in one component does not cascade to others. Services like queues and load balancers help decouple components and improve resilience.

Which benefit describes AWS's ability to go global in minutes by deploying an application in multiple Regions?

• a.Mandatory single-Region hosting
• b.Increased speed and reach for a global user base✓
• c.Reduced encryption strength
• d.Elimination of all networking costs

Deploying across multiple Regions lets you place workloads closer to users worldwide, lowering latency and improving experience. This global reach can be achieved quickly without building physical infrastructure.

Which Well-Architected design principle encourages testing systems at production scale and automating to make experimentation easier?

• a.Keeping one large monolith
• b.Avoiding failure testing
• c.Automate to make architectural experimentation easier✓
• d.Manually provisioning all infrastructure

Well-Architected design principles include automating with infrastructure as code, testing at production scale, and designing for failure. Automation makes it low-cost to create and replicate environments for experimentation.

How does elasticity help a retailer that experiences large traffic spikes during holiday sales?

• a.Capacity automatically scales out during spikes and scales in afterward, matching cost to demand✓
• b.The retailer must manually order servers weeks ahead of each sale
• c.Traffic spikes cause the application to be permanently oversized
• d.Capacity is fixed at the peak level all year, wasting money off-season

Elasticity lets the retailer add capacity during peak periods and remove it when demand falls, so they pay only for what they need. This avoids both over-provisioning year-round and under-provisioning during spikes.

Which statement about the AWS shared model of benefits is correct regarding speed and agility?

• a.Agility means resources can never be released
• b.Agility refers only to how fast invoices are generated
• c.New IT resources are always available only after a multi-week procurement cycle
• d.In the cloud, new IT resources are a click away, reducing the time to make them available to developers✓

Cloud agility means developers can obtain new resources almost instantly instead of waiting weeks for hardware. This dramatically reduces the time and cost of making resources available, accelerating projects.

Which of the following best describes 'fault tolerance' in a cloud architecture?

• a.The system charges customers only for faults
• b.The system stores only a single copy of data
• c.The system requires manual restart after any error
• d.The system continues operating properly even when some components fail✓

Fault tolerance is the ability of a system to keep running correctly despite the failure of one or more of its components, often through redundancy. It is closely related to, but stronger than, high availability.

Which Well-Architected pillar focuses on using computing resources efficiently to meet requirements and maintaining efficiency as demand changes and technologies evolve?

• a.Cost optimization
• b.Security
• c.Performance efficiency✓
• d.Reliability

The performance efficiency pillar is about using computing resources efficiently to meet system requirements and sustaining that efficiency as demand shifts and technologies advance. It encourages selecting the right resource types and reviewing them over time.

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Encrypting the customer's application data at rest
• b.Physical security of the data centers and the hardware running the cloud✓
• c.Managing the customer's IAM user passwords
• d.Configuring security groups on the customer's EC2 instances

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Replacing failed physical disks in the data center
• b.Maintaining the hypervisor that isolates instances
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Macie
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Cognito

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Share its credentials with the whole team
• b.Delete it immediately after account creation
• c.Enable MFA on it and avoid using it for everyday tasks✓
• d.Use it for all daily administrative tasks

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.An Elastic IP address
• b.Multi-factor authentication (MFA)✓
• c.A larger instance type
• d.A public S3 bucket policy

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Attach an IAM role to the EC2 instance✓
• c.Share the root user credentials with the instance
• d.Make the S3 bucket public

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Elastic provisioning
• b.Defense in depth
• c.Separation of billing
• d.Least privilege✓

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.AWS Shield✓
• b.Amazon Inspector
• c.AWS Config
• d.Amazon Macie

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.Amazon Route 53
• b.AWS Trusted Advisor
• c.AWS WAF (Web Application Firewall)✓
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon GuardDuty
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Certificate Manager
• b.AWS Artifact
• c.Amazon Cognito
• d.Amazon GuardDuty✓

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS CloudTrail✓
• c.AWS Config
• d.Amazon Inspector

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS WAF
• c.Amazon Macie
• d.AWS Shield

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.AWS Config
• b.AWS Artifact✓
• c.Amazon GuardDuty
• d.Amazon Inspector

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS Key Management Service (KMS)✓
• b.Amazon Cognito
• c.AWS CloudHSM only
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Secrets Manager✓
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Config

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.AWS Artifact
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Cognito

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS Shield
• c.Amazon Cognito✓
• d.AWS KMS

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Route table
• c.Security group✓
• d.Internet gateway

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are stateful and automatically allow return traffic
• b.They are attached directly to individual instances
• c.They are stateless and operate at the subnet level with allow and deny rules✓
• d.They can only allow traffic and never deny it

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.A single shared IAM user across all accounts
• b.AWS Organizations with service control policies (SCPs)✓
• c.Route 53 health checks
• d.Amazon Macie with WAF rules

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data printed to a physical report
• d.Data as it moves between a client and a server over the network✓

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Certificate Manager (ACM)✓
• b.AWS Config
• c.AWS Secrets Manager
• d.Amazon Inspector

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Disable MFA to simplify sign-in
• b.Use the root account for daily API calls
• c.Attach permissions directly to each individual user
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Direct Connect
• c.Amazon CloudFront
• d.AWS Trusted Advisor

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Only encrypt data after downloading it locally
• b.Server-side encryption with keys managed by AWS (SSE)✓
• c.Disable encryption entirely
• d.Store keys in the application source code

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.Roles can only be used by AWS employees
• c.Users cannot be assigned any permissions
• d.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.No one is responsible
• b.The customer✓
• c.AWS alone
• d.The internet service provider

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.AWS Lambda
• c.Amazon EC2 Auto Scaling
• d.Amazon S3

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They grant full administrative access by default
• c.They are stored permanently in application code
• d.They automatically expire, reducing the risk if they are exposed✓

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.

Which AWS service provides resizable virtual servers in the cloud on which you can run applications?

• a.Amazon RDS
• b.Amazon EC2✓
• c.Amazon S3
• d.AWS Lambda

Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers, called instances, where you control the operating system and software. S3 is object storage, RDS is a managed database, and Lambda runs code without provisioning servers.

Which AWS service provides highly durable object storage designed for 11 nines of durability?

• a.Amazon S3✓
• b.Amazon EC2
• c.Amazon VPC
• d.AWS IAM

Amazon S3 (Simple Storage Service) is object storage designed for 99.999999999% (11 nines) durability by redundantly storing data across multiple facilities. It is commonly used for backups, static websites, data lakes, and media.

Which service lets you run code without provisioning or managing servers, charging only for the compute time consumed?

• a.Amazon EBS
• b.Amazon RDS
• c.AWS Lambda✓
• d.Amazon EC2

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute. You pay only for the requests and the compute time your code uses.

Which service is a managed relational database that supports engines such as MySQL, PostgreSQL, and SQL Server?

• a.Amazon S3
• b.Amazon DynamoDB
• c.Amazon RDS✓
• d.Amazon ElastiCache

Amazon RDS (Relational Database Service) is a managed service for relational databases, handling tasks like patching, backups, and failover for engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. DynamoDB, by contrast, is a NoSQL database.

Which AWS service is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at scale?

• a.Amazon Aurora
• b.Amazon Redshift
• c.Amazon RDS
• d.Amazon DynamoDB✓

Amazon DynamoDB is a fully managed NoSQL database offering fast, consistent performance at any scale with no servers to manage. It is well suited for high-traffic applications needing flexible schemas.

What is an AWS Region?

• a.A physical geographic area containing multiple, isolated Availability Zones✓
• b.A billing category for support plans
• c.A single building that houses one server rack
• d.A content delivery cache at the network edge

An AWS Region is a separate geographic area, each containing multiple Availability Zones. Customers choose Regions based on factors such as latency, data-residency requirements, and service availability.

What is an Availability Zone (AZ)?

• a.A type of EC2 instance
• b.A global DNS service
• c.One or more discrete data centers with redundant power and networking within a Region✓
• d.A billing report

An Availability Zone consists of one or more discrete data centers with independent power, cooling, and networking, isolated from failures in other AZs. Deploying across multiple AZs increases availability and fault tolerance.

Why should a highly available application be deployed across multiple Availability Zones?

• a.So the application can continue running if one AZ experiences a failure✓
• b.To reduce the AWS bill to zero
• c.Because a single AZ cannot run any instances
• d.To avoid using load balancers

Spreading resources across multiple AZs means that if one zone fails, the application can continue serving traffic from the others. AZs are physically isolated, so this design improves availability and fault tolerance.

Which service is a content delivery network (CDN) that caches content at edge locations to reduce latency for users?

• a.AWS Lambda
• b.Amazon CloudFront✓
• c.Amazon EBS
• d.Amazon RDS

Amazon CloudFront is a CDN that caches copies of content at edge locations around the world, delivering it to users from the nearest location to reduce latency. It integrates with services like S3 and load balancers as origins.

Which service automatically distributes incoming application traffic across multiple targets such as EC2 instances?

• a.Amazon S3
• b.Elastic Load Balancing (ELB)✓
• c.Amazon Route 53
• d.AWS Lambda

Elastic Load Balancing automatically spreads incoming traffic across multiple healthy targets, such as EC2 instances in different AZs. This improves fault tolerance and helps applications scale.

Which service automatically adjusts the number of EC2 instances to match demand based on defined policies?

• a.Amazon EC2 Auto Scaling✓
• b.AWS IAM
• c.Amazon S3
• d.Amazon CloudFront

EC2 Auto Scaling adds or removes instances automatically according to demand and your scaling policies, helping maintain performance while controlling cost. Combined with a load balancer, it supports elastic, resilient architectures.

Which storage service provides persistent block-level volumes that can be attached to EC2 instances?

• a.Amazon CloudFront
• b.Amazon EBS✓
• c.Amazon S3
• d.Amazon Route 53

Amazon EBS (Elastic Block Store) provides durable block storage volumes for use with EC2 instances, similar to a virtual hard disk. Volumes persist independently of the instance lifecycle and can be snapshotted to S3.

Which service provides scalable, shared file storage that multiple Linux EC2 instances can mount simultaneously?

• a.Amazon EFS✓
• b.Amazon S3 Glacier
• c.Amazon DynamoDB
• d.Amazon EBS

Amazon EFS (Elastic File System) is a managed, elastic NFS file system that many EC2 instances can mount concurrently. Unlike EBS, which attaches to a single instance at a time, EFS supports shared access.

Which AWS service is a scalable Domain Name System (DNS) web service used to route users to applications?

• a.Amazon CloudFront
• b.Amazon VPC
• c.Amazon Route 53✓
• d.AWS Direct Connect

Amazon Route 53 is a highly available and scalable DNS service that routes end users to applications by translating domain names into IP addresses. It also supports domain registration and health checks.

Which service lets you provision a logically isolated section of the AWS Cloud where you define your own IP ranges, subnets, and routing?

• a.AWS Lambda
• b.Amazon CloudWatch
• c.Amazon S3
• d.Amazon VPC✓

Amazon VPC (Virtual Private Cloud) lets you create an isolated virtual network in AWS where you control IP address ranges, subnets, route tables, and gateways. It gives you networking control similar to a traditional data center.

Which service provides monitoring and observability, collecting metrics, logs, and alarms for AWS resources and applications?

• a.Amazon CloudWatch✓
• b.Amazon Route 53
• c.Amazon Cognito
• d.AWS Artifact

Amazon CloudWatch collects metrics, logs, and events, and can trigger alarms and actions based on thresholds. It is the primary monitoring service for gaining operational visibility into AWS resources and applications.

Which service lets you model and provision AWS infrastructure as code using templates?

• a.Amazon CloudWatch
• b.AWS Shield
• c.Amazon Inspector
• d.AWS CloudFormation✓

AWS CloudFormation lets you define infrastructure in templates and provision it automatically and repeatably as 'stacks.' This infrastructure-as-code approach makes environments consistent and easy to replicate.

A developer wants to deploy a web application without manually configuring the underlying compute, load balancing, and scaling. Which service handles this?

• a.Amazon VPC
• b.Amazon S3
• c.AWS Elastic Beanstalk✓
• d.Amazon EC2

AWS Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, automatically handling capacity provisioning, load balancing, scaling, and health monitoring. Developers simply upload code while retaining control of the resources.

Which fully managed message queuing service decouples components by letting them send and receive messages asynchronously?

• a.Amazon CloudFront
• b.Amazon EFS
• c.Amazon SQS✓
• d.Amazon RDS

Amazon SQS (Simple Queue Service) is a managed message queue that lets application components communicate asynchronously, improving decoupling and resilience. Producers send messages to a queue and consumers process them independently.

Which service is a fully managed publish/subscribe messaging service used to send notifications to subscribers or other services?

• a.Amazon Redshift
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon SNS✓

Amazon SNS (Simple Notification Service) is a pub/sub messaging service that delivers messages to multiple subscribers such as email, SMS, or other AWS services. It is often used for fan-out notifications and event-driven architectures.

Which service is a fully managed data warehouse designed for running complex analytic queries over large datasets?

• a.Amazon SQS
• b.Amazon Redshift✓
• c.Amazon EFS
• d.Amazon DynamoDB

Amazon Redshift is a managed, petabyte-scale data warehouse optimized for analytical queries using columnar storage and parallel processing. It is designed for business intelligence workloads rather than transactional processing.

A company needs a dedicated, private network connection from its on-premises data center to AWS that bypasses the public internet. Which service should it use?

• a.Amazon CloudFront
• b.Amazon SNS
• c.AWS Direct Connect✓
• d.Amazon Route 53

AWS Direct Connect establishes a dedicated private network connection between on-premises and AWS, providing more consistent network performance than the public internet. It is often used for large data transfers and hybrid architectures.

Which option lets you create an encrypted connection over the public internet between your on-premises network and your VPC?

• a.An Elastic IP address
• b.Amazon CloudFront distribution
• c.AWS Site-to-Site VPN✓
• d.S3 Transfer Acceleration

AWS Site-to-Site VPN creates an encrypted tunnel over the internet between your network and your VPC. Unlike Direct Connect, it uses the public internet but is quick to set up and encrypted.

Which purchasing option is best for a fault-tolerant, flexible workload that can handle interruptions and wants the lowest EC2 price?

• a.Reserved Instances with no flexibility
• b.Dedicated Hosts
• c.On-Demand Instances
• d.Spot Instances✓

Spot Instances let you use spare EC2 capacity at steep discounts but can be reclaimed by AWS with short notice. They are ideal for fault-tolerant, flexible workloads such as batch processing.

Which AWS database service is MySQL- and PostgreSQL-compatible and offers higher performance and availability as part of RDS?

• a.Amazon ElastiCache
• b.Amazon DynamoDB
• c.Amazon Neptune
• d.Amazon Aurora✓

Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, offering greater throughput and built-in high availability compared to standard engines. It is part of the Amazon RDS family.

Which service provides in-memory caching to improve the performance of read-heavy applications, supporting engines like Redis and Memcached?

• a.Amazon ElastiCache✓
• b.Amazon EFS
• c.Amazon RDS
• d.Amazon Redshift

Amazon ElastiCache provides managed in-memory data stores using Redis or Memcached to reduce latency and offload databases. It is commonly used to cache frequently accessed data for faster reads.

Which S3 storage class is designed for long-term archival where retrieval times of minutes to hours are acceptable at very low cost?

• a.S3 Intelligent-Tiering
• b.S3 Standard
• c.S3 Standard-Infrequent Access
• d.S3 Glacier✓

The S3 Glacier storage classes are designed for low-cost, long-term archival where data is accessed rarely and some retrieval delay is acceptable. S3 Standard, by contrast, is for frequently accessed data with immediate retrieval.

Which S3 feature automatically moves objects between access tiers based on changing access patterns to optimize cost?

• a.S3 Intelligent-Tiering✓
• b.S3 Versioning
• c.S3 Cross-Region Replication
• d.S3 Transfer Acceleration

S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing storage costs without performance impact or operational overhead. It is useful when access patterns are unknown or changing.

A team wants to run Docker containers on AWS without managing the underlying EC2 servers. Which combination is most appropriate?

• a.Amazon ECS or EKS with AWS Fargate✓
• b.Amazon RDS with EBS
• c.Amazon Route 53 with CloudFront
• d.Amazon SNS with SQS

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, removing the need to provision or manage EC2 instances. It lets teams run containers while AWS handles the underlying infrastructure.

Which service can migrate large amounts of data into AWS by shipping a physical, ruggedized storage device when network transfer would be too slow?

• a.Amazon S3 Transfer Acceleration
• b.Amazon CloudFront
• c.AWS Direct Connect
• d.AWS Snowball✓

AWS Snowball is a physical data transport device used to move large datasets into or out of AWS when transferring over the network would take too long or be too costly. AWS ships the device, you load data, and return it for import.

Which statement correctly describes edge locations in the AWS global infrastructure?

• a.They replace Availability Zones
• b.They are where the root user signs in
• c.They are sites used to cache content closer to users, primarily for services like CloudFront✓
• d.They are used only for storing relational databases

Edge locations are part of the content delivery network and cache content closer to end users to reduce latency. They are distinct from Regions and Availability Zones, which host the core compute and storage infrastructure.

Which service allows you to register domain names and configure routing policies such as latency-based or weighted routing?

• a.Amazon EBS
• b.AWS CloudFormation
• c.Amazon Route 53✓
• d.Amazon VPC

Amazon Route 53 supports domain registration and advanced DNS routing policies, including latency-based, weighted, geolocation, and failover routing. This helps direct users to the best endpoint for their needs.

What is the main advantage of a serverless architecture using services like Lambda and DynamoDB?

• a.You focus on code and data while AWS manages provisioning and scaling of the infrastructure✓
• b.You pay a fixed monthly fee regardless of usage
• c.You must manually patch and scale servers
• d.You cannot integrate with other AWS services

Serverless services remove the need to provision, patch, and scale servers, letting developers focus on application logic while AWS handles the underlying infrastructure. Billing is typically based on actual usage rather than pre-provisioned capacity.

Which compute option provides physically dedicated servers for a customer, often used to meet licensing or compliance requirements?

• a.Amazon EC2 Dedicated Hosts✓
• b.Amazon S3
• c.Spot Instances
• d.AWS Lambda

Amazon EC2 Dedicated Hosts provide physical servers dedicated to a single customer, which can help address software licensing that is tied to physical cores or specific compliance needs. They give visibility and control over the underlying hardware.

