aws_test.txt

QUESTION 1
Under the shared responsibility model, which of the following is the customer responsible for?

A.   Ensuring that disk drives are wiped after use.
B.   Ensuring that firmware is updated on hardware devices.
C.   Ensuring that data is encrypted at rest.
D.   Ensuring that network cables are category six or higher.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS for a self-hosted database that requires a nightly shutdown for maintenance and cost-saving purposes

QUESTION 2
The use of what AWS feature or service allows companies to track and categorize spending on a detailed level?

A.   Cost allocation tags
B.   Consolidated billing
C.   AWS Budgets
D.   AWS Marketplace

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

QUESTION 3
Which service stores objects, provides real-time access to those objects, and offers versioning and lifecycle capabilities?

A.   Amazon Glacier
B.   AWS Storage Gateway
C.   Amazon S3
D.   Amazon EBS

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/s3/faqs/

QUESTION 4
What AWS team assists customers with accelerating cloud adoption through paid engagements in any of several specialty practice areas?

A.   AWS Enterprise Support
B.   AWS Solutions Architects
C.   AWS Professional Services
D.   AWS Account Managers

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/professional-services/

QUESTION 5
A customer would like to design and build a new workload on AWS Cloud but does not have the AWS- related software technical expertise in-house.

Which of the following AWS programs can a customer take advantage of to achieve that outcome?

A.   AWS Partner Network Technology Partners
B.   AWS Marketplace
C.   AWS Partner Network Consulting Partners
D.   AWS Service Catalog

Correct Answer: C
Explanation


QUESTION 6
Distributing workloads across multiple Availability Zones supports which cloud architecture design principle?

A.   Implement automation.
B.   Design for agility.
C.   Design for failure.
D.   Implement elasticity.

Correct Answer: C
Explanation

Explanation/Reference:
QUESTION 7
Which AWS services can host a Microsoft SQL Server database? (Select TWO.)

A.   Amazon EC2
B.   Amazon Relational Database Service (Amazon RDS)
C.   Amazon Aurora
D.   Amazon Redshift
E.   Amazon S3

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/sql/

QUESTION 8
Which of the following inspects AWS environments to find opportunities that can save money for users and also improve system performance?

A.   AWS Cost Explorer
B.   AWS Trusted Advisor
C.   Consolidated billing
D.   Detailed billing

Correct Answer: B
Explanation


QUESTION 9
Which of the following Amazon EC2 pricing models allow customers to use existing server-bound software licenses?

A.   Spot Instances
B.   Reserved Instances
C.   Dedicated Hosts
D.   On-Demand Instances

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/

QUESTION 10
Which AWS characteristics make AWS cost effective for a workload with dynamic user demand? (Select TWO.)

A.   High availability
B.   Shared security model
C.   Elasticity
D.   Pay-as-you-go pricing
E.   Reliability

Correct Answer: CD
Explanation


QUESTION 11
Which service enables risk auditing by continuously monitoring and logging account activity, including user actions in the AWS Management Console and AWS
SDKs?

A.   Amazon CloudWatch
B.   AWS CloudTrail
C.   AWS Config
D.   AWS Health

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudtrail/

QUESTION 12
Which of the following are characteristics of Amazon S3? (Select TWO.)

A.   A global file system
B.   An object store
C.   A local file store
D.   A network file system
E.   A durable storage system

Correct Answer: BE
Explanation

Explanation/Reference:
QUESTION 13
Which services can be used across hybrid AWS Cloud architectures? (Select TWO.)

A.   Amazon Route 53
B.   Virtual Private Gateway
C.   Classic Load Balancer
D.   Auto Scaling
E.   Amazon CloudWatch default metrics

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudwatch/.
You can also use CloudWatch in hybrid cloud architectures by using the CloudWatch Agent or API to monitor your on-premises resources

QUESTION 14
What costs are included when comparing AWS Total Cost of Ownership (TCO) with on-premises TCO?

A.   Project management
B.   Antivirus software licensing
C.   Data center security
D.   Software development

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://media.amazonwebservices.com/AWS_TCO_Web_Applications.pdf

QUESTION 15
A company is considering using AWS for a self-hosted database that requires a nightly shutdown for maintenance and cost-saving purposes.

Which service should the company use?

A.   Amazon Redshift
B.   Amazon DynamoDB
C.   Amazon Elastic Compute Cloud (Amazon EC2) with Amazon EC2 instance store
D.   Amazon EC2 with Amazon Elastic Block Store (Amazon EBS)

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 16
Which of the following is a correct relationship between regions, Availability Zones, and edge locations?

A.   Data centers contain regions.
B.   Regions contain Availability Zones.
C.   Availability Zones contain edge locations.
D.   Edge locations contain regions.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/global-infrastructure/regions_az/#Region_Maps_and_Edge_Networks

QUESTION 17
Which AWS tools assist with estimating costs? (Select three.)

A.   Detailed billing report
B.   Cost allocation tags
C.   AWS Simple Monthly Calculator
D.   AWS Total Cost of Ownership (TCO) Calculator
E.   Cost Eliminator

Correct Answer: BCD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/estimating-aws-resource-costs/

QUESTION 18
Which of the following are advantages of AWS consolidated billing? (Select TWO.)

A.   The ability to receive one bill for multiple accounts
B.   Service limits increasing by default in all accounts
C.   A fixed discount on the monthly bill
D.   Potential volume discounts, as usage in all accounts is combined
E.   The automatic extension of the master account's AWS support plan to all accounts
Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 19
Which of the following Reserved Instance (RI) pricing models provides the highest average savings compared to On-Demand pricing?

A.   One-year, No Upfront, Standard RI pricing
B.   One-year, All Upfront, Convertible RI pricing
C.   Three-year, All Upfront, Standard RI pricing
D.   Three-year, No Upfront, Convertible RI pricing

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/

QUESTION 20
Compared with costs in traditional and virtualized data centers, AWS has:

A.   greater variable costs and greater upfront costs.
B.   fixed usage costs and lower upfront costs.
C.   lower variable costs and greater upfront costs.
D.   lower variable costs and lower upfront costs.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/introduction-to-aws-cloud-economics-final.pdf (10)

QUESTION 21
A characteristic of edge locations is that they:

A.   host Amazon EC2 instances closer to users.
B.   help lower latency and improve performance for users.
C.   cache frequently changing data without reaching the origin server.
D.   refresh data changes daily.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 22
Which of the following can limit Amazon Storage Service (Amazon S3) bucket access to specific users?

A.   A public and private key-pair
B.   Amazon Inspector
C.   AWS Identity and Access Management (IAM) policies
D.   Security Groups

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/

QUESTION 23
Which of the following security-related actions are available at no cost?

A.   Calling AWS Support
B.   Contacting AWS Professional Services to request a workshop
C.   Accessing forums, blogs, and whitepapers
D.   Attending AWS classes at a local university

Correct Answer: C
Explanation


QUESTION 24
Which of the Reserved Instance (RI) pricing models can change the attributes of the RI as long as the exchange results in the creation of RIs of equal or greater
value?

A.   Dedicated RIs
B.   Scheduled RIs
C.   Convertible RIs
D.   Standard RIs

Correct Answer: C
Explanation
Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/reserved-instances/

QUESTION 25
Which AWS feature will reduce the customer's total cost of ownership (TCO)?

A.   Shared responsibility security model
B.   Single tenancy
C.   Elastic computing
D.   Encryption

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 26
Which of the following services will automatically scale with an expected increase in web traffic?

A.   AWS CodePipeline
B.   Elastic Load Balancing
C.   Amazon EBS
D.   AWS Direct Connect

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/elasticloadbalancing/

QUESTION 27
Where are AWS compliance documents, such as an SOC 1 report, located?

A.   Amazon Inspector
B.   AWS CloudTrail
C.   AWS Artifact
D.   AWS Certificate Manager

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/soc-faqs/

QUESTION 28
Under the AWS shared responsibility model, which of the following activities are the customer's responsibility? (Select TWO.)

A.   Patching operating system components for Amazon Relational Database Server (Amazon RDS)
B.   Encrypting data on the client-side
C.   Training the data center staff
D.   Configuring Network Access Control Lists (ACL)
E.   Maintaining environmental controls within a data center

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 29
Which is a recommended pattern for designing a highly available architecture on AWS?

A.   Ensure that components have low-latency network connectivity.
B.   Run enough Amazon EC2 instances to operate at peak load.
C.   Ensure that the application is designed to accommodate failure of any single component.
D.   Use a monolithic application that handles all operations.

Correct Answer: C
Explanation


QUESTION 30
According to best practices, how should an application be designed to run in the AWS Cloud?

A.   Use tighly coupled components.
B.   Use loosely coupled components.
C.   Use infrequently coupled components.
D.   Use frequently coupled components.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf

QUESTION 31
AWS supports which of the following methods to add security to Identity and Access Management (IAM) users? (Select TWO.)

A.   Implementing Amazon Rekognition
B.   Using AWS Shield-protected resources
C.   Blocking access with Security Groups
D.   Using Multi-Factor Authentication (MFA)
E.   Enforcing password strength and expiration

Correct Answer: DE
Explanation


QUESTION 32
Which AWS services should be used for read/write of constantly changing data? (Select TWO.)

A.   Amazon Glacier
B.   Amazon RDS
C.   AWS Snowball
D.   Amazon Redshift
E.   Amazon EFS

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 33
What is one of the advantages of the Amazon Relational Database Service (Amazon RDS)?

A.   It simplifies relational database administration tasks.
B.   It provides 99.99999999999% reliability and durability.
C.   It automatically scales databases for loads.
D.   It enabled users to dynamically adjust CPU and RAM resources.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
In the main RDS page though, Lower administrative burden is listed as part of the benefits.
https://aws.amazon.com/rds/

QUESTION 34
A customer needs to run a MySQL database that easily scales.
Which AWS service should they use?

A.   Amazon Aurora
B.   Amazon Redshift
C.   Amazon DynamoDB
D.   Amazon ElastiCache

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/rds/aurora/serverless/

QUESTION 35
Which of the following components of the AWS Global Infrastructure consists of one or more discrete data centers interconnected through low latency links?

A.   Availability Zone
B.   Edge location
C.   Region
D.   Private networking

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/global-infrastructure.html

QUESTION 36
Which of the following is a shared control between the customer and AWS?

A.   Providing a key for Amazon S3 client-side encryption
B.   Configuration of an Amazon EC2 instance
C.   Environmental controls of physical AWS data centers
D.   Awareness and training

Correct Answer: D
Explanation
Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 37
How many Availability Zones should compute resources be provisioned across to achieve high availability?

A.   A minimum of one
B.   A minimum of two
C.   A minimum of three
D.   A minimum of four or more

Correct Answer: B
Explanation


QUESTION 38
One of the advantages to moving infrastructure from an on-premises data center to the AWS Cloud is:

A.   it allows the business to eliminate IT bills.
B.   it allows the business to put a server in each customer's data center.
C.   it allows the business to focus on business activities.
D.   it allows the business to leave servers unpatched.

Correct Answer: C
Explanation


QUESTION 39
What is the lowest-cost, durable storage option for retaining database backups for immediate retrieval?

A.   Amazon S3
B.   Amazon Glacier
C.   Amazon EBS
D.   Amazon EC2 Instance Store

Correct Answer: A
Explanation


QUESTION 40
Which AWS IAM feature allows developers to access AWS services through the AWS CLI?

A.   API keys
B.   Access keys
C.   User names/Passwords
D.   SSH keys

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

QUESTION 41
Which of the following is a fast and reliable NoSQL database service?

A.   Amazon Redshift
B.   Amazon RDS
C.   Amazon DynamoDB
D.   Amazon S3

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/dynamodb/

QUESTION 42
What is an example of agility in the AWS Cloud?

A.   Access to multiple instance types
B.   Access to managed services
C.   Using Consolidated Billing to produce one bill
D.   Decreased acquisition time for new compute resources

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/enterprise-strategy/risk-is-lack-of-agility/

QUESTION 43
Which service should a customer use to consolidate and centrally manage multiple AWS accounts?
A.   AWS IAM
B.   AWS Organizations
C.   AWS Schema Conversion Tool
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/organizations/

QUESTION 44
What approach to transcoding a large number of individual video files adheres to AWS architecture principles?

A.   Using many instances in parallel
B.   Using a single large instance during off-peak hours
C.   Using dedicated hardware
D.   Using a large GPU instance type

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/solutions/case-studies/encoding/

QUESTION 45
For which auditing process does AWS have sole responsibility?

A.   AWS IAM policies
B.   Physical security
C.   Amazon S3 bucket policies
D.   AWS CloudTrail Logs

Correct Answer: B
Explanation


QUESTION 46
Which feature of the AWS Cloud will support an international company's requirement for low latency to all of its customers?

A.   Fault tolerance
B.   Global reach
C.   Pay-as-you-go pricing
D.   High availability

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Global Reach will support an international company using Cloud-Front.

QUESTION 47
Which of the following is the customer's responsibility under the AWS shared responsibility model?

A.   Patching underlying infrastructure
B.   Physical security
C.   Patching Amazon EC2 instances
D.   Patching network infrastructure

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 48
A customer is using multiple AWS accounts with separate billing.

How can the customer take advantage of volume discounts with minimal impact to the AWS resources?

A.   Create one global AWS acount and move all AWS resources to tha account.
B.   Sign up for three years of Reserved Instance pricing up front.
C.   Use the consolidated billing feature from AWS Organizations.
D.   Sign up for the AWS Enterprise support plan to get volume discounts.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/answers/account-management/aws-multi-account-billing-strategy/

QUESTION 49
Which of the following are features of Amazon CloudWatch Logs? (Select TWO.)
A.   Summaries by Amazon Simple Notification Service (Amazon SNS)
B.   Free Amazon Elasticsearch Service analytics
C.   Provided at no charge
D.   Real-time monitoring
E.   Adjustable retention

Correct Answer: DE
Explanation


QUESTION 50
Which of the following is an AWS managed Domain Name System (DNS) web service?

A.   Amazon Route 53
B.   Amazon Neptune
C.   Amazon SageMaker
D.   Amazon Lightsail

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/tutorials/get-a-domain/

QUESTION 51
A customer is deploying a new application and needs to choose an AWS Region.

Which of the following factors could influence the customer's decision? (Select TWO.)

A.   Reduced latency to users
B.   The application's presentation in the local language
C.   Data sovereignty compliance
D.   Cooling costs in hotter climates
E.   Proximity to the customer's office for on-site visits

Correct Answer: AC
Explanation


QUESTION 52
Which storage service can be used as a low-cost option for hosting static websites?

A.   Amazon Glacier
B.   Amazon DynamoDB
C.   Amazon Elastic File System (Amazon EFS)
D.   Amazon Simple Storage Service (Amazon S3)

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/projects/host-static-website/

QUESTION 53
Which Amazon EC2 instance pricing model can provide discounts of up to 90%?

A.   Reserved Instances
B.   On-Demand
C.   Dedicated Hosts
D.   Spot Instances

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/spot/

QUESTION 54
What is the AWS customer responsible for according to the AWS shared responsibility model?

A.   Physical access controls
B.   Data encryption
C.   Secure disposal of storage devices
D.   Environmental risk management

Correct Answer: B
Explanation


QUESTION 55
Which of the following AWS Cloud services can be used to run a customer-managed relational database?

A. Amazon EC2
B. Amazon Route 53
C. Amazon ElastiCache
D. Amazon DynamoDB

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 56
A company is looking for a scalable data warehouse solution.

Which of the following AWS solutions would meet the company's needs?

A.   Amazon Simple Storage Service (Amazon S3)
B.   Amazon DynamoDB
C.   Amazon Kinesis
D.   Amazon Redshift

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/redshift/

QUESTION 57
Which statement best describes Elastic Load Balancing?

A.   It translates a domain name into an IP address using DNS.
B.   It distributes incoming application traffic across one or more Amazon EC2 instances.
C.   It collects metrics on connected Amazon EC2 instances.
D.   It automatically adjusts the number of Amazon EC2 instances to support incoming traffic.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/elasticloadbalancing/

QUESTION 58
Which of the following are valid ways for a customer to interact with AWS services? (Select TWO.)

A.   Command line interface
B.   On-premises
C.   Software Development Kits
D.   Software-as-a-service
E.   Hybrid

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 59
The AWS Cloud's multiple Regions are an example of:

A.   agility.
B.   global infrastructure.
C.   elasticity.
D.   pay-as-you-go pricing.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 60
Which of the following AWS services can be used to serve large amounts of online video content with the lowest possible latency? (Select TWO.)

A.   AWS Storage Gateway
B.   Amazon S3
C.   Amazon Elastic File System (EFS)
D.   Amazon Glacier
E.   Amazom CloudFront

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/tutorials/deliver-content-faster/ https://aws.amazon.com/cloudfront/

QUESTION 61
Web servers running on Amazon EC2 access a legacy application running in a corporate data center.

What term would describe this model?
A.   Cloud-native
B.   Partner network
C.   Hybrid architecture
D.   Infrastructure as a service

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/enterprise/hybrid/

QUESTION 62
What is the benefit of using AWS managed services, such as Amazon ElastiCache and Amazon Relational Database Service (Amazon RDS)?

A.   They require the customer to monitor and replace failing instances.
B.   They have better performance than customer-managed services.
C.   They simplify patching and updating underlying OSs.
D.   They do not require the customer to optimize instance type or size selections.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/rds/instance-types/
Amazon RDS provides a selection of instance types optimized to fit different relational database use cases. Instance types comprise varying combinations of CPU,
memory, storage, and networking capacity and give you the flexibility to choose the appropriate mix of resources for your database. Each instance type includes
serveral instance sizes, allowing you to scale your database to the requirements of your target workload.

QUESTION 63
Which service provides a virtually unlimited amount of online highly durable object storage?

A.   Amazon Redshift
B.   Amazon Elastic File System (Amazon EFS)
C.   Amazon Elastic Container Service (Amazon ECS)
D.   Amazon S3

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/what-is-cloud-object-storage/

QUESTION 64
Which of the following Identity and Access Management (IAM) entities is associated with an access key ID and secret access key when using AWS Command
Line Interface (AWS CLI)?

A.   IAM group
B.   IAM user
C.   IAM role
D.   IAM policy

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or
AWS API (directly or using the AWS SDK). For more information, see Signing AWS API Requests in the Amazon Web Services General Reference.

QUESTION 65
Which of the following security-related services does AWS offer? (Select TWO.)

A.   Multi-factor authentication physical tokens
B.   AWS Trusted Advisor security checks
C.   Data encryption
D.   Automated penetration testing
E.   Amazon S3 copyrighted content detection

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
Penetration testing is not correct, because it can be done by customers on their own resources.

QUESTION 66
Which AWS managed service is used to host databases?

A.   AWS Batch
B.   AWS Artifact
C.   AWS Data Pipeline
D.   Amazon RDS

Correct Answer: D
Explanation
Explanation/Reference:
Explanation:
Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. It provides cost-efficient and
resizable capacity while automating time- consuming administration tasks such as hardware provisioning, database setup, patching and backups. It frees you to
focus on your applications so you can give them the fast performance, high availability, security and compatibility they need.
Reference: https://aws.amazon.com/rds/?c=db&sec=srv

QUESTION 67
Which AWS service provides a simple and scalable shared file storage solution for use with Linux-based AWS and on-premises servers?

A.   Amazon S3
B.   Amazon Glacier
C.   Amazon EBS
D.   Amazon EFS

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully managed elastic NFS file system for use with AWS Cloud services and on-premises
resources. It is built to scale on demand to petabytes without disrupting applications, growing and shrinking automatically as you add and remove files, eliminating
the need to provision and manage capacity to accommodate growth.
Amazon EFS is designed to provide the throughput, IOPS, and low latency needed for Linux workloads.
Throughput and IOPS scale as a file system grows and can burst to higher throughput levels for short periods of time to support the unpredictable performance
needs of file workloads. For the most demanding workloads, Amazon EFS can support performance over 10 GB/sec and up to 500,000 IOPS.

