AWS Cloud Practitioner — All Questions

Which AWS service provides resizable virtual servers in the cloud on which you can run applications?

• a.Amazon RDS
• b.Amazon EC2✓
• c.Amazon S3
• d.AWS Lambda

Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers, called instances, where you control the operating system and software. S3 is object storage, RDS is a managed database, and Lambda runs code without provisioning servers.

Which AWS service provides highly durable object storage designed for 11 nines of durability?

• a.Amazon S3✓
• b.Amazon EC2
• c.Amazon VPC
• d.AWS IAM

Amazon S3 (Simple Storage Service) is object storage designed for 99.999999999% (11 nines) durability by redundantly storing data across multiple facilities. It is commonly used for backups, static websites, data lakes, and media.

Which service lets you run code without provisioning or managing servers, charging only for the compute time consumed?

• a.Amazon EBS
• b.Amazon RDS
• c.AWS Lambda✓
• d.Amazon EC2

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute. You pay only for the requests and the compute time your code uses.

Which service is a managed relational database that supports engines such as MySQL, PostgreSQL, and SQL Server?

• a.Amazon S3
• b.Amazon DynamoDB
• c.Amazon RDS✓
• d.Amazon ElastiCache

Amazon RDS (Relational Database Service) is a managed service for relational databases, handling tasks like patching, backups, and failover for engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. DynamoDB, by contrast, is a NoSQL database.

Which AWS service is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at scale?

• a.Amazon Aurora
• b.Amazon Redshift
• c.Amazon RDS
• d.Amazon DynamoDB✓

Amazon DynamoDB is a fully managed NoSQL database offering fast, consistent performance at any scale with no servers to manage. It is well suited for high-traffic applications needing flexible schemas.

What is an AWS Region?

• a.A physical geographic area containing multiple, isolated Availability Zones✓
• b.A billing category for support plans
• c.A single building that houses one server rack
• d.A content delivery cache at the network edge

An AWS Region is a separate geographic area, each containing multiple Availability Zones. Customers choose Regions based on factors such as latency, data-residency requirements, and service availability.

What is an Availability Zone (AZ)?

• a.A type of EC2 instance
• b.A global DNS service
• c.One or more discrete data centers with redundant power and networking within a Region✓
• d.A billing report

An Availability Zone consists of one or more discrete data centers with independent power, cooling, and networking, isolated from failures in other AZs. Deploying across multiple AZs increases availability and fault tolerance.

Why should a highly available application be deployed across multiple Availability Zones?

• a.So the application can continue running if one AZ experiences a failure✓
• b.To reduce the AWS bill to zero
• c.Because a single AZ cannot run any instances
• d.To avoid using load balancers

Spreading resources across multiple AZs means that if one zone fails, the application can continue serving traffic from the others. AZs are physically isolated, so this design improves availability and fault tolerance.

Which service is a content delivery network (CDN) that caches content at edge locations to reduce latency for users?

• a.AWS Lambda
• b.Amazon CloudFront✓
• c.Amazon EBS
• d.Amazon RDS

Amazon CloudFront is a CDN that caches copies of content at edge locations around the world, delivering it to users from the nearest location to reduce latency. It integrates with services like S3 and load balancers as origins.

Which service automatically distributes incoming application traffic across multiple targets such as EC2 instances?

• a.Amazon S3
• b.Elastic Load Balancing (ELB)✓
• c.Amazon Route 53
• d.AWS Lambda

Elastic Load Balancing automatically spreads incoming traffic across multiple healthy targets, such as EC2 instances in different AZs. This improves fault tolerance and helps applications scale.

Which service automatically adjusts the number of EC2 instances to match demand based on defined policies?

• a.Amazon EC2 Auto Scaling✓
• b.AWS IAM
• c.Amazon S3
• d.Amazon CloudFront

EC2 Auto Scaling adds or removes instances automatically according to demand and your scaling policies, helping maintain performance while controlling cost. Combined with a load balancer, it supports elastic, resilient architectures.

Which storage service provides persistent block-level volumes that can be attached to EC2 instances?

• a.Amazon CloudFront
• b.Amazon EBS✓
• c.Amazon S3
• d.Amazon Route 53

Amazon EBS (Elastic Block Store) provides durable block storage volumes for use with EC2 instances, similar to a virtual hard disk. Volumes persist independently of the instance lifecycle and can be snapshotted to S3.

Which service provides scalable, shared file storage that multiple Linux EC2 instances can mount simultaneously?

• a.Amazon EFS✓
• b.Amazon S3 Glacier
• c.Amazon DynamoDB
• d.Amazon EBS

Amazon EFS (Elastic File System) is a managed, elastic NFS file system that many EC2 instances can mount concurrently. Unlike EBS, which attaches to a single instance at a time, EFS supports shared access.

Which AWS service is a scalable Domain Name System (DNS) web service used to route users to applications?

• a.Amazon CloudFront
• b.Amazon VPC
• c.Amazon Route 53✓
• d.AWS Direct Connect

Amazon Route 53 is a highly available and scalable DNS service that routes end users to applications by translating domain names into IP addresses. It also supports domain registration and health checks.

Which service lets you provision a logically isolated section of the AWS Cloud where you define your own IP ranges, subnets, and routing?

• a.AWS Lambda
• b.Amazon CloudWatch
• c.Amazon S3
• d.Amazon VPC✓

Amazon VPC (Virtual Private Cloud) lets you create an isolated virtual network in AWS where you control IP address ranges, subnets, route tables, and gateways. It gives you networking control similar to a traditional data center.

Which service provides monitoring and observability, collecting metrics, logs, and alarms for AWS resources and applications?

• a.Amazon CloudWatch✓
• b.Amazon Route 53
• c.Amazon Cognito
• d.AWS Artifact

Amazon CloudWatch collects metrics, logs, and events, and can trigger alarms and actions based on thresholds. It is the primary monitoring service for gaining operational visibility into AWS resources and applications.

Which service lets you model and provision AWS infrastructure as code using templates?

• a.Amazon CloudWatch
• b.AWS Shield
• c.Amazon Inspector
• d.AWS CloudFormation✓

AWS CloudFormation lets you define infrastructure in templates and provision it automatically and repeatably as 'stacks.' This infrastructure-as-code approach makes environments consistent and easy to replicate.

A developer wants to deploy a web application without manually configuring the underlying compute, load balancing, and scaling. Which service handles this?

• a.Amazon VPC
• b.Amazon S3
• c.AWS Elastic Beanstalk✓
• d.Amazon EC2

AWS Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, automatically handling capacity provisioning, load balancing, scaling, and health monitoring. Developers simply upload code while retaining control of the resources.

Which fully managed message queuing service decouples components by letting them send and receive messages asynchronously?

• a.Amazon CloudFront
• b.Amazon EFS
• c.Amazon SQS✓
• d.Amazon RDS

Amazon SQS (Simple Queue Service) is a managed message queue that lets application components communicate asynchronously, improving decoupling and resilience. Producers send messages to a queue and consumers process them independently.

Which service is a fully managed publish/subscribe messaging service used to send notifications to subscribers or other services?

• a.Amazon Redshift
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon SNS✓

Amazon SNS (Simple Notification Service) is a pub/sub messaging service that delivers messages to multiple subscribers such as email, SMS, or other AWS services. It is often used for fan-out notifications and event-driven architectures.

Which service is a fully managed data warehouse designed for running complex analytic queries over large datasets?

• a.Amazon SQS
• b.Amazon Redshift✓
• c.Amazon EFS
• d.Amazon DynamoDB

Amazon Redshift is a managed, petabyte-scale data warehouse optimized for analytical queries using columnar storage and parallel processing. It is designed for business intelligence workloads rather than transactional processing.

