AWS Cloud Practitioner — All Questions

Which practice supports a strong multi-account strategy on AWS?

• a.Disabling CloudTrail organization-wide
• b.Running everything in the root account
• c.Sharing one IAM user everywhere
• d.Separating prod and dev into different accounts with SCP guardrails✓

Isolating environments into separate accounts under Organizations, with SCP guardrails and centralized logging, limits blast radius and improves governance.

AWS Compliance Programs and certifications primarily help customers do what?

• a.Avoid all of their own compliance obligations
• b.Get free AWS promotional credits
• c.Bypass encryption requirements entirely
• d.Meet their own audit requirements by relying on AWS's audited controls✓

AWS's compliance programs provide audited assurance for the infrastructure, which customers use as a foundation for their own compliance; responsibility is shared.

Which statement correctly contrasts security groups with network ACLs?

• a.NACLs are stateful and attach to instances
• b.Security groups work only at the subnet level
• c.Security groups are stateful at the instance level; NACLs are stateless at the subnet level✓
• d.Both are stateless and behave identically

Security groups are stateful instance-level firewalls (return traffic auto-allowed); NACLs are stateless subnet-level filters needing explicit rules both ways.

How does enabling Amazon S3 Versioning help protect data?

• a.It blocks all public access to the bucket
• b.It reduces storage cost to zero
• c.It preserves previous versions so you can recover from accidental deletes or overwrites✓
• d.It encrypts the entire bucket automatically

Versioning keeps prior object versions, protecting against accidental or malicious deletion and overwrites; it pairs well with MFA Delete.

What does enabling MFA Delete on an S3 bucket require?

• a.A Reserved Instance purchase
• b.A public bucket policy
• c.An MFA code to permanently delete versions or change the versioning state✓
• d.A larger EC2 instance type

MFA Delete adds a requirement for a multi-factor code before permanently deleting versions, guarding critical data against unauthorized deletion.

Which practice helps protect critical workloads against accidental data loss?

• a.Turning off encryption entirely
• b.Regular backups plus cross-Region or cross-account copies✓
• c.Storing a single copy in one AZ only
• d.Disabling all logging to save cost

Maintaining backups and copies across Regions or accounts improves durability and recoverability, supporting both reliability and data protection.

What is a security use of Amazon CloudWatch alarms?

• a.Alerting or triggering actions when metrics cross thresholds, such as unusual activity✓
• b.Physically securing the data centers and destroying decommissioned storage media on site
• c.Physically securing the data centers
• d.Provisioning IAM users automatically

CloudWatch alarms can notify teams or trigger automated responses when metrics (like failed logins or CPU spikes) breach thresholds, aiding detection.

Which combination provides an audit trail plus alerting and threat detection for account activity?

• a.Route 53 combined with CloudFront
• b.Only an S3 bucket with public access enabled
• c.CloudTrail for API logging with CloudWatch alarms and GuardDuty for detection✓
• d.EBS snapshots used entirely on their own

CloudTrail records activity, CloudWatch alarms on patterns, and GuardDuty adds ML-based threat detection, together supporting monitoring and response.

What does the principle of 'defense in depth' mean for securing AWS workloads?

• a.Granting broad permissions to move faster
• b.Applying multiple layers of security controls so no single failure is catastrophic✓
• c.Encrypting nothing in order to save cost
• d.Relying on one strong firewall and nothing else

Defense in depth layers controls (network, identity, encryption, monitoring) so that if one control fails, others still protect the workload.

A company wants to ensure only encrypted connections reach its application. Which approach helps enforce encryption in transit?

• a.Disable certificates entirely
• b.Store keys in the web page source
• c.Require HTTPS/TLS with ACM certificates and redirect HTTP to HTTPS✓
• d.Allow only unencrypted HTTP traffic

Enforcing TLS with ACM-managed certificates and redirecting HTTP to HTTPS ensures data in transit is encrypted between clients and the application.

Why does AWS offer several Amazon EC2 instance families such as compute-optimized, memory-optimized, and storage-optimized?

• a.Because each family is permanently locked to one specific AWS Region and cannot be resized or migrated later
• b.So you can match the balance of CPU, memory, and storage to your workload✓
• c.Because larger families are the only ones eligible for the Free Tier
• d.Because instance families determine which support plan you must purchase

EC2 offers purpose-built instance families so you can pick hardware that fits a workload, such as memory-optimized for in-memory databases or compute-optimized for batch processing. Choosing the right family improves performance efficiency and cost.