QUESTION 68
When architecting cloud applications, which of the following are a key design principle?

A.   Use the largest instance possible
B.   Provision capacity for peak load
C.   Use the Scrum development process
D.   Implement elasticity

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
"Provisioning for peaks" is a characteristic of a traditional computing environment, per the AWS Best Practices: "you provision capacity based on an estimate of a
theoretical maximum peak." "https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf"

QUESTION 69
Which AWS service should be used for long-term, low-cost storage of data backups?

A.   Amazon RDS
B.   Amazon Glacier
C.   AWS Snowball
D.   AWS EBS

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon S3 Glacier is a secure, durable, and low-cost storage class of S3 for data archiving and long-term backup. Customers can store large or small amounts of
data for as little as $0.004 per gigabyte per month.
The S3 Glacier storage class is ideal for archives where data is regularly retrieved and some of the data may be needed in minutes.
Amazon RDS is a relational database service that hosts databases. It helps you create and manage databases. Amazon Snowball is a petabyte-scale data
transfer service that provides cost efficient data transfer to AWS from tamper proof physical devices. Similarly, Elastic block storage offers persistent block storage
volumes for EC2 instances.
Reference: https://aws.amazon.com/backup-restore/services/

QUESTION 70
Which task is AWS responsible for in the shared responsibility model for security and compliance?

A.   Granting access to individuals and services
B.   Encrypting data in transit
C.   Updating Amazon EC2 host firmware
D.   Updating operating systems

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Compliance enables customers to establish and operate in an AWS security control environment The shared responsibility model is part of AWS Compliance
program
The Security of the cloud is managed by Amazon AWS provider
The Security in the cloud is responsibility of the customer
The customer is responsible for their information and data, their secure transmission, integrity, and encryption
Also, the customer is responsible for managing, support, patching and control of the guest operating system and AWS services provided like EC2
AWS customers retain control and ownership of their data
The AWS network provides significant protection against traditional network security issues and the customer can implement further protection
Reference: https://www.whizlabs.com/blog/aws-security-shared-responsibility/

QUESTION 71
Where should a company go to search software listings from independent software vendors to find, test, buy and deploy software that runs on AWS?
A.   AWS Marketplace
B.   Amazon Lumberyard
C.   AWS Artifact
D.   Amazon CloudSearch

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Marketplace is a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy
software that runs on AWS.
Reference: https://aws.amazon.com

QUESTION 72
Which of the following is a benefit of using the AWS Cloud?

A.   Permissive security removes the administrative burden.
B.   Ability to focus on revenue-generating activities.
C.   Control over cloud network hardware.
D.   Choice of specific cloud hardware vendors.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Developer and IT staff productivity accounted for nearly 30% of overall financial benefits. The remaining benefits were driven by the flexibility and agility of Amazon
cloud infrastructure services, which make it easier to trial new business models, support revenue-generating applications, and provide more reliable services to
end users.
Reference: https://media.amazonwebservices.com/
IDC_Business_Value_of_AWS_Accelerates_Over_time.pdf

QUESTION 73
When performing a cost analysis that supports physical isolation of a customer workload, which compute hosting model should be accounted for in the Total Cost
of Ownership (TCO)?

A.   Dedicated Hosts
B.   Reserved Instances
C.   On-Demand Instances
D.   No Upfront Reserved Instances

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Use Dedicated Hosts to launch Amazon EC2 instances on physical servers that are dedicated for your use. Dedicated Hosts give you additional visibility and
control over how instances are placed on a physical server, and you can reliably use the same physical server over time. As a result, Dedicated Hosts enable you
to use your existing server-bound software licenses like Windows Server and address corporate compliance and regulatory requirements.

QUESTION 74
Which AWS service provides the ability to manage infrastructure as code?

A.   AWS CodePipeline
B.   AWS CodeDeploy
C.   AWS Direct Connect
D.   AWS CloudFormation

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS CloudFormation provides a common language for you to describe and provision all the infrastructure resources in your cloud environment. CloudFormation
allows you to use a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions
and accounts. This file serves as the single source of truth for your cloud environment.
Reference: https://aws.amazon.com/cloudformation/

QUESTION 75
If a customer needs to audit the change management of AWS resources, which of the following AWS services should the customer use?

A.   AWS Config
B.   AWS Trusted Advisor
C.   Amazon CloudWatch
D.   Amazon Inspector

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your
AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review
changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance
against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and
operational troubleshooting.
Reference: https://aws.amazon.com/config/

QUESTION 76
What is Amazon CloudWatch?

A.   A code repository with customizable build and team commit features.
B.   A metrics repository with customizable notification thresholds and channels.
C.   A security configuration repository with threat analytics.
D.   A rule repository of a web application firewall with automated vulnerability prevention features.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon CloudWatch is basically a metrics repository. An AWS service -- such as Amazon EC2 -- puts metrics into the repository, and you retrieve statistics based
on those metrics. If you put your own custom metrics into the repository, you can retrieve statistics on these metrics as well.
Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ cloudwatch_architecture.html

QUESTION 77
Which service allows a company with multiple AWS accounts to combine its usage to obtain volume discounts?

A.   AWS Server Migration Service
B.   AWS Organizations
C.   AWS Budgets
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
use the consolidated billing feature in AWS Organizations to consolidate billing and payment for multiple AWS accounts or multiple Amazon Internet Services Pvt.
Ltd (AISPL) accounts. Every organization in AWS Organizations has a master account that pays the charges of all the member accounts.
Consolidated billing has the following benefits:
One bill You get one bill for multiple accounts.
Easy tracking You can track the charges across multiple accounts and download the combined cost and usage data.
Combined usage You can combine the usage across all accounts in the organization to share the volume pricing discounts and Reserved Instance discounts. This
can result in a lower charge for your project, department, or company than with individual standalone accounts. For more information, see Volume Discounts.
No extra fee Consolidated billing is offered at no additional cost.

QUESTION 78
Which of the following services could be used to deploy an application to servers running on-premises? (Select TWO.)

A.   AWS Elastic Beanstalk
B.   AWS OpsWorks
C.   AWS CodeDeploy
D.   AWS Batch
E.   AWS X-Ray

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation: https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-on-premises.html https://aws.amazon.com/blogs/aws/opsworks-on-prem-and-
existing-instances/

QUESTION 79
Which Amazon EC2 pricing model adjusts based on supply and demand of EC2 instances?

A.   On-Demand Instances
B.   Reserved Instances
C.   Spot Instances
D.   Convertible Reserved Instances

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
In the new model, the Spot prices are more predictable, updated less frequently, and are determined by supply and demand for Amazon EC2 spare capacity, not
bid prices.
Reference: https://aws.amazon.com/blogs/compute/new-amazon-ec2-spot-pricing/

QUESTION 80
Which design principles for cloud architecture are recommended when re-architecting a large monolithic application? (Select TWO.)

A.   Use manual monitoring.
B.   Use fixed servers.
C.   Implement loose coupling.
D.   Rely on individual components.
E.   Design for scalability.

Correct Answer: CE
Explanation

Explanation/Reference:


QUESTION 81
Which is the MINIMUM AWS Support plan that allows for one-hour target response time for support cases?
A.   Enterprise
B.   Business
C.   Developer
D.   Basic

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 82
Where can AWS compliance and certification reports be downloaded?

A.   AWS Artifact
B.   AWS Concierge
C.   AWS Certificate Manager
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
WS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS's security and compliance
reports and select online agreements. The AWS SOC 2 report is particularly helpful for completing questionnaires because it provides a comprehensive description
of the implementation and operating effectiveness of AWS security controls.
Another useful document is the Executive Briefing within the AWS FedRAMP Partner Package.
Reference: https://aws.amazon.com/compliance/faq/

QUESTION 83
Which AWS service provides a customized view of the health of specific AWS services that power a customer's workloads running on AWS?

A.   AWS Service Health Dashboard
B.   AWS X-Ray
C.   AWS Personal Health Dashboard
D.   Amazon CloudWatch

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 84
Which of the following is an advantage of consolidated billing on AWS?

A.   Volume pricing qualification
B.   Shared access permissions
C.   Multiple bills per account
D.   Eliminates the need for tagging

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
If you have multiple standalone accounts, your charges might decrease if you add the accounts to an organization. AWS combines usage from all accounts in the
organization to qualify you for volume pricing discounts.
Reference: https://help.nops.io/consolidated-billing

QUESTION 85
Which of the following steps should be taken by a customer when conducting penetration testing on AWS?

A.   Conduct penetration testing using Amazon Inspector, and then notify AWS support.
B.   Request and wait for approval from the customer's internal security team, and then conduct testing.
C.   Notify AWS support, and then conduct testing immediately.
D.   Request and wait for approval from AWS support, and then conduct testing.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services.
Reference: https://aws.amazon.com/security/penetration-testing/

QUESTION 86
Which of the following AWS features enables a user to launch a pre-configured Amazon Elastic Compute Cloud (Amazon EC2) instance?

A.   Amazon Elastic Block Store (Amazon EBS)
B.   Amazon Machine Image
C.   Amazon EC2 Systems Manager
D.   Amazon AppStream 2.0

Correct Answer: B
Explanation
Explanation/Reference:
Explanation:
To use Amazon EC2, you simply:
Select a pre-configured, templated Amazon Machine Image (AMI) to get up and running immediately.
Or create an AMI containing your applications, libraries, data, and associated configuration settings.
Configure security and network access on your Amazon EC2 instance.
Choose which instance type(s) you want, then start, terminate, and monitor as many instances of your AMI as needed, using the web service APIs or the variety of
management tools provided.
Determine whether you want to run in multiple locations, utilize static IP endpoints, or attach persistent block storage to your instances.
Pay only for the resources that you actually consume, like instance-hours or data transfer.
Reference: https://aws.amazon.com/ec2/features/

QUESTION 87
How would an AWS customer easily apply common access controls to a large set of users?

A.   Apply an IAM policy to an IAM group.
B.   Apply an IAM policy to an IAM role.
C.   Apply the same IAM policy to all IAM users with access to the same workload.
D.   Apply an IAM policy to an Amazon Cognito user pool.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Instead of defining permissions for individual IAM users, it's usually more convenient to create groups that relate to job functions (administrators, developers,
accounting, etc.). Next, define the relevant permissions for each group. Finally, assign IAM users to those groups. All the users in an IAM group inherit the
permissions assigned to the group. That way, you can make changes for everyone in a group in just one place. As people move around in your company, you can
simply change what IAM group their IAM user belongs to.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 88
Which AWS Cost Management tool allows you to view the most granular data about your AWS bill?

A.   AWS Cost Explorer
B.   AWS Budgets
C.   AWS Cost and Usage report
D.   AWS Billing dashboard

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The Cost & Usage Report is your one-stop-shop for accessing the most granular data about your AWS costs and usage. You can also load your cost and usage
information into Amazon Athena, Amazon Redshift, AWS QuickSight, or a tool of your choice.
Reference: https://aws.amazon.com/aws-cost-management/

QUESTION 89
Which of the following can an AWS customer use to launch a new Amazon Relational Database Service (Amazon RDS) cluster? (Select TWO.)

A.   AWS Concierge
B.   AWS CloudFormation
C.   Amazon Simple Storage Service (Amazon S3)
D.   Amazon EC2 Auto Scaling
E.   AWS Management Console

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 90
Which of the following is an AWS Cloud architecture design principle?

A.   Implement single points of failure.
B.   Implement loose coupling.
C.   Implement monolithic design.
D.   Implement vertical scaling.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Loose coupling between services can also be done through asynchronous integration. It involves one component that generates events and another that
consumes them. The two components do not integrate through direct point-to-point interaction, but usually through an intermediate durable storage layer. This
approach decouples the two components and introduces additional resiliency. So, for example, if a process that is reading messages from the queue fails,
messages can still be added to the queue to be processed when the system recovers.
Reference: https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

QUESTION 91
Which of the following security measures protect access to an AWS account? (Select TWO.)

A.   Enable AWS CloudTrail.
B.   Grant least privilege access to IAM users.
C.   Create one IAM user and share with many developers and users.
D.   Enable Amazon CloudFront.
E. Activate multi-factor authentication (MFA) for privileged users.

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
If you decided to create service accounts (that is, accounts used for programmatic access by applications running outside of the AWS environment) and generate
access keys for them, you should create a dedicated service account for each use case. This will allow you to restrict the associated policy to only the permissions
needed for the particular use case, limiting the blast radius if the credentials are compromised. For example, if a monitoring tool and a release management tool
both require access to your AWS environment, create two separate service accounts with two separate policies that define the minimum set of permissions for
each tool.
Reference: https://aws.amazon.com/blogs/security/guidelines-for-protecting-your-aws-account-while-using-programmatic-access/

QUESTION 92
Which service provides a hybrid storage service that enables on-premises applications to seamlessly use cloud storage?

A.   Amazon Glacier
B.   AWS Snowball
C.   AWS Storage Gateway
D.   Amazon Elastic Block Storage (Amazon EBS)

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage. Customers use Storage Gateway
to simplify storage management and reduce costs for key hybrid cloud storage use cases. These include moving tape backups to the cloud, reducing on-premises
storage with cloud-backed file shares, providing low latency access to data in AWS for on- premises applications, as well as various migration, archiving,
processing, and disaster recovery use cases.
Reference: https://aws.amazon.com/storagegateway/?whats-new-cards.sort- by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc

QUESTION 93
Which of the following services falls under the responsibility of the customer to maintain operating system configuration, security patching, and networking?

A.   Amazon RDS
B.   Amazon EC2
C.   Amazon ElastiCache
D.   AWS Fargate

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The customer is responsible for managing, support, patching and control of the guest operating system and AWS services provided like EC2.
Reference: https://www.whizlabs.com/blog/aws-security-shared-responsibility/

QUESTION 94
Which of the following is an important architectural design principle when designing cloud applications?

A.   Use multiple Availability Zones.
B.   Use tightly coupled components.
C.   Use open source software.
D.   Provision extra capacity.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Data Center resilience is practiced through Availability Zones across data centers that reduce the impact of failures.
Fault isolation improvement can be made to traditional horizontal scaling by sharding (a method of grouping instances into groups called shards, instead of
sending the traffic from all users to every node like in the traditional IT structure.)
Reference: https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

QUESTION 95
Which AWS support plan includes a dedicated Technical Account Manager?

A.   Developer
B.   Enterprise
C.   Business
D.   Basic

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The enterprise support plans supports technical account manager. Developer and business support plans are devoid of this facility.
Reference: https://aws.amazon.com/premiumsupport/plans/

QUESTION 96
Amazon Relational Database Service (Amazon RDS) offers which of the following benefits over traditional database management?

A.   AWS manages the data stored in Amazon RDS tables.
B.   AWS manages the maintenance of the operating system.
C.   AWS automatically scales up instance types on demand.
D.   AWS manages the database type.
Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 97
Which service is best for storing common database query results, which helps to alleviate database access load?

A.   Amazon Machine Learning
B.   Amazon SQS
C.   Amazon ElastiCache
D.   Amazon EC2 Instance Store

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
Amazon ElastiCache for Redis is a great choice for implementing a highly available, distributed, and secure in-memory cache to decrease access latency, increase
throughput, and ease the load off your relational or NoSQL databases and applications. ElastiCache can serve frequently requested items at sub- millisecond
response times, and enables you to easily scale for higher loads without growing the costlier backend databases. Database query results caching, persistent
session caching, and full-page caching are all popular examples of caching with ElastiCache for Redis.
Reference: https://aws.amazon.com/products/databases/real-time-apps-elasticache-for-redis/

QUESTION 98
Which of the following is a component of the shared responsibility model managed entirely by AWS?

A.   Patching operating system software
B.   Encrypting data
C.   Enforcing multi-factor authentication
D.   Auditing physical data center assets

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Of course, Amazon is responsible for auditing physical data center assets and resources since it is the property of Amazon Inc. Customers have no access to
physical sites, hence they are not responsible for maintaining physical data center assets.

QUESTION 99
Which options does AWS make available for customers who want to learn about security in the cloud in an instructor-led setting? (Select TWO.)

A.   AWS Trusted Advisor
B.   AWS Online Tech Talks
C.   AWS Blog
D.   AWS Forums
E.   AWS Classroom Training

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
AWS Training and Certification builds your competence, confidence, and credibility through practical cloud skills that help you innovate and build your future. Our
content is built by experts at AWS and updated regularly so you're always learning the latest and keeping your cloud skills fresh.
Amazon offer both digital and classroom training including private on-site training. You can choose to learn online at your own pace or learn from an accredited
AWS instructor. Whether you're just starting out, building on existing IT skills, or sharpening your cloud knowledge, AWS Training and Certification can help you be
more effective and do more in the cloud.
Reference: https://aws.amazon.com/training/course-descriptions/

QUESTION 100
Which of the following features can be configured through the Amazon Virtual Private Cloud (Amazon VPC) Dashboard? (Select TWO.)

A.   Amazon CloudFront distributions
B.   Amazon Route 53
C.   Security Groups
D.   Subnets
E.   Elastic Load Balancing

Correct Answer: CD
Explanation

Explanation/Reference:
Explanation:
Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual
network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of
subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 in your VPC for secure and easy access to resources and
applications.
You can easily customize the network configuration for your Amazon VPC. For example, you can create a public-facing subnet for your web servers that has
access to the Internet, and place your backend systems such as databases or application servers in a private-facing subnet with no Internet access. You can
leverage multiple layers of security, including security groups and network access control lists, to help control access to Amazon EC2 instances in each subnet.
Reference: https://aws.amazon.com/vpc/

QUESTION 101
If each department within a company has its own AWS account, what is one way to enable consolidated billing?

A. Use AWS Budgets on each account to pay only to budget.
B. Contact AWS Support for a monthly bill.
C. Create an AWS Organization from the payer account and invite the other accounts to join.
D. Put all invoices into one Amazon Simple Storage Service (Amazon S3) bucket, load data into Amazon Redshift, and then run a billing report.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 102
How do customers benefit from Amazon's massive economies of scale?

A.   Periodic price reductions as the result of Amazon's operational efficiencies
B.   New Amazon EC2 instance types providing the latest hardware
C.   The ability to scale up and down when needed
D.   Increased reliability in the underlying hardware of Amazon EC2 instances

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 103
Which AWS services can be used to gather information about AWS account activity? (Select TWO.)

A.   Amazon CloudFront
B.   AWS Cloud9
C.   AWS CloudTrail
D.   AWS CloudHSM
E.   Amazon CloudWatch

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
AWS offers a solution that uses AWS CloudTrail to log account activity, Amazon Kinesis to compute and stream metrics in real-time, and Amazon DynamoDB to
durably store the computed data. Metrics are calculated for create, modify, and delete API calls for more than 60 supported AWS services. The solution also
features a dashboard that visualizes your account activity in real-time.
Reference: https://aws.amazon.com/solutions/real-time-insights-account-activity/

QUESTION 104
Which of the following common IT tasks can AWS cover to free up company IT resources? (Select TWO.)

A.   Patching databases software
B.   Testing application releases
C.   Backing up databases
D.   Creating database schema
E.   Running penetration tests

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 105
In which scenario should Amazon EC2 Spot Instances be used?

A.   A company wants to move its main website to AWS from an on-premises web server.
B.   A company has a number of application services whose Service Level Agreement (SLA) requires 99.999% uptime.
C.   A company's heavily used legacy database is currently running on-premises.
D.   A company has a number of infrequent, interruptible jobs that are currently using On-Demand Instances.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-leveraging-ec2-spot-instances/spot-instance-interruptions.html

QUESTION 106
Which AWS feature should a customer leverage to achieve high availability of an application?

