CSLB General Building (B) — All Questions

Which statement best describes the primary financial benefit of moving from an on-premises data center to the AWS Cloud?

• a.It eliminates all costs associated with running applications
• b.It trades large upfront capital expenses for variable operating expenses that scale with usage✓
• c.It guarantees that monthly bills will never change month to month
• d.It removes the need to monitor how many resources you consume

Cloud computing lets organizations avoid large upfront investments in hardware (CapEx) and instead pay only for the resources they actually use (OpEx). This variable cost model scales up or down with demand. Costs are not eliminated, and usage should still be monitored.

A company can provision hundreds of servers in minutes and release them just as quickly when demand drops. Which cloud benefit does this describe?

• a.Agility and elasticity✓
• b.Fixed capacity planning
• c.Manual hardware procurement
• d.Long-term data-center leasing

Elasticity is the ability to acquire resources as you need them and release them when you no longer need them, in minutes rather than weeks. Combined with agility, this lets teams experiment and innovate faster than with traditional infrastructure.

Because AWS aggregates usage from hundreds of thousands of customers, it can pass lower per-unit prices on to each customer. What is this advantage called?

• a.Elastic load balancing
• b.High availability
• c.Economies of scale✓
• d.Fault tolerance

Massive aggregated usage lets AWS achieve higher economies of scale, which translates into lower pay-as-you-go pricing for customers. Individual organizations could not achieve the same purchasing power on their own.

Which of the following is a pillar of the AWS Well-Architected Framework?

• a.Marketing effectiveness
• b.Vendor lock-in
• c.Headcount reduction
• d.Operational excellence✓

The Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Operational excellence focuses on running and monitoring systems to deliver business value.

Which Well-Architected pillar focuses on using computing resources efficiently and avoiding unnecessary spending?

• a.Reliability
• b.Cost optimization✓
• c.Security
• d.Operational excellence

The cost optimization pillar helps you run systems that deliver business value at the lowest price point, such as by choosing the right pricing model and eliminating idle resources. Reliability and security address different concerns.

A newer pillar of the AWS Well-Architected Framework addresses the long-term environmental impact of cloud workloads. Which pillar is this?

• a.Sustainability✓
• b.Scalability
• c.Portability
• d.Compatibility

Sustainability is the sixth pillar, added to help customers understand and minimize the environmental impacts of running cloud workloads. It encourages maximizing utilization and reducing the resources required.

What does the term 'high availability' mean for a system running in the cloud?

• a.The system uses the cheapest possible resources
• b.The system stores data in a single location
• c.The system remains operational and accessible for a very high percentage of time✓
• d.The system can only be accessed by administrators

High availability means a system is designed to stay up and reachable with minimal downtime, often by removing single points of failure. On AWS this is commonly achieved by spreading resources across multiple Availability Zones.

Which deployment model describes running some workloads on-premises while integrating with services in the AWS Cloud?

• a.Multi-region deployment
• b.Pure public cloud
• c.Serverless deployment
• d.Hybrid cloud✓

A hybrid deployment connects cloud resources with on-premises infrastructure, often used when data must remain local or during a gradual migration. A pure cloud model runs everything in the cloud.

Which of the following best defines scalability in the context of cloud computing?

• a.The ability to encrypt data at rest
• b.The ability of a system to handle increased load by adding resources✓
• c.The ability to restrict user permissions
• d.The ability to generate monthly invoices

Scalability is a system's capacity to grow to meet increased demand, either by adding more resources (horizontal) or larger resources (vertical). Elasticity extends this by automatically scaling in and out with demand.

A startup wants to launch a product globally without building data centers in each country. How does the AWS global infrastructure help?

• a.It lets the company deploy applications close to users in many geographic Regions✓
• b.It requires the company to pick a single country for all users
• c.It forces all traffic through one physical building
• d.It removes the ability to choose where data is stored

AWS operates Regions around the world, so companies can deploy applications near their users to reduce latency and meet local requirements. Customers choose which Regions to use for their workloads.