Which support plan is the minimum required to get a designated Technical Account Manager (TAM) and concierge support?

• a.Business
• b.Enterprise✓
• c.Basic
• d.Developer

The Enterprise Support plan includes a designated Technical Account Manager and access to the concierge support team, along with the fastest response times. The Business plan offers 24/7 technical support but not a dedicated TAM.

Which AWS pricing model lets you pay for compute or database capacity by the hour or second with no long-term commitment?

• a.On-Demand pricing✓
• b.Spot pricing only
• c.Reserved Instance pricing
• d.Savings Plans only

On-Demand pricing charges for capacity by the hour or second with no upfront payment or long-term commitment, making it ideal for short-term or unpredictable workloads. Reserved Instances and Savings Plans trade commitment for lower prices.

Which purchasing option offers significant discounts in exchange for a one- or three-year commitment to a consistent amount of compute usage?

• a.Spot Instances
• b.Savings Plans✓
• c.Dedicated Hosts billed hourly
• d.On-Demand Instances

Savings Plans offer lower prices in return for committing to a consistent amount of compute usage (measured in dollars per hour) over a one- or three-year term. Reserved Instances offer a similar trade-off tied to specific instance attributes.

Which tool provides a free estimate of the cost of an AWS architecture before you deploy it?

• a.AWS Pricing Calculator✓
• b.AWS Cost and Usage Report
• c.AWS Cost Explorer
• d.AWS Budgets

The AWS Pricing Calculator lets you model a proposed architecture and estimate its monthly cost before deploying. Cost Explorer and the Cost and Usage Report, by contrast, analyze actual historical spend.

Which feature of AWS Organizations combines the usage of multiple accounts so they can share volume pricing discounts and receive a single bill?

• a.Consolidated billing✓
• b.Elastic Load Balancing
• c.Cross-Region replication
• d.Service control policies

Consolidated billing in AWS Organizations aggregates usage across member accounts into one bill and can qualify the group for volume discounts. It simplifies payment while still allowing per-account cost tracking.

Which service lets you set custom cost or usage thresholds and receive alerts when spending is forecast to exceed them?

• a.AWS CloudFormation
• b.AWS Budgets✓
• c.Amazon Inspector
• d.AWS Artifact

AWS Budgets lets you define custom budgets for cost or usage and receive alerts when actual or forecasted amounts exceed your thresholds. This helps teams proactively control spending.

Which tool helps you visualize, understand, and analyze your AWS costs and usage over time with graphs and filtering?

• a.AWS Trusted Advisor
• b.AWS Pricing Calculator
• c.AWS Config
• d.AWS Cost Explorer✓

AWS Cost Explorer provides an interface to visualize and analyze historical and forecasted costs and usage, with filtering and grouping. It helps identify spending trends and cost drivers.

Which statement about the AWS Free Tier is correct?

• a.It only applies to enterprise customers
• b.It offers some services free within limits, including 12-month, always-free, and short-term trial offers✓
• c.It makes all AWS services free forever
• d.It requires an Enterprise Support plan

The AWS Free Tier includes three types of offers: 12-month free tiers for new accounts, always-free offers, and short-term trials. Usage beyond the specified limits is billed at standard rates.

Which support plan provides 24/7 access to cloud support engineers by phone, chat, and email, and is often the minimum recommended for production workloads?

• a.Free Tier
• b.Basic
• c.Business✓
• d.Developer

The Business Support plan offers 24/7 access to support engineers via phone, chat, and email, plus full access to Trusted Advisor checks, making it suitable for production workloads. The Developer plan offers only business-hours email access to support.

Which detailed billing artifact provides the most comprehensive, line-item data about your AWS usage and can be delivered to an S3 bucket for analysis?

• a.AWS Pricing Calculator
• b.AWS Trusted Advisor
• c.AWS Artifact
• d.AWS Cost and Usage Report (CUR)✓

The AWS Cost and Usage Report provides the most detailed, comprehensive line-item billing data available and can be delivered to Amazon S3 for analysis. It is used for deep cost analysis and chargeback reporting.

How does tagging AWS resources help with billing and cost management?

• a.Tags automatically reduce the cost of resources
• b.Tags are required before any resource can be launched
• c.Tags let you categorize resources so costs can be tracked and allocated by project, team, or environment✓
• d.Tags encrypt billing data

Cost allocation tags let you label resources so their costs can be grouped and analyzed by dimensions such as project, department, or environment. This improves visibility and enables chargeback or showback.

In which support plans is the full set of AWS Trusted Advisor checks available?

• a.No support plan includes Trusted Advisor
• b.The Business and Enterprise plans✓
• c.Only the Basic plan
• d.Only the Developer plan

The full set of Trusted Advisor checks, covering cost optimization, security, fault tolerance, performance, and service limits, is available with Business and Enterprise Support. Basic and Developer plans include only a limited subset of checks.

A company repeatedly bought too many or too few servers before it knew real demand. Which advantage of cloud computing directly addresses this?

• a.Stop guessing about capacity✓
• b.The ability to go global in minutes across Regions
• c.Massive economies of scale from aggregated demand
• d.Trading operating expense back into capital expense

In the cloud you scale up or down on demand, so you no longer over- or under-provision by guessing capacity in advance. This is one of the six advantages of cloud computing.

A gaming startup wants low latency for players in Europe and Asia without building overseas data centers. Which of the six advantages applies?

• a.Stop spending money running data centers
• b.Go global in minutes✓
• c.Benefit from massive economies of scale
• d.Increase capacity through long procurement cycles

Deploying to multiple AWS Regions lets you reach users worldwide with low latency in minutes, rather than building foreign data centers.

Why can AWS offer lower pay-as-you-go prices as more customers join the platform?

• a.Aggregated demand from many customers lowers per-unit cost✓
• b.Because AWS caps the number of customers per Region
• c.Because customers each negotiate their own hardware pricing directly
• d.Because every customer runs on isolated dedicated hardware

With hundreds of thousands of customers aggregated in the cloud, AWS achieves economies of scale that translate into lower pay-as-you-go prices.

Which advantage means you pay only for the resources you actually consume?

• a.Guaranteed flat monthly pricing regardless of how much you use
• b.A mandatory three-year commitment for all resources
• c.Unlimited capacity provided at no cost to enterprises
• d.Trade fixed expense for variable expense✓

Instead of investing heavily in data centers before knowing usage, you pay a variable expense only for resources you consume.

A company no longer wants to rack, power, and cool its own servers so it can focus on customers. Which advantage is this?

• a.Guess future capacity needs more frequently
• b.Reduce overall business agility and speed
• c.Stop running and maintaining your own data centers✓
• d.Spend more time on undifferentiated heavy-lifting tasks

Cloud removes the undifferentiated heavy lifting of running data centers, freeing teams to focus on customers and differentiating work.

A team can obtain new IT resources in minutes instead of weeks. Which advantage of cloud computing is this?

• a.Benefit from massive economies of scale
• b.Increase speed and agility✓
• c.Trade variable expense for fixed expense
• d.Go global in minutes

Cloud agility means resources are available almost instantly, dramatically cutting the time to make them available to developers.

When comparing on-premises with cloud, which cost concept accounts for hardware, power, cooling, staff, and space over time?

• a.Gross margin
• b.Marginal utility
• c.Total cost of ownership (TCO)✓
• d.An elastic amortization schedule

TCO captures all direct and indirect infrastructure costs; cloud often lowers TCO by removing data-center overhead and shifting to pay-as-you-go.

Buying servers outright before you know how much you will use them is an example of what?

• a.A pay-as-you-go usage charge
• b.A variable operating expense
• c.A consumption-based metered cost
• d.A capital expenditure (CapEx)✓

CapEx is an upfront fixed purchase of assets like servers. Cloud replaces much CapEx with OpEx that scales with actual use.

Which cost-optimization practice lowers spend by matching instance types and sizes to the actual workload requirements?

• a.Right-sizing resources✓
• b.Always buying the largest instances available
• c.Over-provisioning for safety
• d.Paying upfront for unused reserved capacity indefinitely

Right-sizing selects the least expensive resource that still meets performance needs, a core cost-optimization practice.

What is the main financial advantage of the pay-as-you-go model?

• a.You pay only for resources you consume✓
• b.You prepay for maximum peak capacity for the entire year regardless of use
• c.You must reserve all capacity three years in advance
• d.You are billed one fixed enterprise fee each month

Pay-as-you-go converts large fixed costs into variable costs that rise and fall with usage, avoiding paying for idle capacity.

What is the primary purpose of the AWS Cloud Adoption Framework (CAF)?

• a.To automatically provision and scale EC2 instances for you
• b.To encrypt all customer data at rest using managed keys
• c.To guide organizations through cloud adoption✓
• d.To monitor application performance logs in real time

The AWS CAF provides guidance and best practices across business and technical perspectives to help plan a successful cloud transformation.

The AWS Cloud Adoption Framework organizes guidance into how many foundational capability perspectives?

• a.Six✓
• b.Ten
• c.Three
• d.Twelve

The CAF has six perspectives: Business, People, Governance, Platform, Security, and Operations.

Which three CAF perspectives focus on business capabilities rather than technical ones?

• a.Platform, Security, and Operations
• b.Reliability, Security, and Cost
• c.Compute, Storage, and Networking
• d.Business, People, and Governance✓

In the CAF, Business, People, and Governance address business capabilities, while Platform, Security, and Operations address technical capabilities.

Under the AWS CAF, which perspective helps you achieve the confidentiality, integrity, and availability of data and workloads?

• a.The People perspective
• b.The Business perspective
• c.The Security perspective✓
• d.The Operations perspective

The CAF Security perspective helps structure the selection and implementation of controls to protect data and meet compliance goals.

Which CAF perspective focuses on culture, organizational structure, leadership, and workforce skills for cloud adoption?

• a.Platform
• b.Governance
• c.People✓
• d.Operations

The People perspective bridges technology and business, addressing culture, roles, and the skills needed to adopt cloud successfully.

In AWS migration planning, the '6 R's' (or 7 R's) are a set of what?

• a.Application migration strategies✓
• b.The available AWS Support plan tiers
• c.Security and compliance certification frameworks
• d.The pillars of the Well-Architected Framework

The 6/7 R's (Rehost, Replatform, Repurchase, Refactor, Retire, Retain, and Relocate) describe strategies for migrating applications to the cloud.

Moving an application to AWS with little or no change, often called 'lift and shift,' is which migration strategy?

• a.Refactor
• b.Retire
• c.Rehost✓
• d.Repurchase

Rehosting (lift and shift) moves an application as-is to the cloud, typically the fastest strategy and a common first step before later optimization.

Making a few cloud optimizations, such as moving a database to Amazon RDS, without changing the core architecture is called what?

• a.Retiring the application entirely
• b.Retaining it on-premises for now
• c.Repurchasing a SaaS replacement
• d.Replatforming✓

Replatforming ('lift and reshape') makes targeted optimizations while keeping the application's core architecture intact.

Replacing a self-managed application by moving to a different product, often a SaaS offering ('drop and shop'), is which strategy?

• a.Repurchase✓
• b.Refactor
• c.Retain
• d.Rehost

Repurchasing means switching to a different, often SaaS, product, for example moving from a self-hosted CRM to a subscription CRM.

During a migration assessment you find applications that are no longer needed. Which strategy applies?

• a.Repurchase equivalent SaaS tools
• b.Rehost them on EC2
• c.Retire them✓
• d.Refactor them into microservices

Retire means decommissioning applications that provide no value, reducing cost and the migration surface area.

Which migration strategy means keeping certain applications in their current environment for now, perhaps to revisit later?

• a.Retain✓
• b.Replatform onto managed services
• c.Rehost onto right-sized EC2 instances
• d.Repurchase a SaaS equivalent

Retain (sometimes 'revisit') keeps an application where it is, useful when there is no immediate business case to migrate it yet.

Re-architecting an application to be cloud-native, such as breaking a monolith into serverless microservices, is which strategy?

• a.Rehosting with no code changes at all
• b.Retiring the workload permanently
• c.Retaining it unchanged on-premises
• d.Refactoring✓

Refactoring (re-architecting) significantly changes an application to take full advantage of cloud-native features; it usually costs the most effort but can yield the biggest benefits.

What is the main purpose of the AWS Well-Architected Framework?

• a.To provision and patch all infrastructure automatically for you
• b.To eliminate the need for any monitoring or logging tools
• c.To guide building secure, reliable, efficient workloads✓
• d.To automatically bill customers for every architecture review performed

The Well-Architected Framework offers best practices across six pillars to help design and operate reliable, secure, efficient, cost-effective, and sustainable systems.

How many pillars does the AWS Well-Architected Framework currently have?

• a.Nine
• b.Twelve
• c.Six✓
• d.Four

The six pillars are operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Which pillar focuses on running and monitoring systems and continually improving processes and procedures?

• a.Reliability
• b.Cost optimization
• c.Operational excellence✓
• d.Performance efficiency

Operational excellence covers running, monitoring, and continuously improving operations, using practices like operations as code and small, frequent changes.

Protecting information and systems through confidentiality, integrity, and privilege management falls under which pillar?

• a.Reliability
• b.Security✓
• c.Performance efficiency
• d.Sustainability

The security pillar covers protecting data, systems, and assets, including identity management, detective controls, and data protection.

Which Well-Architected best practice improves reliability by assuming components will fail?

• a.Design for failure with automated recovery✓
• b.Avoid redundancy entirely to minimize monthly cost
• c.Manually restart the system after every component fault
• d.Consolidate everything onto one large server for simplicity

Anticipating failure with redundancy and automated recovery lets systems withstand component failures, a key reliability practice.

Using auto scaling so you no longer over- or under-provision enables which Well-Architected design principle?

• a.Keep infrastructure static
• b.Stop guessing capacity✓
• c.Increase manual capacity planning
• d.Refuse to test at scale

With cloud automation you add or remove capacity to match demand, so you stop guessing and avoid paying for idle or under-sized resources.

Adopting a consumption model and measuring overall efficiency are practices in which pillar?

• a.Cost optimization✓
• b.Operational excellence
• c.Reliability
• d.Security

Cost optimization includes adopting a consumption model, measuring efficiency, and stopping spend on undifferentiated heavy lifting.

Maximizing utilization of provisioned resources to reduce energy use supports which pillar?

• a.Security
• b.Reliability
• c.Performance efficiency
• d.Sustainability✓

The sustainability pillar reduces the environmental impact of workloads, such as by maximizing utilization and choosing efficient resources and Regions.

Which factor is NOT typically a reason to choose one AWS Region over another?

• a.The color scheme of the AWS Console✓
• b.Availability of specific services in that Region
• c.Data residency and compliance requirements
• d.Proximity to end users to reduce latency

You choose Regions based on latency, compliance and data residency, service availability, and cost, not cosmetic factors.

To design for high availability within a Region, across how many Availability Zones should you distribute resources?

• a.Exactly one AZ per Region
• b.At least two AZs✓
• c.Zero AZs
• d.A single AZ is sufficient

Deploying across at least two Availability Zones lets a workload survive the failure of one AZ, since AZs are physically isolated.

Amazon CloudFront primarily uses which part of the AWS global infrastructure to cache content near users?

• a.Local storage gateways
• b.Edge locations✓
• c.Availability Zones
• d.Dedicated Hosts

Edge locations (points of presence) cache content close to users to lower latency for CloudFront and speed up DNS with Route 53.

Which infrastructure option places compute and storage closer to a specific large metro area for single-digit-millisecond latency?

• a.Reserved Instances
• b.S3 Glacier
• c.AWS Artifact
• d.AWS Local Zones✓

AWS Local Zones extend a Region to place latency-sensitive resources near large metro areas, useful for media, gaming, and real-time applications.

A regulated customer must keep some workloads physically on-premises but wants AWS services and APIs there. Which offering fits?

• a.AWS Global Accelerator
• b.Amazon CloudFront
• c.Amazon Route 53
• d.AWS Outposts✓

AWS Outposts brings AWS infrastructure and services to your own data center, supporting hybrid workloads that must remain on-premises.

Why are Availability Zones within a Region physically separated by a meaningful distance?

• a.So all zones can share one common power source
• b.To force every network request through a single building
• c.So one AZ's disaster is unlikely to impact the others✓
• d.To deliberately increase network latency between the zones

AZs are far enough apart to be isolated from disasters yet close enough for low-latency links, enabling both resilience and synchronous replication.

Which AWS service is global rather than tied to a single Region?

• a.Amazon EC2
• b.AWS IAM✓
• c.Amazon EBS
• d.Amazon RDS

IAM is a global service; users, roles, and policies are not confined to one Region, whereas EC2, RDS, and EBS are Regional or zonal.

How does the cloud lower the cost of failure for new experiments?

• a.By requiring lengthy hardware approval cycles before testing
• b.By forcing a multi-year commitment before any experiment begins
• c.Resources are provisioned quickly and released when done✓
• d.By charging a large penalty whenever resources are deleted

Fast provisioning and release mean a failed experiment costs little, encouraging rapid, low-risk innovation.

Which cloud characteristic means usage is monitored, controlled, and reported so you can be billed for exactly what you use?

• a.Rapid elasticity
• b.Measured service✓
• c.Resource pooling
• d.Broad network access

Measured service meters usage transparently, enabling pay-as-you-go billing and giving both provider and customer visibility into consumption.

Which cloud characteristic describes AWS serving many customers from a shared pool of physical resources, abstracted from the customer?

• a.Measured, metered service billing
• b.On-demand self-service provisioning through the console
• c.Rapid elasticity that scales in and out automatically
• d.Resource pooling✓

Resource pooling lets AWS serve many tenants from shared, dynamically assigned physical resources while keeping each customer logically isolated.

Which CAF perspective helps you manage and measure cloud investments, control risk, and align cloud spend with business outcomes?

• a.Governance✓
• b.People
• c.Operations
• d.Platform

The Governance perspective orchestrates cloud initiatives while maximizing value and minimizing risk, covering portfolio, program, and financial management.

Which CAF perspective helps build an enterprise-grade, scalable cloud platform and modernize workloads?