A.   AWS Direct Connect
B.   Availability Zones
C.   Data centers
D.   Amazon Virtual Private Cloud (Amazon VPC)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
This is to achieve High Availability for any web application (in this case SwiftCode) deployed in AWS. The following features will be present:
High availability across multiple instances/multiple availability zones.
Auto Scaling of instances (scale up and scale down) based on number of requests coming in
Additional Security to the instances/database that are in production
No impact to end users during newer version of code deployment
No Impact during patching the instances
Reference: https://betsol.com/2018/01/how-to-make-high-availability-web-applications-on-amazon-web- services/

QUESTION 107
Which is the minimum AWS Support plan that includes Infrastructure Event Management without additional costs?

A.   Enterprise
B.   Business
C.   Developer
D.   Basic

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 108
Which AWS service can serve a static website?

A.   Amazon S3
B.   Amazon Route 53
C.   Amazon QuickSight
D.   AWS X-Ray

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
You can host a static website on Amazon Simple Storage Service (Amazon S3). On a static website, individual webpages include static content. They might also
contain client-side scripts. By contrast, a dynamic website relies on server-side processing, including server-side scripts such as PHP, JSP, or ASP.NET. Amazon
S3 does not support server-side scripting.
Reference: https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html

QUESTION 109
How does AWS shorten the time to provision IT resources?

A.   It supplies an online IT ticketing platform for resource requests.
B.   It supports automatic code validation services.
C.   It provides the ability to programmatically provision existing resources.
D.   It automates the resource request process from a company's IT vendor list.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 110
What can AWS edge locations be used for? (Select TWO.)

A.   Hosting applications
B.   Delivering content closer to users
C.   Running NoSQL database caching services
D.   Reducing traffic on the server by caching responses
E.   Sending notification messages to end users

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with
CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.
Reference: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

QUESTION 111
Which of the following can limit Amazon Simple Storage Service (Amazon S3) bucket access to specific users?

A.   A public and private key-pair
B.   Amazon Inspector
C.   AWS Identity and Access Management (IAM) policies
D.   Security Groups

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
To allow users to perform S3 actions on the bucket from the VPC endpoints or IP addresses, you must explicitly grant those user-level permissions. You can grant
user-level permissions on either an AWS Identity and Access Management (IAM) policy or another statement in the bucket policy.
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/

QUESTION 112
A solution that is able to support growth in users, traffic, or data size with no drop in performance aligns with which cloud architecture principle?
A.   Think parallel
B.   Implement elasticity
C.   Decouple your components
D.   Design for failure

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf

QUESTION 113
Which of the following tasks is the responsibility of AWS?

A.   Encrypting client-side data
B.   Configuring AWS Identity and Access Management (IAM) roles
C.   Securing the Amazon EC2 hypervisor
D.   Setting user password policies

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
In EC2, the AWS IaaS offering, everything from the hypervisor layer down is AWS's responsibility. A customer's poorly coded applications, misconfigured operating
systems, or insecure firewall settings will not affect the hypervisor, it will only affect the customer's virtual machines running on that hypervisor.
Reference: https://www.mindpointgroup.com/blog/the-aws-shared-responsibility-model-part-1-security-in- the-cloud/

QUESTION 114
One benefit of On-Demand Amazon Elastic Compute Cloud (Amazon EC2) pricing is:

A.   the ability to bid for a lower hourly cost.
B.   paying a daily rate regardless of time used.
C.   paying only for time used.
D.   pre-paying for instances and paying a lower hourly rate.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
On-Demand Capacity Reservations are priced exactly the same as their equivalent (On-Demand) instance usage. If a Capacity Reservation is fully utilized, you
only pay for instance usage and nothing towards the Capacity Reservation. If a Capacity Reservation is partially utilized, you pay for the instance usage and for the
unused portion of the Capacity Reservation.
Reference: https://aws.amazon.com/ec2/pricing/on-demand/

QUESTION 115
An administrator needs to rapidly deploy a popular IT solution and start using it immediately.

Where can the administrator find assistance?

A.   AWS Well-Architected Framework documentation
B.   Amazon CloudFront
C.   AWS CodeCommit
D.   AWS Quick Start reference deployments

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Quick Starts are built by AWS solutions architects and partners to help you deploy popular technologies on AWS, based on AWS best practices for security and
high availability. These accelerators reduce hundreds of manual procedures into just a few steps, so you can build your production environment quickly and start
using it immediately.
Reference: https://aws.amazon.com/quickstart/?quickstart-all.sort- by=item.additionalFields.updateDate&quickstart-all.sort-order=desc

QUESTION 116
Which of the following services is in the category of AWS serverless platform?

A.   Amazon EMR
B.   Elastic Load Balancing
C.   AWS Lambda
D.   AWS Mobile Hub

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS provides a set of fully managed services that you can use to build and run serverless applications.
Serverless applications don't require provisioning, maintaining, and administering servers for backend components such as compute, databases, storage, stream
processing, message queueing, and more. You also no longer need to worry about ensuring application fault tolerance and availability. Instead, AWS handles all of
these capabilities for you. Serverless platform includes: AWS lambda, Amazon S3, DynamoDB, API gateway, Amazon SNS, AWS step functions, Amazon kinesis
and developing tools and services.
Reference: https://aws.amazon.com/serverless/

QUESTION 117
Which services are parts of the AWS serverless platform?
A.   Amazon EC2, Amazon S3, Amazon Athena
B.   Amazon Kinesis, Amazon SQS, Amazon EMR
C.   AWS Step Functions, Amazon DynamoDB, Amazon SNS
D.   Amazon Athena, Amazon Cognito, Amazon EC2

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS provides a set of fully managed services that you can use to build and run serverless applications.
Serverless applications don't require provisioning, maintaining, and administering servers for backend components such as compute, databases, storage, stream
processing, message queueing, and more. You also no longer need to worry about ensuring application fault tolerance and availability. Instead, AWS handles all of
these capabilities for you. Serverless platform includes: AWS lambda, Amazon S3, DynamoDB, API gateway, Amazon SNS, AWS step functions, Amazon kinesis
and developing tools and services.
Reference: https://aws.amazon.com/serverless/

QUESTION 118
Under the shared responsibility model, which of the following is a shared control between a customer and AWS?

A.   Physical controls
B.   Patch management
C.   Zone security
D.   Data center auditing

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 119
What can AWS edge locations be used for? (Select TWO.)

A.   Hosting applications
B.   Delivering content closer to users
C.   Running NoSQL database caching services
D.   Reducing traffic on the server by caching responses
E.   Sending notification messages to end users

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with
CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.
Reference: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

QUESTION 120
What technology enables compute capacity to adjust as loads change?

A.   Load balancing
B.   Automatic failover
C.   Round robin
D.   Auto Scaling

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Auto Scaling monitors your applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost. Using
AWS Auto Scaling, it's easy to setup application scaling for multiple resources across multiple services in minutes. The service provides a simple, powerful user
interface that lets you build scaling plans for resources including Amazon EC2 instances and Spot Fleets, Amazon ECS tasks, Amazon DynamoDB tables and
indexes, and Amazon Aurora Replicas. AWS Auto Scaling makes scaling simple with recommendations that allow you to optimize performance, costs, or balance
between them. If you're already using Amazon EC2 Auto Scaling to dynamically scale your Amazon EC2 instances, you can now combine it with AWS Auto
Scaling to scale additional resources for other AWS services. With AWS Auto Scaling, your applications always have the right resources at the right time.
Reference: https://aws.amazon.com/autoscaling/

QUESTION 121
Which AWS services are defined as global instead of regional? (Select TWO.)

A.   Amazon Route 53
B.   Amazon EC2
C.   Amazon S3
D.   Amazon CloudFront
E.   Amazon DynamoDB

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
http://jayendrapatil.com/aws-global-vs-regional-vs-az-resources/

QUESTION 122
Which AWS service would you use to obtain compliance reports and certificates?
A.   AWS Artifact
B.   AWS Lambda
C.   Amazon Inspector
D.   AWS Certificate Manager

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS' security and compliance
reports and select online agreements.
Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from
accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).
Reference: https://aws.amazon.com/artifact/

QUESTION 123
Under the shared responsibility model, which of the following tasks are the responsibility of the AWS customer? (Select TWO.)

A.   Ensuring that application data is encrypted at rest
B.   Ensuring that AWS NTP servers are set to the correct time
C.   Ensuring that users have received security training in the use of AWS services
D.   Ensuring that access to data centers is restricted
E.   Ensuring that hardware is disposed of properly

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 124
Which AWS service can be used to manually launch instances based on resource requirements?

A.   Amazon EBS
B.   Amazon S3
C.   Amazon EC2
D.   Amazon ECS

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 125
A company is migrating an application that is running non-interruptible workloads for a three-year time frame.

Which pricing construct would provide the MOST cost-effective solution?

A.   Amazon EC2 Spot Instances
B.   Amazon EC2 Dedicated Instances
C.   Amazon EC2 On-Demand Instances
D.   Amazon EC2 Reserved Instances

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 126
The financial benefits of using AWS are: (Select TWO.)

A.   reduced Total Cost of Ownership (TCO).
B.   increased capital expenditure (capex).
C.   reduced operational expenditure (opex).
D.   deferred payment plans for startups.
E.   business credit lines for stratups.

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 127
Under the shared responsibility model, which of the following is a shared control between a customer and AWS?

A.   Physical controls
B.   Patch management
C.   Zone security
D.   Data center auditing

Correct Answer: C
Explanation
Explanation/Reference:
Explanation:
Shared Controls Controls which apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared
control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services.
Examples include:
Patch Management AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest OS and
applications.
Configuration Management AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating
systems, databases, and applications.
Awareness & Training AWS trains AWS employees, but a customer must train their own employees.
Customer Specific Controls which are solely the responsibility of the customer based on the application they are deploying within AWS services. Examples
include:
- Service and Communications Protection or Zone Security which may require a customer to route or zone data within specific security environments.
Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 128
Which AWS service allows companies to connect an Amazon VPC to an on-premises data center?

A.   AWS VPN
B.   Amazon Redshift
C.   API Gateway
D.   Amazon Direct Connect

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Direct Connect enables you to securely connect your AWS environment to your on-premises data center or office location over a standard 1 gigabit or 10
gigabit Ethernet fiber-optic connection. AWS Direct Connect offers dedicated high speed, low latency connection, which bypasses internet service providers in your
network path. An AWS Direct Connect location provides access to Amazon Web Services in the region it is associated with, as well as access to other US regions.
AWS Direct Connect allows you to logically partition the fiber-optic connections into multiple logical connections called Virtual Local Area Networks (VLAN). You
can take advantage of these logical connections to improve security, differentiate traffic, and achieve compliance requirements.
Reference: https://aws.amazon.com/getting-started/projects/connect-data-center-to-aws/

QUESTION 129
A company wants to reduce the physical compute footprint that developers use to run code.

Which service would meet that need by enabling serverless architectures?

A.   Amazon Elastic Compute Cloud (Amazon EC2)
B.   AWS Lambda
C.   Amazon DynamoDB
D.   AWS CodeCommit

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Lambda is an integral part of coding on AWS. It reduces physical compute footprint by utilizing aws cloud services to run code.

QUESTION 130
Which AWS service provides alerts when an AWS event may impact a company's AWS resources?

A.   AWS Personal Health Dashboard
B.   AWS Service Health Dashboard
C.   AWS Trusted Advisor
D.   AWS Infrastructure Event Management

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Personal Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you. While the Service Health
Dashboard displays the general status of AWS services, Personal Health Dashboard gives you a personalized view into the performance and availability of the
AWS services underlying your AWS resources.
Reference: https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/

QUESTION 131
Which of the following are categories of AWS Trusted Advisor? (Select TWO.)

A.   Fault Tolerance
B.   Instance Usage
C.   Infrastructure
D.   Performance
E.   Storage Capacity

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
Like your customized cloud expert, AWS Trusted Advisor analyzes your AWS environment and provides best practice recommendations in five categories: cost
optimization, performance, security, fault tolerance and service limits.
Reference: https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

QUESTION 132
Which of the following services falls under the responsibility of the customer to maintain operating system configuration, security patching, and networking?
A.   Amazon RDS
B.   Amazon EC2
C.   Amazon ElastiCache
D.   AWS Fargate

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The customer is responsible for managing, support, patching and control of the guest operating system and AWS services provided like EC2.
Reference: https://www.whizlabs.com/blog/aws-security-shared-responsibility/

QUESTION 133
A company will be moving from an on-premises data center to the AWS Cloud.

What would be one financial difference after the move?

A.   Moving from variable operational expense (opex) to upfront capital expense (capex).
B.   Moving from upfront capital expense (capex) to variable capital expense (capex).
C.   Moving from upfront capital expense (capex) to variable operational expense (opex).
D.   Elimination of upfront capital expense (capex) and elimination of variable operational expense (opex)

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 134
How should a customer forecast the future costs for running a new web application?

A.   Amazon Aurora Backtrack
B.   Amazon CloudWatch Billing Alarms
C.   AWS Simple Monthly Calculator
D.   AWS Cost and Usage report

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
You can use Cost explorer which is part of Cost and Usage report to forecast future costs of running an application.
Reference: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-forecast.html

QUESTION 135
Which is the MINIMUM AWS Support plan that provides technical support through phone calls?

A.   Enterprise
B.   Business
C.   Developer
D.   Basic

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 136
According to the AWS shared responsibility model, what is the sole responsibility of AWS?

A.   Application security
B.   Edge location management
C.   Patch management
D.   Client-side data

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Client-side data, application security is the sole responsibility of the customer. Patch management is a shared responsibility. That leaves us with edge location
management and since this out of the control of the customer, AWS is the one responsible for it.
Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 137
Which AWS IAM feature is used to associate a set of permissions with multiple users?

A.   Multi-factor authentication
B.   Groups
C.   Password policies
D.   Access keys

Correct Answer: B
Explanation
Explanation/Reference:
Explanation:
An IAM group is a collection of IAM users. You can use groups to specify permissions for a collection of users, which can make those permissions easier to
manage for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html

QUESTION 138
Which of the following are benefits of the AWS Cloud? (Choose two.)

A.   Unlimited uptime
B.   Elasticity
C.   Agility
D.   Colocation
E.   Capital expenses

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
The most celebrated benefit of AWS cloud is elasticity since you can expand the services when you experience more traffic.
Agile developments in AWS Cloud through strategies are day by day becoming more established within the enterprises across the world. With so much
improvement and call for optimization in the cloud, it is necessary that these strategies get established from the ground up within the organizations. It is highly
important as already enterprises have a lot of bequest, politics and hierarchies which act as barriers in their businesses.
Reference: https://www.botmetric.com/blog/evolution-agile-enterprises-aws-cloud/

QUESTION 139
Which of the following can a customer use to enable single sign-on (SSO) to the AWS Console?

A.   Amazon Connect
B.   AWS Directory Service
C.   Amazon Pinpoint
D.   Amazon Rekognition

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Single sign-on only works when used on a computer that is joined to the AWS Directory Service directory.
It cannot be used on computers that are not joined to the directory.
Reference: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_single_sign_on.html

QUESTION 140
What are the multiple, isolated locations within an AWS Region that are connected by low-latency networks called?

A.   AWS Direct Connects
B.   Amazon VPCs
C.   Edge locations
D.   Availability Zones

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Each Region is completely independent. Each Availability Zone is isolated, but the Availability Zones in a Region are connected through low-latency links. A Local
Zone is an AWS infrastructure deployment that places select services closer to your end users. A Local Zone is an extension of a Region that is in a different
location from your Region. It provides a high-bandwidth backbone to the AWS infrastructure and is ideal for latency-sensitive applications, for example machine
learning.
Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

QUESTION 141
Which of the following benefits does the AWS Compliance program provide to AWS customers? (Choose two.)

A.   It verifies that hosted workloads are automatically compliant with the controls of supported compliance frameworks.
B.   AWS is responsible for the maintenance of common compliance framework documentation.
C.   It assures customers that AWS is maintaining physical security and data protection.
D.   It ensures the use of compliance frameworks that are being used by other cloud providers.
E.   It will adopt new compliance frameworks as they become relevant to customer workloads.

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://d0.awsstatic.com/whitepapers/compliance/ AWS_Risk_and_Compliance_Whitepaper.pdf

QUESTION 142
Which of the following services provides on-demand access to AWS compliance reports?

A.   AWS IAM
B.   AWS Artifact
C.   Amazon GuardDuty
D.   AWS KMS

Correct Answer: B
Explanation
Explanation/Reference:
Explanation:
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS' security and compliance
reports and select online agreements.
Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from
accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).
Reference: https://aws.amazon.com/artifact/

QUESTION 143
As part of the AWS shared responsibility model, which of the following operational controls do users fully inherit from AWS?

A.   Security management of data center
B.   Patch management
C.   Configuration management
D.   User and access management

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 144
When comparing AWS Cloud with on-premises Total Cost of Ownership, which expenses must be considered? (Choose two.)

A.   Software development
B.   Project management
C.   Storage hardware
D.   Physical servers
E.   Antivirus software license

Correct Answer: CD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/the-new-aws-tco-calculator/

QUESTION 145
Under the shared responsibility model, which of the following tasks are the responsibility of the customer? (Choose two.)

A.   Maintaining the underlying Amazon EC2 hardware.
B.   Managing the VPC network access control lists.
C.   Encrypting data in transit and at rest.
D.   Replacing failed hard disk drives.
E.   Deploying hardware in different Availability Zones.

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
The hardware related jobs is the prime responsibility of AWS. VPC network access control lists is something a customer has to do himself to secure the
applications. Encrypting data in transit and at rest is a shared responsibility in which AWS plays a part. All hardware related jobs have nothing to do with the
customer.
Reference: https://dzone.com/articles/aws-shared-responsibility-model-cloud-security

QUESTION 146
Which scenarios represent the concept of elasticity on AWS? (Choose two.)

A.   Scaling the number of Amazon EC2 instances based on traffic.
B.   Resizing Amazon RDS instances as business needs change.
C.   Automatically directing traffic to less-utilized Amazon EC2 instances.
D.   Using AWS compliance documents to accelerate the compliance process.
E.   Having the ability to create and govern environments using code.

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://wa.aws.amazon.com/wat.concept.elasticity.en.html

QUESTION 147
When is it beneficial for a company to use a Spot Instance?

A.   When there is flexibility in when an application needs to run.
B.   When there are mission-critical workloads.
C.   When dedicated capacity is needed.
D.   When an instance should not be stopped.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
The key to understanding spot instances is to look at the way that cloud service providers such as Amazon Web Services (AWS) operate. Cloud service providers
invest in hardware resources and then release those resources (often on a per-hour basis) to subscribers. One of the problems with this business model, however,
is that at any given time, there are likely to be compute resources that are not being utilized.
These resources represent hardware capacity that AWS has paid for but are sitting idle, and not making AWS any money at the moment.
Rather than allowing these computing resources to go to waste, AWS offers them at a substantially discounted rate, with the understanding that if someone needs
those resources for running a normal EC2 instance, that instance will take priority over spot instances that are using the hardware resources at a discounted rate.
In fact, spot instances will be stopped if the resources are needed elsewhere.
Reference: https://awsinsider.net/articles/2017/09/25/aws-spot-instances-primer.aspx

QUESTION 148
A company is considering moving its on-premises data center to AWS. What factors should be included in doing a Total Cost of Ownership (TCO) analysis?
(Choose two.)

A.   Amazon EC2 instance availability
B.   Power consumption of the data center
C.   Labor costs to replace old servers
D.   Application developer time
E.   Database engine capacity

Correct Answer: BC
Explanation

Explanation/Reference:


QUESTION 149
How does AWS charge for AWS Lambda?