Which statement correctly contrasts vertical scaling with horizontal scaling?

• a.Vertical scaling adds more instances; horizontal scaling makes an instance smaller
• b.Both terms mean the same thing
• c.Vertical scaling increases the size of a single resource; horizontal scaling adds more resources✓
• d.Horizontal scaling only applies to databases

Vertical scaling (scaling up) increases the capacity of an individual resource, such as moving to a larger instance type. Horizontal scaling (scaling out) adds more resources, such as more instances behind a load balancer.

Which characteristic of cloud computing allows a developer to obtain compute and storage resources without human interaction with the provider?

• a.Measured billing
• b.Resource pooling
• c.Broad network access
• d.On-demand self-service✓

On-demand self-service means users can provision resources automatically through a console or API whenever needed, without contacting the provider. This is a defining feature of cloud computing.

How does the cloud improve an organization's ability to experiment and innovate?

• a.Low-cost, fast provisioning lowers the risk and cost of trying new ideas✓
• b.It requires a multi-year commitment before any test can begin
• c.It mandates that every experiment run in a physical lab
• d.It prevents teams from deleting resources

Because resources can be spun up quickly and released when done, the cost of failure is low. Teams can test ideas rapidly and shut them down without wasted hardware, encouraging innovation.

Which Well-Architected pillar is primarily concerned with a workload's ability to recover from failures and meet demand?

• a.Cost optimization
• b.Reliability✓
• c.Sustainability
• d.Performance efficiency

The reliability pillar focuses on ensuring a workload performs its intended function correctly and consistently, including recovering from disruptions and dynamically acquiring resources to meet demand.

A company no longer wants to spend time racking, stacking, and powering servers so it can focus on its customers. Which cloud value proposition does this reflect?

• a.Paying more for less capacity
• b.Increasing time spent on undifferentiated tasks
• c.Stop spending money running and maintaining data centers✓
• d.Guaranteeing zero latency worldwide

A key benefit of cloud is to stop spending money on the undifferentiated heavy lifting of running data centers and instead focus on projects that differentiate the business, such as serving customers.

Which cloud computing service model provides virtualized computing resources such as servers, storage, and networking that the customer manages?

• a.Software as a Service (SaaS)
• b.Function as a Service
• c.Platform as a Service (PaaS)
• d.Infrastructure as a Service (IaaS)✓

IaaS provides the fundamental building blocks of cloud IT (compute, storage, networking) and gives the customer the most control over the resources. SaaS delivers a finished application, while PaaS manages the underlying infrastructure for you.

Which of the following is an example of the Software as a Service (SaaS) model?

• a.A ready-to-use, web-based email application✓
• b.A bare virtual machine you must configure yourself
• c.A raw block storage volume
• d.A physical network switch

SaaS delivers a complete, managed application that the customer simply uses, such as web-based email. The provider handles the underlying infrastructure, platform, and application maintenance.

What is meant by 'loose coupling' as an architectural best practice in the cloud?

• a.Making every component depend directly on every other component
• b.Designing components so a failure in one has limited impact on others✓
• c.Running all code on a single large server
• d.Avoiding the use of any managed services

Loosely coupled architectures reduce interdependencies so that a change or failure in one component does not cascade to others. Services like queues and load balancers help decouple components and improve resilience.

Which benefit describes AWS's ability to go global in minutes by deploying an application in multiple Regions?

• a.Reduced encryption strength
• b.Mandatory single-Region hosting
• c.Increased speed and reach for a global user base✓
• d.Elimination of all networking costs

Deploying across multiple Regions lets you place workloads closer to users worldwide, lowering latency and improving experience. This global reach can be achieved quickly without building physical infrastructure.

Which Well-Architected design principle encourages testing systems at production scale and automating to make experimentation easier?