A company needs a dedicated, private network connection from its on-premises data center to AWS that bypasses the public internet. Which service should it use?

• a.Amazon CloudFront
• b.Amazon SNS
• c.AWS Direct Connect✓
• d.Amazon Route 53

AWS Direct Connect establishes a dedicated private network connection between on-premises and AWS, providing more consistent network performance than the public internet. It is often used for large data transfers and hybrid architectures.

Which option lets you create an encrypted connection over the public internet between your on-premises network and your VPC?

• a.An Elastic IP address
• b.Amazon CloudFront distribution
• c.AWS Site-to-Site VPN✓
• d.S3 Transfer Acceleration

AWS Site-to-Site VPN creates an encrypted tunnel over the internet between your network and your VPC. Unlike Direct Connect, it uses the public internet but is quick to set up and encrypted.

Which purchasing option is best for a fault-tolerant, flexible workload that can handle interruptions and wants the lowest EC2 price?

• a.Reserved Instances with no flexibility
• b.Dedicated Hosts
• c.On-Demand Instances
• d.Spot Instances✓

Spot Instances let you use spare EC2 capacity at steep discounts but can be reclaimed by AWS with short notice. They are ideal for fault-tolerant, flexible workloads such as batch processing.

Which AWS database service is MySQL- and PostgreSQL-compatible and offers higher performance and availability as part of RDS?

• a.Amazon ElastiCache
• b.Amazon DynamoDB
• c.Amazon Neptune
• d.Amazon Aurora✓

Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, offering greater throughput and built-in high availability compared to standard engines. It is part of the Amazon RDS family.

Which service provides in-memory caching to improve the performance of read-heavy applications, supporting engines like Redis and Memcached?

• a.Amazon ElastiCache✓
• b.Amazon EFS
• c.Amazon RDS
• d.Amazon Redshift

Amazon ElastiCache provides managed in-memory data stores using Redis or Memcached to reduce latency and offload databases. It is commonly used to cache frequently accessed data for faster reads.

Which S3 storage class is designed for long-term archival where retrieval times of minutes to hours are acceptable at very low cost?

• a.S3 Intelligent-Tiering
• b.S3 Standard
• c.S3 Standard-Infrequent Access
• d.S3 Glacier✓

The S3 Glacier storage classes are designed for low-cost, long-term archival where data is accessed rarely and some retrieval delay is acceptable. S3 Standard, by contrast, is for frequently accessed data with immediate retrieval.

Which S3 feature automatically moves objects between access tiers based on changing access patterns to optimize cost?

• a.S3 Intelligent-Tiering✓
• b.S3 Versioning
• c.S3 Cross-Region Replication
• d.S3 Transfer Acceleration

S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing storage costs without performance impact or operational overhead. It is useful when access patterns are unknown or changing.

A team wants to run Docker containers on AWS without managing the underlying EC2 servers. Which combination is most appropriate?

• a.Amazon ECS or EKS with AWS Fargate✓
• b.Amazon RDS with EBS
• c.Amazon Route 53 with CloudFront
• d.Amazon SNS with SQS

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, removing the need to provision or manage EC2 instances. It lets teams run containers while AWS handles the underlying infrastructure.

Which service can migrate large amounts of data into AWS by shipping a physical, ruggedized storage device when network transfer would be too slow?

• a.Amazon S3 Transfer Acceleration
• b.Amazon CloudFront
• c.AWS Direct Connect
• d.AWS Snowball✓

AWS Snowball is a physical data transport device used to move large datasets into or out of AWS when transferring over the network would take too long or be too costly. AWS ships the device, you load data, and return it for import.

Which statement correctly describes edge locations in the AWS global infrastructure?

• a.They replace Availability Zones
• b.They are where the root user signs in
• c.They are sites used to cache content closer to users, primarily for services like CloudFront✓
• d.They are used only for storing relational databases

Edge locations are part of the content delivery network and cache content closer to end users to reduce latency. They are distinct from Regions and Availability Zones, which host the core compute and storage infrastructure.

Which service allows you to register domain names and configure routing policies such as latency-based or weighted routing?

• a.Amazon EBS
• b.AWS CloudFormation
• c.Amazon Route 53✓
• d.Amazon VPC

Amazon Route 53 supports domain registration and advanced DNS routing policies, including latency-based, weighted, geolocation, and failover routing. This helps direct users to the best endpoint for their needs.

What is the main advantage of a serverless architecture using services like Lambda and DynamoDB?

• a.You focus on code and data while AWS manages provisioning and scaling of the infrastructure✓
• b.You pay a fixed monthly fee regardless of usage
• c.You must manually patch and scale servers
• d.You cannot integrate with other AWS services

Serverless services remove the need to provision, patch, and scale servers, letting developers focus on application logic while AWS handles the underlying infrastructure. Billing is typically based on actual usage rather than pre-provisioned capacity.

Which compute option provides physically dedicated servers for a customer, often used to meet licensing or compliance requirements?

• a.Amazon EC2 Dedicated Hosts✓
• b.Amazon S3
• c.Spot Instances
• d.AWS Lambda

Amazon EC2 Dedicated Hosts provide physical servers dedicated to a single customer, which can help address software licensing that is tied to physical cores or specific compliance needs. They give visibility and control over the underlying hardware.

Why does AWS offer several Amazon EC2 instance families such as compute-optimized, memory-optimized, and storage-optimized?

• a.Because each family is permanently locked to one specific AWS Region and cannot be resized or migrated later
• b.So you can match the balance of CPU, memory, and storage to your workload✓
• c.Because larger families are the only ones eligible for the Free Tier
• d.Because instance families determine which support plan you must purchase

EC2 offers purpose-built instance families so you can pick hardware that fits a workload, such as memory-optimized for in-memory databases or compute-optimized for batch processing. Choosing the right family improves performance efficiency and cost.

What is an Amazon Machine Image (AMI) used for when launching Amazon EC2 instances?

• a.It provides the template of the operating system and software used to launch an instance✓
• b.It is the DNS record that routes users to the instance
• c.It sets the maximum monthly spending limit and automatically stops the instance when that limit is reached
• d.It is the physical server that the instance runs on

An AMI is a preconfigured template containing the operating system, and optionally application software, used to launch EC2 instances. Using a custom AMI lets you launch identical instances quickly and consistently.

A workload runs a short function each time a file is uploaded to Amazon S3 and should incur no charge when idle. Which compute service fits best?

• a.Amazon EC2 Dedicated Hosts reserved for three years
• b.AWS Lambda✓
• c.An Amazon RDS database instance running continuously
• d.A fleet of always-on Amazon EC2 instances

AWS Lambda runs code in response to events, such as an S3 upload, and charges only for the requests and compute time used, with no cost while idle. This event-driven, serverless model is ideal for intermittent tasks.

Which statement best describes AWS Fargate?

• a.A service that registers domain names and manages DNS routing
• b.A managed relational database engine compatible with MySQL
• c.A serverless compute engine that runs containers without managing EC2 servers✓
• d.A ruggedized physical appliance that AWS ships to your data center to transfer very large datasets offline

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, so you run containers without provisioning or managing the underlying EC2 instances. You pay for the vCPU and memory your containers request.

A company wants to run and orchestrate Kubernetes on AWS while letting AWS manage the Kubernetes control plane. Which service should it use?

• a.Amazon EC2 Auto Scaling
• b.Amazon Simple Queue Service (SQS)
• c.AWS Elastic Beanstalk with managed container support
• d.Amazon Elastic Kubernetes Service (EKS)✓

Amazon EKS is a managed service that runs the Kubernetes control plane for you, so you can deploy and operate Kubernetes clusters without maintaining the control-plane infrastructure yourself. Amazon ECS is AWS's own container orchestrator alternative.