A.   Users bid on the maximum price they are willing to pay per hour.
B.   Users choose a 1-, 3- or 5-year upfront payment term.
C.   Users pay for the required permanent storage on a file system or in a database.
D.   Users pay based on the number of requests and consumed compute resources.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Lambda is charging its users by the number of requests for their functions and by the duration, which is the time the code needs to execute. When code
starts running in response to an event, AWS Lambda counts a request. It will charge the total number of requests across all of the functions used. Duration is
calculated by the time when your code started executing until it returns or until it is terminated, rounded up near to 100ms. The AWS Lambda pricing depends on
the amount of memory that the user used to allocate to the function.
Reference: https://dashbird.io/blog/aws-lambda-pricing-model-explained/

QUESTION 150
What function do security groups serve related Amazon Elastic Compute Cloud (Amazon EC2) instance security?

A.   Act as a virtual firewall for the Amazon EC2 instance.
B.   Secure AWS user accounts with AWS identity and Access Management (IAM) policies.
C.   Provide DDoS protection with AWS Shield.
D.   Use Amazon CloudFront to protect the Amazon EC2 instance.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Security Groups act like a firewall for your Amazon EC2 instances controlling both inbound and outbound traffic. When you launch an instance on Amazon
EC2, you need to assign it to a particular security group.
After that, you can set up ports and protocols, which remain open for users and computers over the internet.
AWS Security Groups are very flexible. You can use the default security group and still customize it according to your liking (although we don't recommend this
practice because groups should be named according to their purpose.) Or you can create a security group that you want for your specific applications.
To do this, you can write the corresponding code or use the Amazon EC2 console to make the process easier.
Reference: https://www.threatstack.com/blog/aws-security-groups-what-they-are-and-how-to-get-the-most- out-of-them

QUESTION 151
Which disaster recovery scenario offers the lowest probability of down time?

A.   Backup and restore
B.   Pilot light
C.   Warm standby
D.   Multi-site active-active

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Backup and Restore: a simple, straightforward, cost-effective method that backs up and restores data as needed. Keep in mind that because none of your data is
on standby, this method, while cheap, can be quite time-consuming.
Pilot Light: This method keeps critical applications and data at the ready so that it can be quickly
retrieved if needed.
Warm Standby: This method keeps a duplicate version of your business' core elements running on standby at all times, which makes for a little downtime and an
almost seamless transition.
Multi-Site Solution: Also known as a Hot Standby, this method fully replicates your company's data/ applications between two or more active locations and splits
your traffic/usage between them. If a disaster strikes, everything is simply rerouted to the unaffected area, which means you'll suffer almost zero downtime.
However, by running two separate environments simultaneously, you will obviously incur much higher costs.
Reference: https://cloudranger.com/best-practices-aws-disaster-recovery-planning/

QUESTION 152
What will help a company perform a cost benefit analysis of migrating to the AWS Cloud?
A.   Cost Explorer
B.   AWS Total Cost of Ownership (TCO) Calculator
C.   AWS Simple Monthly Calculator
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS TCO calculators allow you to estimate the cost savings when using AWS and provide a detailed set of reports that can be used in executive presentations.
The calculators also give you the option to modify assumptions that best meet your business needs.
Reference: https://aws.amazon.com/tco-calculator/

QUESTION 153
Which of the following provides the ability to share the cost benefits of Reserved Instances across AWS accounts?

A.   AWS Cost Explorer between AWS accounts
B.   Linked accounts and consolidated billing
C.   Amazon Elastic Compute Cloud (Amazon EC2) Reserved Instance Utilization Report
D.   Amazon EC2 Instance Usage Report between AWS accounts

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The way that Reserved Instance discounts apply to accounts in an organization's consolidated billing family depends on whether Reserved Instance sharing is
turned on or off for the account. By default, Reserved Instance sharing for all accounts in an organization is turned on. You can change this setting by Turning Off
Reserved Instance Sharing for an account.
The capacity reservation for a Reserved Instance applies only to the account the Reserved Instance was purchased on, regardless of whether Reserved Instance
sharing is turned on or off.
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/

QUESTION 154
A company has multiple AWS accounts and wants to simplify and consolidate its billing process.

Which AWS service will achieve this?

A.   AWS Cost and Usage Reports
B.   AWS Organizations
C.   AWS Cost Explorer
D.   AWS Budgets

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can use the consolidated billing feature in AWS Organizations to consolidate billing and payment for multiple AWS accounts or multiple Amazon Internet
Services Pvt. Ltd (AISPL) accounts. Every organization in AWS Organizations has a master (payer) account that pays the charges of all the member (linked)
accounts.
Reference: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 155
A company is designing an application hosted in a single AWS Region serving end-users spread across the world. The company wants to provide the end-users
low latency access to the application data.

Which of the following services will help fulfill this requirement?

A.   Amazon CloudFront
B.   AWS Direct Connect
C.   Amazon Route 53 global DNS
D.   Amazon Simple Storage Service (Amazon S3) transfer acceleration

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Use AWS Local Zones to deploy workloads closer to your end-users for low-latency requirements. AWS Local Zones have their own connection to the internet and
support AWS Direct Connect, so resources created in the Local Zone can serve local end-users with very low-latency communications.nation Reference: https://
aws.amazon.com/about-aws/global-infrastructure/localzones/faqs/

QUESTION 156
Which of the following deployment models enables customers to fully trade their capital IT expenses for operational expenses?

A.   On-premises
B.   Hybrid
C.   Cloud
D.   Platform as a service

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The cloud allows you to trade capital expenses (such as data centers and physical servers) for variable expenses, and only pay for IT as you consume it. Plus, the
variable expenses are much lower than what you would pay to do it yourself because of the economies of scale.
Reference: https://aws.amazon.com/what-is-cloud-computing/
QUESTION 157
How is asset management on AWS easier than asset management in a physical data center?

A.   AWS provides a Configuration Management Database that users can maintain.
B.   AWS performs infrastructure discovery scans on the customer's behalf.
C.   Amazon EC2 automatically generates an asset report and places it in the customer's specified Amazon S3 bucket.
D.   Users can gather asset metadata reliably with a few API calls.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS assets are centrally managed through an inventory management system that stores and tracks owner, location, status, maintenance, and descriptive
information for AWS-owned assets. Following procurement, assets are scanned and tracked, and assets undergoing maintenance are checked and monitored for
ownership, status, and resolution.
Reference: https://aws.amazon.com/compliance/data-center/controls/

QUESTION 158
What feature of Amazon RDS helps to create globally redundant databases?

A.   Snapshots
B.   Automatic patching and updating
C.   Cross-Region read replicas
D.   Provisioned IOPS

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.amazonaws.cn/en_us/AmazonRDS/latest/UserGuide/rds-ug.pdf

QUESTION 159
Using AWS Identity and Access Management (IAM) to grant access only to the resources needed to perform a task is a concept known as:

A.   restricted access.
B.   as-needed access.
C.   least privilege access.
D.   token access.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
When you create IAM policies, follow the standard security advice of granting least privilege, or granting only the permissions required to perform a task.
Determine what users (and roles) need to do and then craft policies that allow them to perform only those tasks.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 160
Which methods can be used to identify AWS costs by departments? (Choose two.)

A.   Enable multi-factor authentication for the AWS account root user.
B.   Create separate accounts for each department.
C.   Use Reserved Instances whenever possible.
D.   Use tags to associate each instance with a particular department.
E.   Pay bills using purchase orders.

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
Tags are key-value pairs that allow you to organize your AWS resources into groups. You can use tags to:
Visualize information about tagged resources in one place, in conjunction with Resource Groups.
View billing information using Cost Explorer and the AWS Cost and Usage report.
Send notifications about spending limits using AWS Budgets.
Use logical groupings of your resources that make sense for your infrastructure or business. For example, you could organize your resources by:
Project
Cost center
Development environment
Application
Department
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/tags-billing-cost-center-project/

QUESTION 161
Under the AWS shared responsibility model, customer responsibilities include which one of the following?

A.   Securing the hardware, software, facilities, and networks that run all products and services.
B.   Providing certificates, reports, and other documentation directly to AWS customers under NDA.
C.   Configuring the operating system, network, and firewall.
D.   Obtaining industry certifications and independent third-party attestations.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 162
Which managed AWS service provides real-time guidance on AWS security best practices?

A.   AWS X-Ray
B.   AWS Trusted Advisor
C.   Amazon CloudWatch
D.   AWS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS offers premium services such as AWS Trusted Advisor, which provides real-time guidance to help you reduce cost, increase performance, and improve
security.
Reference: https://www.ibm.com/downloads/cas/2N40X4PQ

QUESTION 163
Which feature adds elasticity to Amazon EC2 instances to handle the changing demand for workloads?

A.   Resource groups
B.   Lifecycle policies
C.   Application Load Balancer
D.   Amazon EC2 Auto Scaling

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Support for monitoring the health of each service independently, as health checks are defined at the target group level and many CloudWatch metrics are reported
at the target group level. Attaching a target group to an Auto Scaling group enables you to scale each service dynamically based on demand.
Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

QUESTION 164
Under the AWS shared responsibility model, customers are responsible for which aspects of security in the cloud? (Choose two.)

A.   Visualization management
B.   Hardware management
C.   Encryption management
D.   Facilities management
E.   Firewall management

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
With the basic Cloud infrastructure secured and maintained by AWS, the responsibility for what goes into the cloud falls on you. This covers both client and server
side encryption and network traffic protection, security of the operating system, network, and firewall configuration, followed by application security and identity and
access management.
Firewall configuration remains the responsibility of the end user, which integrates at the platform and application management level. For example, RDS utilizes
security groups, which you would be responsible for configuring and implementing.
Reference: https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 165
Which AWS hybrid storage service enables on-premises applications to seamlessly use AWS Cloud storage through standard file-storage protocols?

A.   AWS Direct Connect
B.   AWS Snowball
C.   AWS Storage Gateway
D.   AWS Snowball Edge

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The AWS Storage Gateway service enables hybrid cloud storage between on-premises environments and the AWS Cloud. It seamlessly integrates on-premises
enterprise applications and workflows with Amazon's block and object cloud storage services through industry standard storage protocols. It provides low-latency
performance by caching frequently accessed data on premises, while storing data securely and durably in Amazon cloud storage services. It provides an optimized
data transfer mechanism and bandwidth management, which tolerates unreliable networks and minimizes the amount of data being transferred. It brings the
security, manageability, durability, and scalability of AWS to existing enterprise environments through native integration with AWS encryption, identity
management, monitoring, and storage services. Typical use cases include backup and archiving, disaster recovery, moving data to S3 for in-cloud workloads, and
tiered storage.
Reference: https://aws.amazon.com/storagegateway/faqs/

QUESTION 166
What is a responsibility of AWS in the shared responsibility model?

A.   Updating the network ACLs to block traffic to vulnerable ports.
B.   Patching operating systems running on Amazon EC2 instances.
C.   Updating the firmware on the underlying EC2 hosts.
D.   Updating the security group rules to block traffic to the vulnerable ports.

Correct Answer: C
Explanation
Explanation/Reference:
Explanation:
https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 167
Which architectural principle is used when deploying an Amazon Relational Database Service (Amazon RDS) instance in Multiple Availability Zone mode?

A.   Implement loose coupling.
B.   Design for failure.
C.   Automate everything that can be automated.
D.   Use services, not servers.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon RDS Multi-AZ deployments provide enhanced availability and durability for Database (DB) Instances, making them a natural fit for production database
workloads. When you provision a Multi-AZ DB Instance, Amazon RDS automatically creates a primary DB Instance and synchronously replicates the data to a
standby instance in a different Availability Zone (AZ). Each AZ runs on its own physically distinct, independent infrastructure, and is engineered to be highly
reliable. In case of an infrastructure failure, Amazon RDS performs an automatic failover to the standby (or to a read replica in the case of Amazon Aurora), so that
you can resume database operations as soon as the failover is complete. Since the endpoint for your DB Instance remains the same after a failover, your
application can resume database operation without the need for manual administrative intervention.
Reference: https://aws.amazon.com/rds/details/multi-az/

QUESTION 168
What does it mean to grant least privilege to AWS IAM users?

A.   It is granting permissions to a single user only.
B.   It is granting permissions using AWS IAM policies only.
C.   It is granting AdministratorAccess policy permissions to trustworthy users.
D.   It is granting only the permissions required to perform a given task.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
When you create IAM policies, follow the standard security advice of granting least privilege, or granting only the permissions required to perform a task.
Determine what users (and roles) need to do and then craft policies that allow them to perform only those tasks.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege

QUESTION 169
What is a benefit of loose coupling as a principle of cloud architecture design?

A.   It facilitates low-latency request handling.
B.   It allows applications to have dependent workflows.
C.   It prevents cascading failures between different components.
D.   It allows companies to focus on their physical data center operations.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
IT systems should ideally be designed in a way that reduces inter-dependencies. Your components need to be loosely coupled to avoid changes or failure in one
of the components from affecting others.
Your infrastructure also needs to have well defined interfaces that allow the various components to interact with each other only through specific, technology-
agnostic interfaces. Modifying any underlying operations without affecting other components should be made possible.
Reference: https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

QUESTION 170
A director has been tasked with investigating hybrid cloud architecture. The company currently accesses AWS over the public internet.

Which service will facilitate private hybrid connectivity?

A.   Amazon Virtual Private Cloud (Amazon VPC) NAT Gateway
B.   AWS Direct Connect
C.   Amazon Simple Storage Service (Amazon S3) Transfer Acceleration
D.   AWS Web Application Firewall (AWS WAF)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon VPC provides multiple network connectivity options for you to leverage depending on your current network designs and requirements. These connectivity
options include leveraging either the internet or an AWS Direct Connect connection as the network backbone and terminating the connection into either AWS or
user-managed network endpoints. Additionally, with AWS, you can choose how network routing is delivered between Amazon VPC and your networks, leveraging
either AWS or user-managed network equipment and routes.
Reference: https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/ introduction.html

QUESTION 171
A company's web application currently has tight dependencies on underlying components, so when one component fails the entire web application fails.

Applying which AWS Cloud design principle will address the current design issue?

A. Implementing elasticity, enabling the application to scale up or scale down as demand changes.
B. Enabling several EC2 instances to run in parallel to achieve better performance.
C. Focusing on decoupling components by isolating them and ensuring individual components can function when other components fail.
D. Doubling EC2 computing resources to increase system fault tolerance.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 172
How can a customer increase security to AWS account logons? (Choose two.)

A.   Configure AWS Certificate Manager
B.   Enable Multi-Factor Authentication (MFA)
C.   Use Amazon Cognito to manage access
D.   Configure a strong password policy
E.   Enable AWS Organizations

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
Your root account should always be protected by Multi-Factor Authentication (MFA). This additional layer of security helps protect against unauthorized logins to
your account by requiring two factors: something you know (a password) and something you have (for example, an MFA device). AWS supports virtual and
hardware MFA devices and U2F security keys. You can set password policies to help enforce complex password requirements so that IAM user passwords cannot be easily guessed.
Amazon Cognito is a user pool and identity provider used for managing application users. It is not involved with AWS console access.

QUESTION 173
What AWS service would be used to centrally manage AWS access across multiple accounts?

A.   AWS Service Catalog
B.   AWS Config
C.   AWS Trusted Advisor
D.   AWS Organizations

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
To improve control over your AWS environment, you can use AWS Organizations to create groups of accounts, and then attach policies to a group to ensure the
correct policies are applied across the accounts without requiring custom scripts and manual processes.
Reference: https://aws.amazon.com/organizations/

QUESTION 174
Which AWS service can a customer use to set up an alert notification when the account is approaching a particular dollar amount?

A.   AWS Cost and Usage reports
B.   AWS Budgets
C.   AWS Cost Explorer
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html

QUESTION 175
What can users access from AWS Artifact?

A.   AWS security and compliance documents
B.   A download of configuration management details for all AWS resources
C.   Training materials for AWS services
D.   A security assessment of the applications deployed in the AWS Cloud

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
You can use AWS Artifact Reports to download AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and
System and Organization Control (SOC) reports.
Reference: https://aws.amazon.com/artifact/faq/

QUESTION 176
Which is the MINIMUM AWS Support plan that provides designated Technical Account Managers?

A.   Enterprise
B.   Business
C.   Developer
D.   Basic

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 177
Which of the following is an AWS Well-Architected Framework design principle related to reliability?

A.   Deployment to a single Availability Zone
B.   Ability to recover from failure
C.   Design for cost optimization
D.   Perform operations as code

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 178
Which type of AWS storage is ephemeral and is deleted when an instance is stopped or terminated?

A.   Amazon EBS
B.   Amazon EC2 instance store
C.   Amazon EFS
D.   Amazon S3

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
When you stop or terminate an instance, every block of storage in the instance store is reset. Therefore, your data cannot be accessed through the instance store
of another instance.
Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

QUESTION 179
What is an advantage of using the AWS Cloud over a traditional on-premises solution?

A.   Users do not have to guess about future capacity needs.
B.   Users can utilize existing hardware contracts for purchases.
C.   Users can fix costs no matter what their traffic is.
D.   Users can avoid audits by using reports from AWS.

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://data-flair.training/blogs/aws-advantages/

QUESTION 180
Which of the following is an AWS-managed compute service?

A.   Amazon SWF
B.   Amazon EC2
C.   AWS Lambda
D.   Amazon Aurora

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/compute-services.html

QUESTION 181
Which of the following is an important architectural principle when designing cloud applications?

A.   Store data and backups in the same region.
B.   Design tightly coupled system components.
C.   Avoid multi-threading.
D.   Design for failure

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
There are six design principles for operational excellence in the cloud:
Perform operations as code
Annotate documentation
Make frequent, small, reversible changes
Refine operations procedures frequently
Anticipate failure
Learn from all operational failures
Reference: https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/
QUESTION 182
Which mechanism allows developers to access AWS services from application code?

A.   AWS Software Development Kit
B.   AWS Management Console
C.   AWS CodePipeline
D.   AWS Config

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tools/

QUESTION 183
Which Amazon EC2 pricing model is the MOST cost efficient for an uninterruptible workload that runs once a year for 24 hours?

A.   On-Demand Instances
B.   Reserved Instances
C.   Spot Instances
D.   Dedicated Instances

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
With On-Demand instances, you pay for compute capacity by the hour or the second depending on which instances you run. No longer-term commitments or
upfront payments are needed. You can increase or decrease your compute capacity depending on the demands of your application and only pay the specified per
hourly rates for the instance you use.
Reference: https://aws.amazon.com/ec2/pricing/

QUESTION 184
Which of the following services is a MySQL-compatible database that automatically grows storage as needed?

A.   Amazon Elastic Compute Cloud (Amazon EC2)
B.   Amazon Relational Database Service (Amazon RDS) for MySQL
C.   Amazon Lightsail
D.   Amazon Aurora

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Amazon Aurora is a relational database service that combines the speed and availability of high-end commercial databases with the simplicity and cost-
effectiveness of open source databases. The MySQL- compatible edition of Aurora delivers up to 5X the throughput of standard MySQL running on the same
hardware, and enables existing MySQL applications and tools to run without requiring modification.
Amazon Aurora will automatically grow the size of your database volume as your database storage needs grow. Your volume will grow in increments of 10 GB up
to a maximum of 64 TB. You don't need to provision excess storage for your database to handle future growth.
Reference: https://aws.amazon.com/rds/aurora/mysql-features/

QUESTION 185
Which Amazon Virtual Private Cloud (Amazon VPC) feature enables users to connect two VPCs together?