• a.Governance
• b.Business
• c.People
• d.Platform✓

The Platform perspective focuses on building a scalable hybrid cloud platform and modernizing existing and new workloads.

Ensuring cloud services are delivered and operated at a level that meets business needs falls under which CAF perspective?

• a.Security
• b.People
• c.Operations✓
• d.Business

The Operations perspective ensures cloud services are delivered and operated reliably to meet business requirements, including observability and incident management.

In an on-premises model, who bears the risk of buying too much or too little capacity?

• a.No one, because capacity is automatic
• b.The end users of the application
• c.The hardware manufacturer that originally supplied the physical servers
• d.The organization that owns the data center✓

On-premises, the organization must forecast and buy capacity, bearing the cost of over- or under-provisioning; the cloud shifts this to elastic consumption.

What distinguishes elasticity from basic scalability?

• a.Elasticity scales capacity out and back in automatically✓
• b.Elasticity applies exclusively to object storage services
• c.Elasticity means the capacity level can never change at all
• d.Elasticity can only ever add capacity, never remove it

Scalability is the capacity to grow; elasticity adds and removes resources automatically in response to real-time demand.

A service with 'four nines' availability is designed to be up about what percentage of the time?

• a.90%
• b.9.9%
• c.99.99%✓
• d.50%

'Four nines' means 99.99% availability, roughly 52 minutes of downtime per year; more nines mean less allowable downtime.

In disaster-recovery planning, what does Recovery Time Objective (RTO) measure?

• a.The target time to restore service after disruption✓
• b.The total monthly cost of storing all backups offsite
• c.The number of Availability Zones available in a given Region
• d.The maximum acceptable amount of data loss measured in time

RTO is how quickly you must recover service after an outage; RPO, by contrast, is how much data loss in time is acceptable.

What does Recovery Point Objective (RPO) describe?

• a.The maximum acceptable data loss, in time✓
• b.The hourly on-demand price of an EC2 instance type
• c.The total number of concurrent users a given system can support
• d.How fast the network can transfer data between Regions worldwide

RPO defines how much recent data you can afford to lose, guiding backup and replication frequency.

Why is the cloud's variable-cost model especially valuable to a new startup?

• a.It avoids large upfront hardware spending to launch✓
• b.It contractually guarantees the startup will become profitable
• c.It requires purchasing three full years of capacity upfront
• d.It removes the need to write or maintain any software

Startups can launch without buying data centers, paying only as they grow, freeing capital and reducing risk.

'Performing operations as code' is a design principle of which pillar?

• a.Performance efficiency and cost optimization considered together as one
• b.Sustainability
• c.Operational excellence✓
• d.Cost optimization

Operational excellence encourages defining operations as code so procedures are consistent, repeatable, and can be triggered automatically.

Which reliability design principle uses monitoring to trigger remediation from failure?

• a.Avoid horizontal scaling
• b.Test only in production without monitoring
• c.Automatically recover from failure✓
• d.Provision infrastructure manually

Reliability best practices include automatically recovering from failure by monitoring key indicators and triggering remediation.

Which performance-efficiency practice involves trying new instance types, storage, or services to find the best fit?

• a.Never change the initial choice
• b.Always buy the largest resource
• c.Experiment more often using on-demand resources✓
• d.Always provision the largest possible instances regardless of the workload

Performance efficiency encourages experimenting with different resource types and configurations to keep matching technology to the workload.

Which of the following is one of the six advantages of cloud computing described by AWS?

• a.Eliminate all customer security responsibilities entirely
• b.Guarantee zero downtime and zero failures forever
• c.Remove the need to write any application code
• d.Benefit from economies of scale✓

The six advantages include economies of scale, trading capital for variable expense, stopping capacity guessing, increasing agility, avoiding data-center spend, and going global in minutes.

Which is a common reason an organization adopts a hybrid cloud model?

• a.To keep some data on-premises for latency or compliance✓
• b.To avoid using any AWS or cloud services whatsoever
• c.To eliminate its corporate network infrastructure completely
• d.To intentionally make all of its data publicly accessible online

Hybrid architectures keep sensitive or latency-critical workloads on-premises while extending to the cloud for scale and new capabilities.

Running an application entirely on AWS with no on-premises components is best described as which deployment model?

• a.Multi-tenant colocation
• b.Hybrid
• c.Cloud (all-in)✓
• d.On-premises

A cloud (or all-in) deployment runs entirely in the cloud, versus hybrid (mixed) or on-premises (private) models.

What is a key benefit of choosing AWS managed services over self-managing the same software?

• a.You must manually patch the underlying operating system yourself
• b.You permanently lose the ability to scale the workload
• c.You must give up all encryption and data-protection options
• d.AWS handles patching, backups, and scaling for you✓

Managed services offload operational heavy lifting so teams focus on business logic instead of infrastructure.

The AWS CAF describes transformation across domains such as technology, process, organization, and what else?

• a.Product✓
• b.Geography
• c.Weather
• d.Currency

The CAF identifies four transformation domains: technology, process, organization, and product.

Turning off non-production environments (like dev and test) outside business hours is an example of what?

• a.A reduction in the security posture of the account
• b.The migration strategy formally known as Retire
• c.Cost optimization by cutting idle-resource spend✓
• d.A deliberate increase in capital expenditure over time

Shutting down idle resources aligns spend with actual need, a core cost-optimization tactic enabled by the cloud's on-demand model.

Which AWS tool lets you review your workloads against Well-Architected best practices and get improvement guidance?

• a.AWS Snowball
• b.AWS Pricing Calculator
• c.AWS Well-Architected Tool✓
• d.Amazon Inspector

The AWS Well-Architected Tool guides you through questions per pillar, identifies risks, and recommends improvements for your workloads.

How does increased agility from the cloud create business value?

• a.By helping teams deliver features and adapt faster✓
• b.By locking every team into fixed annual infrastructure plans
• c.By requiring substantially more upfront hardware capacity planning
• d.By deliberately slowing product releases for extra safety review

Agility lets organizations experiment, iterate, and ship faster, turning IT speed into competitive advantage.

Which statement about the AWS global infrastructure is accurate?

• a.A single Availability Zone spans several different Regions
• b.Each Region is made up of exactly one single data center
• c.Regions each contain multiple Availability Zones✓
• d.Edge locations fully replace Availability Zones for compute

The infrastructure is Regions (geographic areas) containing Availability Zones (isolated data-center clusters), plus a large network of edge locations.

A European company must keep customer data within the EU. What does the AWS global infrastructure let it do?

• a.Store all of its data exclusively at network edge locations
• b.Rely entirely on AWS to choose the Region on their behalf
• c.Automatically relocate data anywhere in the world for speed
• d.Select an EU Region so data resides there✓

Customers control which Region stores their data, so they can meet data-residency and compliance requirements by choosing an in-region location.

Compared with communication between two AWS Regions, communication between Availability Zones in the same Region generally has what?

• a.Higher latency
• b.Identical latency to cross-continent links
• c.Lower latency✓
• d.No connectivity at all

AZs in a Region are linked by high-bandwidth, low-latency networking, so intra-Region AZ traffic is faster than cross-Region traffic.

Choosing a Region powered by renewable energy and consolidating workloads to raise utilization supports which pillar?

• a.Sustainability✓
• b.Cost optimization only
• c.Security
• d.Reliability

The sustainability pillar considers environmental impact, including selecting efficient Regions and maximizing utilization.

The AWS CAF describes a transformation journey with phases such as Envision, Align, Launch, and what?

• a.Refactor
• b.Retire
• c.Scale✓
• d.Rehost

The CAF transformation phases are Envision, Align, Launch, and Scale, moving from identifying opportunities to delivering and then expanding cloud value.

Removing 'undifferentiated heavy lifting' primarily allows an organization to do what?

• a.Substantially increase its data-center operations staffing
• b.Spend considerably more time managing physical server hardware
• c.Focus more on work that differentiates the business✓
• d.Deliberately slow the pace of product development work

Offloading commodity infrastructure work lets teams invest effort in the products and features that set the business apart.

Auto Scaling combined with pay-as-you-go pricing primarily helps a business achieve what?

• a.Fixed spending regardless of demand
• b.Cost that closely follows actual demand✓
• c.Permanent over-provisioning of capacity
• d.Guaranteed lowest price only for reserved terms

Elastic scaling with usage-based pricing means you provision to match demand, so cost rises and falls with real usage rather than a fixed peak.

Which operational-excellence practice reduces risk when improving a system?

• a.Never test any changes before releasing to users
• b.Change every component simultaneously in production
• c.Deploy large, infrequent changes all at once each quarter
• d.Make small, reversible changes often✓

Frequent, small, reversible changes limit blast radius and make it easy to roll back.

Which design increases the risk to reliability?

• a.Automating detection and recovery from failures
• b.Using a load balancer in front of several healthy targets
• c.Relying on one server with no redundancy✓
• d.Distributing the workload across multiple Availability Zones

A single point of failure with no redundancy undermines reliability; distributing across AZs and automating recovery are the recommended alternatives.

Which of the following is NOT a benefit of cloud computing as described by AWS?

• a.The ability to deploy and go global within minutes
• b.Removing the customer's duty to secure their own data✓
• c.Increased overall speed and business agility in delivery
• d.Trading upfront capital expense for variable operating expense

Security is a shared responsibility; customers always remain responsible for securing their data. The others are genuine cloud benefits.

Under the shared responsibility model, AWS is responsible for 'security ___ the cloud,' while the customer is responsible for 'security ___ the cloud.'

• a.around; through
• b.of; of
• c.in; of
• d.of; in✓

AWS secures the cloud infrastructure ('of the cloud'); customers secure what they put in it ('in the cloud'), including data, configuration, and access.

Which of these is always the customer's responsibility regardless of which AWS service is used?

• a.Managing their data, including classification and encryption choices✓
• b.Securing the global network backbone
• c.Maintaining the physical data-center hardware
• d.Maintaining the physical data-center hardware and the underlying hypervisor software

The customer always owns their data and its protection; AWS never assumes responsibility for how customers classify, encrypt, or grant access to data.

For Amazon S3, which security task remains with the customer under the shared responsibility model?

• a.Replacing failed physical storage drives
• b.Configuring bucket policies, access controls, and encryption settings✓
• c.Maintaining the storage facility power
• d.Replacing failed physical storage drives and maintaining the facility power and cooling

With S3, AWS manages the infrastructure and service, but customers must configure access (bucket policies, Block Public Access, IAM) and choose encryption.

Under the shared responsibility model, patching the guest operating system on an EC2 instance is whose responsibility?

• a.AWS's alone
• b.The Region operator's
• c.The customer's✓
• d.No one's; it is fully automatic

For EC2 (IaaS), the customer manages the guest OS, including patches; AWS manages the hypervisor and physical host.

For a fully managed service like AWS Lambda, how does the customer's responsibility differ from EC2?

• a.The customer must patch the underlying servers themselves
• b.The customer must patch the underlying servers, manage the hypervisor, and secure the physical hosts
• c.AWS manages the OS and runtime patching; the customer focuses on code and permissions✓
• d.Responsibility is identical to on-premises hosting

The more managed the service, the more AWS handles; for Lambda, AWS patches the OS and runtime, leaving code, data, and IAM to the customer.

Configuring a security group to restrict inbound traffic to an EC2 instance is whose responsibility?

• a.Shared equally with the ISP
• b.The hardware vendor's
• c.AWS's
• d.The customer's✓

Firewall configuration such as security groups is part of security 'in the cloud,' which the customer controls.

Which task belongs to AWS under the shared responsibility model?

• a.Setting IAM password policies
• b.Encrypting customer application data
• c.Setting IAM password policies and configuring multi-factor authentication for every user
• d.Physical and environmental controls of data centers✓

AWS is responsible for the physical facilities, hardware, and environmental controls; identity and data-protection choices are the customer's.

Who is responsible for the durability of the underlying Amazon S3 infrastructure?

• a.A third-party auditor
• b.The customer
• c.The end user
• d.AWS✓

AWS manages and is responsible for the resilient infrastructure delivering S3's durability; the customer secures what they store and how access is granted.

Which statement about the shared responsibility model is TRUE?

• a.The customer is responsible for everything in all cases
• b.AWS is responsible for everything in all cases
• c.The exact split depends on the specific AWS service being used✓
• d.AWS is responsible for absolutely everything, including the customer's own data and access controls

Responsibility shifts by service type: IaaS puts more on the customer, while managed and serverless services shift more to AWS.

Encrypting sensitive data before storing it and controlling who can access it is an example of which side of the model?

• a.Security of the cloud, which is understood to be entirely AWS's responsibility in every case
• b.Neither party's responsibility
• c.Security in the cloud (customer)✓
• d.The Region's responsibility

Data-protection choices such as encryption and access control are the customer's responsibility, 'in the cloud.'

Who is responsible for decommissioning and physically destroying failed storage media in AWS data centers?

• a.The account's IAM administrator
• b.The customer
• c.The customer's external auditor
• d.AWS✓

AWS handles secure decommissioning and physical destruction of storage media as part of securing the infrastructure.

In the shared responsibility model, which control do customers 'inherit' from AWS?

• a.Customer IAM policy design and the configuration of every security group and network ACL
• b.Customer data classification
• c.Physical and environmental data-center controls✓
• d.Application-level input validation

Customers inherit physical and environmental controls from AWS's audited data centers while retaining responsibility for their own configurations and data.

Why is assuming AWS automatically encrypts all of your data by default in every service a risky assumption?

• a.AWS charges a fee to decrypt customer data
• b.AWS forbids customers from using encryption
• c.Customers must often enable and configure encryption themselves✓
• d.AWS strictly forbids customers from applying any form of encryption to their stored data

While many services make encryption easy, enabling and configuring it is frequently the customer's responsibility; assuming it is automatic can leave data unprotected.

Which is a customer responsibility for identity and access management?

• a.Maintaining the servers that run the IAM service
• b.Creating least-privilege IAM policies and enabling MFA✓
• c.Maintaining the physical servers and networking hardware that run the global IAM service
• d.Patching the AWS Management Console backend

Customers configure IAM (users, groups, roles, policies, MFA) following least privilege; AWS operates the IAM service itself.

Configuring security groups, network ACLs, and encryption in transit for your workloads is classified as what?

• a.Something outside the model
• b.A customer responsibility in the cloud✓
• c.A responsibility that belongs entirely to AWS as part of securing the underlying infrastructure
• d.A responsibility of the DNS provider

Configuring network protection (firewalls, NACLs, TLS) for customer workloads is the customer's job, part of security in the cloud.

What are the three main types of identities you can create and manage in IAM?

• a.Stacks, templates, and drifts
• b.Regions, zones, and edges
• c.Users, groups, and roles✓
• d.Buckets, objects, and keys

IAM manages users (people or apps with long-term credentials), groups (collections of users), and roles (assumed temporarily for short-term credentials).

What is an IAM group?

• a.A collection of IAM users that share the same permissions policies✓
• b.A temporary set of credentials for applications
• c.A billing category for grouping resources
• d.A temporary set of automatically rotating credentials issued to applications and services

An IAM group lets you attach policies once and apply them to all member users; groups cannot be nested and cannot sign in.

Which statement about IAM groups is correct?

• a.Groups have their own sign-in credentials
• b.Groups can be nested inside other groups to build arbitrarily deep permission hierarchies
• c.A user can belong to multiple groups, but groups cannot contain other groups✓
• d.Groups can be nested inside other groups

Users can be members of many groups, but IAM groups cannot be nested and have no credentials of their own.

What does an IAM policy define?

• a.The physical location of the data center and the specific rack that hosts the resource
• b.The physical location of a data center
• c.The billing plan for an account
• d.Which actions are allowed or denied on which resources✓

IAM policies are JSON documents that grant or deny permissions for specific actions and resources, and are attached to users, groups, or roles.

By default, when a new IAM user is created, what permissions do they have?

• a.Full administrator access across every service and resource in the entire account
• b.None until permissions are explicitly granted✓
• c.Root-equivalent permissions
• d.Read access to all services

IAM follows an implicit deny: new users have no permissions until policies granting access are attached, embodying least privilege.

When an explicit deny and an explicit allow both apply to a request, what happens?

• a.The request is decided at random
• b.The explicit allow always wins
• c.Both are ignored and access errors out
• d.The explicit deny always wins✓

In IAM policy evaluation, an explicit deny overrides any allow; access is granted only if allowed and not explicitly denied.

What is the benefit of using an IAM role for cross-account access instead of sharing credentials?

• a.It disables logging between the accounts
• b.Trusted identities assume the role for temporary access without sharing long-term keys✓
• c.It makes both accounts share one root password
• d.It makes both accounts permanently share a single root password and set of access keys for all users

A role with a trust policy lets identities from another account assume it and receive temporary credentials, avoiding shared long-term keys.

Which IAM mechanism delivers temporary, automatically rotating credentials to an application running on an EC2 instance?

• a.The root user's console password
• b.An instance profile that provides role credentials✓
• c.A hard-coded access key file on disk
• d.A hard-coded, long-term access key file stored directly on the instance's local disk

Attaching a role via an instance profile gives the application temporary credentials from instance metadata, rotated automatically, with no static keys.

Why is multi-factor authentication (MFA) recommended for AWS sign-in?

• a.It completely replaces the need for any password when a user signs in to the account
• b.It grants administrator access faster
• c.It encrypts data at rest automatically
• d.A stolen password alone cannot grant access without the second factor✓

MFA adds a second verification factor (a device code or hardware key), so a compromised password by itself cannot be used to sign in.

Which is an IAM best practice for the AWS account root user?

• a.Create access keys with it for automation
• b.Use it for all daily administrative work
• c.Enable MFA and use it only for the few tasks that require it✓
• d.Use it for all daily administrative work and for routine automation and deployment scripts

The root user should be protected with MFA and used only for the rare tasks that require it; daily work uses least-privilege IAM identities.

Which type of IAM policy is created and maintained by AWS to cover common use cases?

• a.Customer managed policies
• b.Session policies
• c.Inline policies
• d.AWS managed policies✓

AWS managed policies are predefined by AWS for common permission sets; customer managed and inline policies are created by you for finer control.

What is an inline policy in IAM?

• a.A policy embedded directly in a single user, group, or role✓
• b.A policy that only ever affects billing data and cost-allocation reports for the account
• c.A policy shared across all Regions by default
• d.A policy AWS applies to every account automatically

An inline policy is attached to and lives with one specific identity, maintaining a strict one-to-one relationship rather than being reusable.