• a.Manually provisioning all infrastructure
• b.Avoiding failure testing
• c.Keeping one large monolith
• d.Automate to make architectural experimentation easier✓

Well-Architected design principles include automating with infrastructure as code, testing at production scale, and designing for failure. Automation makes it low-cost to create and replicate environments for experimentation.

How does elasticity help a retailer that experiences large traffic spikes during holiday sales?

• a.Capacity automatically scales out during spikes and scales in afterward, matching cost to demand✓
• b.Capacity is fixed at the peak level all year, wasting money off-season
• c.The retailer must manually order servers weeks ahead of each sale
• d.Traffic spikes cause the application to be permanently oversized

Elasticity lets the retailer add capacity during peak periods and remove it when demand falls, so they pay only for what they need. This avoids both over-provisioning year-round and under-provisioning during spikes.

Which statement about the AWS shared model of benefits is correct regarding speed and agility?

• a.New IT resources are always available only after a multi-week procurement cycle
• b.Agility refers only to how fast invoices are generated
• c.In the cloud, new IT resources are a click away, reducing the time to make them available to developers✓
• d.Agility means resources can never be released

Cloud agility means developers can obtain new resources almost instantly instead of waiting weeks for hardware. This dramatically reduces the time and cost of making resources available, accelerating projects.

Which of the following best describes 'fault tolerance' in a cloud architecture?

• a.The system charges customers only for faults
• b.The system continues operating properly even when some components fail✓
• c.The system requires manual restart after any error
• d.The system stores only a single copy of data

Fault tolerance is the ability of a system to keep running correctly despite the failure of one or more of its components, often through redundancy. It is closely related to, but stronger than, high availability.

Which Well-Architected pillar focuses on using computing resources efficiently to meet requirements and maintaining efficiency as demand changes and technologies evolve?

• a.Reliability
• b.Security
• c.Cost optimization
• d.Performance efficiency✓

The performance efficiency pillar is about using computing resources efficiently to meet system requirements and sustaining that efficiency as demand shifts and technologies advance. It encourages selecting the right resource types and reviewing them over time.

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Physical security of the data centers and the hardware running the cloud✓
• b.Configuring security groups on the customer's EC2 instances
• c.Managing the customer's IAM user passwords
• d.Encrypting the customer's application data at rest

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Maintaining the hypervisor that isolates instances
• b.Replacing failed physical disks in the data center
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Cognito
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Macie

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Use it for all daily administrative tasks
• b.Share its credentials with the whole team
• c.Delete it immediately after account creation
• d.Enable MFA on it and avoid using it for everyday tasks✓

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.Multi-factor authentication (MFA)✓
• b.A larger instance type
• c.A public S3 bucket policy
• d.An Elastic IP address

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Make the S3 bucket public
• c.Attach an IAM role to the EC2 instance✓
• d.Share the root user credentials with the instance

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Defense in depth
• b.Least privilege✓
• c.Separation of billing
• d.Elastic provisioning

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.Amazon Inspector
• b.AWS Config
• c.Amazon Macie
• d.AWS Shield✓

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.AWS WAF (Web Application Firewall)✓
• b.AWS Trusted Advisor
• c.Amazon Route 53
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon GuardDuty
• c.Amazon Macie✓
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Artifact
• b.Amazon GuardDuty✓
• c.AWS Certificate Manager
• d.Amazon Cognito

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS Config
• c.Amazon Inspector
• d.AWS CloudTrail✓

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS Shield
• c.Amazon Macie
• d.AWS WAF

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.Amazon Inspector
• b.AWS Config
• c.AWS Artifact✓
• d.Amazon GuardDuty

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS CloudHSM only
• b.AWS Key Management Service (KMS)✓
• c.Amazon Cognito
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Config
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Secrets Manager✓

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.Amazon Inspector✓
• b.AWS Shield
• c.Amazon Cognito
• d.AWS Artifact