A.   Amazon VPC endpoints
B.   Amazon Elastic Compute Cloud (Amazon EC2) ClassicLink
C.   Amazon VPC peering
D.   AWS Direct Connect

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6
addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between
your own VPCs, or with a VPC in another AWS account. The VPCs can be in different regions (also known as an inter-region VPC peering connection).
Reference: https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

QUESTION 186
Which service's PRIMARY purpose is software version control?

A.   Amazon CodeStar
B.   AWS Command Line Interface (AWS CLI)
C.   Amazon Cognito
D.   AWS CodeCommit

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS CodeCommit is a version control service hosted by Amazon Web Services that you can use to privately store and manage assets (such as documents,
source code, and binary files) in the cloud.
Reference: https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html

QUESTION 187
A company is considering migrating its applications to AWS. The company wants to compare the cost of running the workload on-premises to running the
equivalent workload on the AWS platform.

Which tool can be used to perform this comparison?

A.   AWS Simple Monthly Calculator
B.   AWS Total Cost of Ownership (TCO) Calculator
C.   AWS Billing and Cost Management console
D.   Cost Explorer

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
TCO calculator compare the cost of running your applications in an on-premises or colocation environment to AWS.
Reference: https://awstcocalculator.com

QUESTION 188
Which AWS service provides a secure, fast, and cost-effective way to migrate or transport exabyte-scale datasets into AWS?

A.   AWS Batch
B.   AWS Snowball
C.   AWS Migration Hub
D.   AWS Snowmobile

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Snowmobile is an exabyte-scale data transfer service that can move extremely large amounts of data to AWS in a fast, secure, and cost-effective manner.
You can transfer up to 100PB per Snowmobile, a 45-foot long ruggedized shipping container, pulled by a semi-trailer truck. Snowmobile makes it easy to move
massive volumes of data to the cloud, including video libraries, image repositories, or even a complete data center migration. All data is encrypted with 256-bit
encryption and you can manage your encryption keys with AWS Key Management Service (AWS KMS). Snowmobile includes GPS tracking, alarm monitoring,
24/7 video surveillance and an optional escort security vehicle while in transit.
Reference: https://aws.amazon.com/about-aws/whats-new/2016/11/move-exabyte-scale-data-sets-with- aws-snowmobile/

QUESTION 189
Which of the following BEST describe the AWS pricing model? (Choose two.)

A.   Fixed-term
B.   Pay-as-you-go
C.   Colocation
D.   Planned
E.   Variable cost

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf

QUESTION 190
Which load balancer types are available with Elastic Load Balancing (ELB)? (Choose two.)

A.   Public load balancers with AWS Application Auto Scaling capabilities
B.   F5 Big-IP and Citrix NetScaler load balancers
C.   Classic Load Balancers
D.   Cross-zone load balancers with public and private IPs
E.   Application Load Balancers

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
Elastic Load Balancing supports the following types of load balancers: Application Load Balancers, Network Load Balancers, and Classic Load Balancers. Amazon
ECS services can use either type of load balancer. Application Load Balancers are used to route HTTP/HTTPS (or Layer 7) traffic. Network Load Balancers and
Classic Load Balancers are used to route TCP (or Layer 4) traffic.
Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html

QUESTION 191
Why should a company choose AWS instead of a traditional data center?

A.   AWS provides users with full control over the underlying resources.
B.   AWS does not require long-term contracts and provides a pay-as-you-go model.
C.   AWS offers edge locations in every country, supporting global reach.
D.   AWS has no limits on the number of resources that can be created.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS offers you a pay-as-you-go approach for pricing for over 160 cloud services. With AWS you pay only for the individual services you need, for as long as you
use them, and without requiring long-term contracts or complex licensing. AWS pricing is similar to how you pay for utilities like water and electricity. You only pay
for the services you consume, and once you stop using them, there are no additional costs or termination fees.
Reference: https://aws.amazon.com/pricing/
QUESTION 192
Which solution provides the FASTEST application response times to frequently accessed data to users in multiple AWS Regions?

A.   AWS CloudTrail across multiple Availability Zones
B.   Amazon CloudFront to edge locations
C.   AWS CloudFormation in multiple regions
D.   A virtual private gateway over AWS Direct Connect

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can deliver content and decrease end-user latency of your web application using Amazon CloudFront.
CloudFront speeds up content delivery by leveraging its global network of data centers, known as edge locations, to reduce delivery time by caching your content
close to your end users. CloudFront fetches your content from an origin, such as an Amazon S3 bucket, an Amazon EC2 instance, an Amazon Elastic Load
Balancing load balancer or your own web server, when it's not already in an edge location.
CloudFront can be used to deliver your entire website or application, including dynamic, static, streaming, and interactive content.
Reference: https://aws.amazon.com/getting-started/tutorials/deliver-content-faster/

QUESTION 193
Which AWS service provides a self-service portal for on-demand access to AWS compliance reports?

A.   AWS Config
B.   AWS Certificate Manager
C.   Amazon Inspector
D.   AWS Artifact

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS' security and compliance
reports and select online agreements.
Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from
accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).
Reference: https://aws.amazon.com/artifact/

QUESTION 194
Which of the following AWS services can be used to run a self-managed database?

A.   Amazon Route 53
B.   AWS X-Ray
C.   AWS Snowmobile
D.   Amazon Elastic Compute Cloud (Amazon EC2)

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://severalnines.com/news/aws-users-prefer-self-managed-databases

QUESTION 195
What exclusive benefit is provided to users with Enterprise Support?

A.   Access to a Technical Project Manager
B.   Access to a Technical Account Manager
C.   Access to a Cloud Support Engineer
D.   Access to a Solutions Architect

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/enterprise/

QUESTION 196
How can a user protect against AWS service disruptions if a natural disaster affects an entire geographic area?

A.   Deploy applications across multiple Availability Zones within an AWS Region.
B.   Use a hybrid cloud computing deployment model within the geographic area.
C.   Deploy applications across multiple AWS Regions.
D.   Store application artifacts using AWS Artifact and replicate them across multiple AWS Regions.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
An AWS Region is a geographic location where AWS provides multiple, physically separated and isolated Availability Zones which are connected with low latency,
high throughput, and highly redundant networking.
Reference: https://aws.amazon.com/s3/faqs/

QUESTION 197
How does AWS MOST effectively reduce computing costs for a growing start-up company?
A.   It provides on-demand resources for peak usage.
B.   It automates the provisioning of individual developer environments.
C.   It automates customer relationship management.
D.   It implements a fixed monthly computing budget.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
You can continue to optimize your spend and keep your development costs low by making sure you revisit your architecture often, to adjust to your startup growth.
Manage your cost further by leveraging different options such as S3 CloudFront for caching & offloading to reduce cost of EC2 computing, as well as Elastic Load
Balancing which prepares you for massive scale, high reliability and uninterrupted growth.
Another way to keep costs down is to use AWS Identity and Access Management solutions (IAM) to manage governance of your cost drivers effectively and by the
right teams.
Reference: https://aws.amazon.com/startups/lean/

QUESTION 198
A startup is working on a new application that needs to go to market quickly. The application requirements may need to be adjusted in the near future.

Which of the following is a characteristic of the AWS Cloud that would meet this specific need?

A.   Elasticity
B.   Reliability
C.   Performance
D.   Agility

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Agile is a time boxed, iterative approach to software delivery that builds software incrementally from the start of the project, instead of trying to deliver it all at once
near the end.
Reference: http://www.agilenutshell.com

QUESTION 199
Which AWS Support plan provides a full set of AWS Trusted Advisor checks?

A.   Business and Developer Support
B.   Business and Basic Support
C.   Enterprise and Developer Support
D.   Enterprise and Business Support

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 200
Which of the following services have Distributed Denial of Service (DDoS) mitigation features? (Choose two.)

A.   AWS WAF
B.   Amazon DynamoDB
C.   Amazon EC2
D.   Amazon CloudFront
E.   Amazon Inspector

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/shield/

QUESTION 201
When building a cloud Total Cost of Ownership (TCO) model, which cost elements should be considered for workloads running on AWS? (Choose three.)

A.   Compute costs
B.   Facilities costs
C.   Storage costs
D.   Data transfer costs
E.   Network infrastructure costs
F.   Hardware lifecycle costs

Correct Answer: ACE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/the-new-aws-tco-calculator/

QUESTION 202
What time-savings advantage is offered with the use of Amazon Rekognition?

A. Amazon Rekognition provides automatic watermarking of images.
B. Amazon Rekognition provides automatic detection of objects appearing in pictures.
C. Amazon Rekognition provides the ability to resize millions of images automatically.
D. Amazon Rekognition uses Amazon Mechanical Turk to allow humans to bid on object detection jobs.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Rekognition Image is an image recognition service that detects objects, scenes, and faces; extracts text; recognizes celebrities; and identifies inappropriate
content in images. It also allows you to search and compare faces. Rekognition Image is based on the same proven, highly scalable, deep learning technology
developed by Amazon's computer vision scientists to analyze billions of images daily for Prime Photos.
Reference: https://aws.amazon.com/rekognition/faqs/

QUESTION 203
When comparing AWS with on-premises Total Cost of Ownership (TCO), what costs are included?

A.   Data center security
B.   Business analysis
C.   Project management
D.   Operating system administration

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.awstcocalculator.com/Output/Load/f85bbf7e131446643911859504

QUESTION 204
According to the AWS shared responsibility model, what is AWS responsible for?

A.   Configuring Amazon VPC
B.   Managing application code
C.   Maintaining application traffic
D.   Managing the network infrastructure

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 205
Which service should be used to estimate the costs of running a new project on AWS?

A.   AWS TCO Calculator
B.   AWS Simple Monthly Calculator
C.   AWS Cost Explorer API
D.   AWS Budgets

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
To forecast your costs, use the AWS Cost Explorer. Use cost allocation tags to divide your resources into groups, and then estimate the costs for each group.
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/estimating-aws-resource-costs/

QUESTION 206
Which AWS tool will identify security groups that grant unrestricted Internet access to a limited list of ports?

A.   AWS Organizations
B.   AWS Trusted Advisor
C.   AWS Usage Report
D.   Amazon EC2 dashboard

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://www.cloudconformity.com/knowledge-base/aws/EC2/security-group-egress-any.html

QUESTION 207
Which AWS service can be used to generate alerts based on an estimated monthly bill?

A.   AWS Config
B.   Amazon CloudWatch
C.   AWS X-Ray
D.   AWS CloudTrail

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can monitor your estimated AWS charges by using Amazon CloudWatch. When you enable the monitoring of estimated charges for your AWS account, the
estimated charges are calculated and sent several times daily to CloudWatch as metric data.
Billing metric data is stored in the US East (N. Virginia) Region and represents worldwide charges. This data includes the estimated charges for every service in
AWS that you use, in addition to the estimated overall total of your AWS charges.
Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ monitor_estimated_charges_with_cloudwatch.html

QUESTION 208
Which Amazon EC2 pricing model offers the MOST significant discount when compared to On-Demand Instances?

A.   Partial Upfront Reserved Instances for a 1-year term
B.   All Upfront Reserved Instances for a 1-year term
C.   All Upfront Reserved Instances for a 3-year term
D.   No Upfront Reserved Instances for a 3-year term

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/reserved-instances/

QUESTION 209
Which of the following is the responsibility of AWS?

A.   Setting up AWS Identity and Access Management (IAM) users and groups
B.   Physically destroying storage media at end of life
C.   Patching guest operating systems
D.   Configuring security settings on Amazon EC2 instances

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Media storage devices used to store customer data are classified by AWS as Critical and treated accordingly, as high impact, throughout their life-cycles. AWS has
exacting standards on how to install, service, and eventually destroy the devices when they are no longer useful. When a storage device has reached the end of its
useful life, AWS decommissions media using techniques detailed in NIST 800-88.
Media that stored customer data is not removed from AWS control until it has been securely decommissioned.
Reference: https://aws.amazon.com/compliance/data-center/controls/

QUESTION 210
Which of the following is an advantage of using AWS?

A.   AWS audits user data.
B.   Data is automatically secure.
C.   There is no guessing on capacity needs.
D.   AWS manages compliance needs.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS manages dozens of compliance programs in its infrastructure. This means that segments of your compliance have already been completed.
Reference: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/security-and-compliance.html

QUESTION 211
Which AWS service would a customer use with a static website to achieve lower latency and high transfer speeds?

A.   AWS Lambda
B.   Amazon DynamoDB Accelerator
C.   Amazon Route 53
D.   Amazon CloudFront

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low
latency, high transfer speeds, all within a developer- friendly environment. CloudFront is integrated with AWS both physical locations that are directly connected to
the AWS global infrastructure, as well as other AWS services.
Reference: https://aws.amazon.com/cloudfront/

QUESTION 212
Which services manage and automate application deployments on AWS? (Choose two.)

A.   AWS Elastic Beanstalk
B.   AWS CodeCommit
C.   AWS Data Pipeline
D.   AWS CloudFormation
E.   AWS Config

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/tutorials/continuous-deployment-pipeline/

QUESTION 213
A user wants guidance on possible savings when migrating from on-premises to AWS.

Which tool is suitable for this scenario?

A.   AWS Budgets
B.   Cost Explorer
C.   AWS Total Cost of Ownership (TCO) Calculator
D.   AWS Well-Architected Tool

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The TCO Calculator provides directional guidance on possible realized savings when deploying AWS. This tool is built on an underlying calculation model, that
generates a fair assessment of value that a customer may achieve given the data provided by the user.
Reference: https://aws.amazon.com/tco-calculator/

QUESTION 214
Which principles are used to architect applications for reliability on the AWS Cloud? (Choose two.)

A.   Design for automated failure recovery
B.   Use multiple Availability Zones
C.   Manage changes via documented processes
D.   Test for moderate demand to ensure reliability
E.   Backup recovery to an on-premises environment

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 215
What tasks should a customer perform when that customer suspects an AWS account has been compromised? (Choose two.)

A.   Rotate passwords and access keys.
B.   Remove MFA tokens.
C.   Move resources to a different AWS Region.
D.   Delete AWS CloudTrail Resources.
E.   Contact AWS Support.

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/

QUESTION 216
What is an example of high availability in the AWS Cloud?

A.   Consulting AWS technical support at any time day or night
B.   Ensuring an application remains accessible, even if a resource fails
C.   Making any AWS service available for use by paying on demand
D.   Deploying in any part of the world using AWS Regions

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/startups/high-availability-for-mere-mortals/

QUESTION 217
Which AWS security service protects applications from distributed denial of service attacks with always-on detection and automatic inline mitigations?

A.   Amazon Inspector
B.   AWS Web Application Firewall (AWS WAF)
C.   Elastic Load Balancing (ELB)
D.   AWS Shield

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on
detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS
protection. There are two tiers of AWS Shield - Standard and Advanced.
Reference: https://aws.amazon.com/shield/

QUESTION 218
A company wants to monitor the CPU usage of its Amazon EC2 resources.

Which AWS service should the company use?

A. AWS CloudTrail
B. Amazon CloudWatch
C. AWS Cost and Usage report
D. Amazon Simple Notification Service (Amazon SNS)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
With Basic monitoring you get data on your cloudwatch metrics every 5 minutes. Enabling detailed monitoring, you will get the data every one minute.
To check if detailed monitoring is enabled, on your EC2 Console, Select the instance, on the lower plane, Select Monitoring.
Reference: https://forums.aws.amazon.com/thread.jspa?threadID=263876

QUESTION 219
What is an AWS Identity and Access Management (IAM) role?

A.   A user associated with an AWS resource
B.   A group associated with an AWS resource
C.   An entity that defines a set of permissions for use with an AWS resource
D.   An authentication credential associated with a multi-factor authentication (MFA) token

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage
AWS users and groups, and use permissions to allow and deny their access to AWS resources.
Reference: https://aws.amazon.com/iam/

QUESTION 220
What are the advantages of Reserved Instances? (Choose two.)

A.   They provide a discount over on-demand pricing.
B.   They provide access to additional instance types.
C.   They provide additional networking capability.
D.   Customers can upgrade instances as new types become available.
E.   Customers can reserve capacity in an Availability Zone.

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-basics/

QUESTION 221
How do Amazon EC2 Auto Scaling groups help achieve high availability for a web application?

A.   They automatically add more instances across multiple AWS Regions based on global demand of the application.
B.   They automatically add or replace instances across multiple Availability Zones when the application needs it.
C.   They enable the application's static content to reside closer to end users.
D.   They are able to distribute incoming requests across a tier of web server instances.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
When the unhealthy Availability Zone returns to a healthy state, Auto Scaling automatically redistributes the application instances evenly across all of the
designated Availability Zones.
Reference: https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html

QUESTION 222
How can one AWS account use Reserved Instances from another AWS account?

A.   By using Amazon EC2 Dedicated Instances
B.   By using AWS Organizations consolidated billing
C.   By using the AWS Cost Explorer tool
D.   By using AWS Budgets

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The account that originally purchased the Reserved Instance receives the discount first. If the purchasing account doesn't have any instances that match the terms
of the Reserved Instance, the discount for the Reserved Instance is assigned to any matching usage on another account in the organization.
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/

QUESTION 223
A customer runs an On-Demand Amazon Linux EC2 instance for 3 hours, 5 minutes, and 6 seconds.

For how much time will the customer be billed?

A.   3 hours, 5 minutes
B.   3 hours, 5 minutes, and 6 seconds
C.   3 hours, 6 minutes
D.   4 hours
Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-hour-billing/

QUESTION 224
Which of the following AWS services provide compute resources? (Choose two.)

A.   AWS Lambda
B.   Amazon Elastic Container Service (Amazon ECS)
C.   AWS CodeDeploy
D.   Amazon Glacier
E.   AWS Organizations

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/compute-services.html

QUESTION 225
Which AWS service enables users to deploy infrastructure as code by automating the process of provisioning resources?

A.   Amazon GameLift
B.   AWS CloudFormation
C.   AWS Data Pipeline
D.   AWS Glue

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS CloudFormation provides a common language for you to model and provision AWS and third party application resources in your cloud environment. AWS
CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources
needed for your applications across all regions and accounts. This gives you a single source of truth for your AWS and third party resources.
Reference: https://aws.amazon.com/cloudformation/

QUESTION 226
Which AWS services provide a way to extend an on-premises architecture to the AWS Cloud? (Choose two.)

A.   Amazon EBS
B.   AWS Direct Connect
C.   Amazon CloudFront
D.   AWS Storage Gateway
E.   Amazon Connect

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/hybrid/

QUESTION 227
Which of the following allows users to provision a dedicated network connection from their internal network to AWS?

A.   AWS CloudHSM
B.   AWS Direct Connect
C.   AWS VPN
D.   Amazon Connect

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Direct Connect lets you establish a dedicated network connection between your network and one of the AWS Direct Connect locations. Using industry
standard 802.1q VLANs, this dedicated connection can be partitioned into multiple virtual interfaces. This allows you to use the same connection to access public
resources such as objects stored in Amazon S3 using public IP address space, and private resources such as Amazon EC2 instances running within an Amazon
Virtual Private Cloud (VPC) using private IP space, while maintaining network separation between the public and private environments. Virtual interfaces can be
reconfigured at any time to meet your changing needs.
Reference: https://aws.amazon.com/directconnect/

QUESTION 228
Which services use AWS edge locations? (Choose two.)

A.   Amazon CloudFront
B.   AWS Shield
C.   Amazon EC2
D.   Amazon RDS
E.   Amazon ElastiCache

Correct Answer: AC
Explanation
Explanation/Reference:
Explanation:
https://www.edureka.co/community/600/what-is-an-edge-location-in-aws

QUESTION 229
Which service would provide network connectivity in a hybrid architecture that includes the AWS Cloud?

