AWS Cloud Practitioner — All Questions

Several Linux EC2 instances across multiple Availability Zones must read and write to the same file system at the same time. Which storage service supports this?

• a.An EC2 instance store volume
• b.Amazon Elastic File System (EFS)✓
• c.A single Amazon EBS volume
• d.Amazon S3 Glacier Deep Archive storage class

Amazon EFS is a managed, elastic NFS file system that many EC2 instances can mount concurrently across Availability Zones. A standard EBS volume attaches to only one instance at a time.

Which Amazon S3 storage class offers the lowest storage cost for rarely accessed archival data that can tolerate retrieval times of up to 12 hours?

• a.S3 Glacier Deep Archive✓
• b.S3 Standard-Infrequent Access
• c.S3 Standard
• d.S3 Intelligent-Tiering

S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of data accessed once or twice a year with retrieval times measured in hours. S3 Standard is priced for frequent, immediate access.

What does enabling versioning on an Amazon S3 bucket do?

• a.It converts all objects to the Glacier storage class
• b.It keeps multiple variants of an object so you can recover from unintended overwrites or deletes✓
• c.It replicates the bucket to every AWS Region
• d.It automatically deletes the older versions of every object each night in order to reduce your storage costs

S3 versioning preserves every version of an object, so overwritten or deleted objects can be recovered. It protects against accidental changes but increases storage used, since old versions are retained.

An EC2 instance store (instance-store volume) has which key characteristic that a customer should understand?

• a.It is automatically backed up to Amazon S3 Glacier every hour for long-term retention
• b.It is billed separately as an object storage bucket
• c.It can be shared simultaneously by many instances
• d.Its data is ephemeral and is lost when the instance stops or terminates✓

Instance store provides temporary block storage physically attached to the host, and its data does not persist when the instance stops, hibernates, or terminates. For persistent storage you use EBS or another durable service.

A company keeps petabytes of data on-premises and wants low-latency local access while backing the data up to AWS storage. Which service bridges on-premises applications to AWS storage?

• a.Amazon Route 53
• b.AWS Storage Gateway✓
• c.AWS Lambda
• d.Amazon Redshift data warehouse

AWS Storage Gateway connects on-premises environments to AWS storage, providing local cached access while storing data durably in services such as S3. It supports file, volume, and tape gateway configurations for hybrid storage.

Which service provides fully managed third-party file systems, such as Windows File Server (SMB) and Lustre, on AWS?

• a.Amazon S3
• b.Amazon EBS
• c.Amazon Elastic File System
• d.Amazon FSx✓

Amazon FSx provides fully managed file systems built on popular technologies like Windows File Server and Lustre, useful for Windows-based apps or high-performance computing. EFS, by contrast, provides NFS file storage primarily for Linux.

A team must move 80 TB of data into AWS but has limited internet bandwidth that would take months to upload. Which approach is most practical?

• a.Use an AWS Snow Family device to ship the data physically✓
• b.Store the data only in Amazon EBS snapshots
• c.Upload the data over your existing standard internet connection over several months
• d.Email the data to AWS Support

The AWS Snow Family provides physical, ruggedized devices you load with data and ship to AWS for import, which is far faster than uploading very large datasets over limited bandwidth. It is designed for petabyte- and terabyte-scale transfers.

What is the benefit of Amazon S3 lifecycle policies?

• a.They distribute S3 content to CloudFront edge locations around the world automatically
• b.They automatically transition or expire objects to lower-cost classes based on age✓
• c.They convert S3 buckets into EBS volumes
• d.They encrypt data only while it is in transit

S3 lifecycle policies let you define rules that automatically move objects to cheaper storage classes or delete them after a set time. This reduces cost for data whose access frequency declines predictably.

Within an Amazon VPC, what is a subnet?

• a.A dedicated physical fiber connection running directly into an AWS data center building
• b.A managed DNS zone for your domain
• c.A billing report for network usage
• d.A range of IP addresses in the VPC, tied to a single Availability Zone✓

A subnet is a segment of a VPC's IP address range that resides in one Availability Zone, and you place resources such as EC2 instances into subnets. Public and private subnets differ by whether they have a route to an internet gateway.

What is the role of an internet gateway in a VPC?