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS KMS
• c.Amazon Cognito✓
• d.AWS Shield

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Security group✓
• c.Internet gateway
• d.Route table

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are attached directly to individual instances
• b.They are stateful and automatically allow return traffic
• c.They can only allow traffic and never deny it
• d.They are stateless and operate at the subnet level with allow and deny rules✓

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.AWS Organizations with service control policies (SCPs)✓
• b.A single shared IAM user across all accounts
• c.Amazon Macie with WAF rules
• d.Route 53 health checks

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data as it moves between a client and a server over the network✓
• d.Data printed to a physical report

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Secrets Manager
• b.AWS Certificate Manager (ACM)✓
• c.Amazon Inspector
• d.AWS Config

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Attach permissions directly to each individual user
• b.Use the root account for daily API calls
• c.Disable MFA to simplify sign-in
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Trusted Advisor
• c.Amazon CloudFront
• d.AWS Direct Connect

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Disable encryption entirely
• b.Store keys in the application source code
• c.Server-side encryption with keys managed by AWS (SSE)✓
• d.Only encrypt data after downloading it locally

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓
• c.Roles can only be used by AWS employees
• d.Users cannot be assigned any permissions

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.AWS alone
• b.The internet service provider
• c.No one is responsible
• d.The customer✓

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.Amazon S3
• c.AWS Lambda
• d.Amazon EC2 Auto Scaling

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They automatically expire, reducing the risk if they are exposed✓
• c.They grant full administrative access by default
• d.They are stored permanently in application code

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.

Which AWS service provides resizable virtual servers in the cloud on which you can run applications?

• a.Amazon S3
• b.Amazon RDS
• c.Amazon EC2✓
• d.AWS Lambda

Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers, called instances, where you control the operating system and software. S3 is object storage, RDS is a managed database, and Lambda runs code without provisioning servers.

Which AWS service provides highly durable object storage designed for 11 nines of durability?

• a.Amazon S3✓
• b.Amazon EC2
• c.Amazon VPC
• d.AWS IAM

Amazon S3 (Simple Storage Service) is object storage designed for 99.999999999% (11 nines) durability by redundantly storing data across multiple facilities. It is commonly used for backups, static websites, data lakes, and media.

Which service lets you run code without provisioning or managing servers, charging only for the compute time consumed?

• a.Amazon EC2
• b.Amazon RDS
• c.Amazon EBS
• d.AWS Lambda✓

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute. You pay only for the requests and the compute time your code uses.

Which service is a managed relational database that supports engines such as MySQL, PostgreSQL, and SQL Server?

• a.Amazon DynamoDB
• b.Amazon RDS✓
• c.Amazon S3
• d.Amazon ElastiCache

Amazon RDS (Relational Database Service) is a managed service for relational databases, handling tasks like patching, backups, and failover for engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. DynamoDB, by contrast, is a NoSQL database.

Which AWS service is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at scale?

• a.Amazon DynamoDB✓
• b.Amazon RDS
• c.Amazon Redshift
• d.Amazon Aurora

Amazon DynamoDB is a fully managed NoSQL database offering fast, consistent performance at any scale with no servers to manage. It is well suited for high-traffic applications needing flexible schemas.

What is an AWS Region?

• a.A single building that houses one server rack
• b.A content delivery cache at the network edge
• c.A physical geographic area containing multiple, isolated Availability Zones✓
• d.A billing category for support plans

An AWS Region is a separate geographic area, each containing multiple Availability Zones. Customers choose Regions based on factors such as latency, data-residency requirements, and service availability.

What is an Availability Zone (AZ)?

• a.A global DNS service
• b.A type of EC2 instance
• c.A billing report
• d.One or more discrete data centers with redundant power and networking within a Region✓

An Availability Zone consists of one or more discrete data centers with independent power, cooling, and networking, isolated from failures in other AZs. Deploying across multiple AZs increases availability and fault tolerance.