Which AWS service is a fully managed batch-processing service that dynamically provisions compute to run large numbers of batch computing jobs?

• a.Amazon Athena
• b.Amazon Kinesis Data Streams
• c.Amazon Lightsail
• d.AWS Batch✓

AWS Batch plans, schedules, and runs batch computing workloads, automatically provisioning the right quantity and type of compute based on job requirements. It removes the need to manually manage batch infrastructure.

A developer wants a simple way to launch a small website with a bundled virtual server, storage, and networking for a predictable low monthly price. Which service is designed for this?

• a.Amazon Redshift
• b.AWS CloudFormation
• c.Amazon Lightsail✓
• d.Amazon EMR

Amazon Lightsail offers easy-to-use virtual private servers bundled with storage and networking at a predictable monthly price, aimed at simpler workloads and users new to the cloud. It abstracts much of the configuration required with raw EC2.

In Amazon EC2, what does the instance type (for example, m5.large) primarily determine?

• a.The specific AWS Region and Availability Zone that the instance is permanently tied to for its whole life
• b.The IAM permissions granted to the instance
• c.The amount of vCPU, memory, storage, and network capacity of the instance✓
• d.The Availability Zone that will be used automatically

An EC2 instance type defines the hardware profile of the instance, including vCPUs, memory, storage, and networking performance. Selecting the right type balances performance and cost for the workload.

Which EC2 feature lets you run instances on hardware physically isolated for a single customer to help meet strict compliance or licensing rules tied to physical cores?

• a.Dedicated Hosts✓
• b.Auto Scaling groups
• c.Spot Instances
• d.Elastic IP addresses

Amazon EC2 Dedicated Hosts provide a physical server dedicated to your use, giving visibility into sockets and cores that helps with license terms and compliance. Standard shared tenancy places instances on hardware shared with other customers.

What is the main purpose of an Amazon EC2 Auto Scaling group's desired, minimum, and maximum capacity settings?

• a.To set the KMS encryption keys used for the instances' attached storage volumes and their snapshots
• b.To choose which support plan applies to the account
• c.To determine the retention period for CloudTrail logs
• d.To keep the number of running instances within defined bounds as demand changes✓

An Auto Scaling group uses minimum, maximum, and desired capacity to control how many instances run, adding or removing instances within those bounds as scaling policies trigger. This maintains availability while matching capacity to demand.

A stateless web tier needs to scale out during traffic spikes and in during quiet periods automatically. Which pair of services is most appropriate?

• a.Amazon S3 for storage combined with Amazon Glacier for archival
• b.Amazon Route 53 and AWS Artifact
• c.Elastic Load Balancing with EC2 Auto Scaling✓
• d.Amazon SNS with Amazon Cognito

Elastic Load Balancing distributes incoming traffic across instances while EC2 Auto Scaling adjusts the number of instances to match demand. Together they provide an elastic, highly available web tier.

Which statement about AWS Elastic Beanstalk is correct?

• a.It is a NoSQL database service for key-value data
• b.It only supports static websites with no server-side code
• c.You upload application code and it provisions and manages the underlying resources for you✓
• d.It requires you to manually configure every load balancer, Auto Scaling group, and security group yourself

Elastic Beanstalk is a platform service where you upload code and it automatically handles capacity provisioning, load balancing, scaling, and health monitoring. You keep full control of the underlying AWS resources if you need it.

In Amazon S3, what is a 'bucket'?

• a.A reserved compute capacity reservation
• b.A virtual network boundary for your resources
• c.A container that holds objects (files) stored in S3✓
• d.A block-level storage volume that attaches to a single EC2 instance

In Amazon S3, a bucket is the top-level container that holds objects, each identified by a unique key. Buckets are created in a specific Region and organize your stored data.

Which characteristic distinguishes object storage such as Amazon S3 from block storage such as Amazon EBS?

• a.Object storage manages data as whole objects with metadata, accessed over HTTP-based APIs✓
• b.Block storage cannot be attached to compute resources
• c.Object storage can only hold files smaller than one megabyte and cannot store any associated metadata
• d.Block storage is accessed only through a web browser

Object storage like S3 stores data as complete objects with metadata and is accessed via web APIs, making it ideal for unstructured data at scale. Block storage like EBS presents raw volumes to an instance, which the OS formats and uses like a disk.

A single Amazon EC2 instance needs a persistent, low-latency volume that behaves like an attached disk for its operating system and database files. Which service fits?

• a.Amazon Elastic Block Store (EBS)✓
• b.Amazon S3
• c.Amazon SQS
• d.Amazon Elastic File System (EFS) shared mount

Amazon EBS provides persistent block-level volumes attached to a single EC2 instance, suitable for boot volumes and databases that need low-latency disk access. The volume persists independently of the instance lifecycle.

What does an Amazon EBS snapshot allow you to do?

• a.Automatically resize the volume every hour
• b.Create a point-in-time backup of a volume that is stored durably in Amazon S3✓
• c.Convert the volume into an object storage bucket
• d.It lets you attach the same volume to hundreds of instances across many Availability Zones at once

An EBS snapshot captures a point-in-time backup of a volume and stores it durably in Amazon S3 (managed by AWS). Snapshots are incremental and can be used to restore volumes or create new ones.

Several Linux EC2 instances across multiple Availability Zones must read and write to the same file system at the same time. Which storage service supports this?

• a.An EC2 instance store volume
• b.Amazon Elastic File System (EFS)✓
• c.A single Amazon EBS volume
• d.Amazon S3 Glacier Deep Archive storage class

Amazon EFS is a managed, elastic NFS file system that many EC2 instances can mount concurrently across Availability Zones. A standard EBS volume attaches to only one instance at a time.

Which Amazon S3 storage class offers the lowest storage cost for rarely accessed archival data that can tolerate retrieval times of up to 12 hours?

• a.S3 Glacier Deep Archive✓
• b.S3 Standard-Infrequent Access
• c.S3 Standard
• d.S3 Intelligent-Tiering

S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of data accessed once or twice a year with retrieval times measured in hours. S3 Standard is priced for frequent, immediate access.

What does enabling versioning on an Amazon S3 bucket do?

• a.It converts all objects to the Glacier storage class
• b.It keeps multiple variants of an object so you can recover from unintended overwrites or deletes✓
• c.It replicates the bucket to every AWS Region
• d.It automatically deletes the older versions of every object each night in order to reduce your storage costs

S3 versioning preserves every version of an object, so overwritten or deleted objects can be recovered. It protects against accidental changes but increases storage used, since old versions are retained.

An EC2 instance store (instance-store volume) has which key characteristic that a customer should understand?

• a.It is automatically backed up to Amazon S3 Glacier every hour for long-term retention
• b.It is billed separately as an object storage bucket
• c.It can be shared simultaneously by many instances
• d.Its data is ephemeral and is lost when the instance stops or terminates✓

Instance store provides temporary block storage physically attached to the host, and its data does not persist when the instance stops, hibernates, or terminates. For persistent storage you use EBS or another durable service.

A company keeps petabytes of data on-premises and wants low-latency local access while backing the data up to AWS storage. Which service bridges on-premises applications to AWS storage?

• a.Amazon Route 53
• b.AWS Storage Gateway✓
• c.AWS Lambda
• d.Amazon Redshift data warehouse

AWS Storage Gateway connects on-premises environments to AWS storage, providing local cached access while storing data durably in services such as S3. It supports file, volume, and tape gateway configurations for hybrid storage.

Which service provides fully managed third-party file systems, such as Windows File Server (SMB) and Lustre, on AWS?