What is an Amazon Machine Image (AMI) used for when launching Amazon EC2 instances?

• a.It provides the template of the operating system and software used to launch an instance✓
• b.It is the DNS record that routes users to the instance
• c.It sets the maximum monthly spending limit and automatically stops the instance when that limit is reached
• d.It is the physical server that the instance runs on

An AMI is a preconfigured template containing the operating system, and optionally application software, used to launch EC2 instances. Using a custom AMI lets you launch identical instances quickly and consistently.

A workload runs a short function each time a file is uploaded to Amazon S3 and should incur no charge when idle. Which compute service fits best?

• a.Amazon EC2 Dedicated Hosts reserved for three years
• b.AWS Lambda✓
• c.An Amazon RDS database instance running continuously
• d.A fleet of always-on Amazon EC2 instances

AWS Lambda runs code in response to events, such as an S3 upload, and charges only for the requests and compute time used, with no cost while idle. This event-driven, serverless model is ideal for intermittent tasks.

Which statement best describes AWS Fargate?

• a.A service that registers domain names and manages DNS routing
• b.A managed relational database engine compatible with MySQL
• c.A serverless compute engine that runs containers without managing EC2 servers✓
• d.A ruggedized physical appliance that AWS ships to your data center to transfer very large datasets offline

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, so you run containers without provisioning or managing the underlying EC2 instances. You pay for the vCPU and memory your containers request.

A company wants to run and orchestrate Kubernetes on AWS while letting AWS manage the Kubernetes control plane. Which service should it use?

• a.Amazon EC2 Auto Scaling
• b.Amazon Simple Queue Service (SQS)
• c.AWS Elastic Beanstalk with managed container support
• d.Amazon Elastic Kubernetes Service (EKS)✓

Amazon EKS is a managed service that runs the Kubernetes control plane for you, so you can deploy and operate Kubernetes clusters without maintaining the control-plane infrastructure yourself. Amazon ECS is AWS's own container orchestrator alternative.

Which AWS service is a fully managed batch-processing service that dynamically provisions compute to run large numbers of batch computing jobs?

• a.Amazon Athena
• b.Amazon Kinesis Data Streams
• c.Amazon Lightsail
• d.AWS Batch✓

AWS Batch plans, schedules, and runs batch computing workloads, automatically provisioning the right quantity and type of compute based on job requirements. It removes the need to manually manage batch infrastructure.

A developer wants a simple way to launch a small website with a bundled virtual server, storage, and networking for a predictable low monthly price. Which service is designed for this?

• a.Amazon Redshift
• b.AWS CloudFormation
• c.Amazon Lightsail✓
• d.Amazon EMR

Amazon Lightsail offers easy-to-use virtual private servers bundled with storage and networking at a predictable monthly price, aimed at simpler workloads and users new to the cloud. It abstracts much of the configuration required with raw EC2.

In Amazon EC2, what does the instance type (for example, m5.large) primarily determine?

• a.The specific AWS Region and Availability Zone that the instance is permanently tied to for its whole life
• b.The IAM permissions granted to the instance
• c.The amount of vCPU, memory, storage, and network capacity of the instance✓
• d.The Availability Zone that will be used automatically

An EC2 instance type defines the hardware profile of the instance, including vCPUs, memory, storage, and networking performance. Selecting the right type balances performance and cost for the workload.

Which EC2 feature lets you run instances on hardware physically isolated for a single customer to help meet strict compliance or licensing rules tied to physical cores?

• a.Dedicated Hosts✓
• b.Auto Scaling groups
• c.Spot Instances
• d.Elastic IP addresses

Amazon EC2 Dedicated Hosts provide a physical server dedicated to your use, giving visibility into sockets and cores that helps with license terms and compliance. Standard shared tenancy places instances on hardware shared with other customers.

What is the main purpose of an Amazon EC2 Auto Scaling group's desired, minimum, and maximum capacity settings?

• a.To set the KMS encryption keys used for the instances' attached storage volumes and their snapshots
• b.To choose which support plan applies to the account
• c.To determine the retention period for CloudTrail logs
• d.To keep the number of running instances within defined bounds as demand changes✓

An Auto Scaling group uses minimum, maximum, and desired capacity to control how many instances run, adding or removing instances within those bounds as scaling policies trigger. This maintains availability while matching capacity to demand.

A stateless web tier needs to scale out during traffic spikes and in during quiet periods automatically. Which pair of services is most appropriate?