Why should a highly available application be deployed across multiple Availability Zones?

• a.To reduce the AWS bill to zero
• b.So the application can continue running if one AZ experiences a failure✓
• c.Because a single AZ cannot run any instances
• d.To avoid using load balancers

Spreading resources across multiple AZs means that if one zone fails, the application can continue serving traffic from the others. AZs are physically isolated, so this design improves availability and fault tolerance.

Which service is a content delivery network (CDN) that caches content at edge locations to reduce latency for users?

• a.Amazon CloudFront✓
• b.Amazon RDS
• c.AWS Lambda
• d.Amazon EBS

Amazon CloudFront is a CDN that caches copies of content at edge locations around the world, delivering it to users from the nearest location to reduce latency. It integrates with services like S3 and load balancers as origins.

Which service automatically distributes incoming application traffic across multiple targets such as EC2 instances?

• a.Amazon Route 53
• b.AWS Lambda
• c.Elastic Load Balancing (ELB)✓
• d.Amazon S3

Elastic Load Balancing automatically spreads incoming traffic across multiple healthy targets, such as EC2 instances in different AZs. This improves fault tolerance and helps applications scale.

Which service automatically adjusts the number of EC2 instances to match demand based on defined policies?

• a.Amazon CloudFront
• b.Amazon S3
• c.AWS IAM
• d.Amazon EC2 Auto Scaling✓

EC2 Auto Scaling adds or removes instances automatically according to demand and your scaling policies, helping maintain performance while controlling cost. Combined with a load balancer, it supports elastic, resilient architectures.

Which storage service provides persistent block-level volumes that can be attached to EC2 instances?

• a.Amazon EBS✓
• b.Amazon S3
• c.Amazon CloudFront
• d.Amazon Route 53

Amazon EBS (Elastic Block Store) provides durable block storage volumes for use with EC2 instances, similar to a virtual hard disk. Volumes persist independently of the instance lifecycle and can be snapshotted to S3.

Which service provides scalable, shared file storage that multiple Linux EC2 instances can mount simultaneously?

• a.Amazon EBS
• b.Amazon EFS✓
• c.Amazon S3 Glacier
• d.Amazon DynamoDB

Amazon EFS (Elastic File System) is a managed, elastic NFS file system that many EC2 instances can mount concurrently. Unlike EBS, which attaches to a single instance at a time, EFS supports shared access.

Which AWS service is a scalable Domain Name System (DNS) web service used to route users to applications?

• a.Amazon CloudFront
• b.Amazon VPC
• c.Amazon Route 53✓
• d.AWS Direct Connect

Amazon Route 53 is a highly available and scalable DNS service that routes end users to applications by translating domain names into IP addresses. It also supports domain registration and health checks.

Which service lets you provision a logically isolated section of the AWS Cloud where you define your own IP ranges, subnets, and routing?

• a.Amazon S3
• b.AWS Lambda
• c.Amazon CloudWatch
• d.Amazon VPC✓

Amazon VPC (Virtual Private Cloud) lets you create an isolated virtual network in AWS where you control IP address ranges, subnets, route tables, and gateways. It gives you networking control similar to a traditional data center.

Which service provides monitoring and observability, collecting metrics, logs, and alarms for AWS resources and applications?

• a.Amazon CloudWatch✓
• b.Amazon Route 53
• c.AWS Artifact
• d.Amazon Cognito

Amazon CloudWatch collects metrics, logs, and events, and can trigger alarms and actions based on thresholds. It is the primary monitoring service for gaining operational visibility into AWS resources and applications.

Which service lets you model and provision AWS infrastructure as code using templates?

• a.Amazon CloudWatch
• b.AWS CloudFormation✓
• c.Amazon Inspector
• d.AWS Shield

AWS CloudFormation lets you define infrastructure in templates and provision it automatically and repeatably as 'stacks.' This infrastructure-as-code approach makes environments consistent and easy to replicate.