Which approach best follows least privilege when granting a developer access?

• a.Grant full administrator access for convenience and to avoid any future permission requests
• b.Grant only the specific permissions the developer's tasks require✓
• c.Grant full administrator access for convenience
• d.Give access to every service just in case

Least privilege means granting only the permissions needed for the job, reducing risk if credentials are compromised.

How does AWS IAM Identity Center (successor to AWS SSO) help organizations?

• a.It stores objects for static websites
• b.It removes the need for any encryption
• c.It centrally manages workforce sign-in and access across multiple AWS accounts✓
• d.It stores and serves static website objects and media files from edge locations worldwide

IAM Identity Center provides centralized single sign-on and permission management across many AWS accounts and applications.

What is the recommended alternative to long-term access keys for programmatic access where possible?

• a.Sharing the console password widely
• b.Publishing keys in code repositories
• c.Temporary credentials from IAM roles✓
• d.Using the root user's access keys

Roles provide short-lived credentials that expire automatically, reducing exposure compared with long-term access keys that persist until rotated.

In an IAM policy statement, what does the 'Action' element specify?

• a.The specific API operations being allowed or denied✓
• b.The physical Region and Availability Zone in which the target resource is located
• c.The monetary cost of the operation
• d.The physical Region of the resource

The Action element lists the service operations (for example s3:GetObject) that the statement allows or denies.

Which is TRUE about the account root user compared with IAM users?

• a.Root can be permission-restricted by group policies
• b.IAM users always have more access than root
• c.IAM users always have strictly more access to the account than the root user ever does
• d.The root user has full, unrestricted access that IAM policies cannot limit✓

The root user has complete account access and should be secured with MFA and avoided for daily tasks; IAM users receive only the permissions you grant.

What does enabling an IAM account password policy let an administrator enforce?

• a.Requirements such as minimum length, complexity, and rotation✓
• b.Managed DDoS protection for the account
• c.Automatic encryption of all S3 buckets
• d.Automatic encryption of all S3 buckets and EBS volumes created anywhere in the account

An account password policy sets rules like minimum length, character requirements, expiration, and reuse prevention for IAM users.

Why should you avoid attaching policies directly to individual users at scale?

• a.Users cannot have any policies attached to them
• b.It automatically deletes the user account
• c.Users cannot have any policies attached to them directly under any circumstances at all
• d.Managing permissions through groups and roles is easier to maintain and audit✓

Assigning permissions via groups (or roles) centralizes management and scales better than maintaining per-user policies.

An IAM role's trust policy defines what?

• a.Which principals are allowed to assume the role✓
• b.The billing account charged for the role
• c.The encryption key used by the role
• d.The Region where the role runs

A role has two parts: a permissions policy (what it can do) and a trust policy (who is allowed to assume it).

A mobile app needs users to sign in with an external identity provider and then get temporary AWS access. Which approach fits best?

• a.Embedding long-term access keys in the app
• b.Identity federation so external identities receive temporary AWS credentials✓
• c.Creating a separate long-term IAM user and password for every single application user
• d.Creating an IAM user for every single app user

Federation lets users authenticate with an external identity provider and receive temporary AWS credentials, avoiding an IAM user per person.

What credentials does an IAM user use for programmatic access via the CLI or SDK?

• a.A KMS data key
• b.An SSL certificate from ACM
• c.An access key ID and secret access key✓
• d.A console password only

Programmatic access uses access keys (ID plus secret); the console uses a password, ideally with MFA. Keys should be rotated and never hard-coded.

What is a key security reason to rotate IAM access keys regularly?

• a.It limits how long a leaked key remains usable✓
• b.It speeds up API calls
• c.It increases the account's storage limits
• d.It is required to use the Free Tier

Rotating keys reduces the window during which a compromised key is valid, a standard credential-hygiene practice.

Which IAM feature helps you find and remove unused users, keys, and permissions?

• a.The AWS Pricing Calculator
• b.Amazon CloudFront access logs that are delivered to an S3 bucket for later manual review
• c.The IAM credential report and last-used information✓
• d.Amazon CloudFront access logs

IAM provides a credential report and 'last used' data so you can identify and remove stale users, keys, and permissions.

What does combining least privilege with regular access reviews achieve?

• a.Every user gradually gains admin rights
• b.Permissions stay minimal and are tightened as needs change✓
• c.Permissions can never be changed again
• d.Every user gradually gains full administrator rights over time in an automatic fashion

Granting minimal permissions and reviewing them regularly keeps access aligned to actual needs and reduces attack surface.

Which service would help detect an EC2 instance communicating with a known malicious IP address?

• a.Amazon Macie
• b.AWS Certificate Manager
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty analyzes logs and threat intelligence to flag activity like communication with known-malicious IPs, without deploying agents.

Which service offers automatic, always-on protection against common network-layer DDoS attacks at no additional cost?

• a.AWS Shield Standard✓
• b.Amazon Inspector
• c.AWS Shield Advanced
• d.AWS WAF

Shield Standard is automatically included for all AWS customers at no extra cost; Shield Advanced adds enhanced protection for a fee.

What additional benefit does AWS Shield Advanced provide over Shield Standard?

• a.Enhanced DDoS protection, cost protection, and access to the DDoS response team✓
• b.Physical security of the data centers
• c.Automatic fixes to application code
• d.Free unlimited compute capacity

Shield Advanced adds protection against larger attacks, DDoS cost protection, and access to the Shield Response Team for an additional fee.

You need to block requests containing SQL-injection patterns before they reach your Application Load Balancer. Which service creates those rules?

• a.AWS WAF✓
• b.Amazon GuardDuty
• c.Amazon Macie
• d.AWS Config

AWS WAF filters HTTP and HTTPS requests with rules, including managed rule groups, to block common exploits on CloudFront, ALB, and API Gateway.

Which service should you use to find personally identifiable information (PII) accidentally stored in S3 buckets?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon Inspector
• d.AWS Trusted Advisor

Macie uses machine learning to discover and classify sensitive data such as PII in S3 and alerts you to exposure.

Which service automatically scans your EC2 instances and container images for known software vulnerabilities (CVEs)?

• a.Amazon Cognito
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Macie

Amazon Inspector continuously scans workloads for software vulnerabilities (CVEs) and unintended network exposure, prioritizing findings.

Which service aggregates security findings and runs automated checks against standards like CIS and PCI DSS?

• a.AWS Security Hub✓
• b.Amazon EFS
• c.AWS Direct Connect
• d.Amazon Route 53

Security Hub centralizes findings from GuardDuty, Inspector, and Macie, and runs automated checks against frameworks like CIS and PCI DSS.

Which service records API activity in your account to support security auditing and investigations?

• a.AWS WAF
• b.AWS CloudTrail✓
• c.Amazon CloudWatch metrics
• d.AWS Artifact

CloudTrail logs API calls and events, providing an audit trail of who did what, when, and from where, essential for investigations and compliance.

What is the difference between AWS CloudTrail and Amazon CloudWatch?

• a.CloudTrail encrypts data while CloudWatch stores backups
• b.CloudTrail is for billing and CloudWatch is for DNS
• c.CloudTrail records API activity for auditing; CloudWatch monitors metrics, logs, and alarms✓
• d.They are the same service under two names

CloudTrail answers 'who did what' (audit); CloudWatch answers 'how is it performing' (metrics, logs, alarms).

Which service continuously monitors and records resource configuration changes to assess compliance over time?

• a.Amazon SNS
• b.AWS Shield
• c.AWS Config✓
• d.Amazon Macie

AWS Config tracks configuration changes and evaluates resources against rules, giving a history useful for compliance and troubleshooting.

Which service uses machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events for threats?

• a.AWS Config
• b.Amazon ElastiCache
• c.AWS Artifact
• d.Amazon GuardDuty✓

GuardDuty ingests these data sources and applies ML and threat intelligence to surface findings such as compromised instances or reconnaissance.

Which service gives automated best-practice recommendations across security, cost, performance, fault tolerance, and service limits?

• a.AWS CloudFormation
• b.AWS Secrets Manager
• c.Amazon Inspector
• d.AWS Trusted Advisor✓

Trusted Advisor inspects your environment and recommends improvements across five categories, including security checks like exposed keys and open ports.

A security check flags that your S3 bucket is publicly accessible. Which feature can prevent public access at the account or bucket level?

• a.S3 Transfer Acceleration
• b.S3 Block Public Access✓
• c.S3 Requester Pays
• d.S3 Versioning

S3 Block Public Access settings override permissive policies and ACLs to keep buckets private, guarding against accidental public exposure.

Which managed service centrally configures and enforces firewall rules such as WAF and security-group policies across accounts in an organization?

• a.Amazon CloudFront
• b.AWS Snowball
• c.Amazon Athena
• d.AWS Firewall Manager✓

AWS Firewall Manager centrally applies and enforces WAF rules, Shield Advanced protections, and security-group policies across an AWS Organization.

Which service provides a managed, stateful firewall for filtering traffic entering and leaving a VPC?

• a.Amazon Macie
• b.AWS Artifact
• c.AWS Cost Explorer
• d.AWS Network Firewall✓

AWS Network Firewall is a managed, stateful firewall for VPCs, providing intrusion prevention and traffic filtering at the network perimeter.

What is a primary use of Amazon Detective?

• a.To provision virtual servers on demand
• b.To analyze and investigate the root cause of security findings✓
• c.To deliver content from edge locations
• d.To provision and automatically scale fleets of virtual servers across many Regions

Amazon Detective automatically collects and correlates data to help you analyze and investigate the root cause of potential security issues.

Which statement about AWS WAF managed rules is accurate?

• a.They fully replace the need for IAM
• b.They are used only for billing alerts
• c.They provide physical data-center security
• d.They are preconfigured rule groups maintained to address common threats✓

AWS Managed Rules for WAF offer curated, maintained rule groups, reducing the effort of writing rules yourself.

An organization wants a single, consolidated view of its security posture across many accounts. Which service is designed for this?

• a.Amazon EC2 Auto Scaling
• b.AWS Security Hub✓
• c.Amazon Redshift
• d.AWS Direct Connect

Security Hub provides a consolidated, cross-account view of security and compliance state, aggregating findings and standards checks.

Which service can filter malicious bot and scraping traffic in addition to common web exploits?

• a.AWS WAF with Bot Control✓
• b.Amazon EBS snapshots
• c.Amazon Kinesis
• d.AWS Snowmobile

AWS WAF, including its Bot Control managed rule group, can filter malicious bot traffic and common web exploits at the application layer.

In terms of security controls, what kind of service is Amazon GuardDuty?

• a.A physical control for data centers
• b.A preventive control that blocks all traffic
• c.A billing optimization control
• d.A detective control that identifies threats✓

GuardDuty is a detective control: it detects and alerts on suspicious activity but does not itself block traffic; remediation is handled separately.

What is the difference between encryption at rest and encryption in transit?

• a.At rest uses TLS while in transit uses disk encryption
• b.At rest protects stored data; in transit protects data moving across networks✓
• c.At rest is for backups and in transit is for billing
• d.They are two names for the same thing

Encryption at rest secures data on disk or storage; encryption in transit (typically TLS) secures data as it travels between systems.

Which service lets you create and control the encryption keys used to protect data, integrated across many AWS services?

• a.AWS Trusted Advisor
• b.AWS Artifact
• c.AWS Key Management Service (KMS)✓
• d.Amazon Macie

AWS KMS centrally creates, manages, and controls cryptographic keys, integrating with services like S3, EBS, and RDS for encryption at rest.

What is a benefit of using AWS KMS-managed keys for encryption?

• a.Centralized key control tied to IAM and key policies, with usage logged for audit✓
• b.Keys are stored in your application source code
• c.Keys are embedded directly in your application source code and shared with every developer
• d.It removes the need for any access control

KMS centralizes key control, ties usage to IAM and key policies, and logs key use in CloudTrail for auditing.

Which service provides dedicated, single-tenant hardware security modules for managing your own encryption keys to meet strict compliance?

• a.Amazon Cognito
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudHSM✓

AWS CloudHSM offers dedicated hardware security modules for customers needing exclusive control of keys for compliance; KMS is the more managed option.

For Amazon S3, which option encrypts objects using keys fully managed by AWS with no customer key management?

• a.Encryption only after you download objects
• b.Client-side encryption with your own library
• c.Server-side encryption with S3-managed keys (SSE-S3)✓
• d.No encryption at all

SSE-S3 has S3 manage the encryption keys and process automatically; SSE-KMS uses KMS keys, and client-side encryption is done before upload.

What is the main difference between SSE-KMS and SSE-S3 for S3 encryption?

• a.SSE-KMS uses AWS KMS keys, adding control and audit logging of key use✓
• b.There is no difference between them
• c.SSE-S3 is not actually encryption
• d.SSE-KMS stores the data unencrypted

Both encrypt at rest, but SSE-KMS uses KMS keys, adding key policies, usage permissions, and CloudTrail auditing of key use.

Which service manages and can automatically renew SSL/TLS certificates for AWS services to enable encryption in transit?

• a.AWS Config
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Macie
• d.AWS Secrets Manager

ACM provisions, manages, and auto-renews TLS certificates for services like ELB, CloudFront, and API Gateway, simplifying encryption in transit.

What does client-side encryption mean?

• a.AWS encrypts the data only after storing it
• b.The data is never actually encrypted
• c.Data is encrypted by the customer before it is sent to AWS✓
• d.Only AWS ever holds the keys

With client-side encryption you encrypt data locally before uploading, so it is already encrypted in transit and at rest, and you control the keys.

Which service is best for storing and automatically rotating database credentials and API keys?

• a.Amazon GuardDuty
• b.AWS Artifact
• c.AWS Shield
• d.AWS Secrets Manager✓

Secrets Manager securely stores secrets and can automatically rotate them (for example RDS credentials), removing hard-coded secrets from code.

How does AWS Systems Manager Parameter Store relate to storing configuration and secrets?

• a.It provisions and manages fleets of physical servers dedicated entirely to your workloads
• b.It securely stores configuration data and secrets, optionally encrypted with KMS✓
• c.It replaces the need for IAM roles
• d.It provisions physical servers on demand

Parameter Store holds configuration values and secrets (SecureString via KMS); Secrets Manager adds built-in rotation for secrets specifically.

A customer needs full ownership and control of key material for regulatory reasons, with dedicated hardware. Which is most appropriate?

• a.Amazon CloudFront
• b.AWS Trusted Advisor
• c.SSE-S3
• d.AWS CloudHSM✓

CloudHSM provides dedicated hardware security modules giving customers exclusive control of keys for strict compliance; managed KMS is simpler but shared.

Why is encrypting data both at rest and in transit considered defense in depth?

• a.It protects data in multiple states so a single failure does not expose it✓
• b.It makes data impossible to ever read again
• c.It removes the need for any access control
• d.It is required only to use the Free Tier

Layering encryption across storage and network states means data stays protected even if one layer is bypassed, an example of defense in depth.

Which service provides on-demand downloads of AWS compliance reports such as SOC and ISO certifications?

• a.Amazon Inspector
• b.AWS Shield
• c.AWS Config
• d.AWS Artifact✓

AWS Artifact is a self-service portal to download AWS audit reports (SOC, ISO, PCI) and manage agreements, helping customers meet compliance needs.

In the shared responsibility model, AWS compliance certifications such as ISO 27001 cover what?

• a.The security and compliance of the underlying cloud infrastructure✓
• b.The customer's IAM policies
• c.The customer's application source code
• d.The customer's data classification decisions

AWS certifications attest to the infrastructure AWS manages; customers still must achieve compliance for their own workloads and data built on top.

What does AWS Organizations enable?

• a.Automatic application development
• b.Physical access to data centers
• c.Central management and consolidated billing for multiple AWS accounts✓
• d.Free unlimited compute for all accounts

AWS Organizations lets you centrally manage multiple accounts, apply policies, and consolidate billing across the organization.

What is a service control policy (SCP) in AWS Organizations?

• a.A network routing rule
• b.A guardrail that sets the maximum permissions available to member accounts✓
• c.A policy that grants permissions directly to users
• d.A billing discount agreement

SCPs define the ceiling of allowed actions for accounts or organizational units; they restrict but do not by themselves grant permissions, which IAM still does.

An SCP denies use of a service in an organizational unit, but a user there has an IAM policy allowing it. What is the result?

• a.The two cancel out and access is random
• b.Access is denied because the SCP caps the maximum allowed permissions✓
• c.The user account is automatically deleted
• d.Access is allowed because IAM overrides SCPs

Effective permissions are the intersection of SCPs and IAM policies; if an SCP denies an action, no IAM policy can grant it.

How can grouping accounts into organizational units (OUs) help governance?

• a.It gives every account root access
• b.It disables billing for the accounts
• c.It removes all IAM controls
• d.You can apply policies like SCPs to many accounts at once by OU✓

OUs let you organize accounts hierarchically and apply consistent guardrails (SCPs) to groups of accounts, simplifying governance at scale.

A healthcare company needs to review and accept the Business Associate Addendum (BAA) for HIPAA. Where can it manage that agreement?

• a.AWS Artifact✓
• b.Amazon CloudFront
• c.Amazon SQS
• d.AWS Lambda

AWS Artifact provides compliance reports and lets customers review and accept agreements such as the BAA for HIPAA.

What is a governance benefit of consolidated billing in AWS Organizations?

• a.One payer with organization-wide visibility while accounts stay isolated✓
• b.It disables CloudTrail for all accounts
• c.It makes all account data public
• d.It merges all IAM users into a single user

Consolidated billing gives one bill and organization-wide cost visibility while accounts remain isolated for security, and can earn volume discounts.

Which practice supports a strong multi-account strategy on AWS?

• a.Disabling CloudTrail organization-wide
• b.Running everything in the root account
• c.Sharing one IAM user everywhere
• d.Separating prod and dev into different accounts with SCP guardrails✓

Isolating environments into separate accounts under Organizations, with SCP guardrails and centralized logging, limits blast radius and improves governance.

AWS Compliance Programs and certifications primarily help customers do what?