A.   Amazon VPC
B.   AWS Direct Connect
C.   AWS Directory Service
D.   Amazon API Gateway

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Amazon Virtual Private Cloud (Amazon VPC) is a logically isolated, private section of the AWS Cloud to launch resources in a virtual data center in the cloud.
Amazon VPC allows you to leverage multiple Availability Zones (AZ) within a region so that you can build greater fault tolerance within your workloads.
You have complete control.
Reference: https://aws.amazon.com/blogs/publicsector/aws-networking-capabilities-gives-you-choices-for- hybrid-cloud-connectivity-but-which-service-works-best-
for-your-use-case/

QUESTION 230
Which tool can be used to compare the costs of running a web application in a traditional hosting environment to running it on AWS?

A.   AWS Cost Explorer
B.   AWS Budgets
C.   AWS Cost and Usage report
D.   AWS Total Cost of Ownership (TCO) Calculator

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tco-calculator/

QUESTION 231
What is the value of using third-party software from AWS Marketplace instead of installing third-party software on Amazon EC2? (Choose two.)

A.   Users pay for software by the hour or month depending on licensing.
B.   AWS Marketplace enables the user to launch applications with 1-Click.
C.   AWS Marketplace data encryption is managed by a third-party vendor.
D.   AWS Marketplace eliminates the need to upgrade to newer software versions.
E.   Users can deploy third-party software without testing.

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/partners/aws-marketplace/

QUESTION 232
Which of the following is a cloud architectural design principle?

A.   Scale up, not out.
B.   Loosely couple components.
C.   Build monolithic systems.
D.   Use commercial database software.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Loosely coupled architectures reduce interdependencies, so that a change or failure in a component does not cascade to other components.
Reference: https://aws-certified-cloud-practitioner.fandom.com/ wiki/1.3_List_the_different_cloud_architecture_design_principles

QUESTION 233
Under the shared responsibility model; which of the following areas are the customer's responsibility? (Choose two.)

A.   Firmware upgrades of network infrastructure
B.   Patching of operating systems
C.   Patching of the underlying hypervisor
D.   Physical security of data centers
E.   Configuration of the security group

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 234
Which service enables customers to audit and monitor changes in AWS resources?
A.   AWS Trusted Advisor
B.   Amazon GuardDuty
C.   Amazon Inspector
D.   AWS Config

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your
AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review
changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance
against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and
operational troubleshooting.
Reference: https://aws.amazon.com/config/

QUESTION 235
Which AWS service identifies security groups that allow unrestricted access to a user's AWS resources?

A.   AWS CloudTrail
B.   AWS Trusted Advisor
C.   Amazon CloudWatch
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 236
According to the AWS shared responsibility model, who is responsible for configuration management?

A.   It is solely the responsibility of the customer.
B.   It is solely the responsibility of AWS.
C.   It is shared between AWS and the customer.
D.   It is not part of the AWS shared responsibility model.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and
applications.
Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 237
Which AWS service is a content delivery network that securely delivers data, video, and applications to users globally with low latency and high speeds?

A.   AWS CloudFormation
B.   AWS Direct Connect
C.   Amazon CloudFront
D.   Amazon Pinpoint

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low
latency, high transfer speeds, all within a developer- friendly environment. CloudFront is integrated with AWS both physical locations that are directly connected to
the AWS global infrastructure, as well as other AWS services.
Reference: https://aws.amazon.com/cloudfront/

QUESTION 238
Which benefit of the AWS Cloud supports matching the supply of resources with changing workload demands?

A.   Security
B.   Reliability
C.   Elasticity
D.   High availability

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://wa.aws.amazon.com/wat.map.en.html

QUESTION 239
A user is running an application on AWS and notices that one or more AWS-owned IP addresses is involved in a distributed denial-of-service (DDoS) attack.

Who should the user contact FIRST about this situation?

A. AWS Premium Support
B. AWS Technical Account Manager
C. AWS Solutions Architect
D. AWS Abuse team

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/

QUESTION 240
Which of the following are benefits of hosting infrastructure in the AWS Cloud? (Choose two.)

A.   There are no upfront commitments.
B.   AWS manages all security in the cloud.
C.   Users have the ability to provision resources on demand.
D.   Users have access to free and unlimited storage.
E.   Users have control over the physical infrastructure.

Correct Answer: AC
Explanation: Option B is incorrect because while AWS provides a secure cloud infrastructure, customers are responsible for managing security of their own applications and data running on AWS.

Explanation/Reference:


QUESTION 241
What AWS service would be used to centrally manage AWS access policies across multiple accounts?

A.   AWS Service Catalog
B.   AWS Config
C.   AWS Trusted Advisor
D.   AWS Organizations

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large
enterprise, Organizations helps you to centrally manage billing; control access, compliance, and security; and share resources across your AWS accounts.
Reference: https://aws.amazon.com/organizations/

QUESTION 242
What is AWS Trusted Advisor?

A.   It is an AWS staff member who provides recommendations and best practices on how to use AWS.
B.   It is a network of AWS partners who provide recommendations and best practices on how to use AWS.
C.   It is an online tool with a set of automated checks that provides recommendations on cost optimization, performance, and security.
D.   It is another name for AWS Technical Account Managers who provide recommendations on cost optimization, performance, and security.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS Trusted Advisor is an online tool that provides you real time guidance to help you provision your resources following AWS best practices.
Whether establishing new workflows, developing applications, or as part of ongoing improvement, take advantage of the recommendations provided by Trusted
Advisor on a regular basis to help keep your solutions provisioned optimally.
Reference: https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

QUESTION 243
Which AWS service or feature allows a company to visualize, understand, and manage AWS costs and usage over time?

A.   AWS Budgets
B.   AWS Cost Explorer
C.   AWS Organizations
D.   Consolidated billing

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Cost Explorer has an easy-to-use interface that lets you visualize, understand, and manage your AWS costs and usage over time.
Reference: https://aws.amazon.com/aws-cost-management/aws-cost-explorer/

QUESTION 244
Which AWS service offers on-demand access to AWS security and compliance reports?

A.   AWS CloudTrail
B.   AWS Artifact
C.   AWS Health
D.   Amazon CloudWatch

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS' security and compliance
reports and select online agreements.
Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from
accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).
Reference: https://aws.amazon.com/artifact/

QUESTION 245
What are the benefits of using the AWS Cloud for companies with customers in many countries around the world? (Choose two.)

A.   Companies can deploy applications in multiple AWS Regions to reduce latency.
B.   Amazon Translate automatically translates third-party website interfaces into multiple languages.
C.   Amazon CloudFront has multiple edge locations around the world to reduce latency.
D.   Amazon Comprehend allows users to build applications that can respond to user requests in many languages.
E.   Elastic Load Balancing can distribute application web traffic to multiple AWS Regions around the world, which reduces latency.

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/comprehend/features/
https://aws.amazon.com/cloudfront/

QUESTION 246
Which AWS service handles the deployment details of capacity provisioning, load balancing, Auto Scaling, and application health monitoring?

A.   AWS Config
B.   AWS Elastic Beanstalk
C.   Amazon Route 53
D.   Amazon CloudFront

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Upload your code and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health
monitoring. At the same time, you retain full control over the AWS resources powering your application and can access the underlying resources at any time.
Reference: https://aws.amazon.com/elasticbeanstalk/

QUESTION 247
Which AWS service provides inbound and outbound network ACLs to harden external connectivity to Amazon EC2?

A.   AWS IAM
B.   Amazon Connect
C.   Amazon VPC
D.   Amazon API Gateway

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html

QUESTION 248
When a company provisions web servers in multiple AWS Regions, what is being increased?

A.   Coupling
B.   Availability
C.   Security
D.   Durability

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

QUESTION 249
The pay-as-you-go pricing model for AWS services:

A.   reduces capital expenditures.
B.   requires payment up front for AWS services.
C.   is relevant only for Amazon EC2, Amazon S3, and Amazon RDS.
D.   reduces operational expenditures.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.10thmagnitude.com/opex-vs-capex-the-real-cloud-computing-cost-advantage/

QUESTION 250
Under the AWS shared responsibility model, AWS is responsible for which security-related task?
A.   Lifecycle management of IAM credentials
B.   Physical security of global infrastructure
C.   Encryption of Amazon EBS volumes
D.   Firewall configuration

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 251
Which AWS service enables users to consolidate billing across multiple accounts?

A.   Amazon QuickSight
B.   AWS Organizations
C.   AWS Budgets
D.   Amazon Forecast

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can use the consolidated billing feature in AWS Organizations to consolidate billing and payment for multiple AWS accounts or multiple Amazon Internet
Services Pvt. Ltd (AISPL) accounts. Every organization in AWS Organizations has a master (payer) account that pays the charges of all the member (linked)
accounts.
Reference: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 252
Under the AWS shared responsibility model, which of the following is an example of security in the AWS Cloud?

A.   Managing edge locations
B.   Physical security
C.   Firewall configuration
D.   Global infrastructure

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 253
How can an AWS user with an AWS Basic Support plan obtain technical assistance from AWS?

A.   AWS Senior Support Engineers
B.   AWS Technical Account Managers
C.   AWS Trusted Advisor
D.   AWS Discussion Forums

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/faqs/

QUESTION 254
Which of the following are pillars of the AWS Well-Architected Framework? (Choose two.)

A.   Multiple Availability Zones
B.   Performance efficiency
C.   Security
D.   Encryption usage
E.   High availability

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf (5)

QUESTION 255
After selecting an Amazon EC2 Dedicated Host reservation, which pricing option would provide the largest discount?

A.   No upfront payment
B.   Hourly on-demand payment
C.   Partial upfront payment
D.   All upfront payment

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/

QUESTION 256
What is an advantage of deploying an application across multiple Availability Zones?

A.   There is a lower risk of service failure if a natural disaster causes a service disruption in a given AWS Region.
B.   The application will have higher availability because it can withstand a service disruption in one Availability Zone.
C.   There will be better coverage as Availability Zones are geographically distant and can serve a wider area.
D.   There will be decreased application latency that will improve the user experience.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

QUESTION 257
A Cloud Practitioner is asked how to estimate the cost of using a new application on AWS.

What is the MOST appropriate response?

A.   Inform the user that AWS pricing allows for on-demand pricing.
B.   Direct the user to the AWS Simple Monthly Calculator for an estimate.
C.   Use Amazon QuickSight to analyze current spending on-premises.
D.   Use Amazon AppStream 2.0 for real-time pricing analytics.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/estimating-aws-resource-costs/

QUESTION 258
A company wants to migrate its applications to a VPC on AWS. These applications will need to access on-premises resources.

What combination of actions will enable the company to accomplish this goal? (Choose two.)

A.   Use the AWS Service Catalog to identify a list of on-premises resources that can be migrated.
B.   Build a VPN connection between an on-premises device and a virtual private gateway in the new VPC.
C.   Use Amazon Athena to query data from the on-premises database servers.
D.   Connect the company's on-premises data center to AWS using AWS Direct Connect.
E.   Leverage Amazon CloudFront to restrict access to static web content provided through the company's on-premises web servers.

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/amazon-vpc-for-on-premises-network-engineers-part-one/

QUESTION 259
A web application running on AWS has been spammed with malicious requests from a recurring set of IP addresses.

Which AWS service can help secure the application and block the malicious traffic?

A.   AWS IAM
B.   Amazon GuardDuty
C.   Amazon Simple Notification Service (Amazon SNS)
D.   AWS WAF

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise
security, or consume excessive resources. You can use AWS WAF to define customizable web security rules that control which traffic accesses your web
applications. If you use AWS Shield Advanced, you can use AWS WAF at no extra cost for those protected resources and can engage the DRT to create WAF
rules.
Reference: https://aws.amazon.com/answers/networking/aws-ddos-attack-mitigation/

QUESTION 260
Treating infrastructure as code in the AWS Cloud allows users to:

A.   automate migration of on-premises hardware to AWS data centers.
B.   let a third party automate an audit of the AWS infrastructure.
C.   turn over application code to AWS so it can run on the AWS infrastructure.
D.   automate the infrastructure provisioning process.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://asperbrothers.com/blog/infrastructure-as-code-aws/

QUESTION 261
A company requires a dedicated network connection between its on-premises servers and the AWS Cloud.
Which AWS service should be used?

A.   AWS VPN
B.   AWS Direct Connect
C.   Amazon API Gateway
D.   Amazon Connect

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can use AWS Direct Connect to establish a private virtual interface from your on-premise network directly to your Amazon VPC, providing you with a private,
high bandwidth network connection between your network and your VPC. With multiple virtual interfaces, you can even establish private connectivity to multiple
VPCs while maintaining network isolation.
Reference: https://aws.amazon.com/directconnect/

QUESTION 262
Which AWS service can be used to query stored datasets directly from Amazon S3 using standard SQL?

A.   AWS Glue
B.   AWS Data Pipeline
C.   Amazon CloudSearch
D.   Amazon Athena

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Amazon Athena is defined as "an interactive query service that makes it easy to analyse data directly in Amazon Simple Storage Service (Amazon S3) using
standard SQL." So, it's another SQL query engine for large data sets stored in S3. This is very similar to other SQL query engines, such as Apache Drill. But unlike
Apache Drill, Athena is limited to data only from Amazon's own S3 storage service. However, Athena is able to query a variety of file formats, including, but not
limited to CSV, Parquet, JSON, etc.

QUESTION 263
AWS CloudFormation is designed to help the user:

A.   model and provision resources.
B.   update application code.
C.   set up data lakes.
D.   create reports for billing.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS CloudFormation provides a common language for you to model and provision AWS and third party application resources in your cloud environment. AWS
CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources
needed for your applications across all regions and accounts. This gives you a single source of truth for your AWS and third party resources.
Reference: https://aws.amazon.com/cloudformation/

QUESTION 264
Which of the following is an AWS database service?

A.   Amazon Redshift
B.   Amazon Elastic Block Store (Amazon EBS)
C.   Amazon S3 Glacier
D.   AWS Snowball

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.sisense.com/glossary/redshift-database/

QUESTION 265
A Cloud Practitioner must determine if any security groups in an AWS account have been provisioned to allow unrestricted access for specific ports.

What is the SIMPLEST way to do this?

A.   Review the inbound rules for each security group in the Amazon EC2 management console to check for port 0.0.0.0/0.
B.   Run AWS Trusted Advisor and review the findings.
C.   Open the AWS IAM console and check the inbound rule filters for open access.
D.   In AWS Config, create a custom rule that invokes an AWS Lambda function to review rules for inbound access.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html

QUESTION 266
What are the benefits of developing and running a new application in the AWS Cloud compared to on-premises? (Choose two.)

A. AWS automatically distributes the data globally for higher durability.
B.   AWS will take care of operating the application.
C.   AWS makes it easy to architect for high availability.
D.   AWS can easily accommodate application demand changes.
E.   AWS takes care application security patching.

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 267
A user needs an automated security assessment report that will identify unintended network access to Amazon EC2 instances and vulnerabilities on those
instances.

Which AWS service will provide this assessment report?

A.   EC2 security groups
B.   AWS Config
C.   Amazon Macie
D.   Amazon Inspector

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon
Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector
produces a detailed list of security findings prioritized by level of severity. These findings can be reviewed directly or as part of detailed assessment reports which
are available via the Amazon Inspector console or API.
Reference: https://aws.amazon.com/inspector/

QUESTION 268
How can a company isolate the costs of production and non-production workloads on AWS?

A.   Create Identity and Access Management (IAM) roles for production and non-production workloads.
B.   Use different accounts for production and non-production expenses.
C.   Use Amazon EC2 for non-production workloads and other services for production workloads.
D.   Use Amazon CloudWatch to monitor the use of services.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/answers/account-management/aws-multi-account-billing-strategy/

QUESTION 269
Where can users find a catalog of AWS-recognized providers of third-party security solutions?

A.   AWS Service Catalog
B.   AWS Marketplace
C.   AWS Quick Start
D.   AWS CodeDeploy

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS Service Catalog Delivery Partners are APN Consulting Partners who help create catalogs of IT services that are approved by the customer's organization for
use on AWS. With AWS Service Catalog, customers and partners can centrally manage commonly deployed IT services to help achieve consistent governance
and meet compliance requirements while enabling users to self-provision approved services.
Reference: https://aws.amazon.com/servicecatalog/partners/

QUESTION 270
A Cloud Practitioner needs to store data for 7 years to meet regulatory requirements.

Which AWS service will meet this requirement at the LOWEST cost?

A.   Amazon S3
B.   AWS Snowball
C.   Amazon Redshift
D.   Amazon S3 Glacier

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class and supports long-term retention and digital preservation for data that may be accessed once
or twice in a year. It is designed for customers --particularly those in highly-regulated industries, such as the Financial Services, Healthcare, and Public Sectors --
that retain data sets for 7-10 years or longer to meet regulatory compliance requirements. S3 Glacier Deep Archive can also be used for backup and disaster
recovery use cases, and is a cost-effective and easy-to-manage alternative to magnetic tape systems, whether they are on-premises libraries or off-premises
services.
Reference: https://aws.amazon.com/s3/storage-classes/

QUESTION 271
What are the immediate benefits of using the AWS Cloud? (Choose two.)
A.   Increased IT staff.
B.   Capital expenses are replaced with variable expenses.
C.   User control of infrastructure.
D.   Increased agility.
E.   AWS holds responsibility for security in the cloud.

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 272
Which security service automatically recognizes and classifies sensitive data or intellectual property on AWS?

A.   Amazon GuardDuty
B.   Amazon Macie
C.   Amazon Inspector
D.   AWS Shield

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Macie recognizes sensitive
data such as personally identifiable information (PII) or intellectual property. It provides you with dashboards and alerts that give visibility into how this data is being
accessed or moved.
Reference: https://docs.aws.amazon.com/macie/latest/userguide/what-is-macie.html

QUESTION 273
What is the purpose of AWS Storage Gateway?

A.   It ensures on-premises data storage is 99.999999999% durable.
B.   It transports petabytes of data to and from AWS.
C.   It connects to multiple Amazon EC2 instances.
D.   It connects on-premises data storage to the AWS Cloud.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Moving data to the cloud is not quite as simple as flipping a switch. For companies that have managed their own data centers or server rooms for decades, there
are a few steps to consider --and it's not always wise to pull the plug on an internal infrastructure quite so quickly. If a startup uses on-premise business servers
and then experiences unexpected growth, abandoning those servers doesn't make sense (even if the long-term plan is to do exactly that).
AWS Storage Gateway is a way to bridge this gap for companies of any size. It's a hybrid storage option that connects on-premise storage including age-old tape
backup systems to the cloud in a way that also provides one console to access all storage configurations.
Reference: https://www.techradar.com/news/what-is-aws-storage-gateway

QUESTION 274
What should users do if they want to install an application in geographically isolated locations?

A.   Install the application using multiple internet gateways.
B.   Deploy the application to an Amazon VPC.
C.   Deploy the application to multiple AWS Regions.
D.   Configure the application using multiple NAT gateways.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

QUESTION 275
A system in the AWS Cloud is designed to withstand the failure of one or more components.

What is this an example of?

A.   Elasticity
B.   High Availability
C.   Scalability
D.   Agility

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://wa.aws.amazon.com/wat.question.REL_7.en.html

QUESTION 276
A Cloud Practitioner needs a consistent and dedicated connection between AWS resources and an on-premises system.

Which AWS service can fulfill this requirement?

A. AWS Direct Connect
B. AWS VPN
C. Amazon Connect
D. AWS Data Pipeline

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
You can use AWS Direct Connect to establish a private virtual interface from your on-premise network directly to your Amazon VPC, providing you with a private,
high bandwidth network connection between your network and your VPC. With multiple virtual interfaces, you can even establish private connectivity to multiple
VPCs while maintaining network isolation.
Reference: https://aws.amazon.com/directconnect/

QUESTION 277
Within the AWS shared responsibility model, who is responsible for security and compliance?