• a.It enables communication between resources in the VPC and the internet✓
• b.It automatically encrypts all data stored in Amazon S3 buckets within the VPC
• c.It provides an in-memory cache for databases
• d.It automatically scales EC2 instances

An internet gateway is a VPC component that allows communication between instances in your VPC and the internet. Public subnets route outbound traffic to the internet through it.

Instances in a private subnet need to download software updates from the internet but must not be reachable from the internet. Which component enables this?

• a.An Elastic Load Balancer in the private subnet
• b.An internet gateway attached directly to the private subnet
• c.A NAT gateway in a public subnet✓
• d.An Amazon S3 bucket policy

A NAT gateway lets instances in a private subnet initiate outbound connections to the internet (for example, for updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with a route to the internet gateway.

Which routing policy in Amazon Route 53 sends users to the endpoint that provides the lowest network latency for them?

• a.Failover routing
• b.Weighted routing
• c.Simple routing to a single resource
• d.Latency-based routing✓

Latency-based routing in Route 53 directs users to the AWS Region that gives them the lowest latency, improving performance for a global audience. Weighted and failover policies serve different traffic-distribution goals.

Beyond DNS resolution, which capability does Amazon Route 53 provide?

• a.Managed relational database backups and patching
• b.Object storage with versioning
• c.Serverless function execution
• d.Domain name registration and health checks✓

Amazon Route 53 is a DNS web service that also offers domain registration and health checking of endpoints, allowing traffic to be routed away from unhealthy targets. These features make it a full-featured DNS and traffic-management service.

How does Amazon CloudFront reduce latency for globally distributed users?

• a.By caching copies of content at edge locations near users✓
• b.By replacing the need for an origin server entirely and hosting content itself
• c.By storing all data in a single central Region
• d.By encrypting data only at rest

Amazon CloudFront is a content delivery network that caches content at edge locations worldwide, so users are served from a nearby location instead of a distant origin. This lowers latency and offloads traffic from the origin.

A company needs a private, dedicated network link between its data center and AWS with more consistent throughput than the public internet. Which service provides this?

• a.Amazon Route 53
• b.AWS Direct Connect✓
• c.Amazon CloudFront
• d.AWS Site-to-Site VPN

AWS Direct Connect establishes a dedicated, private physical connection between on-premises and AWS, offering more consistent performance and potentially lower data-transfer costs than the internet. A VPN, by contrast, is encrypted but rides over the public internet.

Which service simplifies connecting thousands of VPCs and on-premises networks through a single central hub?

• a.Amazon EFS
• b.AWS Transit Gateway✓
• c.AWS Certificate Manager
• d.Amazon CloudFront

AWS Transit Gateway acts as a central hub that connects VPCs and on-premises networks, replacing complex peering meshes with a simpler hub-and-spoke topology. It scales network connectivity across many accounts and VPCs.

What is the primary difference between a security group and a network ACL in a VPC?

• a.A security group is stateful at the instance level; a network ACL is stateless at the subnet level✓
• b.A security group only supports deny rules; a network ACL only supports allow rules
• c.There is no functional difference between them
• d.A network ACL is attached directly to individual instances while a security group is attached to whole subnets

Security groups act as stateful firewalls at the instance level, automatically allowing return traffic, while network ACLs are stateless firewalls at the subnet level that evaluate allow and deny rules in order. Both are layers of VPC network security.

Which service lets resources in a VPC reach supported AWS services privately without traversing the public internet?

• a.Amazon CloudFront distributions with signed URLs
• b.Amazon Route 53 health checks
• c.Elastic IP addresses
• d.VPC endpoints (including AWS PrivateLink)✓

VPC endpoints, powered by AWS PrivateLink for many services, let VPC resources connect privately to AWS services without an internet gateway or public IPs. This keeps traffic on the AWS network and improves security.

What does a route table in a VPC control?

• a.Where network traffic from a subnet is directed✓
• b.The encryption keys used for data at rest
• c.The number of instances in an Auto Scaling group
• d.The billing alerts for the account

A route table contains rules (routes) that determine where network traffic from a subnet or gateway is directed, such as to an internet gateway or NAT gateway. Each subnet is associated with a route table.

What does the Multi-AZ deployment option for Amazon RDS provide?