• a.Avoid all of their own compliance obligations
• b.Get free AWS promotional credits
• c.Bypass encryption requirements entirely
• d.Meet their own audit requirements by relying on AWS's audited controls✓

AWS's compliance programs provide audited assurance for the infrastructure, which customers use as a foundation for their own compliance; responsibility is shared.

Which statement correctly contrasts security groups with network ACLs?

• a.NACLs are stateful and attach to instances
• b.Security groups work only at the subnet level
• c.Security groups are stateful at the instance level; NACLs are stateless at the subnet level✓
• d.Both are stateless and behave identically

Security groups are stateful instance-level firewalls (return traffic auto-allowed); NACLs are stateless subnet-level filters needing explicit rules both ways.

How does enabling Amazon S3 Versioning help protect data?

• a.It blocks all public access to the bucket
• b.It reduces storage cost to zero
• c.It preserves previous versions so you can recover from accidental deletes or overwrites✓
• d.It encrypts the entire bucket automatically

Versioning keeps prior object versions, protecting against accidental or malicious deletion and overwrites; it pairs well with MFA Delete.

What does enabling MFA Delete on an S3 bucket require?

• a.A Reserved Instance purchase
• b.A public bucket policy
• c.An MFA code to permanently delete versions or change the versioning state✓
• d.A larger EC2 instance type

MFA Delete adds a requirement for a multi-factor code before permanently deleting versions, guarding critical data against unauthorized deletion.

Which practice helps protect critical workloads against accidental data loss?

• a.Turning off encryption entirely
• b.Regular backups plus cross-Region or cross-account copies✓
• c.Storing a single copy in one AZ only
• d.Disabling all logging to save cost

Maintaining backups and copies across Regions or accounts improves durability and recoverability, supporting both reliability and data protection.

What is a security use of Amazon CloudWatch alarms?

• a.Alerting or triggering actions when metrics cross thresholds, such as unusual activity✓
• b.Physically securing the data centers and destroying decommissioned storage media on site
• c.Physically securing the data centers
• d.Provisioning IAM users automatically

CloudWatch alarms can notify teams or trigger automated responses when metrics (like failed logins or CPU spikes) breach thresholds, aiding detection.

Which combination provides an audit trail plus alerting and threat detection for account activity?

• a.Route 53 combined with CloudFront
• b.Only an S3 bucket with public access enabled
• c.CloudTrail for API logging with CloudWatch alarms and GuardDuty for detection✓
• d.EBS snapshots used entirely on their own

CloudTrail records activity, CloudWatch alarms on patterns, and GuardDuty adds ML-based threat detection, together supporting monitoring and response.

What does the principle of 'defense in depth' mean for securing AWS workloads?

• a.Granting broad permissions to move faster
• b.Applying multiple layers of security controls so no single failure is catastrophic✓
• c.Encrypting nothing in order to save cost
• d.Relying on one strong firewall and nothing else

Defense in depth layers controls (network, identity, encryption, monitoring) so that if one control fails, others still protect the workload.

A company wants to ensure only encrypted connections reach its application. Which approach helps enforce encryption in transit?

• a.Disable certificates entirely
• b.Store keys in the web page source
• c.Require HTTPS/TLS with ACM certificates and redirect HTTP to HTTPS✓
• d.Allow only unencrypted HTTP traffic

Enforcing TLS with ACM-managed certificates and redirecting HTTP to HTTPS ensures data in transit is encrypted between clients and the application.

Why does AWS offer several Amazon EC2 instance families such as compute-optimized, memory-optimized, and storage-optimized?

• a.Because each family is permanently locked to one specific AWS Region and cannot be resized or migrated later
• b.So you can match the balance of CPU, memory, and storage to your workload✓
• c.Because larger families are the only ones eligible for the Free Tier
• d.Because instance families determine which support plan you must purchase

EC2 offers purpose-built instance families so you can pick hardware that fits a workload, such as memory-optimized for in-memory databases or compute-optimized for batch processing. Choosing the right family improves performance efficiency and cost.

What is an Amazon Machine Image (AMI) used for when launching Amazon EC2 instances?

• a.It provides the template of the operating system and software used to launch an instance✓
• b.It is the DNS record that routes users to the instance
• c.It sets the maximum monthly spending limit and automatically stops the instance when that limit is reached
• d.It is the physical server that the instance runs on

An AMI is a preconfigured template containing the operating system, and optionally application software, used to launch EC2 instances. Using a custom AMI lets you launch identical instances quickly and consistently.

A workload runs a short function each time a file is uploaded to Amazon S3 and should incur no charge when idle. Which compute service fits best?

• a.Amazon EC2 Dedicated Hosts reserved for three years
• b.AWS Lambda✓
• c.An Amazon RDS database instance running continuously
• d.A fleet of always-on Amazon EC2 instances

AWS Lambda runs code in response to events, such as an S3 upload, and charges only for the requests and compute time used, with no cost while idle. This event-driven, serverless model is ideal for intermittent tasks.

Which statement best describes AWS Fargate?

• a.A service that registers domain names and manages DNS routing
• b.A managed relational database engine compatible with MySQL
• c.A serverless compute engine that runs containers without managing EC2 servers✓
• d.A ruggedized physical appliance that AWS ships to your data center to transfer very large datasets offline

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, so you run containers without provisioning or managing the underlying EC2 instances. You pay for the vCPU and memory your containers request.

A company wants to run and orchestrate Kubernetes on AWS while letting AWS manage the Kubernetes control plane. Which service should it use?

• a.Amazon EC2 Auto Scaling
• b.Amazon Simple Queue Service (SQS)
• c.AWS Elastic Beanstalk with managed container support
• d.Amazon Elastic Kubernetes Service (EKS)✓

Amazon EKS is a managed service that runs the Kubernetes control plane for you, so you can deploy and operate Kubernetes clusters without maintaining the control-plane infrastructure yourself. Amazon ECS is AWS's own container orchestrator alternative.

Which AWS service is a fully managed batch-processing service that dynamically provisions compute to run large numbers of batch computing jobs?

• a.Amazon Athena
• b.Amazon Kinesis Data Streams
• c.Amazon Lightsail
• d.AWS Batch✓

AWS Batch plans, schedules, and runs batch computing workloads, automatically provisioning the right quantity and type of compute based on job requirements. It removes the need to manually manage batch infrastructure.

A developer wants a simple way to launch a small website with a bundled virtual server, storage, and networking for a predictable low monthly price. Which service is designed for this?

• a.Amazon Redshift
• b.AWS CloudFormation
• c.Amazon Lightsail✓
• d.Amazon EMR

Amazon Lightsail offers easy-to-use virtual private servers bundled with storage and networking at a predictable monthly price, aimed at simpler workloads and users new to the cloud. It abstracts much of the configuration required with raw EC2.

In Amazon EC2, what does the instance type (for example, m5.large) primarily determine?

• a.The specific AWS Region and Availability Zone that the instance is permanently tied to for its whole life
• b.The IAM permissions granted to the instance
• c.The amount of vCPU, memory, storage, and network capacity of the instance✓
• d.The Availability Zone that will be used automatically

An EC2 instance type defines the hardware profile of the instance, including vCPUs, memory, storage, and networking performance. Selecting the right type balances performance and cost for the workload.

Which EC2 feature lets you run instances on hardware physically isolated for a single customer to help meet strict compliance or licensing rules tied to physical cores?

• a.Dedicated Hosts✓
• b.Auto Scaling groups
• c.Spot Instances
• d.Elastic IP addresses

Amazon EC2 Dedicated Hosts provide a physical server dedicated to your use, giving visibility into sockets and cores that helps with license terms and compliance. Standard shared tenancy places instances on hardware shared with other customers.

What is the main purpose of an Amazon EC2 Auto Scaling group's desired, minimum, and maximum capacity settings?

• a.To set the KMS encryption keys used for the instances' attached storage volumes and their snapshots
• b.To choose which support plan applies to the account
• c.To determine the retention period for CloudTrail logs
• d.To keep the number of running instances within defined bounds as demand changes✓

An Auto Scaling group uses minimum, maximum, and desired capacity to control how many instances run, adding or removing instances within those bounds as scaling policies trigger. This maintains availability while matching capacity to demand.

A stateless web tier needs to scale out during traffic spikes and in during quiet periods automatically. Which pair of services is most appropriate?

• a.Amazon S3 for storage combined with Amazon Glacier for archival
• b.Amazon Route 53 and AWS Artifact
• c.Elastic Load Balancing with EC2 Auto Scaling✓
• d.Amazon SNS with Amazon Cognito

Elastic Load Balancing distributes incoming traffic across instances while EC2 Auto Scaling adjusts the number of instances to match demand. Together they provide an elastic, highly available web tier.

Which statement about AWS Elastic Beanstalk is correct?

• a.It is a NoSQL database service for key-value data
• b.It only supports static websites with no server-side code
• c.You upload application code and it provisions and manages the underlying resources for you✓
• d.It requires you to manually configure every load balancer, Auto Scaling group, and security group yourself

Elastic Beanstalk is a platform service where you upload code and it automatically handles capacity provisioning, load balancing, scaling, and health monitoring. You keep full control of the underlying AWS resources if you need it.

In Amazon S3, what is a 'bucket'?

• a.A reserved compute capacity reservation
• b.A virtual network boundary for your resources
• c.A container that holds objects (files) stored in S3✓
• d.A block-level storage volume that attaches to a single EC2 instance

In Amazon S3, a bucket is the top-level container that holds objects, each identified by a unique key. Buckets are created in a specific Region and organize your stored data.

Which characteristic distinguishes object storage such as Amazon S3 from block storage such as Amazon EBS?

• a.Object storage manages data as whole objects with metadata, accessed over HTTP-based APIs✓
• b.Block storage cannot be attached to compute resources
• c.Object storage can only hold files smaller than one megabyte and cannot store any associated metadata
• d.Block storage is accessed only through a web browser

Object storage like S3 stores data as complete objects with metadata and is accessed via web APIs, making it ideal for unstructured data at scale. Block storage like EBS presents raw volumes to an instance, which the OS formats and uses like a disk.

A single Amazon EC2 instance needs a persistent, low-latency volume that behaves like an attached disk for its operating system and database files. Which service fits?

• a.Amazon Elastic Block Store (EBS)✓
• b.Amazon S3
• c.Amazon SQS
• d.Amazon Elastic File System (EFS) shared mount

Amazon EBS provides persistent block-level volumes attached to a single EC2 instance, suitable for boot volumes and databases that need low-latency disk access. The volume persists independently of the instance lifecycle.

What does an Amazon EBS snapshot allow you to do?

• a.Automatically resize the volume every hour
• b.Create a point-in-time backup of a volume that is stored durably in Amazon S3✓
• c.Convert the volume into an object storage bucket
• d.It lets you attach the same volume to hundreds of instances across many Availability Zones at once

An EBS snapshot captures a point-in-time backup of a volume and stores it durably in Amazon S3 (managed by AWS). Snapshots are incremental and can be used to restore volumes or create new ones.

Several Linux EC2 instances across multiple Availability Zones must read and write to the same file system at the same time. Which storage service supports this?

• a.An EC2 instance store volume
• b.Amazon Elastic File System (EFS)✓
• c.A single Amazon EBS volume
• d.Amazon S3 Glacier Deep Archive storage class

Amazon EFS is a managed, elastic NFS file system that many EC2 instances can mount concurrently across Availability Zones. A standard EBS volume attaches to only one instance at a time.

Which Amazon S3 storage class offers the lowest storage cost for rarely accessed archival data that can tolerate retrieval times of up to 12 hours?

• a.S3 Glacier Deep Archive✓
• b.S3 Standard-Infrequent Access
• c.S3 Standard
• d.S3 Intelligent-Tiering

S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of data accessed once or twice a year with retrieval times measured in hours. S3 Standard is priced for frequent, immediate access.

What does enabling versioning on an Amazon S3 bucket do?

• a.It converts all objects to the Glacier storage class
• b.It keeps multiple variants of an object so you can recover from unintended overwrites or deletes✓
• c.It replicates the bucket to every AWS Region
• d.It automatically deletes the older versions of every object each night in order to reduce your storage costs

S3 versioning preserves every version of an object, so overwritten or deleted objects can be recovered. It protects against accidental changes but increases storage used, since old versions are retained.

An EC2 instance store (instance-store volume) has which key characteristic that a customer should understand?

• a.It is automatically backed up to Amazon S3 Glacier every hour for long-term retention
• b.It is billed separately as an object storage bucket
• c.It can be shared simultaneously by many instances
• d.Its data is ephemeral and is lost when the instance stops or terminates✓

Instance store provides temporary block storage physically attached to the host, and its data does not persist when the instance stops, hibernates, or terminates. For persistent storage you use EBS or another durable service.

A company keeps petabytes of data on-premises and wants low-latency local access while backing the data up to AWS storage. Which service bridges on-premises applications to AWS storage?

• a.Amazon Route 53
• b.AWS Storage Gateway✓
• c.AWS Lambda
• d.Amazon Redshift data warehouse

AWS Storage Gateway connects on-premises environments to AWS storage, providing local cached access while storing data durably in services such as S3. It supports file, volume, and tape gateway configurations for hybrid storage.

Which service provides fully managed third-party file systems, such as Windows File Server (SMB) and Lustre, on AWS?

• a.Amazon S3
• b.Amazon EBS
• c.Amazon Elastic File System
• d.Amazon FSx✓

Amazon FSx provides fully managed file systems built on popular technologies like Windows File Server and Lustre, useful for Windows-based apps or high-performance computing. EFS, by contrast, provides NFS file storage primarily for Linux.

A team must move 80 TB of data into AWS but has limited internet bandwidth that would take months to upload. Which approach is most practical?

• a.Use an AWS Snow Family device to ship the data physically✓
• b.Store the data only in Amazon EBS snapshots
• c.Upload the data over your existing standard internet connection over several months
• d.Email the data to AWS Support

The AWS Snow Family provides physical, ruggedized devices you load with data and ship to AWS for import, which is far faster than uploading very large datasets over limited bandwidth. It is designed for petabyte- and terabyte-scale transfers.

What is the benefit of Amazon S3 lifecycle policies?

• a.They distribute S3 content to CloudFront edge locations around the world automatically
• b.They automatically transition or expire objects to lower-cost classes based on age✓
• c.They convert S3 buckets into EBS volumes
• d.They encrypt data only while it is in transit

S3 lifecycle policies let you define rules that automatically move objects to cheaper storage classes or delete them after a set time. This reduces cost for data whose access frequency declines predictably.

Within an Amazon VPC, what is a subnet?

• a.A dedicated physical fiber connection running directly into an AWS data center building
• b.A managed DNS zone for your domain
• c.A billing report for network usage
• d.A range of IP addresses in the VPC, tied to a single Availability Zone✓

A subnet is a segment of a VPC's IP address range that resides in one Availability Zone, and you place resources such as EC2 instances into subnets. Public and private subnets differ by whether they have a route to an internet gateway.

What is the role of an internet gateway in a VPC?

• a.It enables communication between resources in the VPC and the internet✓
• b.It automatically encrypts all data stored in Amazon S3 buckets within the VPC
• c.It provides an in-memory cache for databases
• d.It automatically scales EC2 instances

An internet gateway is a VPC component that allows communication between instances in your VPC and the internet. Public subnets route outbound traffic to the internet through it.

Instances in a private subnet need to download software updates from the internet but must not be reachable from the internet. Which component enables this?

• a.An Elastic Load Balancer in the private subnet
• b.An internet gateway attached directly to the private subnet
• c.A NAT gateway in a public subnet✓
• d.An Amazon S3 bucket policy

A NAT gateway lets instances in a private subnet initiate outbound connections to the internet (for example, for updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with a route to the internet gateway.

Which routing policy in Amazon Route 53 sends users to the endpoint that provides the lowest network latency for them?

• a.Failover routing
• b.Weighted routing
• c.Simple routing to a single resource
• d.Latency-based routing✓

Latency-based routing in Route 53 directs users to the AWS Region that gives them the lowest latency, improving performance for a global audience. Weighted and failover policies serve different traffic-distribution goals.

Beyond DNS resolution, which capability does Amazon Route 53 provide?

• a.Managed relational database backups and patching
• b.Object storage with versioning
• c.Serverless function execution
• d.Domain name registration and health checks✓

Amazon Route 53 is a DNS web service that also offers domain registration and health checking of endpoints, allowing traffic to be routed away from unhealthy targets. These features make it a full-featured DNS and traffic-management service.

How does Amazon CloudFront reduce latency for globally distributed users?

• a.By caching copies of content at edge locations near users✓
• b.By replacing the need for an origin server entirely and hosting content itself
• c.By storing all data in a single central Region
• d.By encrypting data only at rest

Amazon CloudFront is a content delivery network that caches content at edge locations worldwide, so users are served from a nearby location instead of a distant origin. This lowers latency and offloads traffic from the origin.

A company needs a private, dedicated network link between its data center and AWS with more consistent throughput than the public internet. Which service provides this?

• a.Amazon Route 53
• b.AWS Direct Connect✓
• c.Amazon CloudFront
• d.AWS Site-to-Site VPN

AWS Direct Connect establishes a dedicated, private physical connection between on-premises and AWS, offering more consistent performance and potentially lower data-transfer costs than the internet. A VPN, by contrast, is encrypted but rides over the public internet.

Which service simplifies connecting thousands of VPCs and on-premises networks through a single central hub?

• a.Amazon EFS
• b.AWS Transit Gateway✓
• c.AWS Certificate Manager
• d.Amazon CloudFront

AWS Transit Gateway acts as a central hub that connects VPCs and on-premises networks, replacing complex peering meshes with a simpler hub-and-spoke topology. It scales network connectivity across many accounts and VPCs.

What is the primary difference between a security group and a network ACL in a VPC?

• a.A security group is stateful at the instance level; a network ACL is stateless at the subnet level✓
• b.A security group only supports deny rules; a network ACL only supports allow rules
• c.There is no functional difference between them
• d.A network ACL is attached directly to individual instances while a security group is attached to whole subnets

Security groups act as stateful firewalls at the instance level, automatically allowing return traffic, while network ACLs are stateless firewalls at the subnet level that evaluate allow and deny rules in order. Both are layers of VPC network security.

Which service lets resources in a VPC reach supported AWS services privately without traversing the public internet?