A.   The customer is responsible.
B.   AWS is responsible.
C.   AWS and the customer share responsibility.
D.   AWS shares responsibility with the relevant governing body.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer's operational burden as
AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which
the service operates.
Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 278
To use the AWS CLI, users are required to generate:

A.   a password policy.
B.   an access/secret key.
C.   a managed policy.
D.   an API key.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 279
Which AWS service is used to provide encryption for Amazon EBS?

A.   AWS Certificate Manager
B.   AWS Systems Manager
C.   AWS KMS
D.   AWS Config

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html

QUESTION 280
How does AWS charge for AWS Lambda usage once the free tier has been exceeded? (Choose two.)

A.   By the time it takes for the Lambda function to execute.
B.   By the number of versions of a specific Lambda function.
C.   By the number of requests made for a given Lambda function.
D.   By the programming language that is used for the Lambda function.
E.   By the total number of Lambda functions in an AWS account.

Correct Answer: AC
Explanation: Lambda charges are dependent on the amount of time it takes to run the code. Lambda charges are dependent on the number of requests for your Lambda functions. The number of versions, programming language of a specific Lambda function does not contribute to the cost. There is no charge based on the number of functions in an AWS account.

Explanation/Reference:
Explanation:
https://aws.amazon.com/lambda/pricing/

QUESTION 281
Which of the following describes the relationships among AWS Regions, Availability Zones, and edge locations? (Choose two.)

A.   There are more AWS Regions than Availability Zones.
B.   There are more edge locations than AWS Regions.
C.   An edge location is an Availability Zone.
D.   There are more AWS Regions than edge locations.
E.   There are more Availability Zones than AWS Regions.

Correct Answer: BE
Explanation
Explanation/Reference:


QUESTION 282
What does AWS Shield Standard provide?

A.   WAF rules
B.   DDoS protection
C.   Identity and Access Management (IAM) permissions and access to resources
D.   Data encryption

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Shield Standard provides protection for all AWS customers from common, most frequently occurring network and transport layer DDoS attacks that target
your web site or application at no additional charge.
Reference: https://aws.amazon.com/shield/pricing/

QUESTION 283
A company wants to build its new application workloads in the AWS Cloud instead of using on-premises resources.

What expense can be reduced using the AWS Cloud?

A.   The cost of writing custom-built Java or Node .js code
B.   Penetration testing for security
C.   hardware required to support new applications
D.   Writing specific test cases for third-party applications.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/pricing/cost-optimization/

QUESTION 284
What does AWS Marketplace allow users to do? (Choose two.)

A.   Sell unused Amazon EC2 Spot Instances.
B.   Sell solutions to other AWS users.
C.   Buy third-party software that runs on AWS.
D.   Purchase AWS security and compliance documents.
E.   Order AWS Snowball.

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/marketplace

QUESTION 285
What does it mean if a user deploys a hybrid cloud architecture on AWS?

A.   All resources run using on-premises infrastructure.
B.   Some resources run on-premises and some run in a colocation center.
C.   All resources run in the AWS Cloud.
D.   Some resources run on-premises and some run in the AWS Cloud.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/hybrid/

QUESTION 286
Which AWS service allows users to identify the changes made to a resource over time?

A.   Amazon Inspector
B.   AWS Config
C.   AWS Service Catalog
D.   AWS IAM

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/config/latest/developerguide/view-manage-resource.html

QUESTION 287
How can a company reduce its Total Cost of Ownership (TCO) using AWS?

A. By minimizing large capital expenditures
B. By having no responsibility for third-party license costs
C. By having no operational expenditures
D. By having AWS manage applications

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS helps you reduce Total Cost of Ownership (TCO) by reducing the need to invest in large capital expenditures and providing a pay-as-you-go model that
empowers you to invest in the capacity you need and use it only when the business requires it.
Reference: https://aws.amazon.com/tco-calculator/

QUESTION 288
Which activity is a customer responsibility in the AWS Cloud according to the AWS shared responsibility model?

A.   Ensuring network connectivity from AWS to the internet
B.   Patching and fixing flaws within the AWS Cloud infrastructure
C.   Ensuring the physical security of cloud data centers
D.   Ensuring Amazon EBS volumes are backed up

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/the-aws-shared-responsibility-model-and-gdpr/

QUESTION 289
What are the advantages of the AWS Cloud? (Choose two.)

A.   Fixed rate monthly cost
B.   No need to guess capacity requirements
C.   Increased speed to market
D.   Increased upfront capital expenditure
E.   Physical access to cloud data centers

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://data-flair.training/blogs/aws-advantages/

QUESTION 290
When comparing the total cost of ownership (TCO) of an on-premises infrastructure to a cloud architecture, what costs should be considered? (Choose two.)

A.   The credit card processing fees for application transactions in the cloud.
B.   The cost of purchasing and installing server hardware in the on-premises data.
C.   The cost of administering the infrastructure, including operating system and software installations, patches, backups, and recovering from failures.
D.   The costs of third-party penetration testing.
E.   The advertising costs associated with an ongoing enterprise-wide campaign.

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tco-calculator/

QUESTION 291
Which AWS feature allows a company to take advantage of usage tiers for services across multiple member accounts?

A.   Service control policies (SCPs)
B.   Consolidated billing
C.   All Upfront Reserved Instances
D.   AWS Cost Explorer

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tco-calculator/

QUESTION 292
What is one of the customer's responsibilities according to the AWS shared responsibility model?

A.   Virtualization infrastructure
B.   Network infrastructure
C.   Application security
D.   Physical security of hardware

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 293
What helps a company provide a lower latency experience to its users globally?

A.   Using an AWS Region that is central to all users
B.   Using a second Availability Zone in the AWS Region that is using used
C.   Enabling caching in the AWS Region that is being used
D.   Using edge locations to put content closer to all users

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

QUESTION 294
How can the AWS Cloud increase user workforce productivity after migration from an on-premises data center?

A.   Users do not have to wait for infrastructure provisioning.
B.   The AWS Cloud infrastructure is much faster than an on-premises data center infrastructure.
C.   AWS takes over application configuration management on behalf of users.
D.   Users do not need to address security and compliance issues.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/Migration/aws-migration-whitepaper.pdf

QUESTION 295
Which AWS service provides a quick and automated way to create and manage AWS accounts?

A.   AWS QuickSight
B.   Amazon Lightsail
C.   AWS Organizations
D.   Amazon Connect

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/mt/automate-account-creation-and-resource-provisioning-using-aws-service-catalog-aws-organizations-and-aws-lambda/

QUESTION 296
Which Amazon RDS feature can be used to achieve high availability?

A.   Multiple Availability Zones
B.   Amazon Reserved Instances
C.   Provisioned IOPS storage
D.   Enhanced monitoring

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Amazon RDS provides high availability and failover support for DB instances using Multi-AZ deployments.
Amazon RDS uses several different technologies to provide failover support. Multi-AZ deployments for Oracle, PostgreSQL, MySQL, and MariaDB DB instances
use Amazon's failover technology. SQL Server DB instances use SQL Server Database Mirroring (DBM).
Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

QUESTION 297
Where should users report that AWS resources are being used for malicious purposes?

A.   AWS Abuse team
B.   AWS Shield
C.   AWS Support
D.   AWS Developer Forums

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/

QUESTION 298
Which AWS service needs to be enabled to track all user account changes within the AWS Management Console?

A.   AWS CloudTrail
B.   Amazon Simple Notification Service (Amazon SNS)
C.   VPC Flow Logs
D.   AWS CloudHSM

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log,
continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity,
including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security
analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in your AWS accounts.
These capabilities help simplify operational analysis and troubleshooting.
Reference: https://aws.amazon.com/cloudtrail/

QUESTION 299
What is an AWS Cloud design best practice?

A.   Tight coupling of components
B.   Single point of failure
C.   High availability
D.   Overprovisioning of resources

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf

QUESTION 300
Why is AWS more economical than traditional data centers for applications with varying compute workloads?

A.   Amazon Elastic Compute Cloud (Amazon EC2) costs are billed on a monthly basis.
B.   Customers retain full administrative access to their Amazon EC2 instances.
C.   Amazon EC2 instances can be launched on-demand when needed.
D.   Customers can permanently run enough instances to handle peak workloads.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The ability to launch instances on-demand when needed allows customers launch and terminate instances in response to a varying workload. This is a more
economical practice than purchasing enough on-premises servers to handle the peak load.

QUESTION 301
Which AWS service would simplify migration of a database to AWS?

A.   AWS Storage Gateway
B.   AWS Database Migration Service (AWS DMS)
C.   Amazon Elastic Compute Cloud (Amazon EC2)
D.   Amazon AppStream 2.0

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/dms/

QUESTION 302
Which AWS offering enables customers to find, buy, and immediately start using software solutions in their AWS environment?

A.   AWS Config
B.   AWS OpsWorks
C.   AWS SDK
D.   AWS Marketplace

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/mp/

QUESTION 303
Which AWS networking service enables a company to create a virtual network within AWS?

A.   AWS Config
B.   Amazon Route 53
C.   AWS Direct Connect
D.   Amazon Virtual Private Cloud (Amazon VPC.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/vpc/

QUESTION 304
Which of the following is AWS's responsibility under the AWS shared responsibility model?

A. Configuring third-party applications
B. Maintaining physical hardware
C. Securing application access and data
D. Managing custom Amazon Machine Images (AMIs)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 305
Which component of AWS global infrastructure does Amazon CloudFront use to ensure low-latency delivery?

A.   AWS Regions
B.   AWS edge locations
C.   AWS Availability Zones
D.   Amazon Virtual Private Cloud (Amazon VPC.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudfront/

QUESTION 306
How would a system administrator add an additional layer of login security to a user's AWS Management Console?

A.   Use AWS Cloud Directory
B.   Audit AWS Identity and Access Management (IAM) roles
C.   Enable Multi-Factor Authentication
D.   Enable AWS CloudTrail

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/iam/details/mfa/

QUESTION 307
Which service can identify the user that made the API call when an Amazon Elastic Compute Cloud (Amazon EC2) instance is terminated?

A.   Amazon CloudWatch
B.   AWS CloudTrail
C.   AWS X-Ray
D.   AWS Identity and Access Management (AWS IAM)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html

QUESTION 308
Which service would you use to send alerts based on Amazon CloudWatch alarms?

A.   Amazon Simple Notification Service (Amazon SNS)
B.   AWS CloudTrail
C.   AWS Trusted Advisor
D.   Amazon Route 53

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html

QUESTION 309
Where can a customer find information about prohibited actions on AWS infrastructure?

A.   AWS Trusted Advisor
B.   AWS Identity and Access Management (IAM)
C.   AWS Billing Console
D.   AWS Acceptable Use Policy

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/aup/

QUESTION 310
Which of the following is an example of how moving to the AWS Cloud reduces upfront cost?

A. By replacing large variable costs with lower capital investments
B. By replacing large capital investments with lower variable costs
C. By allowing the provisioning of compute and storage at a fixed level to meet peak demand
D. By replacing the repeated scaling of virtual servers with a simpler fixed-scale model

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS does not require minimum spend commitments or long-term contracts. You replace large upfront expenses with low variable payments that only apply to
what you use. With AWS you are not bound to multi-year agreements or complicated licensing models.
https://aws.amazon.com/economics/

QUESTION 311
When designing a typical three-tier web application, which AWS services and/or features improve availability and reduce the impact failures? (Choose two.)

A.   AWS Auto Scaling for Amazon EC2 instances
B.   Amazon VPC subnet ACLs to check the health of a service
C.   Distributed resources across multiple Availability Zones
D.   AWS Server Migration Service (AWS SMS) to move Amazon EC2 instances into a different Region
E.   Distributed resources across multiple AWS points of presence

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf

QUESTION 312
Which cloud design principle aligns with AWS Cloud best practices?

A.   Create fixed dependencies among application components
B.   Aggregate services on a single instance
C.   Deploy applications in a single Availability Zone
D.   Distribute the compute load across multiple resources

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Use load balancing for offloading encryption termination (TLS) to improve performance and to manage and route traffic effectively. Distribute traffic across multiple
resources or services to allow your workload to take advantage of the elasticity that AWS provides.
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf

QUESTION 313
Which of the following are recommended practices for managing IAM users? (Choose two.)

A.   Require IAM users to change their passwords after a specified period of time
B.   Prevent IAM users from reusing previous passwords
C.   Recommend that the same password be used on AWS and other sites
D.   Require IAM users to store their passwords in raw text
E.   Disable multi-factor authentication (MFA) for IAM users

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 314
A company is migrating from on-premises data centers to the AWS Cloud and is looking for hands-on help with the project.

How can the company get this support? (Choose two.)

A.   Ask for a quote from the AWS Marketplace team to perform a migration into the company's AWS account.
B.   Contact AWS Support and open a case for assistance
C.   Use AWS Professional Services to provide guidance and to set up an AWS Landing Zone in the company's AWS account
D.   Select a partner from the AWS Partner Network (APN) to assist with the migration
E.   Use Amazon Connect to create a new request for proposal (RFP) for expert assistance in migrating to the AWS Cloud.

Correct Answer: CD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/solutions/aws-landing-zone/

QUESTION 315
How does the AWS Enterprise Support Concierge team help users?

A.   Supporting application development
B.   Providing architecture guidance
C.   Answering billing and account inquires
D.   Answering questions regarding technical support cases
Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/enterprise/

QUESTION 316
An application designed to span multiple Availability Zones is described as:

A.   being highly available
B.   having global reach
C.   using an economy of scale
D.   having elasticity

Correct Answer: A
Explanation: 
This architecture provides high availability because spanning Availability Zones removes single points of failure.

Explanation/Reference:


QUESTION 317
A new service using AWS must be highly available. Yet, due to regulatory requirements, all of its Amazon EC2 instances must be located in a single geographic
area.

According to best practices, to meet these requirements, the EC2 instances must be placed in at least two:

A.   AWS Regions
B.   Availability Zones
C.   subnets
D.   placement groups

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/faqs/

QUESTION 318
Which AWS tool is used to compare the cost of running an application on-premises to running the application in the AWS Cloud?

A.   AWS Trusted Advisor
B.   AWS Simple Monthly Calculator
C.   AWS Total Cost of Ownership (TCO) Calculator
D.   Cost Explorer

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tco-calculator/

QUESTION 319
A company has multiple AWS accounts within AWS Organizations and wants to apply the Amazon EC2 Reserved Instances benefit to a single account only.

Which action should be taken?

A.   Purchase the Reserved Instances from master payer account and turn off Reserved Instance sharing.
B.   Enable billing alerts in the AWS Billing and Cost Management console.
C.   Purchase the Reserved Instances in individual linked accounts and turn off Reserved Instance sharing from the payer level.
D.   Enable Reserved Instance sharing in the AWS Billing and Cost Management console.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/

QUESTION 320
Which situation should be reported to the AWS Abuse team?

A.   In Availability Zone has a service disruption
B.   An intrusion attempt is made from an AWS IP address
C.   A user has trouble accessing an Amazon S3 bucket from an AWS IP address
D.   A user needs to change payment methods due to a compromise

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/

QUESTION 321
A company is planning to launch an ecommerce site in a single AWS Region to a worldwide user base.

Which AWS services will allow the company to reach users and provide low latency and high transfer speeds? (Choose two.)
A.   Application Load Balancer
B.   AWS Global Accelerator
C.   AWS Direct Connect
D.   Amazon CloudFront
E.   AWS Lambda

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudfront/faqs/

QUESTION 322
Which AWS service or resource is serverless?

A.   AWS Lambda
B.   Amazon EC2 instances
C.   Amazon Lightsail
D.   Amazon ElastiCache

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://blogs.itemis.com/en/serverless-services-on-aws

QUESTION 323
Which of the following are components of Amazon VPC? (Choose two.)

A.   Objects
B.   Subnets
C.   Buckets
D.   Internet gateways
E.   Access key

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://subscription.packtpub.com/book/virtualization_and_cloud/9781788293723/3/ ch03lvl1sec26/vpc-components

QUESTION 324
AWS Budgets can be used to:

A.   prevent a given user from creating a resource
B.   send an alert when the utilization of Reserved Instances drops below a certain percentage
C.   set resource limits in AWS accounts to prevent overspending
D.   split an AWS bill across multiple forms of payment

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

QUESTION 325
Which of the following will enhance the security of access to the AWS Management Console? (Choose two.)

A.   AWS Secrets Manager
B.   AWS Certificate Manager
C.   AWS Multi-Factor Authentication (AWS MFA)
D.   Security groups
E.   Password policies

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/guidelines-for-protecting-your-aws-account-while-using-programmatic-access/

QUESTION 326
The AWS Trusted Advisor checks include recommendations regarding which of the following? (Choose two.)

A.   Information on Amazon S3 bucket permissions
B.   AWS service outages
C.   Multi-factor authentication enabled on the AWS account root user
D.   Available software patches
E.   Number of users in the account

Correct Answer: AC
Explanation
Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/

QUESTION 327
Which functions can users perform using AWS KMS?

A.   Create and manage AWS access keys for the AWS account root user
B.   Create and manage AWS access keys for an AWS account IAM user
C.   Create and manage keys for encryption and decryption of data
D.   Create and manage keys for multi-factor authentication

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html

QUESTION 328
How does AWS Trusted Advisor provide guidance to users of the AWS Cloud? (Choose two.)

A.   It identifies software vulnerabilities in applications running on AWS
B.   It provides a list of cost optimization recommendations based on current AWS usage
C.   It detects potential security vulnerabilities caused by permissions settings on account resources
D.   It automatically corrects potential security issues caused by permissions settings on account resources
E.   It provides proactive alerting whenever an Amazon EC2 instance has been compromised

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 329
Which of the following are advantages of the AWS Cloud? (Choose two.)

A.   AWS manages the maintenance of the cloud infrastructure
B.   AWS manages the security of applications built on AWS
C.   AWS manages capacity planning for physical servers
D.   AWS manages the development of applications on AWS
E.   AWS manages cost planning for virtual servers

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/data-center/controls/

QUESTION 330
A user deploys an Amazon RDS DB instance in multiple Availability Zones.

This strategy involves which pillar of the AWS Well-Architected Framework?

A.   Performance efficiency
B.   Reliability
C.   Cost optimization
D.   Security

Correct Answer: B
Explanation
The reliability pillar includes the ability of a workload to perform its intended function correctly and consistently when it is expected to do so. The deployment of Amazon RDS in multiple Availability Zones supports the goal of reliability because it reduces single points of failure.
Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 331
Which AWS services provide a user with connectivity between the AWS Cloud and on-premises resources? (Choose two.)

A.   AWS VPN
B.   Amazon Connect
C.   Amazon Cognito
D.   AWS Direct Connect
E.   AWS Managed Services

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/directconnect/
https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-client-vpn-to-securely-access-aws-and-on-premises-resources/

QUESTION 332
Which AWS service is used to pay AWS bills, and monitor usage and budget costs?

A. AWS Billing and Cost Management
B. Consolidated billing
C. Amazon CloudWatch
D. Amazon QuickSight

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html

QUESTION 333
Which element of the AWS global infrastructure consists of one or more discrete data centers, each with redundant power, networking, and connectivity, which are
housed in separate facilities?

A.   AWS Regions
B.   Availability Zones
C.   Edge locations
D.   Amazon CloudFront

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/global-infrastructure.html

QUESTION 334
Which Amazon VPC feature enables users to capture information about the IP traffic that reaches Amazon EC2 instances?

A.   Security groups
B.   Elastic network interfaces
C.   Network ACLs
D.   VPC Flow Logs

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be
published to Amazon CloudWatch Logs or Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination.
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

QUESTION 335
Which AWS service can be used to automatically scale an application up and down without making capacity planning decisions?