A developer wants to deploy a web application without manually configuring the underlying compute, load balancing, and scaling. Which service handles this?

• a.Amazon EC2
• b.Amazon VPC
• c.AWS Elastic Beanstalk✓
• d.Amazon S3

AWS Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, automatically handling capacity provisioning, load balancing, scaling, and health monitoring. Developers simply upload code while retaining control of the resources.

Which fully managed message queuing service decouples components by letting them send and receive messages asynchronously?

• a.Amazon CloudFront
• b.Amazon RDS
• c.Amazon EFS
• d.Amazon SQS✓

Amazon SQS (Simple Queue Service) is a managed message queue that lets application components communicate asynchronously, improving decoupling and resilience. Producers send messages to a queue and consumers process them independently.

Which service is a fully managed publish/subscribe messaging service used to send notifications to subscribers or other services?

• a.Amazon SNS✓
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon Redshift

Amazon SNS (Simple Notification Service) is a pub/sub messaging service that delivers messages to multiple subscribers such as email, SMS, or other AWS services. It is often used for fan-out notifications and event-driven architectures.

Which service is a fully managed data warehouse designed for running complex analytic queries over large datasets?

• a.Amazon DynamoDB
• b.Amazon Redshift✓
• c.Amazon EFS
• d.Amazon SQS

Amazon Redshift is a managed, petabyte-scale data warehouse optimized for analytical queries using columnar storage and parallel processing. It is designed for business intelligence workloads rather than transactional processing.

A company needs a dedicated, private network connection from its on-premises data center to AWS that bypasses the public internet. Which service should it use?

• a.Amazon CloudFront
• b.Amazon Route 53
• c.AWS Direct Connect✓
• d.Amazon SNS

AWS Direct Connect establishes a dedicated private network connection between on-premises and AWS, providing more consistent network performance than the public internet. It is often used for large data transfers and hybrid architectures.

Which option lets you create an encrypted connection over the public internet between your on-premises network and your VPC?

• a.Amazon CloudFront distribution
• b.S3 Transfer Acceleration
• c.An Elastic IP address
• d.AWS Site-to-Site VPN✓

AWS Site-to-Site VPN creates an encrypted tunnel over the internet between your network and your VPC. Unlike Direct Connect, it uses the public internet but is quick to set up and encrypted.

Which purchasing option is best for a fault-tolerant, flexible workload that can handle interruptions and wants the lowest EC2 price?

• a.Spot Instances✓
• b.On-Demand Instances
• c.Dedicated Hosts
• d.Reserved Instances with no flexibility

Spot Instances let you use spare EC2 capacity at steep discounts but can be reclaimed by AWS with short notice. They are ideal for fault-tolerant, flexible workloads such as batch processing.

Which AWS database service is MySQL- and PostgreSQL-compatible and offers higher performance and availability as part of RDS?

• a.Amazon DynamoDB
• b.Amazon Aurora✓
• c.Amazon ElastiCache
• d.Amazon Neptune

Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, offering greater throughput and built-in high availability compared to standard engines. It is part of the Amazon RDS family.

Which service provides in-memory caching to improve the performance of read-heavy applications, supporting engines like Redis and Memcached?

• a.Amazon Redshift
• b.Amazon RDS
• c.Amazon ElastiCache✓
• d.Amazon EFS

Amazon ElastiCache provides managed in-memory data stores using Redis or Memcached to reduce latency and offload databases. It is commonly used to cache frequently accessed data for faster reads.

Which S3 storage class is designed for long-term archival where retrieval times of minutes to hours are acceptable at very low cost?

• a.S3 Standard
• b.S3 Standard-Infrequent Access
• c.S3 Intelligent-Tiering
• d.S3 Glacier✓

The S3 Glacier storage classes are designed for low-cost, long-term archival where data is accessed rarely and some retrieval delay is acceptable. S3 Standard, by contrast, is for frequently accessed data with immediate retrieval.