• a.A read-only replica that is used only to increase read throughput for heavy reporting queries
• b.A synchronous standby replica in another Availability Zone for automatic failover✓
• c.Automatic conversion of the database to a NoSQL engine
• d.A discount on the database instance price

RDS Multi-AZ maintains a synchronous standby in a different Availability Zone and fails over automatically if the primary fails, improving availability and durability. It is for resilience, not for scaling read traffic, which is what read replicas address.

A read-heavy application backed by Amazon RDS needs to offload read queries from the primary database. Which feature helps?

• a.A NAT gateway
• b.Multi-AZ standby
• c.RDS read replicas✓
• d.A larger EBS snapshot

RDS read replicas provide additional read-only copies that can serve read traffic, reducing load on the primary and improving read scalability. Multi-AZ, by contrast, provides a standby for failover, not for scaling reads.

Which use case is Amazon DynamoDB best suited for?

• a.Mounting a single shared POSIX-compliant file system across many Linux servers at the same time
• b.A petabyte-scale columnar analytics warehouse
• c.Complex multi-table SQL joins for reporting
• d.A high-traffic application needing single-digit millisecond key-value lookups at any scale✓

DynamoDB is a fully managed NoSQL key-value and document database delivering consistent, low-latency performance at scale, ideal for high-traffic apps with simple access patterns. Relational analytics and joins are better served by RDS or Redshift.

Amazon Aurora is best described as which of the following?

• a.A MySQL- and PostgreSQL-compatible relational database built for the cloud with high performance and availability✓
• b.A managed in-memory cache using Redis
• c.A fully managed graph database service purpose-built for highly connected datasets such as social and recommendation graphs
• d.A serverless function runtime

Amazon Aurora is a cloud-optimized relational database compatible with MySQL and PostgreSQL, offering higher throughput and built-in fault-tolerant, self-healing storage. It is part of the Amazon RDS family.

A business intelligence team needs to run complex analytical queries across billions of rows for reporting. Which service is purpose-built for this?

• a.Amazon Redshift✓
• b.Amazon RDS for MySQL
• c.Amazon DynamoDB
• d.Amazon ElastiCache

Amazon Redshift is a managed, petabyte-scale data warehouse using columnar storage and massively parallel processing, optimized for analytical (OLAP) queries. Transactional databases like RDS and DynamoDB are optimized for different workloads.

Which service provides a managed in-memory data store to reduce database load and speed up read-heavy applications?

• a.Amazon Athena
• b.Amazon ElastiCache✓
• c.Amazon Neptune
• d.Amazon Redshift Serverless

Amazon ElastiCache offers managed Redis or Memcached in-memory caches that store frequently accessed data close to the application, reducing latency and offloading the primary database. It is commonly placed in front of databases for read-heavy workloads.

A team is migrating an on-premises database to AWS and wants to minimize downtime during the move. Which service is designed to help?

• a.Amazon SNS
• b.Amazon CloudFront
• c.AWS Trusted Advisor cost and security checks
• d.AWS Database Migration Service (DMS)✓

AWS Database Migration Service migrates databases to AWS while the source remains operational, minimizing downtime, and supports both homogeneous and heterogeneous migrations. It is the standard tool for moving databases into AWS.

Which AWS service is a fully managed graph database for use cases such as social networks and recommendation engines?

• a.Amazon DynamoDB
• b.Amazon Redshift
• c.Amazon Neptune✓
• d.Amazon RDS for Oracle

Amazon Neptune is a fully managed graph database service optimized for highly connected data and queries, such as social graphs, fraud detection, and recommendation engines. It supports popular graph models and query languages.

What is a key operational advantage of using Amazon RDS instead of running a database yourself on EC2?

• a.RDS eliminates all database costs
• b.RDS automates administrative tasks such as patching, backups, and failover✓
• c.RDS lets you run any database engine ever created
• d.RDS gives you full root operating-system access so you can tune the kernel yourself

Amazon RDS handles time-consuming administration like software patching, automated backups, and failover, letting teams focus on the data and application. Running a database on EC2 leaves all of that management to the customer.

Which AWS service would you use to set an alarm that notifies you when an EC2 instance's CPU utilization stays above a threshold?

• a.Amazon CloudWatch✓
• b.AWS Artifact
• c.AWS CloudTrail audit logs
• d.Amazon Cognito

Amazon CloudWatch collects metrics such as CPU utilization and lets you create alarms that trigger notifications or actions when thresholds are breached. It is the primary monitoring and observability service on AWS.