• a.Amazon S3 for storage combined with Amazon Glacier for archival
• b.Amazon Route 53 and AWS Artifact
• c.Elastic Load Balancing with EC2 Auto Scaling✓
• d.Amazon SNS with Amazon Cognito

Elastic Load Balancing distributes incoming traffic across instances while EC2 Auto Scaling adjusts the number of instances to match demand. Together they provide an elastic, highly available web tier.

Which statement about AWS Elastic Beanstalk is correct?

• a.It is a NoSQL database service for key-value data
• b.It only supports static websites with no server-side code
• c.You upload application code and it provisions and manages the underlying resources for you✓
• d.It requires you to manually configure every load balancer, Auto Scaling group, and security group yourself

Elastic Beanstalk is a platform service where you upload code and it automatically handles capacity provisioning, load balancing, scaling, and health monitoring. You keep full control of the underlying AWS resources if you need it.

In Amazon S3, what is a 'bucket'?

• a.A reserved compute capacity reservation
• b.A virtual network boundary for your resources
• c.A container that holds objects (files) stored in S3✓
• d.A block-level storage volume that attaches to a single EC2 instance

In Amazon S3, a bucket is the top-level container that holds objects, each identified by a unique key. Buckets are created in a specific Region and organize your stored data.

Which characteristic distinguishes object storage such as Amazon S3 from block storage such as Amazon EBS?

• a.Object storage manages data as whole objects with metadata, accessed over HTTP-based APIs✓
• b.Block storage cannot be attached to compute resources
• c.Object storage can only hold files smaller than one megabyte and cannot store any associated metadata
• d.Block storage is accessed only through a web browser

Object storage like S3 stores data as complete objects with metadata and is accessed via web APIs, making it ideal for unstructured data at scale. Block storage like EBS presents raw volumes to an instance, which the OS formats and uses like a disk.

A single Amazon EC2 instance needs a persistent, low-latency volume that behaves like an attached disk for its operating system and database files. Which service fits?

• a.Amazon Elastic Block Store (EBS)✓
• b.Amazon S3
• c.Amazon SQS
• d.Amazon Elastic File System (EFS) shared mount

Amazon EBS provides persistent block-level volumes attached to a single EC2 instance, suitable for boot volumes and databases that need low-latency disk access. The volume persists independently of the instance lifecycle.

What does an Amazon EBS snapshot allow you to do?

• a.Automatically resize the volume every hour
• b.Create a point-in-time backup of a volume that is stored durably in Amazon S3✓
• c.Convert the volume into an object storage bucket
• d.It lets you attach the same volume to hundreds of instances across many Availability Zones at once

An EBS snapshot captures a point-in-time backup of a volume and stores it durably in Amazon S3 (managed by AWS). Snapshots are incremental and can be used to restore volumes or create new ones.

Several Linux EC2 instances across multiple Availability Zones must read and write to the same file system at the same time. Which storage service supports this?

• a.An EC2 instance store volume
• b.Amazon Elastic File System (EFS)✓
• c.A single Amazon EBS volume
• d.Amazon S3 Glacier Deep Archive storage class

Amazon EFS is a managed, elastic NFS file system that many EC2 instances can mount concurrently across Availability Zones. A standard EBS volume attaches to only one instance at a time.

Which Amazon S3 storage class offers the lowest storage cost for rarely accessed archival data that can tolerate retrieval times of up to 12 hours?

• a.S3 Glacier Deep Archive✓
• b.S3 Standard-Infrequent Access
• c.S3 Standard
• d.S3 Intelligent-Tiering

S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of data accessed once or twice a year with retrieval times measured in hours. S3 Standard is priced for frequent, immediate access.

What does enabling versioning on an Amazon S3 bucket do?

• a.It converts all objects to the Glacier storage class
• b.It keeps multiple variants of an object so you can recover from unintended overwrites or deletes✓
• c.It replicates the bucket to every AWS Region
• d.It automatically deletes the older versions of every object each night in order to reduce your storage costs

S3 versioning preserves every version of an object, so overwritten or deleted objects can be recovered. It protects against accidental changes but increases storage used, since old versions are retained.

An EC2 instance store (instance-store volume) has which key characteristic that a customer should understand?

• a.It is automatically backed up to Amazon S3 Glacier every hour for long-term retention
• b.It is billed separately as an object storage bucket
• c.It can be shared simultaneously by many instances
• d.Its data is ephemeral and is lost when the instance stops or terminates✓

Instance store provides temporary block storage physically attached to the host, and its data does not persist when the instance stops, hibernates, or terminates. For persistent storage you use EBS or another durable service.