Which S3 feature automatically moves objects between access tiers based on changing access patterns to optimize cost?

• a.S3 Intelligent-Tiering✓
• b.S3 Transfer Acceleration
• c.S3 Versioning
• d.S3 Cross-Region Replication

S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing storage costs without performance impact or operational overhead. It is useful when access patterns are unknown or changing.

A team wants to run Docker containers on AWS without managing the underlying EC2 servers. Which combination is most appropriate?

• a.Amazon RDS with EBS
• b.Amazon ECS or EKS with AWS Fargate✓
• c.Amazon Route 53 with CloudFront
• d.Amazon SNS with SQS

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, removing the need to provision or manage EC2 instances. It lets teams run containers while AWS handles the underlying infrastructure.

Which service can migrate large amounts of data into AWS by shipping a physical, ruggedized storage device when network transfer would be too slow?

• a.Amazon S3 Transfer Acceleration
• b.AWS Direct Connect
• c.AWS Snowball✓
• d.Amazon CloudFront

AWS Snowball is a physical data transport device used to move large datasets into or out of AWS when transferring over the network would take too long or be too costly. AWS ships the device, you load data, and return it for import.

Which statement correctly describes edge locations in the AWS global infrastructure?

• a.They are used only for storing relational databases
• b.They replace Availability Zones
• c.They are where the root user signs in
• d.They are sites used to cache content closer to users, primarily for services like CloudFront✓

Edge locations are part of the content delivery network and cache content closer to end users to reduce latency. They are distinct from Regions and Availability Zones, which host the core compute and storage infrastructure.

Which service allows you to register domain names and configure routing policies such as latency-based or weighted routing?

• a.Amazon Route 53✓
• b.Amazon VPC
• c.AWS CloudFormation
• d.Amazon EBS

Amazon Route 53 supports domain registration and advanced DNS routing policies, including latency-based, weighted, geolocation, and failover routing. This helps direct users to the best endpoint for their needs.

What is the main advantage of a serverless architecture using services like Lambda and DynamoDB?

• a.You must manually patch and scale servers
• b.You focus on code and data while AWS manages provisioning and scaling of the infrastructure✓
• c.You pay a fixed monthly fee regardless of usage
• d.You cannot integrate with other AWS services

Serverless services remove the need to provision, patch, and scale servers, letting developers focus on application logic while AWS handles the underlying infrastructure. Billing is typically based on actual usage rather than pre-provisioned capacity.

Which compute option provides physically dedicated servers for a customer, often used to meet licensing or compliance requirements?

• a.Spot Instances
• b.AWS Lambda
• c.Amazon EC2 Dedicated Hosts✓
• d.Amazon S3

Amazon EC2 Dedicated Hosts provide physical servers dedicated to a single customer, which can help address software licensing that is tied to physical cores or specific compliance needs. They give visibility and control over the underlying hardware.

Which support plan is the minimum required to get a designated Technical Account Manager (TAM) and concierge support?

• a.Basic
• b.Developer
• c.Business
• d.Enterprise✓

The Enterprise Support plan includes a designated Technical Account Manager and access to the concierge support team, along with the fastest response times. The Business plan offers 24/7 technical support but not a dedicated TAM.

Which AWS pricing model lets you pay for compute or database capacity by the hour or second with no long-term commitment?

• a.On-Demand pricing✓
• b.Reserved Instance pricing
• c.Spot pricing only
• d.Savings Plans only

On-Demand pricing charges for capacity by the hour or second with no upfront payment or long-term commitment, making it ideal for short-term or unpredictable workloads. Reserved Instances and Savings Plans trade commitment for lower prices.

Which purchasing option offers significant discounts in exchange for a one- or three-year commitment to a consistent amount of compute usage?