• a.Amazon S3
• b.Amazon EBS
• c.Amazon Elastic File System
• d.Amazon FSx✓

Amazon FSx provides fully managed file systems built on popular technologies like Windows File Server and Lustre, useful for Windows-based apps or high-performance computing. EFS, by contrast, provides NFS file storage primarily for Linux.

A team must move 80 TB of data into AWS but has limited internet bandwidth that would take months to upload. Which approach is most practical?

• a.Use an AWS Snow Family device to ship the data physically✓
• b.Store the data only in Amazon EBS snapshots
• c.Upload the data over your existing standard internet connection over several months
• d.Email the data to AWS Support

The AWS Snow Family provides physical, ruggedized devices you load with data and ship to AWS for import, which is far faster than uploading very large datasets over limited bandwidth. It is designed for petabyte- and terabyte-scale transfers.

What is the benefit of Amazon S3 lifecycle policies?

• a.They distribute S3 content to CloudFront edge locations around the world automatically
• b.They automatically transition or expire objects to lower-cost classes based on age✓
• c.They convert S3 buckets into EBS volumes
• d.They encrypt data only while it is in transit

S3 lifecycle policies let you define rules that automatically move objects to cheaper storage classes or delete them after a set time. This reduces cost for data whose access frequency declines predictably.

Within an Amazon VPC, what is a subnet?

• a.A dedicated physical fiber connection running directly into an AWS data center building
• b.A managed DNS zone for your domain
• c.A billing report for network usage
• d.A range of IP addresses in the VPC, tied to a single Availability Zone✓

A subnet is a segment of a VPC's IP address range that resides in one Availability Zone, and you place resources such as EC2 instances into subnets. Public and private subnets differ by whether they have a route to an internet gateway.

What is the role of an internet gateway in a VPC?

• a.It enables communication between resources in the VPC and the internet✓
• b.It automatically encrypts all data stored in Amazon S3 buckets within the VPC
• c.It provides an in-memory cache for databases
• d.It automatically scales EC2 instances

An internet gateway is a VPC component that allows communication between instances in your VPC and the internet. Public subnets route outbound traffic to the internet through it.

Instances in a private subnet need to download software updates from the internet but must not be reachable from the internet. Which component enables this?

• a.An Elastic Load Balancer in the private subnet
• b.An internet gateway attached directly to the private subnet
• c.A NAT gateway in a public subnet✓
• d.An Amazon S3 bucket policy

A NAT gateway lets instances in a private subnet initiate outbound connections to the internet (for example, for updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with a route to the internet gateway.

Which routing policy in Amazon Route 53 sends users to the endpoint that provides the lowest network latency for them?

• a.Failover routing
• b.Weighted routing
• c.Simple routing to a single resource
• d.Latency-based routing✓

Latency-based routing in Route 53 directs users to the AWS Region that gives them the lowest latency, improving performance for a global audience. Weighted and failover policies serve different traffic-distribution goals.

Beyond DNS resolution, which capability does Amazon Route 53 provide?

• a.Managed relational database backups and patching
• b.Object storage with versioning
• c.Serverless function execution
• d.Domain name registration and health checks✓

Amazon Route 53 is a DNS web service that also offers domain registration and health checking of endpoints, allowing traffic to be routed away from unhealthy targets. These features make it a full-featured DNS and traffic-management service.

How does Amazon CloudFront reduce latency for globally distributed users?

• a.By caching copies of content at edge locations near users✓
• b.By replacing the need for an origin server entirely and hosting content itself
• c.By storing all data in a single central Region
• d.By encrypting data only at rest

Amazon CloudFront is a content delivery network that caches content at edge locations worldwide, so users are served from a nearby location instead of a distant origin. This lowers latency and offloads traffic from the origin.

A company needs a private, dedicated network link between its data center and AWS with more consistent throughput than the public internet. Which service provides this?

• a.Amazon Route 53
• b.AWS Direct Connect✓
• c.Amazon CloudFront
• d.AWS Site-to-Site VPN

AWS Direct Connect establishes a dedicated, private physical connection between on-premises and AWS, offering more consistent performance and potentially lower data-transfer costs than the internet. A VPN, by contrast, is encrypted but rides over the public internet.

Which service simplifies connecting thousands of VPCs and on-premises networks through a single central hub?

• a.Amazon EFS
• b.AWS Transit Gateway✓
• c.AWS Certificate Manager
• d.Amazon CloudFront

AWS Transit Gateway acts as a central hub that connects VPCs and on-premises networks, replacing complex peering meshes with a simpler hub-and-spoke topology. It scales network connectivity across many accounts and VPCs.

What is the primary difference between a security group and a network ACL in a VPC?

• a.A security group is stateful at the instance level; a network ACL is stateless at the subnet level✓
• b.A security group only supports deny rules; a network ACL only supports allow rules
• c.There is no functional difference between them
• d.A network ACL is attached directly to individual instances while a security group is attached to whole subnets

Security groups act as stateful firewalls at the instance level, automatically allowing return traffic, while network ACLs are stateless firewalls at the subnet level that evaluate allow and deny rules in order. Both are layers of VPC network security.

Which service lets resources in a VPC reach supported AWS services privately without traversing the public internet?

• a.Amazon CloudFront distributions with signed URLs
• b.Amazon Route 53 health checks
• c.Elastic IP addresses
• d.VPC endpoints (including AWS PrivateLink)✓

VPC endpoints, powered by AWS PrivateLink for many services, let VPC resources connect privately to AWS services without an internet gateway or public IPs. This keeps traffic on the AWS network and improves security.

What does a route table in a VPC control?

• a.Where network traffic from a subnet is directed✓
• b.The encryption keys used for data at rest
• c.The number of instances in an Auto Scaling group
• d.The billing alerts for the account

A route table contains rules (routes) that determine where network traffic from a subnet or gateway is directed, such as to an internet gateway or NAT gateway. Each subnet is associated with a route table.

What does the Multi-AZ deployment option for Amazon RDS provide?

• a.A read-only replica that is used only to increase read throughput for heavy reporting queries
• b.A synchronous standby replica in another Availability Zone for automatic failover✓
• c.Automatic conversion of the database to a NoSQL engine
• d.A discount on the database instance price

RDS Multi-AZ maintains a synchronous standby in a different Availability Zone and fails over automatically if the primary fails, improving availability and durability. It is for resilience, not for scaling read traffic, which is what read replicas address.

A read-heavy application backed by Amazon RDS needs to offload read queries from the primary database. Which feature helps?

• a.A NAT gateway
• b.Multi-AZ standby
• c.RDS read replicas✓
• d.A larger EBS snapshot

RDS read replicas provide additional read-only copies that can serve read traffic, reducing load on the primary and improving read scalability. Multi-AZ, by contrast, provides a standby for failover, not for scaling reads.

Which use case is Amazon DynamoDB best suited for?

• a.Mounting a single shared POSIX-compliant file system across many Linux servers at the same time
• b.A petabyte-scale columnar analytics warehouse
• c.Complex multi-table SQL joins for reporting
• d.A high-traffic application needing single-digit millisecond key-value lookups at any scale✓

DynamoDB is a fully managed NoSQL key-value and document database delivering consistent, low-latency performance at scale, ideal for high-traffic apps with simple access patterns. Relational analytics and joins are better served by RDS or Redshift.

Amazon Aurora is best described as which of the following?

• a.A MySQL- and PostgreSQL-compatible relational database built for the cloud with high performance and availability✓
• b.A managed in-memory cache using Redis
• c.A fully managed graph database service purpose-built for highly connected datasets such as social and recommendation graphs
• d.A serverless function runtime

Amazon Aurora is a cloud-optimized relational database compatible with MySQL and PostgreSQL, offering higher throughput and built-in fault-tolerant, self-healing storage. It is part of the Amazon RDS family.