A company keeps petabytes of data on-premises and wants low-latency local access while backing the data up to AWS storage. Which service bridges on-premises applications to AWS storage?

• a.Amazon Route 53
• b.AWS Storage Gateway✓
• c.AWS Lambda
• d.Amazon Redshift data warehouse

AWS Storage Gateway connects on-premises environments to AWS storage, providing local cached access while storing data durably in services such as S3. It supports file, volume, and tape gateway configurations for hybrid storage.

Which service provides fully managed third-party file systems, such as Windows File Server (SMB) and Lustre, on AWS?

• a.Amazon S3
• b.Amazon EBS
• c.Amazon Elastic File System
• d.Amazon FSx✓

Amazon FSx provides fully managed file systems built on popular technologies like Windows File Server and Lustre, useful for Windows-based apps or high-performance computing. EFS, by contrast, provides NFS file storage primarily for Linux.

A team must move 80 TB of data into AWS but has limited internet bandwidth that would take months to upload. Which approach is most practical?

• a.Use an AWS Snow Family device to ship the data physically✓
• b.Store the data only in Amazon EBS snapshots
• c.Upload the data over your existing standard internet connection over several months
• d.Email the data to AWS Support

The AWS Snow Family provides physical, ruggedized devices you load with data and ship to AWS for import, which is far faster than uploading very large datasets over limited bandwidth. It is designed for petabyte- and terabyte-scale transfers.

What is the benefit of Amazon S3 lifecycle policies?

• a.They distribute S3 content to CloudFront edge locations around the world automatically
• b.They automatically transition or expire objects to lower-cost classes based on age✓
• c.They convert S3 buckets into EBS volumes
• d.They encrypt data only while it is in transit

S3 lifecycle policies let you define rules that automatically move objects to cheaper storage classes or delete them after a set time. This reduces cost for data whose access frequency declines predictably.

Within an Amazon VPC, what is a subnet?

• a.A dedicated physical fiber connection running directly into an AWS data center building
• b.A managed DNS zone for your domain
• c.A billing report for network usage
• d.A range of IP addresses in the VPC, tied to a single Availability Zone✓

A subnet is a segment of a VPC's IP address range that resides in one Availability Zone, and you place resources such as EC2 instances into subnets. Public and private subnets differ by whether they have a route to an internet gateway.

What is the role of an internet gateway in a VPC?

• a.It enables communication between resources in the VPC and the internet✓
• b.It automatically encrypts all data stored in Amazon S3 buckets within the VPC
• c.It provides an in-memory cache for databases
• d.It automatically scales EC2 instances

An internet gateway is a VPC component that allows communication between instances in your VPC and the internet. Public subnets route outbound traffic to the internet through it.

Instances in a private subnet need to download software updates from the internet but must not be reachable from the internet. Which component enables this?

• a.An Elastic Load Balancer in the private subnet
• b.An internet gateway attached directly to the private subnet
• c.A NAT gateway in a public subnet✓
• d.An Amazon S3 bucket policy

A NAT gateway lets instances in a private subnet initiate outbound connections to the internet (for example, for updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with a route to the internet gateway.

Which routing policy in Amazon Route 53 sends users to the endpoint that provides the lowest network latency for them?

• a.Failover routing
• b.Weighted routing
• c.Simple routing to a single resource
• d.Latency-based routing✓

Latency-based routing in Route 53 directs users to the AWS Region that gives them the lowest latency, improving performance for a global audience. Weighted and failover policies serve different traffic-distribution goals.

Beyond DNS resolution, which capability does Amazon Route 53 provide?

• a.Managed relational database backups and patching
• b.Object storage with versioning
• c.Serverless function execution
• d.Domain name registration and health checks✓

Amazon Route 53 is a DNS web service that also offers domain registration and health checking of endpoints, allowing traffic to be routed away from unhealthy targets. These features make it a full-featured DNS and traffic-management service.

How does Amazon CloudFront reduce latency for globally distributed users?

• a.By caching copies of content at edge locations near users✓
• b.By replacing the need for an origin server entirely and hosting content itself
• c.By storing all data in a single central Region
• d.By encrypting data only at rest

Amazon CloudFront is a content delivery network that caches content at edge locations worldwide, so users are served from a nearby location instead of a distant origin. This lowers latency and offloads traffic from the origin.

A company needs a private, dedicated network link between its data center and AWS with more consistent throughput than the public internet. Which service provides this?