You need to determine which user made a specific change to a resource and when it happened. Which service records this account activity?

• a.AWS Pricing Calculator
• b.Amazon CloudWatch metrics
• c.AWS CloudTrail✓
• d.Amazon S3 versioning

AWS CloudTrail records API calls and account activity, providing an audit trail of who did what, when, and from where. CloudWatch focuses on performance metrics and logs rather than API-level auditing.

What is the primary purpose of AWS CloudFormation?

• a.To define and provision AWS infrastructure from templates as code✓
• b.To store objects durably across Availability Zones
• c.To distribute content to edge locations
• d.To monitor application performance and user experience in real time

AWS CloudFormation lets you describe infrastructure in JSON or YAML templates and provision it automatically and repeatably as stacks. This infrastructure-as-code approach makes environments consistent and easy to recreate.

Which three primary methods can be used to interact with and provision AWS services?

• a.The AWS Management Console, the AWS CLI, and the AWS SDKs✓
• b.Only the AWS Management Console
• c.Only third-party automation tools that are not made or supported by AWS
• d.Only physical mail requests to AWS

You can interact with AWS through the web-based Management Console, the AWS Command Line Interface (CLI), and language-specific AWS SDKs. All three ultimately call the same AWS service APIs.

A developer wants a browser-based shell, already authenticated, to run AWS CLI commands without installing anything locally. Which service provides this?

• a.AWS Config
• b.AWS CloudFormation
• c.Amazon Inspector
• d.AWS CloudShell✓

AWS CloudShell is a browser-based shell in the console, pre-authenticated with your console credentials and preloaded with the AWS CLI and common tools. It lets you run commands without installing or configuring anything locally.

Which service continuously records and evaluates the configuration of your AWS resources to help assess compliance over time?

• a.Amazon CloudWatch
• b.AWS Config✓
• c.Amazon SNS
• d.AWS CloudShell

AWS Config records resource configurations and changes over time and can evaluate them against rules to assess compliance. It is useful for auditing, change management, and governance.

Which service helps you manage operational tasks such as patching and running commands across fleets of EC2 instances at scale?

• a.Amazon Athena
• b.Amazon Comprehend natural-language processing
• c.Amazon Neptune
• d.AWS Systems Manager✓

AWS Systems Manager provides operational tools to view and control infrastructure, including running commands, applying patches, and managing parameters across fleets of instances. It centralizes many routine operational tasks.

A large enterprise wants to centrally set up and govern a secure, multi-account AWS environment based on best practices. Which service automates this landing-zone setup?

• a.AWS Control Tower✓
• b.Amazon Macie
• c.AWS Direct Connect
• d.Amazon CloudFront

AWS Control Tower automates the setup of a well-architected, multi-account environment (a landing zone) with guardrails and best practices, built on top of AWS Organizations. It simplifies governance at scale.

What is the benefit of using infrastructure as code with services like AWS CloudFormation?

• a.It automatically writes the application's business logic
• b.It completely removes the need to pay for any of the provisioned underlying resources
• c.It prevents anyone from ever deleting resources
• d.Environments can be provisioned consistently and repeatably, reducing manual errors✓

Infrastructure as code lets you define resources in templates so environments are created the same way every time, reducing manual configuration errors and enabling version control. You still pay for whatever resources the templates provision.

Which service lets developers model cloud infrastructure using familiar programming languages such as Python or TypeScript, which then synthesizes CloudFormation templates?

• a.AWS Systems Manager Automation runbooks
• b.Amazon QuickSight
• c.AWS Cloud Development Kit (CDK)✓
• d.AWS Config

The AWS Cloud Development Kit (CDK) lets you define infrastructure using general-purpose programming languages, which it converts into CloudFormation templates for provisioning. It appeals to developers who prefer code over raw templates.

Which service is a serverless event bus that connects application components using events from AWS services, SaaS apps, and your own apps?

• a.Amazon RDS
• b.Amazon EBS
• c.Amazon EventBridge✓
• d.Amazon Elastic File System

Amazon EventBridge is a serverless event bus that routes events between AWS services, custom applications, and SaaS providers, enabling event-driven architectures. It helps decouple producers and consumers of events.

Which service lets you coordinate multiple AWS services into serverless workflows using visual state machines?