A business intelligence team needs to run complex analytical queries across billions of rows for reporting. Which service is purpose-built for this?

• a.Amazon Redshift✓
• b.Amazon RDS for MySQL
• c.Amazon DynamoDB
• d.Amazon ElastiCache

Amazon Redshift is a managed, petabyte-scale data warehouse using columnar storage and massively parallel processing, optimized for analytical (OLAP) queries. Transactional databases like RDS and DynamoDB are optimized for different workloads.

Which service provides a managed in-memory data store to reduce database load and speed up read-heavy applications?

• a.Amazon Athena
• b.Amazon ElastiCache✓
• c.Amazon Neptune
• d.Amazon Redshift Serverless

Amazon ElastiCache offers managed Redis or Memcached in-memory caches that store frequently accessed data close to the application, reducing latency and offloading the primary database. It is commonly placed in front of databases for read-heavy workloads.

A team is migrating an on-premises database to AWS and wants to minimize downtime during the move. Which service is designed to help?

• a.Amazon SNS
• b.Amazon CloudFront
• c.AWS Trusted Advisor cost and security checks
• d.AWS Database Migration Service (DMS)✓

AWS Database Migration Service migrates databases to AWS while the source remains operational, minimizing downtime, and supports both homogeneous and heterogeneous migrations. It is the standard tool for moving databases into AWS.

Which AWS service is a fully managed graph database for use cases such as social networks and recommendation engines?

• a.Amazon DynamoDB
• b.Amazon Redshift
• c.Amazon Neptune✓
• d.Amazon RDS for Oracle

Amazon Neptune is a fully managed graph database service optimized for highly connected data and queries, such as social graphs, fraud detection, and recommendation engines. It supports popular graph models and query languages.

What is a key operational advantage of using Amazon RDS instead of running a database yourself on EC2?

• a.RDS eliminates all database costs
• b.RDS automates administrative tasks such as patching, backups, and failover✓
• c.RDS lets you run any database engine ever created
• d.RDS gives you full root operating-system access so you can tune the kernel yourself

Amazon RDS handles time-consuming administration like software patching, automated backups, and failover, letting teams focus on the data and application. Running a database on EC2 leaves all of that management to the customer.

Which AWS service would you use to set an alarm that notifies you when an EC2 instance's CPU utilization stays above a threshold?

• a.Amazon CloudWatch✓
• b.AWS Artifact
• c.AWS CloudTrail audit logs
• d.Amazon Cognito

Amazon CloudWatch collects metrics such as CPU utilization and lets you create alarms that trigger notifications or actions when thresholds are breached. It is the primary monitoring and observability service on AWS.

You need to determine which user made a specific change to a resource and when it happened. Which service records this account activity?

• a.AWS Pricing Calculator
• b.Amazon CloudWatch metrics
• c.AWS CloudTrail✓
• d.Amazon S3 versioning

AWS CloudTrail records API calls and account activity, providing an audit trail of who did what, when, and from where. CloudWatch focuses on performance metrics and logs rather than API-level auditing.

What is the primary purpose of AWS CloudFormation?

• a.To define and provision AWS infrastructure from templates as code✓
• b.To store objects durably across Availability Zones
• c.To distribute content to edge locations
• d.To monitor application performance and user experience in real time

AWS CloudFormation lets you describe infrastructure in JSON or YAML templates and provision it automatically and repeatably as stacks. This infrastructure-as-code approach makes environments consistent and easy to recreate.

Which three primary methods can be used to interact with and provision AWS services?

• a.The AWS Management Console, the AWS CLI, and the AWS SDKs✓
• b.Only the AWS Management Console
• c.Only third-party automation tools that are not made or supported by AWS
• d.Only physical mail requests to AWS

You can interact with AWS through the web-based Management Console, the AWS Command Line Interface (CLI), and language-specific AWS SDKs. All three ultimately call the same AWS service APIs.

A developer wants a browser-based shell, already authenticated, to run AWS CLI commands without installing anything locally. Which service provides this?

• a.AWS Config
• b.AWS CloudFormation
• c.Amazon Inspector
• d.AWS CloudShell✓

AWS CloudShell is a browser-based shell in the console, pre-authenticated with your console credentials and preloaded with the AWS CLI and common tools. It lets you run commands without installing or configuring anything locally.

Which service continuously records and evaluates the configuration of your AWS resources to help assess compliance over time?

• a.Amazon CloudWatch
• b.AWS Config✓
• c.Amazon SNS
• d.AWS CloudShell

AWS Config records resource configurations and changes over time and can evaluate them against rules to assess compliance. It is useful for auditing, change management, and governance.

Which service helps you manage operational tasks such as patching and running commands across fleets of EC2 instances at scale?

• a.Amazon Athena
• b.Amazon Comprehend natural-language processing
• c.Amazon Neptune
• d.AWS Systems Manager✓

AWS Systems Manager provides operational tools to view and control infrastructure, including running commands, applying patches, and managing parameters across fleets of instances. It centralizes many routine operational tasks.

A large enterprise wants to centrally set up and govern a secure, multi-account AWS environment based on best practices. Which service automates this landing-zone setup?

• a.AWS Control Tower✓
• b.Amazon Macie
• c.AWS Direct Connect
• d.Amazon CloudFront

AWS Control Tower automates the setup of a well-architected, multi-account environment (a landing zone) with guardrails and best practices, built on top of AWS Organizations. It simplifies governance at scale.

What is the benefit of using infrastructure as code with services like AWS CloudFormation?

• a.It automatically writes the application's business logic
• b.It completely removes the need to pay for any of the provisioned underlying resources
• c.It prevents anyone from ever deleting resources
• d.Environments can be provisioned consistently and repeatably, reducing manual errors✓

Infrastructure as code lets you define resources in templates so environments are created the same way every time, reducing manual configuration errors and enabling version control. You still pay for whatever resources the templates provision.

Which service lets developers model cloud infrastructure using familiar programming languages such as Python or TypeScript, which then synthesizes CloudFormation templates?

• a.AWS Systems Manager Automation runbooks
• b.Amazon QuickSight
• c.AWS Cloud Development Kit (CDK)✓
• d.AWS Config

The AWS Cloud Development Kit (CDK) lets you define infrastructure using general-purpose programming languages, which it converts into CloudFormation templates for provisioning. It appeals to developers who prefer code over raw templates.

Which service is a serverless event bus that connects application components using events from AWS services, SaaS apps, and your own apps?

• a.Amazon RDS
• b.Amazon EBS
• c.Amazon EventBridge✓
• d.Amazon Elastic File System

Amazon EventBridge is a serverless event bus that routes events between AWS services, custom applications, and SaaS providers, enabling event-driven architectures. It helps decouple producers and consumers of events.

Which service lets you coordinate multiple AWS services into serverless workflows using visual state machines?

• a.Amazon EBS
• b.Amazon CloudFront content delivery network
• c.Amazon Route 53
• d.AWS Step Functions✓

AWS Step Functions orchestrates multiple services into serverless workflows defined as state machines, managing sequencing, retries, and error handling. It simplifies building and visualizing multi-step processes.

A team is building a REST API and wants a managed service to create, publish, secure, and monitor APIs at scale. Which service should they use?

• a.Amazon Redshift
• b.Amazon Kinesis Data Streams
• c.Amazon EFS
• d.Amazon API Gateway✓

Amazon API Gateway is a fully managed service for creating, publishing, securing, and monitoring APIs at any scale, and it integrates well with Lambda for serverless backends. It handles traffic management, authorization, and throttling.