• a.Amazon Route 53
• b.AWS Direct Connect✓
• c.Amazon CloudFront
• d.AWS Site-to-Site VPN

AWS Direct Connect establishes a dedicated, private physical connection between on-premises and AWS, offering more consistent performance and potentially lower data-transfer costs than the internet. A VPN, by contrast, is encrypted but rides over the public internet.

Which service simplifies connecting thousands of VPCs and on-premises networks through a single central hub?

• a.Amazon EFS
• b.AWS Transit Gateway✓
• c.AWS Certificate Manager
• d.Amazon CloudFront

AWS Transit Gateway acts as a central hub that connects VPCs and on-premises networks, replacing complex peering meshes with a simpler hub-and-spoke topology. It scales network connectivity across many accounts and VPCs.

What is the primary difference between a security group and a network ACL in a VPC?

• a.A security group is stateful at the instance level; a network ACL is stateless at the subnet level✓
• b.A security group only supports deny rules; a network ACL only supports allow rules
• c.There is no functional difference between them
• d.A network ACL is attached directly to individual instances while a security group is attached to whole subnets

Security groups act as stateful firewalls at the instance level, automatically allowing return traffic, while network ACLs are stateless firewalls at the subnet level that evaluate allow and deny rules in order. Both are layers of VPC network security.

Which service lets resources in a VPC reach supported AWS services privately without traversing the public internet?

• a.Amazon CloudFront distributions with signed URLs
• b.Amazon Route 53 health checks
• c.Elastic IP addresses
• d.VPC endpoints (including AWS PrivateLink)✓

VPC endpoints, powered by AWS PrivateLink for many services, let VPC resources connect privately to AWS services without an internet gateway or public IPs. This keeps traffic on the AWS network and improves security.

What does a route table in a VPC control?

• a.Where network traffic from a subnet is directed✓
• b.The encryption keys used for data at rest
• c.The number of instances in an Auto Scaling group
• d.The billing alerts for the account

A route table contains rules (routes) that determine where network traffic from a subnet or gateway is directed, such as to an internet gateway or NAT gateway. Each subnet is associated with a route table.

What does the Multi-AZ deployment option for Amazon RDS provide?

• a.A read-only replica that is used only to increase read throughput for heavy reporting queries
• b.A synchronous standby replica in another Availability Zone for automatic failover✓
• c.Automatic conversion of the database to a NoSQL engine
• d.A discount on the database instance price

RDS Multi-AZ maintains a synchronous standby in a different Availability Zone and fails over automatically if the primary fails, improving availability and durability. It is for resilience, not for scaling read traffic, which is what read replicas address.

A read-heavy application backed by Amazon RDS needs to offload read queries from the primary database. Which feature helps?

• a.A NAT gateway
• b.Multi-AZ standby
• c.RDS read replicas✓
• d.A larger EBS snapshot

RDS read replicas provide additional read-only copies that can serve read traffic, reducing load on the primary and improving read scalability. Multi-AZ, by contrast, provides a standby for failover, not for scaling reads.

Which use case is Amazon DynamoDB best suited for?

• a.Mounting a single shared POSIX-compliant file system across many Linux servers at the same time
• b.A petabyte-scale columnar analytics warehouse
• c.Complex multi-table SQL joins for reporting
• d.A high-traffic application needing single-digit millisecond key-value lookups at any scale✓

DynamoDB is a fully managed NoSQL key-value and document database delivering consistent, low-latency performance at scale, ideal for high-traffic apps with simple access patterns. Relational analytics and joins are better served by RDS or Redshift.

Amazon Aurora is best described as which of the following?

• a.A MySQL- and PostgreSQL-compatible relational database built for the cloud with high performance and availability✓
• b.A managed in-memory cache using Redis
• c.A fully managed graph database service purpose-built for highly connected datasets such as social and recommendation graphs
• d.A serverless function runtime

Amazon Aurora is a cloud-optimized relational database compatible with MySQL and PostgreSQL, offering higher throughput and built-in fault-tolerant, self-healing storage. It is part of the Amazon RDS family.

A business intelligence team needs to run complex analytical queries across billions of rows for reporting. Which service is purpose-built for this?

• a.Amazon Redshift✓
• b.Amazon RDS for MySQL
• c.Amazon DynamoDB
• d.Amazon ElastiCache

Amazon Redshift is a managed, petabyte-scale data warehouse using columnar storage and massively parallel processing, optimized for analytical (OLAP) queries. Transactional databases like RDS and DynamoDB are optimized for different workloads.