• a.Amazon EBS
• b.Amazon CloudFront content delivery network
• c.Amazon Route 53
• d.AWS Step Functions✓

AWS Step Functions orchestrates multiple services into serverless workflows defined as state machines, managing sequencing, retries, and error handling. It simplifies building and visualizing multi-step processes.

A team is building a REST API and wants a managed service to create, publish, secure, and monitor APIs at scale. Which service should they use?

• a.Amazon Redshift
• b.Amazon Kinesis Data Streams
• c.Amazon EFS
• d.Amazon API Gateway✓

Amazon API Gateway is a fully managed service for creating, publishing, securing, and monitoring APIs at any scale, and it integrates well with Lambda for serverless backends. It handles traffic management, authorization, and throttling.

Which service is designed to collect, process, and analyze streaming data such as clickstreams or IoT telemetry in real time?

• a.Amazon Kinesis✓
• b.AWS Artifact
• c.Amazon Glacier
• d.Amazon Athena interactive queries

Amazon Kinesis captures and processes real-time streaming data such as logs, clickstreams, and telemetry, enabling near-real-time analytics. Athena, by contrast, runs SQL queries against data already stored in S3.

Which service lets you run standard SQL queries directly against data stored in Amazon S3 without loading it into a database?

• a.Amazon DynamoDB
• b.Amazon Athena✓
• c.Amazon Redshift Spectrum only
• d.Amazon RDS

Amazon Athena is a serverless, interactive query service that runs SQL directly against data in Amazon S3, charging per data scanned with no infrastructure to manage. It is ideal for ad hoc analysis of data already in S3.

Which fully managed service helps developers build, train, and deploy machine learning models?

• a.Amazon EBS
• b.Amazon Route 53 DNS service
• c.Amazon SageMaker✓
• d.AWS CloudTrail

Amazon SageMaker is a managed platform that covers the full machine-learning lifecycle, from building and training models to deploying them for inference. It removes much of the heavy lifting of standing up ML infrastructure.

Which AWS AI service converts text into lifelike speech?

• a.Amazon Rekognition
• b.Amazon Polly✓
• c.Amazon Translate
• d.Amazon Comprehend

Amazon Polly turns text into lifelike speech using deep learning, supporting many languages and voices. Rekognition analyzes images and video, Comprehend does natural-language processing, and Translate performs language translation.

Which service provides a fully managed data-integration (ETL) capability to discover, prepare, and combine data for analytics?

• a.Amazon Route 53
• b.Amazon EFS
• c.Amazon EC2
• d.AWS Glue✓

AWS Glue is a serverless data-integration service that makes it easy to discover, prepare, transform, and combine data for analytics and machine learning. It includes a data catalog and managed ETL jobs.

A company needs AWS compute and storage running physically inside its own on-premises data center while using the same AWS APIs. Which service provides this?

• a.Amazon Lightsail
• b.Amazon CloudFront
• c.AWS Outposts✓
• d.AWS Snowmobile

AWS Outposts brings AWS infrastructure and services to a customer's on-premises facility, offering a consistent hybrid experience with the same APIs and tools used in AWS Regions. It suits low-latency or data-residency needs that require local processing.

What are AWS Local Zones primarily used for?

• a.Storing rarely accessed archival data at the lowest possible storage cost for many years
• b.Placing compute and storage closer to large population centers for very low latency✓
• c.Registering domain names
• d.Replacing the need for IAM permissions

AWS Local Zones extend a Region to place select services closer to end users in specific metropolitan areas, reducing latency for demanding applications like gaming or media. They are an extension of the Region's infrastructure.

Which statement about AWS Lambda pricing and operation is correct?

• a.It requires you to patch the underlying operating system
• b.It can only run code written in Java
• c.You are charged based on the number of requests and the duration your code runs✓
• d.You must reserve and pay for a fixed number of servers in advance for the whole term

With Lambda you pay per request and for the compute duration your function consumes, and AWS manages the servers, scaling, and patching. It supports many languages and scales automatically with demand.

A message must be delivered to multiple subscribers at once (fan-out), such as several queues and an email endpoint. Which service is designed for this?

• a.Amazon Simple Queue Service
• b.Amazon EBS
• c.Amazon RDS
• d.Amazon SNS✓

Amazon SNS is a publish/subscribe service that delivers a single published message to many subscribers simultaneously, such as SQS queues, Lambda functions, and email. SQS, by contrast, is a queue for point-to-point, decoupled processing.