Which service is designed to collect, process, and analyze streaming data such as clickstreams or IoT telemetry in real time?

• a.Amazon Kinesis✓
• b.AWS Artifact
• c.Amazon Glacier
• d.Amazon Athena interactive queries

Amazon Kinesis captures and processes real-time streaming data such as logs, clickstreams, and telemetry, enabling near-real-time analytics. Athena, by contrast, runs SQL queries against data already stored in S3.

Which service lets you run standard SQL queries directly against data stored in Amazon S3 without loading it into a database?

• a.Amazon DynamoDB
• b.Amazon Athena✓
• c.Amazon Redshift Spectrum only
• d.Amazon RDS

Amazon Athena is a serverless, interactive query service that runs SQL directly against data in Amazon S3, charging per data scanned with no infrastructure to manage. It is ideal for ad hoc analysis of data already in S3.

Which fully managed service helps developers build, train, and deploy machine learning models?

• a.Amazon EBS
• b.Amazon Route 53 DNS service
• c.Amazon SageMaker✓
• d.AWS CloudTrail

Amazon SageMaker is a managed platform that covers the full machine-learning lifecycle, from building and training models to deploying them for inference. It removes much of the heavy lifting of standing up ML infrastructure.

Which AWS AI service converts text into lifelike speech?

• a.Amazon Rekognition
• b.Amazon Polly✓
• c.Amazon Translate
• d.Amazon Comprehend

Amazon Polly turns text into lifelike speech using deep learning, supporting many languages and voices. Rekognition analyzes images and video, Comprehend does natural-language processing, and Translate performs language translation.

Which service provides a fully managed data-integration (ETL) capability to discover, prepare, and combine data for analytics?

• a.Amazon Route 53
• b.Amazon EFS
• c.Amazon EC2
• d.AWS Glue✓

AWS Glue is a serverless data-integration service that makes it easy to discover, prepare, transform, and combine data for analytics and machine learning. It includes a data catalog and managed ETL jobs.

A company needs AWS compute and storage running physically inside its own on-premises data center while using the same AWS APIs. Which service provides this?

• a.Amazon Lightsail
• b.Amazon CloudFront
• c.AWS Outposts✓
• d.AWS Snowmobile

AWS Outposts brings AWS infrastructure and services to a customer's on-premises facility, offering a consistent hybrid experience with the same APIs and tools used in AWS Regions. It suits low-latency or data-residency needs that require local processing.

What are AWS Local Zones primarily used for?

• a.Storing rarely accessed archival data at the lowest possible storage cost for many years
• b.Placing compute and storage closer to large population centers for very low latency✓
• c.Registering domain names
• d.Replacing the need for IAM permissions

AWS Local Zones extend a Region to place select services closer to end users in specific metropolitan areas, reducing latency for demanding applications like gaming or media. They are an extension of the Region's infrastructure.

Which statement about AWS Lambda pricing and operation is correct?

• a.It requires you to patch the underlying operating system
• b.It can only run code written in Java
• c.You are charged based on the number of requests and the duration your code runs✓
• d.You must reserve and pay for a fixed number of servers in advance for the whole term

With Lambda you pay per request and for the compute duration your function consumes, and AWS manages the servers, scaling, and patching. It supports many languages and scales automatically with demand.

A message must be delivered to multiple subscribers at once (fan-out), such as several queues and an email endpoint. Which service is designed for this?

• a.Amazon Simple Queue Service
• b.Amazon EBS
• c.Amazon RDS
• d.Amazon SNS✓

Amazon SNS is a publish/subscribe service that delivers a single published message to many subscribers simultaneously, such as SQS queues, Lambda functions, and email. SQS, by contrast, is a queue for point-to-point, decoupled processing.

Which service decouples application components by letting a producer place messages in a queue for a consumer to process later?

• a.Amazon SQS✓
• b.Amazon Redshift
• c.Amazon Route 53
• d.Amazon CloudFront

Amazon SQS is a managed message queue that lets components communicate asynchronously; producers enqueue messages and consumers process them independently. This decoupling improves resilience and scalability.

What does the term 'serverless' mean on AWS?

• a.You build applications without provisioning or managing servers, and AWS handles scaling✓
• b.Customers must manage the underlying servers themselves
• c.Applications somehow run without using any AWS servers or managed infrastructure whatsoever
• d.Only static websites can be built this way

Serverless means you focus on code and configuration while AWS provisions, scales, and maintains the underlying infrastructure automatically. Servers still exist, but you never manage them; examples include Lambda, DynamoDB, and S3.

Which service provides desktops in the cloud (Desktop-as-a-Service) so users can access a managed Windows or Linux desktop remotely?

• a.Amazon AppStream 2.0
• b.Amazon Lightsail
• c.Amazon WorkSpaces✓
• d.Amazon Connect

Amazon WorkSpaces provides managed, secure virtual desktops in the cloud that users can access from various devices. AppStream 2.0, by contrast, streams individual applications rather than full desktops.

Which service is a cloud-based contact center that lets companies handle customer phone and chat interactions?

• a.Amazon Connect✓
• b.Amazon Comprehend
• c.Amazon Kinesis
• d.Amazon Cognito

Amazon Connect is a scalable, cloud-based contact center service for handling customer interactions across voice and chat. It is billed by usage and requires no upfront telephony infrastructure.

Which service uses machine learning to detect and read text and data from scanned documents automatically?

• a.Amazon Redshift data warehouse
• b.Amazon Route 53
• c.Amazon EFS
• d.Amazon Textract✓

Amazon Textract automatically extracts text, forms, and tables from scanned documents using machine learning, going beyond simple optical character recognition. It helps automate document-processing workflows.

Which service is a business analytics service used to build interactive dashboards and visualizations from your data?

• a.Amazon Neptune
• b.Amazon Athena
• c.Amazon Kinesis Data Firehose
• d.Amazon QuickSight✓

Amazon QuickSight is a scalable business intelligence service for building interactive dashboards and visualizations, with pay-per-session pricing. It connects to many AWS and external data sources.

What is the purpose of tagging AWS resources from a technical management standpoint?

• a.Tags apply metadata labels used to organize, search, and automate management of resources✓
• b.Tags directly increase the performance and throughput of the resources that they are applied to
• c.Tags encrypt the resource's data at rest
• d.Tags are required before any resource can start

Tags are key-value metadata labels that help you organize, identify, search, and automate actions on resources, and they also support cost allocation. They do not affect performance or encryption.

Which service continuously delivers and automates the steps of building, testing, and deploying application code (a managed CI/CD pipeline)?

• a.Amazon Inspector vulnerability scanning
• b.Amazon Route 53
• c.AWS CodePipeline✓
• d.AWS Artifact

AWS CodePipeline is a managed continuous integration and continuous delivery service that automates build, test, and deploy stages for fast, reliable releases. It integrates with services like CodeBuild and CodeDeploy.

Which service is a managed Git-compatible source-control repository for storing and versioning application code? (Note historical AWS naming.)

• a.AWS Lambda
• b.Amazon EBS
• c.Amazon Simple Storage Service
• d.AWS CodeCommit✓

AWS CodeCommit is a managed source-control service that hosts secure, Git-based repositories for versioning code. It integrates with the rest of the AWS developer tools for CI/CD.

A company wants to distribute a static website's files with high durability and serve them cheaply. Which combination is commonly used?

• a.Amazon RDS combined with attached Amazon EBS block storage volumes
• b.Amazon Redshift with Athena
• c.Amazon S3 for hosting with Amazon CloudFront for delivery✓
• d.Amazon SQS with SNS

Static websites are commonly hosted as objects in Amazon S3 and delivered globally with low latency through Amazon CloudFront. This serverless pattern is durable, scalable, and cost-effective.