• a.Amazon CloudFront distributions with signed URLs
• b.Amazon Route 53 health checks
• c.Elastic IP addresses
• d.VPC endpoints (including AWS PrivateLink)✓

VPC endpoints, powered by AWS PrivateLink for many services, let VPC resources connect privately to AWS services without an internet gateway or public IPs. This keeps traffic on the AWS network and improves security.

What does a route table in a VPC control?

• a.Where network traffic from a subnet is directed✓
• b.The encryption keys used for data at rest
• c.The number of instances in an Auto Scaling group
• d.The billing alerts for the account

A route table contains rules (routes) that determine where network traffic from a subnet or gateway is directed, such as to an internet gateway or NAT gateway. Each subnet is associated with a route table.

What does the Multi-AZ deployment option for Amazon RDS provide?

• a.A read-only replica that is used only to increase read throughput for heavy reporting queries
• b.A synchronous standby replica in another Availability Zone for automatic failover✓
• c.Automatic conversion of the database to a NoSQL engine
• d.A discount on the database instance price

RDS Multi-AZ maintains a synchronous standby in a different Availability Zone and fails over automatically if the primary fails, improving availability and durability. It is for resilience, not for scaling read traffic, which is what read replicas address.

A read-heavy application backed by Amazon RDS needs to offload read queries from the primary database. Which feature helps?

• a.A NAT gateway
• b.Multi-AZ standby
• c.RDS read replicas✓
• d.A larger EBS snapshot

RDS read replicas provide additional read-only copies that can serve read traffic, reducing load on the primary and improving read scalability. Multi-AZ, by contrast, provides a standby for failover, not for scaling reads.

Which use case is Amazon DynamoDB best suited for?

• a.Mounting a single shared POSIX-compliant file system across many Linux servers at the same time
• b.A petabyte-scale columnar analytics warehouse
• c.Complex multi-table SQL joins for reporting
• d.A high-traffic application needing single-digit millisecond key-value lookups at any scale✓

DynamoDB is a fully managed NoSQL key-value and document database delivering consistent, low-latency performance at scale, ideal for high-traffic apps with simple access patterns. Relational analytics and joins are better served by RDS or Redshift.

Amazon Aurora is best described as which of the following?

• a.A MySQL- and PostgreSQL-compatible relational database built for the cloud with high performance and availability✓
• b.A managed in-memory cache using Redis
• c.A fully managed graph database service purpose-built for highly connected datasets such as social and recommendation graphs
• d.A serverless function runtime

Amazon Aurora is a cloud-optimized relational database compatible with MySQL and PostgreSQL, offering higher throughput and built-in fault-tolerant, self-healing storage. It is part of the Amazon RDS family.

A business intelligence team needs to run complex analytical queries across billions of rows for reporting. Which service is purpose-built for this?

• a.Amazon Redshift✓
• b.Amazon RDS for MySQL
• c.Amazon DynamoDB
• d.Amazon ElastiCache

Amazon Redshift is a managed, petabyte-scale data warehouse using columnar storage and massively parallel processing, optimized for analytical (OLAP) queries. Transactional databases like RDS and DynamoDB are optimized for different workloads.

Which service provides a managed in-memory data store to reduce database load and speed up read-heavy applications?

• a.Amazon Athena
• b.Amazon ElastiCache✓
• c.Amazon Neptune
• d.Amazon Redshift Serverless

Amazon ElastiCache offers managed Redis or Memcached in-memory caches that store frequently accessed data close to the application, reducing latency and offloading the primary database. It is commonly placed in front of databases for read-heavy workloads.

A team is migrating an on-premises database to AWS and wants to minimize downtime during the move. Which service is designed to help?

• a.Amazon SNS
• b.Amazon CloudFront
• c.AWS Trusted Advisor cost and security checks
• d.AWS Database Migration Service (DMS)✓

AWS Database Migration Service migrates databases to AWS while the source remains operational, minimizing downtime, and supports both homogeneous and heterogeneous migrations. It is the standard tool for moving databases into AWS.

Which AWS service is a fully managed graph database for use cases such as social networks and recommendation engines?

• a.Amazon DynamoDB
• b.Amazon Redshift
• c.Amazon Neptune✓
• d.Amazon RDS for Oracle

Amazon Neptune is a fully managed graph database service optimized for highly connected data and queries, such as social graphs, fraud detection, and recommendation engines. It supports popular graph models and query languages.

What is a key operational advantage of using Amazon RDS instead of running a database yourself on EC2?

• a.RDS eliminates all database costs
• b.RDS automates administrative tasks such as patching, backups, and failover✓
• c.RDS lets you run any database engine ever created
• d.RDS gives you full root operating-system access so you can tune the kernel yourself

Amazon RDS handles time-consuming administration like software patching, automated backups, and failover, letting teams focus on the data and application. Running a database on EC2 leaves all of that management to the customer.

Which AWS service would you use to set an alarm that notifies you when an EC2 instance's CPU utilization stays above a threshold?

• a.Amazon CloudWatch✓
• b.AWS Artifact
• c.AWS CloudTrail audit logs
• d.Amazon Cognito

Amazon CloudWatch collects metrics such as CPU utilization and lets you create alarms that trigger notifications or actions when thresholds are breached. It is the primary monitoring and observability service on AWS.

You need to determine which user made a specific change to a resource and when it happened. Which service records this account activity?

• a.AWS Pricing Calculator
• b.Amazon CloudWatch metrics
• c.AWS CloudTrail✓
• d.Amazon S3 versioning

AWS CloudTrail records API calls and account activity, providing an audit trail of who did what, when, and from where. CloudWatch focuses on performance metrics and logs rather than API-level auditing.

What is the primary purpose of AWS CloudFormation?

• a.To define and provision AWS infrastructure from templates as code✓
• b.To store objects durably across Availability Zones
• c.To distribute content to edge locations
• d.To monitor application performance and user experience in real time

AWS CloudFormation lets you describe infrastructure in JSON or YAML templates and provision it automatically and repeatably as stacks. This infrastructure-as-code approach makes environments consistent and easy to recreate.

Which three primary methods can be used to interact with and provision AWS services?

• a.The AWS Management Console, the AWS CLI, and the AWS SDKs✓
• b.Only the AWS Management Console
• c.Only third-party automation tools that are not made or supported by AWS
• d.Only physical mail requests to AWS

You can interact with AWS through the web-based Management Console, the AWS Command Line Interface (CLI), and language-specific AWS SDKs. All three ultimately call the same AWS service APIs.

A developer wants a browser-based shell, already authenticated, to run AWS CLI commands without installing anything locally. Which service provides this?

• a.AWS Config
• b.AWS CloudFormation
• c.Amazon Inspector
• d.AWS CloudShell✓

AWS CloudShell is a browser-based shell in the console, pre-authenticated with your console credentials and preloaded with the AWS CLI and common tools. It lets you run commands without installing or configuring anything locally.

Which service continuously records and evaluates the configuration of your AWS resources to help assess compliance over time?

• a.Amazon CloudWatch
• b.AWS Config✓
• c.Amazon SNS
• d.AWS CloudShell

AWS Config records resource configurations and changes over time and can evaluate them against rules to assess compliance. It is useful for auditing, change management, and governance.

Which service helps you manage operational tasks such as patching and running commands across fleets of EC2 instances at scale?

• a.Amazon Athena
• b.Amazon Comprehend natural-language processing
• c.Amazon Neptune
• d.AWS Systems Manager✓

AWS Systems Manager provides operational tools to view and control infrastructure, including running commands, applying patches, and managing parameters across fleets of instances. It centralizes many routine operational tasks.

A large enterprise wants to centrally set up and govern a secure, multi-account AWS environment based on best practices. Which service automates this landing-zone setup?

• a.AWS Control Tower✓
• b.Amazon Macie
• c.AWS Direct Connect
• d.Amazon CloudFront

AWS Control Tower automates the setup of a well-architected, multi-account environment (a landing zone) with guardrails and best practices, built on top of AWS Organizations. It simplifies governance at scale.

What is the benefit of using infrastructure as code with services like AWS CloudFormation?

• a.It automatically writes the application's business logic
• b.It completely removes the need to pay for any of the provisioned underlying resources
• c.It prevents anyone from ever deleting resources
• d.Environments can be provisioned consistently and repeatably, reducing manual errors✓

Infrastructure as code lets you define resources in templates so environments are created the same way every time, reducing manual configuration errors and enabling version control. You still pay for whatever resources the templates provision.

Which service lets developers model cloud infrastructure using familiar programming languages such as Python or TypeScript, which then synthesizes CloudFormation templates?

• a.AWS Systems Manager Automation runbooks
• b.Amazon QuickSight
• c.AWS Cloud Development Kit (CDK)✓
• d.AWS Config

The AWS Cloud Development Kit (CDK) lets you define infrastructure using general-purpose programming languages, which it converts into CloudFormation templates for provisioning. It appeals to developers who prefer code over raw templates.

Which service is a serverless event bus that connects application components using events from AWS services, SaaS apps, and your own apps?

• a.Amazon RDS
• b.Amazon EBS
• c.Amazon EventBridge✓
• d.Amazon Elastic File System

Amazon EventBridge is a serverless event bus that routes events between AWS services, custom applications, and SaaS providers, enabling event-driven architectures. It helps decouple producers and consumers of events.

Which service lets you coordinate multiple AWS services into serverless workflows using visual state machines?

• a.Amazon EBS
• b.Amazon CloudFront content delivery network
• c.Amazon Route 53
• d.AWS Step Functions✓

AWS Step Functions orchestrates multiple services into serverless workflows defined as state machines, managing sequencing, retries, and error handling. It simplifies building and visualizing multi-step processes.

A team is building a REST API and wants a managed service to create, publish, secure, and monitor APIs at scale. Which service should they use?

• a.Amazon Redshift
• b.Amazon Kinesis Data Streams
• c.Amazon EFS
• d.Amazon API Gateway✓

Amazon API Gateway is a fully managed service for creating, publishing, securing, and monitoring APIs at any scale, and it integrates well with Lambda for serverless backends. It handles traffic management, authorization, and throttling.

Which service is designed to collect, process, and analyze streaming data such as clickstreams or IoT telemetry in real time?

• a.Amazon Kinesis✓
• b.AWS Artifact
• c.Amazon Glacier
• d.Amazon Athena interactive queries

Amazon Kinesis captures and processes real-time streaming data such as logs, clickstreams, and telemetry, enabling near-real-time analytics. Athena, by contrast, runs SQL queries against data already stored in S3.

Which service lets you run standard SQL queries directly against data stored in Amazon S3 without loading it into a database?

• a.Amazon DynamoDB
• b.Amazon Athena✓
• c.Amazon Redshift Spectrum only
• d.Amazon RDS

Amazon Athena is a serverless, interactive query service that runs SQL directly against data in Amazon S3, charging per data scanned with no infrastructure to manage. It is ideal for ad hoc analysis of data already in S3.

Which fully managed service helps developers build, train, and deploy machine learning models?

• a.Amazon EBS
• b.Amazon Route 53 DNS service
• c.Amazon SageMaker✓
• d.AWS CloudTrail

Amazon SageMaker is a managed platform that covers the full machine-learning lifecycle, from building and training models to deploying them for inference. It removes much of the heavy lifting of standing up ML infrastructure.

Which AWS AI service converts text into lifelike speech?

• a.Amazon Rekognition
• b.Amazon Polly✓
• c.Amazon Translate
• d.Amazon Comprehend

Amazon Polly turns text into lifelike speech using deep learning, supporting many languages and voices. Rekognition analyzes images and video, Comprehend does natural-language processing, and Translate performs language translation.

Which service provides a fully managed data-integration (ETL) capability to discover, prepare, and combine data for analytics?

• a.Amazon Route 53
• b.Amazon EFS
• c.Amazon EC2
• d.AWS Glue✓

AWS Glue is a serverless data-integration service that makes it easy to discover, prepare, transform, and combine data for analytics and machine learning. It includes a data catalog and managed ETL jobs.

A company needs AWS compute and storage running physically inside its own on-premises data center while using the same AWS APIs. Which service provides this?

• a.Amazon Lightsail
• b.Amazon CloudFront
• c.AWS Outposts✓
• d.AWS Snowmobile

AWS Outposts brings AWS infrastructure and services to a customer's on-premises facility, offering a consistent hybrid experience with the same APIs and tools used in AWS Regions. It suits low-latency or data-residency needs that require local processing.

What are AWS Local Zones primarily used for?

• a.Storing rarely accessed archival data at the lowest possible storage cost for many years
• b.Placing compute and storage closer to large population centers for very low latency✓
• c.Registering domain names
• d.Replacing the need for IAM permissions

AWS Local Zones extend a Region to place select services closer to end users in specific metropolitan areas, reducing latency for demanding applications like gaming or media. They are an extension of the Region's infrastructure.

Which statement about AWS Lambda pricing and operation is correct?

• a.It requires you to patch the underlying operating system
• b.It can only run code written in Java
• c.You are charged based on the number of requests and the duration your code runs✓
• d.You must reserve and pay for a fixed number of servers in advance for the whole term

With Lambda you pay per request and for the compute duration your function consumes, and AWS manages the servers, scaling, and patching. It supports many languages and scales automatically with demand.

A message must be delivered to multiple subscribers at once (fan-out), such as several queues and an email endpoint. Which service is designed for this?

• a.Amazon Simple Queue Service
• b.Amazon EBS
• c.Amazon RDS
• d.Amazon SNS✓

Amazon SNS is a publish/subscribe service that delivers a single published message to many subscribers simultaneously, such as SQS queues, Lambda functions, and email. SQS, by contrast, is a queue for point-to-point, decoupled processing.

Which service decouples application components by letting a producer place messages in a queue for a consumer to process later?

• a.Amazon SQS✓
• b.Amazon Redshift
• c.Amazon Route 53
• d.Amazon CloudFront

Amazon SQS is a managed message queue that lets components communicate asynchronously; producers enqueue messages and consumers process them independently. This decoupling improves resilience and scalability.

What does the term 'serverless' mean on AWS?

• a.You build applications without provisioning or managing servers, and AWS handles scaling✓
• b.Customers must manage the underlying servers themselves
• c.Applications somehow run without using any AWS servers or managed infrastructure whatsoever
• d.Only static websites can be built this way

Serverless means you focus on code and configuration while AWS provisions, scales, and maintains the underlying infrastructure automatically. Servers still exist, but you never manage them; examples include Lambda, DynamoDB, and S3.

Which service provides desktops in the cloud (Desktop-as-a-Service) so users can access a managed Windows or Linux desktop remotely?

• a.Amazon AppStream 2.0
• b.Amazon Lightsail
• c.Amazon WorkSpaces✓
• d.Amazon Connect

Amazon WorkSpaces provides managed, secure virtual desktops in the cloud that users can access from various devices. AppStream 2.0, by contrast, streams individual applications rather than full desktops.

Which service is a cloud-based contact center that lets companies handle customer phone and chat interactions?

• a.Amazon Connect✓
• b.Amazon Comprehend
• c.Amazon Kinesis
• d.Amazon Cognito

Amazon Connect is a scalable, cloud-based contact center service for handling customer interactions across voice and chat. It is billed by usage and requires no upfront telephony infrastructure.

Which service uses machine learning to detect and read text and data from scanned documents automatically?

• a.Amazon Redshift data warehouse
• b.Amazon Route 53
• c.Amazon EFS
• d.Amazon Textract✓

Amazon Textract automatically extracts text, forms, and tables from scanned documents using machine learning, going beyond simple optical character recognition. It helps automate document-processing workflows.

Which service is a business analytics service used to build interactive dashboards and visualizations from your data?

• a.Amazon Neptune
• b.Amazon Athena
• c.Amazon Kinesis Data Firehose
• d.Amazon QuickSight✓

Amazon QuickSight is a scalable business intelligence service for building interactive dashboards and visualizations, with pay-per-session pricing. It connects to many AWS and external data sources.

What is the purpose of tagging AWS resources from a technical management standpoint?

• a.Tags apply metadata labels used to organize, search, and automate management of resources✓
• b.Tags directly increase the performance and throughput of the resources that they are applied to
• c.Tags encrypt the resource's data at rest
• d.Tags are required before any resource can start

Tags are key-value metadata labels that help you organize, identify, search, and automate actions on resources, and they also support cost allocation. They do not affect performance or encryption.

Which service continuously delivers and automates the steps of building, testing, and deploying application code (a managed CI/CD pipeline)?

• a.Amazon Inspector vulnerability scanning
• b.Amazon Route 53
• c.AWS CodePipeline✓
• d.AWS Artifact

AWS CodePipeline is a managed continuous integration and continuous delivery service that automates build, test, and deploy stages for fast, reliable releases. It integrates with services like CodeBuild and CodeDeploy.

Which service is a managed Git-compatible source-control repository for storing and versioning application code? (Note historical AWS naming.)

• a.AWS Lambda
• b.Amazon EBS
• c.Amazon Simple Storage Service
• d.AWS CodeCommit✓

AWS CodeCommit is a managed source-control service that hosts secure, Git-based repositories for versioning code. It integrates with the rest of the AWS developer tools for CI/CD.

A company wants to distribute a static website's files with high durability and serve them cheaply. Which combination is commonly used?

• a.Amazon RDS combined with attached Amazon EBS block storage volumes
• b.Amazon Redshift with Athena
• c.Amazon S3 for hosting with Amazon CloudFront for delivery✓
• d.Amazon SQS with SNS

Static websites are commonly hosted as objects in Amazon S3 and delivered globally with low latency through Amazon CloudFront. This serverless pattern is durable, scalable, and cost-effective.

What is an Elastic IP address in AWS?

• a.A DNS record automatically created for every bucket
• b.A billing identifier used for consolidated billing
• c.A static public IPv4 address you can allocate and associate with instances in your account✓
• d.A private, internal-only IP address that can never be reached from the public internet at all

An Elastic IP is a static, public IPv4 address allocated to your account that you can associate with an instance and remap as needed. It provides a stable address even if the underlying instance changes.

Which statement correctly describes horizontal scaling of an application tier on AWS?

• a.Reducing the storage attached to a single server
• b.Moving the application to a different support plan
• c.Replacing an existing instance with a physically larger and more powerful instance type
• d.Adding more instances to share the load, often behind a load balancer✓

Horizontal scaling (scaling out) adds more instances to handle load, typically distributed by a load balancer, and pairs naturally with Auto Scaling. Vertical scaling, by contrast, increases the size of a single instance.