• a.On-Demand Instances
• b.Savings Plans✓
• c.Spot Instances
• d.Dedicated Hosts billed hourly

Savings Plans offer lower prices in return for committing to a consistent amount of compute usage (measured in dollars per hour) over a one- or three-year term. Reserved Instances offer a similar trade-off tied to specific instance attributes.

Which tool provides a free estimate of the cost of an AWS architecture before you deploy it?

• a.AWS Cost Explorer
• b.AWS Budgets
• c.AWS Pricing Calculator✓
• d.AWS Cost and Usage Report

The AWS Pricing Calculator lets you model a proposed architecture and estimate its monthly cost before deploying. Cost Explorer and the Cost and Usage Report, by contrast, analyze actual historical spend.

Which feature of AWS Organizations combines the usage of multiple accounts so they can share volume pricing discounts and receive a single bill?

• a.Service control policies
• b.Cross-Region replication
• c.Elastic Load Balancing
• d.Consolidated billing✓

Consolidated billing in AWS Organizations aggregates usage across member accounts into one bill and can qualify the group for volume discounts. It simplifies payment while still allowing per-account cost tracking.

Which service lets you set custom cost or usage thresholds and receive alerts when spending is forecast to exceed them?

• a.AWS Budgets✓
• b.AWS Artifact
• c.Amazon Inspector
• d.AWS CloudFormation

AWS Budgets lets you define custom budgets for cost or usage and receive alerts when actual or forecasted amounts exceed your thresholds. This helps teams proactively control spending.

Which tool helps you visualize, understand, and analyze your AWS costs and usage over time with graphs and filtering?

• a.AWS Pricing Calculator
• b.AWS Cost Explorer✓
• c.AWS Trusted Advisor
• d.AWS Config

AWS Cost Explorer provides an interface to visualize and analyze historical and forecasted costs and usage, with filtering and grouping. It helps identify spending trends and cost drivers.

Which statement about the AWS Free Tier is correct?

• a.It makes all AWS services free forever
• b.It only applies to enterprise customers
• c.It offers some services free within limits, including 12-month, always-free, and short-term trial offers✓
• d.It requires an Enterprise Support plan

The AWS Free Tier includes three types of offers: 12-month free tiers for new accounts, always-free offers, and short-term trials. Usage beyond the specified limits is billed at standard rates.

Which support plan provides 24/7 access to cloud support engineers by phone, chat, and email, and is often the minimum recommended for production workloads?

• a.Basic
• b.Developer
• c.Free Tier
• d.Business✓

The Business Support plan offers 24/7 access to support engineers via phone, chat, and email, plus full access to Trusted Advisor checks, making it suitable for production workloads. The Developer plan offers only business-hours email access to support.

Which detailed billing artifact provides the most comprehensive, line-item data about your AWS usage and can be delivered to an S3 bucket for analysis?

• a.AWS Cost and Usage Report (CUR)✓
• b.AWS Pricing Calculator
• c.AWS Trusted Advisor
• d.AWS Artifact

The AWS Cost and Usage Report provides the most detailed, comprehensive line-item billing data available and can be delivered to Amazon S3 for analysis. It is used for deep cost analysis and chargeback reporting.

How does tagging AWS resources help with billing and cost management?

• a.Tags automatically reduce the cost of resources
• b.Tags let you categorize resources so costs can be tracked and allocated by project, team, or environment✓
• c.Tags are required before any resource can be launched
• d.Tags encrypt billing data

Cost allocation tags let you label resources so their costs can be grouped and analyzed by dimensions such as project, department, or environment. This improves visibility and enables chargeback or showback.

In which support plans is the full set of AWS Trusted Advisor checks available?

• a.Only the Basic plan
• b.Only the Developer plan
• c.The Business and Enterprise plans✓
• d.No support plan includes Trusted Advisor

The full set of Trusted Advisor checks, covering cost optimization, security, fault tolerance, performance, and service limits, is available with Business and Enterprise Support. Basic and Developer plans include only a limited subset of checks.