What is an Elastic IP address in AWS?

• a.A DNS record automatically created for every bucket
• b.A billing identifier used for consolidated billing
• c.A static public IPv4 address you can allocate and associate with instances in your account✓
• d.A private, internal-only IP address that can never be reached from the public internet at all

An Elastic IP is a static, public IPv4 address allocated to your account that you can associate with an instance and remap as needed. It provides a stable address even if the underlying instance changes.

Which statement correctly describes horizontal scaling of an application tier on AWS?

• a.Reducing the storage attached to a single server
• b.Moving the application to a different support plan
• c.Replacing an existing instance with a physically larger and more powerful instance type
• d.Adding more instances to share the load, often behind a load balancer✓

Horizontal scaling (scaling out) adds more instances to handle load, typically distributed by a load balancer, and pairs naturally with Auto Scaling. Vertical scaling, by contrast, increases the size of a single instance.

Which AWS service or feature helps ensure an application remains available if an entire Availability Zone fails?

• a.Using one instance in one subnet
• b.Deploying resources across multiple Availability Zones behind a load balancer✓
• c.Storing all of the application's data on a single instance store volume on one host
• d.Disabling health checks

Distributing resources across multiple Availability Zones, with a load balancer routing to healthy targets, keeps an application running even if one AZ fails. AZs are physically isolated, so multi-AZ designs increase resilience.

Which of the following is a valid reason to choose one AWS Region over another?

• a.To change the account's root user email address
• b.To increase the durability of Amazon S3 objects above their normally published level
• c.To meet data-residency requirements and reduce latency for local users✓
• d.To avoid paying for any data transfer ever

Region choice is driven by factors such as compliance and data residency, proximity to users (latency), service availability, and cost. It does not change fundamental durability guarantees or eliminate all data-transfer charges.

Which service provides fully managed Apache Kafka for streaming data without managing the Kafka infrastructure yourself?

• a.Amazon Athena
• b.Amazon Managed Streaming for Apache Kafka (MSK)✓
• c.Amazon Neptune
• d.Amazon RDS running the PostgreSQL database engine

Amazon MSK is a fully managed service that runs Apache Kafka, handling provisioning, patching, and scaling of the Kafka clusters. It lets teams use Kafka without operating the underlying brokers themselves.

Which statement about AWS managed services (for example, RDS, DynamoDB, or Lambda) is true regarding the shared responsibility model?

• a.Using managed services entirely removes the customer's own responsibility for protecting their stored data
• b.The customer must patch the underlying operating system for all of them
• c.The customer becomes responsible for the physical data center security
• d.AWS takes on more of the operational responsibility, such as patching and infrastructure management✓

With managed services, AWS handles more of the operational burden such as OS patching, backups, and scaling, shifting the responsibility boundary toward AWS. The customer still remains responsible for their data, access management, and configuration.

A gaming company needs a fully managed, low-latency NoSQL database with automatic scaling and no server management for its global leaderboard. Which service fits best?

• a.Amazon RDS for PostgreSQL
• b.Amazon Redshift
• c.Amazon EFS
• d.Amazon DynamoDB✓

Amazon DynamoDB is a serverless NoSQL database offering single-digit millisecond latency and automatic scaling, well suited to high-traffic key-value workloads like leaderboards. It requires no server provisioning or management.

Which AWS service provides object storage designed for eleven nines of durability by storing data redundantly across multiple facilities?

• a.Amazon EBS
• b.Amazon S3✓
• c.Amazon EFS
• d.Amazon Instance Store

Amazon S3 is designed for 99.999999999% (eleven nines) durability by automatically storing copies of data across multiple facilities within a Region. This makes it a strong choice for backups, archives, and data lakes.

What is the main function of Elastic Load Balancing health checks?

• a.To calculate the monthly bill
• b.To detect unhealthy targets and stop routing traffic to them✓
• c.To provision new AWS accounts
• d.To encrypt all of the data that is stored inside Amazon S3 buckets

ELB health checks continuously test registered targets and route traffic only to those that are healthy, improving availability. Unhealthy targets are automatically removed from rotation until they recover.

Which service would you use to create a private connection to Amazon S3 from within a VPC without using an internet gateway?

• a.A gateway VPC endpoint for S3✓
• b.An Elastic IP address assigned to the instance
• c.A CloudFront distribution
• d.A NAT gateway alone

A gateway VPC endpoint lets resources in a VPC reach Amazon S3 privately over the AWS network without an internet gateway or NAT device. This keeps traffic off the public internet and can reduce data-transfer costs.

Which statement best describes the AWS global infrastructure hierarchy?

• a.Availability Zones contain Regions, which contain edge locations
• b.Edge locations physically contain the Regions, which in turn contain all the Availability Zones
• c.Regions and Availability Zones are the same thing
• d.Regions contain multiple Availability Zones, and edge locations are separate caching sites✓

AWS organizes infrastructure into Regions, each containing multiple isolated Availability Zones, with edge locations forming a separate global network used mainly for content caching. Understanding this hierarchy is central to designing for latency and resilience.

Which service lets you centrally manage software licenses from vendors such as Microsoft and Oracle across AWS and on-premises?

• a.AWS Artifact
• b.AWS License Manager✓
• c.Amazon Redshift
• d.Amazon Cognito user directories

AWS License Manager helps you track and enforce license usage across AWS and on-premises environments, reducing the risk of non-compliance and overspending. It centralizes rules for bring-your-own-license scenarios.

Which service is a fully managed document database with MongoDB compatibility?

• a.Amazon Neptune
• b.Amazon DocumentDB✓
• c.Amazon Redshift
• d.Amazon ElastiCache

Amazon DocumentDB is a fully managed database service that is compatible with MongoDB workloads, handling scaling, backups, and patching. It suits applications that use document data models.

What does Amazon S3 Transfer Acceleration do?

• a.It encrypts objects only at rest
• b.It replaces the need for a bucket policy
• c.It automatically archives objects to the S3 Glacier storage class on a schedule
• d.It speeds up uploads to S3 over long distances using CloudFront edge locations✓

S3 Transfer Acceleration uses CloudFront's globally distributed edge locations to speed up transfers of data to and from S3 over long distances. It is useful when users far from the bucket's Region upload large files.

Which service provides a managed, scalable service for sending marketing, transactional, and notification emails?

• a.Amazon SQS
• b.Amazon Simple Email Service (SES)✓
• c.Amazon SNS
• d.Amazon Connect cloud contact center

Amazon SES is a managed email service for sending transactional, marketing, and notification emails at scale, with pay-as-you-go pricing. SNS and SQS are messaging services for application integration rather than email delivery.

A stateless application must handle unpredictable traffic while minimizing operational overhead. Which architecture aligns with AWS best practices?

• a.A fixed cluster that never changes size
• b.Serverless with Lambda, API Gateway, and DynamoDB that scale automatically✓
• c.An on-premises server connected by VPN only
• d.A single very large EC2 instance sized for the yearly peak load and left running always

A serverless architecture using services like Lambda, API Gateway, and DynamoDB scales automatically with demand and reduces operational overhead, matching cost to usage. Fixed, over-provisioned capacity wastes money and still risks under-provisioning.

Which service captures information about the IP traffic going to and from network interfaces in your VPC for troubleshooting and monitoring?

• a.Amazon CloudFront logs
• b.AWS CloudTrail
• c.Amazon Inspector
• d.VPC Flow Logs✓

VPC Flow Logs capture metadata about IP traffic to and from network interfaces, helping with troubleshooting connectivity and monitoring for unusual patterns. CloudTrail, by contrast, logs API activity rather than packet-level flow data.