Which AWS service or feature helps ensure an application remains available if an entire Availability Zone fails?

• a.Using one instance in one subnet
• b.Deploying resources across multiple Availability Zones behind a load balancer✓
• c.Storing all of the application's data on a single instance store volume on one host
• d.Disabling health checks

Distributing resources across multiple Availability Zones, with a load balancer routing to healthy targets, keeps an application running even if one AZ fails. AZs are physically isolated, so multi-AZ designs increase resilience.

Which of the following is a valid reason to choose one AWS Region over another?

• a.To change the account's root user email address
• b.To increase the durability of Amazon S3 objects above their normally published level
• c.To meet data-residency requirements and reduce latency for local users✓
• d.To avoid paying for any data transfer ever

Region choice is driven by factors such as compliance and data residency, proximity to users (latency), service availability, and cost. It does not change fundamental durability guarantees or eliminate all data-transfer charges.

Which service provides fully managed Apache Kafka for streaming data without managing the Kafka infrastructure yourself?

• a.Amazon Athena
• b.Amazon Managed Streaming for Apache Kafka (MSK)✓
• c.Amazon Neptune
• d.Amazon RDS running the PostgreSQL database engine

Amazon MSK is a fully managed service that runs Apache Kafka, handling provisioning, patching, and scaling of the Kafka clusters. It lets teams use Kafka without operating the underlying brokers themselves.

Which statement about AWS managed services (for example, RDS, DynamoDB, or Lambda) is true regarding the shared responsibility model?

• a.Using managed services entirely removes the customer's own responsibility for protecting their stored data
• b.The customer must patch the underlying operating system for all of them
• c.The customer becomes responsible for the physical data center security
• d.AWS takes on more of the operational responsibility, such as patching and infrastructure management✓

With managed services, AWS handles more of the operational burden such as OS patching, backups, and scaling, shifting the responsibility boundary toward AWS. The customer still remains responsible for their data, access management, and configuration.

A gaming company needs a fully managed, low-latency NoSQL database with automatic scaling and no server management for its global leaderboard. Which service fits best?

• a.Amazon RDS for PostgreSQL
• b.Amazon Redshift
• c.Amazon EFS
• d.Amazon DynamoDB✓

Amazon DynamoDB is a serverless NoSQL database offering single-digit millisecond latency and automatic scaling, well suited to high-traffic key-value workloads like leaderboards. It requires no server provisioning or management.

Which AWS service provides object storage designed for eleven nines of durability by storing data redundantly across multiple facilities?

• a.Amazon EBS
• b.Amazon S3✓
• c.Amazon EFS
• d.Amazon Instance Store

Amazon S3 is designed for 99.999999999% (eleven nines) durability by automatically storing copies of data across multiple facilities within a Region. This makes it a strong choice for backups, archives, and data lakes.

What is the main function of Elastic Load Balancing health checks?

• a.To calculate the monthly bill
• b.To detect unhealthy targets and stop routing traffic to them✓
• c.To provision new AWS accounts
• d.To encrypt all of the data that is stored inside Amazon S3 buckets

ELB health checks continuously test registered targets and route traffic only to those that are healthy, improving availability. Unhealthy targets are automatically removed from rotation until they recover.

Which service would you use to create a private connection to Amazon S3 from within a VPC without using an internet gateway?

• a.A gateway VPC endpoint for S3✓
• b.An Elastic IP address assigned to the instance
• c.A CloudFront distribution
• d.A NAT gateway alone

A gateway VPC endpoint lets resources in a VPC reach Amazon S3 privately over the AWS network without an internet gateway or NAT device. This keeps traffic off the public internet and can reduce data-transfer costs.

Which statement best describes the AWS global infrastructure hierarchy?

• a.Availability Zones contain Regions, which contain edge locations
• b.Edge locations physically contain the Regions, which in turn contain all the Availability Zones
• c.Regions and Availability Zones are the same thing
• d.Regions contain multiple Availability Zones, and edge locations are separate caching sites✓

AWS organizes infrastructure into Regions, each containing multiple isolated Availability Zones, with edge locations forming a separate global network used mainly for content caching. Understanding this hierarchy is central to designing for latency and resilience.

Which service lets you centrally manage software licenses from vendors such as Microsoft and Oracle across AWS and on-premises?

• a.AWS Artifact
• b.AWS License Manager✓
• c.Amazon Redshift
• d.Amazon Cognito user directories

AWS License Manager helps you track and enforce license usage across AWS and on-premises environments, reducing the risk of non-compliance and overspending. It centralizes rules for bring-your-own-license scenarios.

Which service is a fully managed document database with MongoDB compatibility?

• a.Amazon Neptune
• b.Amazon DocumentDB✓
• c.Amazon Redshift
• d.Amazon ElastiCache

Amazon DocumentDB is a fully managed database service that is compatible with MongoDB workloads, handling scaling, backups, and patching. It suits applications that use document data models.

What does Amazon S3 Transfer Acceleration do?

• a.It encrypts objects only at rest
• b.It replaces the need for a bucket policy
• c.It automatically archives objects to the S3 Glacier storage class on a schedule
• d.It speeds up uploads to S3 over long distances using CloudFront edge locations✓

S3 Transfer Acceleration uses CloudFront's globally distributed edge locations to speed up transfers of data to and from S3 over long distances. It is useful when users far from the bucket's Region upload large files.

Which service provides a managed, scalable service for sending marketing, transactional, and notification emails?

• a.Amazon SQS
• b.Amazon Simple Email Service (SES)✓
• c.Amazon SNS
• d.Amazon Connect cloud contact center

Amazon SES is a managed email service for sending transactional, marketing, and notification emails at scale, with pay-as-you-go pricing. SNS and SQS are messaging services for application integration rather than email delivery.

A stateless application must handle unpredictable traffic while minimizing operational overhead. Which architecture aligns with AWS best practices?

• a.A fixed cluster that never changes size
• b.Serverless with Lambda, API Gateway, and DynamoDB that scale automatically✓
• c.An on-premises server connected by VPN only
• d.A single very large EC2 instance sized for the yearly peak load and left running always

A serverless architecture using services like Lambda, API Gateway, and DynamoDB scales automatically with demand and reduces operational overhead, matching cost to usage. Fixed, over-provisioned capacity wastes money and still risks under-provisioning.

Which service captures information about the IP traffic going to and from network interfaces in your VPC for troubleshooting and monitoring?

• a.Amazon CloudFront logs
• b.AWS CloudTrail
• c.Amazon Inspector
• d.VPC Flow Logs✓

VPC Flow Logs capture metadata about IP traffic to and from network interfaces, helping with troubleshooting connectivity and monitoring for unusual patterns. CloudTrail, by contrast, logs API activity rather than packet-level flow data.

Which service is used to run containerized applications with AWS's own orchestration, integrating tightly with other AWS services?

• a.Amazon Route 53
• b.Amazon Elastic Container Service (ECS)✓
• c.AWS Artifact
• d.Amazon Redshift data warehouse clusters

Amazon ECS is AWS's native container orchestration service that schedules and manages containers, integrating closely with services like IAM, load balancing, and CloudWatch. It can run on EC2 or serverless via Fargate.

What does a launch template or launch configuration define for EC2 Auto Scaling?

• a.The instance settings (such as AMI, instance type, and security groups) used to launch new instances✓
• b.The DNS routing policy for the domain
• c.The set of KMS encryption keys and database credentials that are stored inside AWS Secrets Manager for the app
• d.The monthly budget for the account

A launch template specifies the configuration used to launch instances, including the AMI, instance type, key pair, and security groups, so Auto Scaling can create consistent instances. It ensures new instances match the intended configuration.

Which service would help a company analyze application performance by tracing requests as they travel through distributed microservices?

• a.Amazon Macie
• b.Amazon Route 53
• c.AWS Artifact
• d.AWS X-Ray✓

AWS X-Ray helps developers analyze and debug distributed applications by tracing requests across services and identifying bottlenecks or errors. It provides an end-to-end view of request flows in microservice architectures.

Which service lets you schedule and automate the creation and retention of Amazon EBS snapshots?

• a.AWS Shield
• b.Amazon Cognito
• c.Amazon CloudFront distributions
• d.Amazon Data Lifecycle Manager✓

Amazon Data Lifecycle Manager automates the creation, retention, and deletion of EBS snapshots on a schedule, helping enforce backup policies. This reduces manual effort and helps meet data-protection requirements.

Which AWS compute service is best described as 'run code in response to events, scaling automatically, with no servers to manage'?

• a.Amazon EC2
• b.AWS Lambda✓
• c.Amazon Lightsail
• d.Amazon EC2 Dedicated Hosts

AWS Lambda runs your code in response to events and automatically scales by running as many copies as needed, with no server management. You pay only for the compute time consumed while your code runs.

Which service provides a fully managed feature to replicate objects automatically between S3 buckets in different Regions?

• a.Amazon EFS replication to another Region only
• b.S3 Cross-Region Replication✓
• c.Amazon Route 53 failover
• d.S3 Transfer Acceleration

S3 Cross-Region Replication automatically copies objects to a bucket in another Region, supporting disaster recovery, latency reduction, and compliance requirements. Replication is asynchronous and configurable at the bucket or prefix level.

A workload occasionally needs a burst of GPU compute for machine-learning training and can tolerate interruptions to save money. Which purchasing option combined with the right instance family is ideal?

• a.Spot Instances on GPU (accelerated computing) instances✓
• b.Dedicated Hosts billed hourly with no interruptions
• c.On-Demand CPU-only instances reserved for a full three-year term
• d.Reserved standard instances with no flexibility

Accelerated-computing (GPU) instances handle ML training, and Spot Instances offer the deepest discounts for interruption-tolerant, flexible jobs like batch training. Together they minimize cost for elastic, fault-tolerant compute.

Which service provides managed DNS and can route users to the closest healthy endpoint across multiple Regions for a global application?

• a.Amazon EBS
• b.Amazon Route 53✓
• c.AWS Direct Connect
• d.Amazon CloudFront

Amazon Route 53 offers managed DNS with routing policies (such as latency-based, geolocation, and failover) and health checks to send users to the best healthy endpoint. This helps deliver resilient, low-latency global applications.

Which AWS database capability automatically scales capacity up and down based on application traffic, so you pay for what you use without provisioning instances?

• a.Amazon ElastiCache reserved nodes
• b.Amazon Redshift reserved nodes
• c.Amazon Aurora Serverless✓
• d.Amazon RDS Multi-AZ

Aurora Serverless automatically starts, scales, and shuts down database capacity based on demand, so you pay for the capacity used rather than provisioning fixed instances. It suits variable or intermittent workloads.

Which best describes the purpose of Amazon CloudWatch Logs?

• a.To register and manage domain names
• b.To centralize, store, and query log data from applications and AWS services✓
• c.To store highly durable object backups designed for eleven nines of durability
• d.To provision infrastructure from templates

Amazon CloudWatch Logs centralizes log data from applications, EC2 instances, and AWS services so you can store, search, and analyze it. It complements CloudWatch metrics and alarms for full observability.

Which service helps you deploy application updates to EC2 instances, on-premises servers, or Lambda with controlled rollouts?

• a.Amazon QuickSight
• b.Amazon Athena
• c.AWS CodeDeploy✓
• d.Amazon Neptune

AWS CodeDeploy automates code deployments to compute services such as EC2, on-premises servers, and Lambda, supporting strategies like rolling and blue/green to reduce downtime. It is part of AWS's developer tooling for release automation.

What is the primary benefit of a blue/green deployment strategy?

• a.It encrypts all data at rest automatically
• b.It permanently doubles your total monthly infrastructure bill for the entire duration of the deployment
• c.It reduces deployment risk by shifting traffic to a new environment and enabling quick rollback✓
• d.It removes the need for any testing

Blue/green deployments run a new (green) environment alongside the current (blue) one and shift traffic over, allowing fast rollback if problems appear. This lowers the risk and downtime of releases.

Which service would a company use to build, deploy, and manage a serverless application defined as a single stack of Lambda functions, APIs, and tables?

• a.AWS Serverless Application Model (SAM) / CloudFormation✓
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon Redshift provisioned data-warehouse cluster nodes

The AWS Serverless Application Model (SAM) extends CloudFormation to define serverless resources like Lambda functions, APIs, and DynamoDB tables in a concise template. It provisions the whole application as one stack.

Which capability lets you connect users' existing corporate identities to AWS so they can sign in without separate IAM users, centrally across accounts?

• a.Root user sharing
• b.AWS IAM Identity Center (single sign-on)✓
• c.Long-term access keys per user
• d.Amazon Cognito user pools for the app only

AWS IAM Identity Center provides centralized single sign-on and lets you connect an existing identity source so users access multiple AWS accounts and applications without separate IAM users. It simplifies workforce access at scale.

Which service is designed to run high-performance computing (HPC) or big-data frameworks like Apache Spark and Hadoop on managed clusters?

• a.Amazon EMR✓
• b.Amazon Cognito
• c.Amazon Route 53
• d.AWS Artifact

Amazon EMR provides managed clusters to run big-data frameworks such as Apache Spark, Hadoop, and Hive at scale, handling provisioning and tuning. It is used for large-scale data processing and analytics.

A company wants to reduce the operational effort of running its message queue and pay only for what it uses. Which AWS characteristic makes SQS attractive here?

• a.It requires managing your own broker servers
• b.It is fully managed and scales automatically with pay-per-use pricing✓
• c.It can only be used from on-premises servers
• d.It charges one large fixed monthly fee regardless of how many messages you send

Amazon SQS is fully managed, scales automatically, and charges based on usage, removing the need to run and patch your own message-broker servers. This lowers operational overhead and matches cost to actual traffic.

Which statement about scaling a relational database on Amazon RDS is accurate?

• a.Read replicas provide automatic failover for the primary
• b.You can only scale the database by fully rewriting the entire application to use a NoSQL engine
• c.RDS cannot be scaled at all once created
• d.You can scale reads with read replicas and scale compute by changing the instance class✓

With RDS you can add read replicas to scale read traffic and change the instance class to scale compute and memory (vertical scaling). Multi-AZ provides failover, which is a separate capability from read scaling.

Which core AWS pricing principle is reflected by paying only for the compute you actually consume, with no long-term contract required?

• a.Pay the same amount every month regardless of usage
• b.Pay a large fixed annual fee
• c.Pay only after a three-year commitment
• d.Pay-as-you-go✓

A foundational AWS pricing principle is pay-as-you-go: you pay only for the individual services and capacity you use, for as long as you use them, without long-term contracts. This aligns spending with actual consumption.

Which AWS pricing principle explains why customers get lower per-unit prices as AWS grows and gains more customers?

• a.You always pay a single flat fee for unlimited usage of every AWS service each month
• b.Pay more to reserve capacity
• c.As AWS grows, economies of scale lower costs that are passed on to customers✓
• d.Prices increase as usage increases

One of AWS's pricing principles is that its economies of scale reduce its costs over time, and those savings are passed to customers as lower prices. This is distinct from the discounts customers earn by committing to usage.

Which EC2 pricing option offers up to about a 72% discount in exchange for a one- or three-year commitment tied to specific instance attributes?

• a.Spot Instances
• b.Standard Reserved Instances✓
• c.Dedicated Hosts billed on demand
• d.On-Demand Instances

Standard Reserved Instances provide substantial discounts (up to roughly 72%) versus On-Demand in return for a one- or three-year commitment to specific attributes such as instance type and Region. They suit steady-state, predictable workloads.

Which purchasing option provides spare EC2 capacity at the deepest discounts but can be interrupted with little notice?

• a.On-Demand Instances
• b.Spot Instances✓
• c.Standard Reserved Instances
• d.Dedicated Hosts

Spot Instances let you use unused EC2 capacity at up to about 90% off On-Demand prices, but AWS can reclaim them when it needs the capacity. They are ideal for fault-tolerant, flexible, and stateless workloads.

Compared with Reserved Instances, what added flexibility do Savings Plans generally offer?

• a.They only apply to one single specific instance type in a single Availability Zone and can never be shared or moved between accounts
• b.They apply savings across usage based on a dollars-per-hour commitment, often spanning instance families or even compute services✓
• c.They require no commitment at all
• d.They eliminate all data-transfer charges

Savings Plans commit you to a consistent amount of usage measured in dollars per hour, and Compute Savings Plans apply automatically across instance families, Regions, and even services like Fargate and Lambda. This is more flexible than Reserved Instances tied to specific attributes.

Which statement about the AWS Free Tier's three offer types is correct?

• a.It includes 12-month free offers, always-free offers, and short-term trials✓
• b.The Free Tier is available only to enterprise customers
• c.It requires purchasing the Business Support plan
• d.Everything in AWS is completely free forever once you sign up under the Free Tier

The AWS Free Tier has three categories: 12-month free offers for new accounts, always-free offers, and short-term free trials. Usage beyond the specified limits is billed at standard rates.

A new customer wants to explore AWS without incurring charges as long as they stay within limits. What should they be aware of about the Free Tier?

• a.It requires an Enterprise Support plan
• b.It never expires for any service
• c.Exceeding the Free Tier limits results in standard charges✓
• d.It automatically caps all of your account spending at exactly zero dollars

The Free Tier lets you try services within specific limits, but any usage beyond those limits is billed at normal rates, so it does not guarantee a zero bill. Monitoring usage with Budgets or the Free Tier dashboard helps avoid surprises.

Which tool provides an upfront estimate of the monthly cost of a proposed AWS architecture before you build it?

• a.AWS Cost and Usage Report
• b.AWS Pricing Calculator✓
• c.AWS Budgets
• d.AWS Cost Explorer

The AWS Pricing Calculator models a planned architecture and estimates its cost before deployment, useful for planning and comparisons. Cost Explorer and the Cost and Usage Report analyze actual, historical usage instead.

Which service lets you set a custom threshold and receive an alert when your actual or forecasted AWS spending exceeds it?

• a.Amazon Inspector
• b.AWS Budgets✓
• c.AWS Artifact
• d.AWS CloudFormation

AWS Budgets lets you create custom cost and usage budgets and sends alerts when actual or forecasted amounts breach your thresholds. This supports proactive cost control.

Which tool is best for visualizing and analyzing historical AWS spend with graphs, filtering, and forecasting?

• a.AWS Cost Explorer✓
• b.AWS Pricing Calculator
• c.AWS Artifact
• d.Amazon Macie

AWS Cost Explorer provides an interactive interface to visualize, filter, and forecast historical costs and usage, helping identify trends and cost drivers. The Pricing Calculator, by contrast, estimates costs before deployment.

Which billing artifact provides the most granular, line-item detail of AWS usage and can be delivered to Amazon S3 for deep analysis?

• a.AWS Cost and Usage Report (CUR)✓
• b.AWS Pricing Calculator estimate export
• c.AWS Trusted Advisor summary
• d.AWS Budgets report

The AWS Cost and Usage Report contains the most detailed billing data available, down to the line item and hour, and can be delivered to S3 for querying with tools like Athena. It supports advanced cost analysis and chargeback.

What does consolidated billing in AWS Organizations provide?

• a.It automatically encrypts all resources
• b.A single bill across accounts, with combined usage that can unlock volume pricing tiers✓
• c.It deliberately reduces the durability of all of your stored data in order to save you money
• d.It grants every account root access to the others

Consolidated billing aggregates charges from all member accounts into one payer bill and combines usage so the group can reach volume-pricing discount tiers sooner. Each account's costs remain trackable individually.

Which feature lets a management account share the benefit of Reserved Instances or Savings Plans across accounts in an organization?

• a.VPC peering
• b.Service control policies
• c.Automatic cross-Region replication of all storage buckets in the organization
• d.Consolidated billing with sharing of reservation and Savings Plans discounts✓

Under consolidated billing, Reserved Instance and Savings Plans discounts can be shared across accounts in the organization when sharing is enabled, improving overall utilization. This maximizes the value of commitments.

How many support plans does AWS offer for customers, and what is the lowest tier?

• a.Several plans; the lowest is Basic, which is included free with every account✓
• b.Two plans; the lowest is Enterprise
• c.There is only one plan; the lowest tier is Developer, which costs a flat monthly fee
• d.One plan only, which is Business

AWS offers multiple support tiers, and Basic Support is included with every account at no additional cost, providing access to documentation, whitepapers, and account/billing support. Paid tiers add technical support and faster response times.

Which support plan is the least expensive paid tier and provides business-hours email access to a Cloud Support Associate, suited to early experimentation?

• a.Basic
• b.Business
• c.Developer✓
• d.Enterprise

The Developer Support plan is the entry-level paid tier, offering business-hours email access to support for non-production or early development use. Production workloads typically warrant Business or higher.

A company running production workloads wants 24/7 phone, email, and chat support plus full Trusted Advisor checks, but does not need a dedicated TAM. Which plan fits?

• a.Basic
• b.Business✓
• c.Developer
• d.Enterprise

The Business Support plan provides 24/7 technical support by phone, chat, and email and the full set of Trusted Advisor checks, making it appropriate for production workloads. A dedicated Technical Account Manager comes with Enterprise-level plans.

Which support plan includes a designated Technical Account Manager (TAM), concierge billing support, and the fastest response times?

• a.Business Support plan
• b.Developer
• c.Basic
• d.Enterprise✓

The Enterprise Support plan includes a designated Technical Account Manager, a concierge support team for billing and account help, and the fastest response times for critical issues. It targets large, business-critical workloads.

Which support offering gives a lower-cost path to some Enterprise-level benefits, including a pool of Technical Account Managers rather than a single designated TAM?

• a.Free Tier Support
• b.Developer Support plan
• c.Basic Support
• d.Enterprise On-Ramp✓

Enterprise On-Ramp provides a subset of Enterprise benefits at a lower cost, including access to a pool of Technical Account Managers and faster response times than Business. It bridges the gap between Business and full Enterprise support.

Which service inspects your AWS environment and gives recommendations across cost optimization, security, fault tolerance, performance, and service limits?

• a.Amazon Inspector
• b.AWS Pricing Calculator
• c.AWS Trusted Advisor✓
• d.AWS Budgets

AWS Trusted Advisor evaluates your account against best practices in five categories, including cost optimization, and recommends actions such as removing idle resources. The full set of checks is available with Business and Enterprise Support.

Which category of AWS Trusted Advisor checks would flag underutilized or idle resources to help you save money?

• a.Service limits
• b.Security
• c.Cost optimization✓
• d.Fault tolerance checks

The cost optimization category of Trusted Advisor identifies opportunities to save money, such as idle load balancers, underused EC2 instances, or unattached EBS volumes. Acting on these recommendations reduces waste.

How does resource tagging support cost management on AWS?

• a.Tags are mandatory before launching any resource
• b.Tags encrypt the billing data
• c.Applying cost allocation tags automatically lowers the hourly price of every resource they are applied to
• d.Cost allocation tags let you group and report spending by dimensions like project, team, or environment✓

Activating cost allocation tags lets you break down and report costs by categories such as project, department, or environment in Cost Explorer and the Cost and Usage Report. This improves visibility and enables chargeback or showback.

Which AWS service uses machine learning to detect unusual spending patterns and alert you to potential cost anomalies?

• a.AWS Pricing Calculator estimates
• b.AWS Cost Anomaly Detection✓
• c.Amazon Macie
• d.AWS Artifact

AWS Cost Anomaly Detection uses machine learning to monitor spend and alert you when it detects unexpected or unusual cost patterns. This helps catch runaway costs early.

Which statement about AWS data-transfer pricing is generally true?

• a.AWS charges a flat monthly fee that includes unlimited data transfer
• b.Data transferred into AWS is typically free, while data transferred out to the internet is usually charged✓
• c.All data transfer in and out is always free
• d.All data transferred within the same Availability Zone always costs the most of any type of transfer you can make

As a general rule, inbound data transfer into AWS is free, while outbound data transfer to the internet is metered and billed, with rates that can vary by volume and Region. Understanding this helps forecast costs for data-heavy applications.

Which of the following is a way to reduce AWS costs according to AWS best practices?

• a.Always run the single largest available instance type
• b.Disable monitoring so you cannot see usage
• c.Right-size resources and shut down idle instances✓
• d.Keep unattached storage volumes indefinitely

Cost optimization best practices include right-sizing resources to match actual needs and turning off or removing idle resources such as stopped instances or unattached volumes. Monitoring usage is essential to finding these savings.

What is the pricing model for AWS Lambda?

• a.A charge only when the account is created
• b.A fixed monthly subscription per function
• c.A one-time upfront payment that covers all future invocations of the function
• d.A charge based on the number of requests and the duration your code runs✓

AWS Lambda charges by the number of requests and the compute duration (rounded to the millisecond) that your function runs, with no charge when idle. This usage-based model aligns cost with actual execution.

For Amazon S3, which factors primarily determine your monthly cost?

• a.The number of IAM users in the account
• b.The amount of storage, the storage class, requests, and data transfer out✓
• c.Only the number of buckets you create
• d.A single flat monthly fee no matter how much or how little data you actually store

S3 costs depend on how much data you store, the storage class chosen, the number and type of requests, and data transfer out of AWS. Choosing the right storage class and lifecycle rules helps optimize these costs.

Which AWS pricing principle is demonstrated by receiving a lower per-GB price as your Amazon S3 storage volume crosses higher usage tiers?

• a.Pay only after a multi-year commitment
• b.Pay more by reserving capacity
• c.Pay a single flat rate regardless of the total volume you use
• d.Pay less per unit when you use more (volume-based discounts)✓

AWS offers tiered, volume-based pricing on some services so that the per-unit price decreases as usage grows. This is distinct from commitment-based discounts like Reserved Instances or Savings Plans.

Which tool would you use to compare the cost of running a workload on-premises versus on AWS to build a business case for migration?

• a.AWS WAF
• b.Amazon GuardDuty continuous threat-detection and account-monitoring service dashboards view
• c.Amazon Route 53
• d.A total cost of ownership (TCO) analysis, for example using the AWS Pricing Calculator✓

A total cost of ownership analysis compares the full costs of on-premises infrastructure with running the same workload on AWS, and tools like the AWS Pricing Calculator help model the AWS side. This supports migration business cases.

Which statement about On-Demand pricing is correct?

• a.It is always guaranteed to be cheaper than Reserved Instances for every possible workload
• b.It is only available for storage services
• c.You pay for compute capacity by the hour or second with no long-term commitment✓
• d.It requires a one-year commitment

On-Demand pricing charges for capacity by the hour or second with no upfront cost or commitment, making it flexible for unpredictable or short-term workloads. Committed options like Reserved Instances and Savings Plans trade flexibility for lower rates.

A workload runs steadily 24/7 for the next three years with predictable usage. Which purchasing approach typically minimizes cost?

• a.Dedicated Hosts billed hourly with no commitment
• b.Spot Instances only
• c.On-Demand Instances only
• d.A three-year Savings Plan or Reserved Instances✓

For steady, predictable, long-running workloads, committing to a one- or three-year Savings Plan or Reserved Instances yields the largest discounts over On-Demand. Spot suits interruptible work, and On-Demand is best for variable usage.

What does the AWS Billing Dashboard primarily let you do?

• a.View current and past charges, spending trends, and access billing tools in one place✓
• b.Trace each individual request as it travels across all of your distributed microservices
• c.Provision new EC2 instances
• d.Encrypt data stored in Amazon S3

The AWS Billing Dashboard gives a central view of current month-to-date spend, historical trends, and links to billing tools such as Cost Explorer and Budgets. It is the starting point for understanding and managing account charges.

Which is a benefit of using AWS Organizations for a company with many AWS accounts, from a cost perspective?

• a.It automatically finds and deletes any unused resources across all of the accounts to save money
• b.It guarantees a fixed monthly bill
• c.Combined usage across accounts can qualify for volume discounts under one consolidated bill✓
• d.It removes the need to monitor usage

AWS Organizations enables consolidated billing, which aggregates usage across accounts so the group can reach volume-pricing tiers and share commitment discounts under one bill. It simplifies payment while preserving per-account visibility.

Which support plan tier includes access to online resources, whitepapers, documentation, and the AWS support community at no additional charge?

• a.Business
• b.Basic✓
• c.Enterprise
• d.Developer

Basic Support is included free with every AWS account and provides access to documentation, whitepapers, support forums, and account and billing assistance. Technical support with response-time commitments requires a paid plan.

Which of the following usage would typically incur a charge even when other Free Tier limits are respected?

• a.Reading AWS documentation
• b.Using an always-free service within its stated limits
• c.Staying exactly within the twelve-month Free Tier limits for each service
• d.Exceeding the monthly Free Tier hours for an EC2 instance type✓

Exceeding a Free Tier allowance, such as running more EC2 hours than the offer includes, triggers standard pay-as-you-go charges for the overage. Staying within limits and using always-free offers within their bounds avoids charges.

What is the main advantage of the Compute Savings Plans over EC2 Instance Savings Plans?

• a.Compute Savings Plans apply broadly across instance families, Regions, and services like Fargate and Lambda✓
• b.Compute Savings Plans require no commitment
• c.Compute Savings Plans always give the single largest possible discount of any purchase option that is available
• d.Compute Savings Plans only apply to a single instance type

Compute Savings Plans offer the most flexibility, automatically applying the discount across any instance family, size, Region, tenancy, and even to Fargate and Lambda usage. EC2 Instance Savings Plans give a deeper discount but are limited to a chosen instance family in a Region.

Which action helps ensure you are notified before a project's monthly spending exceeds an approved amount?

• a.Attach an Elastic IP to every instance
• b.Turn off AWS CloudTrail
• c.Enable Amazon Macie scanning on all of your buckets
• d.Create an AWS Budget with an alert threshold✓

Creating an AWS Budget with alert thresholds sends notifications as actual or forecasted spend approaches or exceeds the limit, helping teams stay within approved amounts. It is a core proactive cost-control practice.

Which of the following would AWS Trusted Advisor NOT typically help with directly?

• a.Checking whether you are approaching service limits
• b.Identifying idle load balancers to reduce cost
• c.Flagging security groups with unrestricted access
• d.Writing the business logic of your application✓

Trusted Advisor provides best-practice checks for cost, security, fault tolerance, performance, and service limits, but it does not write application code. It advises on your environment's configuration and usage, not your software logic.

A startup expects highly variable, unpredictable traffic in its first months. Which pricing model best matches this uncertainty while minimizing commitment risk?

• a.On-Demand pricing✓
• b.A three-year Savings Plan
• c.Dedicated Hosts with a one-year commitment
• d.Three-year Reserved Instances

On-Demand pricing matches unpredictable, variable workloads because it requires no commitment and charges only for what is used. Long-term commitments make sense later, once usage patterns become predictable.

Which best describes how AWS charges for most services?

• a.A one-time lifetime license per service
• b.Based on actual usage of each service, such as compute time, storage, and data transfer✓
• c.A single flat monthly fee that covers completely unlimited use of every AWS service offered
• d.Only an annual subscription negotiated in advance

AWS generally bills based on metered usage of each service, such as compute hours, storage consumed, requests, and data transfer, following the pay-as-you-go model. This lets costs scale with actual consumption.

Which tool helps you allocate and track shared costs and view amortized costs of Reserved Instances and Savings Plans over time?

• a.AWS Shield
• b.AWS Cost Explorer✓
• c.Amazon Inspector service
• d.Amazon Cognito

AWS Cost Explorer can display costs including amortized views of Reserved Instances and Savings Plans and, with cost categories and allocation tags, helps allocate shared spend. It supports understanding true cost distribution over time.

Which statement about AWS support plan pricing is accurate?

• a.All support plans are free
• b.Support plans are billed only one single time, at the moment the account is first created
• c.Paid support plan cost often scales with your monthly AWS usage, subject to minimums✓
• d.Enterprise Support is cheaper than Developer Support

Paid AWS Support plans are commonly priced as the greater of a monthly minimum or a percentage of monthly AWS usage, so cost generally scales with spend. Basic Support is free, while Enterprise is the most comprehensive and costly tier.

Which service or feature would help a finance team automatically stop or receive alerts when a sandbox account's spend is abnormally high?

• a.Amazon EBS point-in-time volume snapshots scheduled hourly
• b.AWS Budgets combined with Cost Anomaly Detection✓
• c.AWS Direct Connect
• d.Amazon Route 53

AWS Budgets can alert (and trigger actions) when spend crosses thresholds, and Cost Anomaly Detection uses machine learning to flag unusual spending. Together they help finance teams catch and respond to abnormal costs.

Why might an organization choose EC2 Instance Savings Plans over Compute Savings Plans?

• a.Because they require no commitment at all
• b.Because they automatically apply to both Lambda and Fargate compute usage across your whole account
• c.Because they are the only option that includes support
• d.To get a deeper discount in exchange for committing to a specific instance family in a Region✓

EC2 Instance Savings Plans provide a larger discount than Compute Savings Plans but restrict the commitment to a particular instance family within a Region. The trade-off is less flexibility for a deeper price reduction.

What does 'amortized cost' represent in AWS cost reporting?

• a.The total data stored in Amazon S3
• b.Upfront commitment charges spread evenly across the term they cover✓
• c.The cost of outbound data transfer only
• d.The current total number of running EC2 instances across the whole account

Amortized cost distributes upfront payments for commitments like Reserved Instances or Savings Plans evenly over the commitment term, rather than showing the full charge at purchase. This gives a smoother, more representative view of ongoing costs.

A company wants a single monthly invoice for 15 AWS accounts while keeping each team's costs visible. Which capability enables this?

• a.Consolidated billing through AWS Organizations✓
• b.AWS Direct Connect
• c.Elastic Load Balancing
• d.Automatic cross-Region replication of resources

Consolidated billing in AWS Organizations produces one invoice for the payer account across all member accounts while still allowing per-account cost tracking. It also aggregates usage for potential volume discounts.

Which is the best first step to control costs when you notice an unexpectedly high bill driven by many small services?

• a.Immediately upgrade to the Enterprise Support plan to reduce your per-service prices
• b.Immediately delete the entire AWS account
• c.Turn off all monitoring to stop the charges
• d.Use Cost Explorer to identify which services and resources are driving the spend✓

Cost Explorer lets you break down spend by service, account, and tag to pinpoint what is driving costs before taking action. Understanding the source is the essential first step to targeted cost reduction.

Which pricing benefit is unique to committing to Reserved Instances or Savings Plans rather than using On-Demand?

• a.Charges only for storage and never for compute
• b.No ability to run instances continuously
• c.Lower rates in exchange for a one- or three-year usage commitment✓
• d.Automatic elimination of every outbound data-transfer fee across all Regions

Reserved Instances and Savings Plans reduce compute costs significantly in return for committing to a one- or three-year term, unlike On-Demand which has no commitment or discount. The right choice depends on how predictable the workload is.

Which service provides on-demand access to compliance reports, and is free of charge but is not itself a cost-management tool?

• a.AWS Budgets
• b.AWS Cost Explorer
• c.AWS Artifact✓
• d.AWS Pricing Calculator

AWS Artifact offers free, on-demand access to AWS compliance reports and agreements, but it is a governance/compliance tool rather than a cost-management one. Cost management is handled by tools like Cost Explorer, Budgets, and the Pricing Calculator.

Which statement about the relationship between AWS Support plans and Trusted Advisor is correct?

• a.AWS Trusted Advisor requires a completely separate paid subscription that must be purchased outside of the standard AWS Support plans
• b.Only the Basic plan gets the full set of checks
• c.Trusted Advisor is unavailable on every plan
• d.Basic and Developer plans get a limited set of Trusted Advisor checks, while Business and Enterprise get the full set✓

All accounts get a core subset of Trusted Advisor checks, while the full set across all five categories is unlocked with Business and Enterprise (and Enterprise On-Ramp) Support. Higher tiers therefore provide deeper cost and security guidance.

Which Reserved Instance payment option provides the largest discount?

• a.Partial Upfront combined with lower monthly charges
• b.All Upfront✓
• c.Paying only after the reserved term has fully ended
• d.No Upfront, spread as equal monthly charges over the whole term with no initial payment

Reserved Instances offer three payment options, and All Upfront (paying the entire amount at purchase) gives the biggest discount. No Upfront gives the smallest discount, and Partial Upfront falls in between.