Which service is used to run containerized applications with AWS's own orchestration, integrating tightly with other AWS services?

• a.Amazon Route 53
• b.Amazon Elastic Container Service (ECS)✓
• c.AWS Artifact
• d.Amazon Redshift data warehouse clusters

Amazon ECS is AWS's native container orchestration service that schedules and manages containers, integrating closely with services like IAM, load balancing, and CloudWatch. It can run on EC2 or serverless via Fargate.

What does a launch template or launch configuration define for EC2 Auto Scaling?

• a.The instance settings (such as AMI, instance type, and security groups) used to launch new instances✓
• b.The DNS routing policy for the domain
• c.The set of KMS encryption keys and database credentials that are stored inside AWS Secrets Manager for the app
• d.The monthly budget for the account

A launch template specifies the configuration used to launch instances, including the AMI, instance type, key pair, and security groups, so Auto Scaling can create consistent instances. It ensures new instances match the intended configuration.

Which service would help a company analyze application performance by tracing requests as they travel through distributed microservices?

• a.Amazon Macie
• b.Amazon Route 53
• c.AWS Artifact
• d.AWS X-Ray✓

AWS X-Ray helps developers analyze and debug distributed applications by tracing requests across services and identifying bottlenecks or errors. It provides an end-to-end view of request flows in microservice architectures.

Which service lets you schedule and automate the creation and retention of Amazon EBS snapshots?

• a.AWS Shield
• b.Amazon Cognito
• c.Amazon CloudFront distributions
• d.Amazon Data Lifecycle Manager✓

Amazon Data Lifecycle Manager automates the creation, retention, and deletion of EBS snapshots on a schedule, helping enforce backup policies. This reduces manual effort and helps meet data-protection requirements.

Which AWS compute service is best described as 'run code in response to events, scaling automatically, with no servers to manage'?

• a.Amazon EC2
• b.AWS Lambda✓
• c.Amazon Lightsail
• d.Amazon EC2 Dedicated Hosts

AWS Lambda runs your code in response to events and automatically scales by running as many copies as needed, with no server management. You pay only for the compute time consumed while your code runs.

Which service provides a fully managed feature to replicate objects automatically between S3 buckets in different Regions?

• a.Amazon EFS replication to another Region only
• b.S3 Cross-Region Replication✓
• c.Amazon Route 53 failover
• d.S3 Transfer Acceleration

S3 Cross-Region Replication automatically copies objects to a bucket in another Region, supporting disaster recovery, latency reduction, and compliance requirements. Replication is asynchronous and configurable at the bucket or prefix level.

A workload occasionally needs a burst of GPU compute for machine-learning training and can tolerate interruptions to save money. Which purchasing option combined with the right instance family is ideal?

• a.Spot Instances on GPU (accelerated computing) instances✓
• b.Dedicated Hosts billed hourly with no interruptions
• c.On-Demand CPU-only instances reserved for a full three-year term
• d.Reserved standard instances with no flexibility

Accelerated-computing (GPU) instances handle ML training, and Spot Instances offer the deepest discounts for interruption-tolerant, flexible jobs like batch training. Together they minimize cost for elastic, fault-tolerant compute.

Which service provides managed DNS and can route users to the closest healthy endpoint across multiple Regions for a global application?

• a.Amazon EBS
• b.Amazon Route 53✓
• c.AWS Direct Connect
• d.Amazon CloudFront

Amazon Route 53 offers managed DNS with routing policies (such as latency-based, geolocation, and failover) and health checks to send users to the best healthy endpoint. This helps deliver resilient, low-latency global applications.

Which AWS database capability automatically scales capacity up and down based on application traffic, so you pay for what you use without provisioning instances?

• a.Amazon ElastiCache reserved nodes
• b.Amazon Redshift reserved nodes
• c.Amazon Aurora Serverless✓
• d.Amazon RDS Multi-AZ

Aurora Serverless automatically starts, scales, and shuts down database capacity based on demand, so you pay for the capacity used rather than provisioning fixed instances. It suits variable or intermittent workloads.

Which best describes the purpose of Amazon CloudWatch Logs?

• a.To register and manage domain names
• b.To centralize, store, and query log data from applications and AWS services✓
• c.To store highly durable object backups designed for eleven nines of durability
• d.To provision infrastructure from templates

Amazon CloudWatch Logs centralizes log data from applications, EC2 instances, and AWS services so you can store, search, and analyze it. It complements CloudWatch metrics and alarms for full observability.

Which service helps you deploy application updates to EC2 instances, on-premises servers, or Lambda with controlled rollouts?

• a.Amazon QuickSight
• b.Amazon Athena
• c.AWS CodeDeploy✓
• d.Amazon Neptune

AWS CodeDeploy automates code deployments to compute services such as EC2, on-premises servers, and Lambda, supporting strategies like rolling and blue/green to reduce downtime. It is part of AWS's developer tooling for release automation.

What is the primary benefit of a blue/green deployment strategy?

• a.It encrypts all data at rest automatically
• b.It permanently doubles your total monthly infrastructure bill for the entire duration of the deployment
• c.It reduces deployment risk by shifting traffic to a new environment and enabling quick rollback✓
• d.It removes the need for any testing

Blue/green deployments run a new (green) environment alongside the current (blue) one and shift traffic over, allowing fast rollback if problems appear. This lowers the risk and downtime of releases.

Which service would a company use to build, deploy, and manage a serverless application defined as a single stack of Lambda functions, APIs, and tables?

• a.AWS Serverless Application Model (SAM) / CloudFormation✓
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon Redshift provisioned data-warehouse cluster nodes

The AWS Serverless Application Model (SAM) extends CloudFormation to define serverless resources like Lambda functions, APIs, and DynamoDB tables in a concise template. It provisions the whole application as one stack.

Which capability lets you connect users' existing corporate identities to AWS so they can sign in without separate IAM users, centrally across accounts?

• a.Root user sharing
• b.AWS IAM Identity Center (single sign-on)✓
• c.Long-term access keys per user
• d.Amazon Cognito user pools for the app only

AWS IAM Identity Center provides centralized single sign-on and lets you connect an existing identity source so users access multiple AWS accounts and applications without separate IAM users. It simplifies workforce access at scale.

Which service is designed to run high-performance computing (HPC) or big-data frameworks like Apache Spark and Hadoop on managed clusters?

• a.Amazon EMR✓
• b.Amazon Cognito
• c.Amazon Route 53
• d.AWS Artifact

Amazon EMR provides managed clusters to run big-data frameworks such as Apache Spark, Hadoop, and Hive at scale, handling provisioning and tuning. It is used for large-scale data processing and analytics.

A company wants to reduce the operational effort of running its message queue and pay only for what it uses. Which AWS characteristic makes SQS attractive here?

• a.It requires managing your own broker servers
• b.It is fully managed and scales automatically with pay-per-use pricing✓
• c.It can only be used from on-premises servers
• d.It charges one large fixed monthly fee regardless of how many messages you send

Amazon SQS is fully managed, scales automatically, and charges based on usage, removing the need to run and patch your own message-broker servers. This lowers operational overhead and matches cost to actual traffic.

Which statement about scaling a relational database on Amazon RDS is accurate?

• a.Read replicas provide automatic failover for the primary
• b.You can only scale the database by fully rewriting the entire application to use a NoSQL engine
• c.RDS cannot be scaled at all once created
• d.You can scale reads with read replicas and scale compute by changing the instance class✓

With RDS you can add read replicas to scale read traffic and change the instance class to scale compute and memory (vertical scaling). Multi-AZ provides failover, which is a separate capability from read scaling.