A.   Amazon AutoScaling
B.   Amazon Redshift
C.   AWS CloudTrail
D.   AWS Lambda

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/category/auto-scaling/

QUESTION 336
AWS Enterprise Support users have access to which service or feature that is not available to users with other AWS Support plans?

A.   AWS Trusted Advisor
B.   AWS Support case
C.   Concierge team
D.   Amazon Connect

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 337
A company wants to migrate a MySQL database to AWS but does not have the budget for Database Administrators to handle routine tasks including provisioning,
patching, and performing backups.

Which AWS service will support this use case?

A.   Amazon RDS
B.   Amazon DynamoDB
C.   Amazon DocumentDB
D.   Amazon ElastiCache

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Amazon RDS makes it easy to set up, operate, and scale a relational database in the cloud. It provides cost-efficient and resizable capacity while automating time-
consuming administration tasks, such as hardware provisioning, database setup, patching, and backups. It frees you to focus on your applications, so you can give
them the fast performance, high availability, security, and compatibility that they need.
https://aws.amazon.com/blogs/database/part-1-role-of-the-dba-when-moving-to-amazon-rds-responsibilities/

QUESTION 338
A company wants to expand from one AWS Region into a second AWS Region.

What does the company need to do to start supporting the new Region?

A.   Contact an AWS Account Manager to sign a new contract
B.   Move an Availability Zone to the new Region
C.   Begin deploying resources in the second Region
D.   Download the AWS Management Console for the new Region

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-region.html

QUESTION 339
A user must meet compliance and software licensing requirements that state a workload must be hosted on a physical server.

Which Amazon EC2 instance pricing option will meet these requirements?

A.   Dedicated Hosts
B.   Dedicated Instances
C.   Spot Instances
D.   Reserved Instances

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/dedicated-hosts/

QUESTION 340
Which AWS service will provide a way to generate encryption keys that can be used to encrypt data? (Choose two.)

A.   Amazon Macie
B.   AWS Certificate Manager
C.   AWS Key Management Service (AWS KMS)
D.   AWS Secrets Manager
E.   AWS CloudHSM

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-service-hsm.html
https://docs.aws.amazon.com/kms/latest/developerguide/overview.html

QUESTION 341
A company is planning to migrate from on-premises to the AWS Cloud.

Which AWS tool or service provides detailed reports on estimated cost savings after migration?

A.   AWS Total Cost of Ownership (TCO) Calculator
B.   Cost Explorer
C.   AWS Budgets
D.   AWS Migration Hub

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/migrationhub/latest/ug/hub-api.pdf (26)

QUESTION 342
What can assist in evaluating an application for migration to the cloud? (Choose two.)

A.   AWS Trusted Advisor
B.   AWS Professional Services
C.   AWS Systems Manager
D.   AWS Partner Network (APN)
E.   AWS Secrets Manager

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 343
Which AWS service helps users meet contractual and regulatory compliance requirements for data security by using dedicated hardware appliances within the
AWS Cloud?

A.   AWS Secrets Manager
B.   AWS CloudHSM
C.   AWS Key Management Service (AWS KMS)
D.   AWS Directory Service

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
The AWS CloudHSM service helps you meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated Hardware
Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the
AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be
necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are designed and validated
to government standards for secure key management. CloudHSM allows you to securely generate, store, and manage cryptographic keys used for data encryption
in a way that keys are accessible only by you.
https://aws.amazon.com/cloudhsm/faqs/

QUESTION 344
Under the AWS shared responsibility model, the customer manages which of the following? (Choose two.)

A.   Decommissioning of physical storage devices
B.   Security group and ACL configuration
C.   Patch management of an Amazon RDS instance operating system
D.   Controlling physical access to data centers
E.   Patch management of an Amazon EC2 instance operating system

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://www.whizlabs.com/blog/aws-security-shared-responsibility/

QUESTION 345
Which AWS service is suitable for an event-driven workload?

A.   Amazon EC2
B.   AWS Elastic Beanstalk
C.   AWS Lambda
D.   Amazon Lumberyard

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
An easy-to-use service for deploying and scaling web applications and web services developed in a number of programming languages. You can configure event
notifications for your Elastic Beanstalk environment so that notable events can be automatically published to an SNS topic, then pushed to topic subscribers.As an
example, you may use this event-driven architecture to coordinate your continuous integration pipeline (such as Jenkins CI). That way, whenever an environment
is created, Elastic Beanstalk publishes this event to an SNS topic, which triggers a subscribing Lambda function, which then kicks off a CI job against your newly
created Elastic Beanstalk environment.
https://aws.amazon.com/blogs/compute/event-driven-computing-with-amazon-sns-compute-storage-database-and-networking-services/

QUESTION 346
What is a value proposition of the AWS Cloud?

A.   AWS is responsible for security in the AWS Cloud
B.   No long-term contract is required
C.   Provision new servers in days
D.   AWS manages user applications in the AWS Cloud

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Correct. There is no long-term contract required to use AWS. You pay only for the compute power, storage, and other resources that you use.
https://d1.awsstatic.com/whitepapers/aws-whitepaper-business-value-of-aws.pdf

QUESTION 347
What is a characteristic of Amazon S3 cross-region replication?

A.   Both source and destination S3 buckets must have versioning disabled
B.   The source and destination S3 buckets cannot be in different AWS Regions
C.   S3 buckets configured for cross-region replication can be owned by a single AWS account or by different accounts
D.   The source S3 bucket owner must have the source and destination AWS Regions disabled for their account

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html

QUESTION 348
What is a user responsible for when running an application in the AWS Cloud?
A.   Managing physical hardware
B.   Updating the underlying hypervisor
C.   Providing a list of users approved for data center access
D.   Managing application software updates

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 349
A company that does business online needs to quickly deliver new functionality in an iterative manner, minimizing the time to market.

Which AWS Cloud feature can provide this?

A.   Elasticity
B.   High availability
C.   Agility
D.   Reliability

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/devops/partner-solutions/

QUESTION 350
Which features or services can be used to monitor costs and expenses for an AWS account? (Choose two.)

A.   AWS Cost and Usage report
B.   AWS product pages
C.   AWS Simple Monthly Calculator
D.   Billing alerts and Amazon CloudWatch alarms
E.   AWS Price List API

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html

QUESTION 351
Amazon Route 53 enables users to:

A.   encrypt data in transit
B.   register DNS domain names
C.   generate and manage SSL certificates
D.   establish a dedicated network connection to AWS

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html

QUESTION 352
Which AWS service helps identify malicious or unauthorized activities in AWS accounts and workloads?

A.   Amazon Rekognition
B.   AWS Trusted Advisor
C.   Amazon GuardDuty
D.   Amazon CloudWatch

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/guardduty/

QUESTION 353
A company wants to try a third-party ecommerce solution before deciding to use it long term.

Which AWS service or tool will support this effort?

A.   AWS Marketplace
B.   AWS Partner Network (APN)
C.   AWS Managed Services
D.   AWS Service Catalog

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2019/09/aws-marketplace-easier-to-find-solutions-from-aws-console/

QUESTION 354
Which AWS service is a managed NoSQL database?

A.   Amazon Redshift
B.   Amazon DynamoDB
C.   Amazon Aurora
D.   Amazon RDS for MariaDB

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/dynamodb/

QUESTION 355
Which AWS service should be used to create a billing alarm?

A.   AWS Trusted Advisor
B.   AWS CloudTrail
C.   Amazon CloudWatch
D.   Amazon QuickSight

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html

QUESTION 356
A company is hosting a web application in a Docker container on Amazon EC2.

AWS is responsible for which of the following tasks?

A.   Scaling the web application and services developed with Docker
B.   Provisioning or scheduling containers to run on clusters and maintain their availability
C.   Performing hardware maintenance in the AWS facilities that run the AWS Cloud
D.   Managing the guest operating system, including updates and security patches

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/tutorials/deploy-docker-containers/

QUESTION 357
Users are reporting latency when connecting to a website with a global customer base.

Which AWS service will improve the customer experience by reducing latency?

A.   Amazon CloudFront
B.   AWS Direct Connect
C.   Amazon EC2 Auto Scaling
D.   AWS Transit Gateway

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/tutorials/deliver-content-faster/

QUESTION 358
Which actions represent best practices for using AWS IAM? (Choose two.)

A.   Configure a strong password policy
B.   Share the security credentials among users of AWS accounts who are in the same Region
C.   Use access keys to log in to the AWS Management Console
D.   Rotate access keys on a regular basis
E.   Avoid using IAM roles to delegate permissions

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 359
Which AWS feature or service can be used to capture information about incoming and outgoing traffic in an AWS VPC infrastructure?

A. AWS Config
B. VPC Flow Logs
C. AWS Trusted Advisor
D. AWS CloudTrail

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

QUESTION 360
A company wants to use an AWS service to monitor the health of application endpoints, with the ability to route traffic to healthy regional endpoints to improve
application availability.

Which service will support these requirements?

A.   Amazon Inspector
B.   Amazon CloudWatch
C.   AWS Global Accelerator
D.   Amazon CloudFront

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
AWS Global Accelerator uses the AWS global network to optimize the path from your users to your applications, improving the performance of your traffic by as
much as 60%. AWS Global Accelerator continually monitors the health of your application endpoints and redirects traffic to healthy endpoints in less than 30
seconds.
https://aws.amazon.com/global-accelerator/?blogs-global-accelerator.sort-by=item.additionalFields.createdDate&blogs-global-accelerator.sort-order=desc&aws-
global-accelerator- wn.sort-by=item.additionalFields.postDateTime&aws-global-accelerator-wn.sort-order=desc

QUESTION 361
According to the AWS Well-Architected Framework, what change management steps should be taken to achieve reliability in the AWS Cloud? (Choose two.)

A.   Use AWS Config to generate an inventory of AWS resources
B.   Use service limits to prevent users from creating or making changes to AWS resources
C.   Use AWS CloudTrail to record AWS API calls into an auditable log file
D.   Use AWS Certificate Manager to whitelist approved AWS resources and services
E.   Use Amazon GuardDuty to validate configuration changes made to AWS resources

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 362
Which service can be used to monitor and receive alerts for AWS account root user AWS Management Console sign-in events?

A.   Amazon CloudWatch
B.   AWS Config
C.   AWS Trusted Advisor
D.   AWS IAM

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/mt/monitor-and-notify-on-aws-account-root-user-activity/

QUESTION 363
Which design principle should be considered when architecting in the AWS Cloud?

A.   Think of servers as non-disposable resources
B.   Use synchronous integration of services
C.   Design loosely coupled components
D.   Implement the least permissive rules for security groups

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

QUESTION 364
Which AWS services can be used to move data from on-premises data centers to AWS? (Choose two.)

A.   AWS Snowball
B.   AWS Lambda
C.   AWS ElastiCache
D.   AWS Database Migration Service (AWS DMS)
E.   Amazon API Gateway

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/snowball/

QUESTION 365
A batch workload takes 5 hours to finish on an Amazon EC2 instance. The amount of data to be processed doubles monthly and the processing time is
proportional.

What is the best cloud architecture to address this consistently growing demand?

A.   Run the application on a bigger EC2 instance size.
B.   Switch to an EC2 instance family that better matches batch requirements.
C.   Distribute the application across multiple EC2 instances and run the workload in parallel.
D.   Run the application on a bare metal EC2 instance.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 366
Each department within a company has its own independent AWS account and its own payment method. New company leadership wants to centralize
departmental governance and consolidate payments.

How can this be achieved using AWS services or features?

A.   Forward monthly invoices for each account. Then create IAM roles to allow cross-account access.
B.   Create a new AWS account. Then configure AWS Organizations and invite all existing accounts to join.
C.   Configure AWS Organizations in each of the existing accounts. Then link all accounts together.
D.   Use Cost Explorer to combine costs from all accounts. Then replicate IAM policies across accounts.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts.html

QUESTION 367
The ability to horizontally scale Amazon EC2 instances based on demand is an example of which concept in the AWS Cloud value proposition?

A.   Economy of scale
B.   Elasticity
C.   High availability
D.   Agility

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 368
An ecommerce company anticipates a huge increase in web traffic for two very popular upcoming shopping holidays.

Which AWS service or feature can be configured to dynamically adjust resources to meet this change in demand?

A.   AWS CloudTrail
B.   Amazon EC2 Auto Scaling
C.   Amazon Forecast
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/autoscaling/

QUESTION 369
Which AWS service enables users to securely connect to AWS resources over the public internet?

A.   Amazon VPC peering
B.   AWS Direct Connect
C.   AWS VPN
D.   Amazon Pinpoint

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper.pdf (36)

QUESTION 370
Which tool is used to forecast AWS spending?

A. AWS Trusted Advisor
B. AWS Organizations
C. Cost Explorer
D. Amazon Inspector

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-forecast.html

QUESTION 371
A company is running an ecommerce application hosted in Europe. To decrease latency for users who access the website from other parts of the world, the
company would like to cache frequently accessed static content closer to the users.

Which AWS service will support these requirements?

A.   Amazon ElastiCache
B.   Amazon CloudFront
C.   Amazon Elastic File System (Amazon EFS)
D.   Amazon Elastic Block Store (Amazon EBS)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Amazon CloudFront employs a global network of edge locations and regional edge caches that cache copies of your content close to your viewers. Amazon
CloudFront ensures that end-user requests are served by the closest edge location. As a result, viewer requests travel a short distance, improving performance for
your viewers. For files not cached at the edge locations and the regional edge caches, Amazon CloudFront keeps persistent connections with your origin servers
so that those files can be fetched from the origin servers as quickly as possible.
https://aws.amazon.com/cloudfront/faqs/

QUESTION 372
Which of the following is a component of the AWS Global Infrastructure?

A.   Amazon Alexa
B.   AWS Regions
C.   Amazon Lightsail
D.   AWS Organizations

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/global-infrastructure/

QUESTION 373
Which AWS service will help users determine if an application running on an Amazon EC2 instance has sufficient CPU capacity?

A.   Amazon CloudWatch
B.   AWS Config
C.   AWS CloudTrail
D.   Amazon Inspector

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/faqs/

QUESTION 374
Why is it beneficial to use Elastic Load Balancers with applications?

A.   They allow for the conversion from Application Load Balancers to Classic Load Balancers.
B.   They are capable of handling constant changes in network traffic patterns.
C.   They automatically adjust capacity.
D.   They are provided at no charge to users.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html

QUESTION 375
Which tasks are the customer's responsibility in the AWS shared responsibility model? (Choose two.)

A.   Infrastructure facilities access management
B.   Cloud infrastructure hardware lifecycle management
C.   Configuration management of user's applications
D.   Networking infrastructure protection
E.   Security groups configuration

Correct Answer: CE
Explanation
Explanation/Reference:
Explanation:
https://cloudacademy.com/blog/aws-shared-responsibility-model-security/

QUESTION 376
IT systems should be designed to reduce interdependencies, so that a change or failure in one component does not cascade to other components.

This is an example of which principle of cloud architecture design?

A.   Scalability
B.   Loose coupling
C.   Automation
D.   Automatic scaling

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf (20)

QUESTION 377
Which AWS service or feature can enhance network security by blocking requests from a particular network for a web application on AWS? (Choose two.)

A.   AWS WAF
B.   AWS Trusted Advisor
C.   AWS Direct Connect
D.   AWS Organizations
E.   Network ACLs

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/waf/
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

QUESTION 378
An application runs on multiple Amazon EC2 instances that access a shared file system simultaneously.

Which AWS storage service should be used?

A.   Amazon EBS
B.   Amazon EFS
C.   Amazon S3
D.   AWS Artifact

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/efs/

QUESTION 379
A web application is hosted on AWS using an Elastic Load Balancer, multiple Amazon EC2 instances, and Amazon RDS.

Which security measures fall under the responsibility of AWS? (Choose two.)

A.   Running a virus scan on EC2 instances
B.   Protecting against IP spoofing and packet sniffing
C.   Installing the latest security patches on the RDS instance
D.   Encrypting communication between the EC2 instances and the Elastic Load Balancer
E.   Configuring a security group and a network access control list (NACL) for EC2

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 380
What is the benefit of elasticity in the AWS Cloud?

A.   Ensure web traffic is automatically spread across multiple AWS Regions.
B.   Minimize storage costs by automatically archiving log data.
C.   Enable AWS to automatically select the most cost-effective services.
D.   Automatically adjust the required compute capacity to maintain consistent performance.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aimconsulting.com/insights/blog/the-elastic-cloud-opportunity/

QUESTION 381
The continual reduction of AWS Cloud pricing is due to:
A.   pay-as-you go pricing
B.   the AWS global infrastructure
C.   economies of scale
D.   reserved storage pricing

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://read.acloud.guru/there-are-four-reasons-to-explain-how-using-aws-can-change-the-economic-model-of-the-it-services-850dcc8ea1aa?gi=3bcf6cd0e1e2

QUESTION 382
A company needs an Amazon S3 bucket that cannot have any public objects due to compliance requirements.

How can this be accomplished?

A.   Enable S3 Block Public Access from the AWS Management Console.
B.   Hold a team meeting to discuss the importance if only uploading private S3 objects.
C.   Require all S3 objects to be manually approved before uploading.
D.   Create a service to monitor all S3 uploads and remove any public uploads.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html

QUESTION 383
A Cloud Practitioner identifies a billing issue after examining the AWS Cost and Usage report in the AWS Management Console.

Which action can be taken to resolve this?

A.   Open a detailed case related to billing and submit it to AWS Support for help.
B.   Upload data describing the issue to a new object in a private Amazon S3 bucket.
C.   Create a pricing application and deploy it to a right-sized Amazon EC2 instance for more information.
D.   Proceed with creating a new dashboard in Amazon QuickSight.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 384
What does the AWS Simple Monthly Calculator do?

A.   Compares on-premises costs to colocation environments
B.   Estimates monthly billing based on projected usage
C.   Estimates power consumption at existing data centers
D.   Estimates CPU utilization

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/estimate-your-c/

QUESTION 385
Who is responsible for patching the guest operating system for Amazon RDS?

A.   The AWS Product team
B.   The customer Database Administrator
C.   Managed partners
D.   AWS Support

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 386
Which AWS services may be scaled using AWS Auto Scaling? (Choose two.)

A.   Amazon EC2
B.   Amazon DynamoDB
C.   Amazon S3
D.   Amazon Route 53
E.   Amazon Redshift

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/autoscaling/faqs/

QUESTION 387
Which of the following are benefits of AWS Global Accelerator? (Choose two.)

A.   Reduced cost to run services on AWS
B.   Improved availability of applications deployed on AWS
C.   Higher durability of data stored on AWS
D.   Decreased latency to reach applications deployed on AWS
E.   Higher security of data stored on AWS

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/global-accelerator/faqs/

QUESTION 388
A user who wants to get help with billing and reactivate a suspended account should submit an account and billing request to:

A.   the AWS Support forum
B.   AWS Abuse
C.   an AWS Solutions Architect
D.   AWS Support

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/reactivate-suspended-account/

QUESTION 389
Which AWS Cloud best practice uses the elasticity and agility of cloud computing?

A.   Provision capacity based on past usage and theoretical peaks
B.   Dynamically and predictively scale to meet usage demands
C.   Build the application and infrastructure in a data center that grants physical access
D.   Break apart the application into loosely coupled components

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:

In a traditional computing environment, you provision capacity based on an estimate of a theoretical maximum peak. This can result in periods where expensive
resources are sitting idle or occasions of insufficient capacity. With cloud computing, you can access as much or as little capacity as you need and dynamically
scale to meet actual demand, while only paying for what you use.

QUESTION 390
Which method helps to optimize costs of users moving to the AWS Cloud?

A.   Paying only for what is used
B.   Purchasing hardware before it is needed
C.   Manually provisioning cloud resources
D.   Purchasing for the maximum possible load

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.cloudmanagementinsider.com/ways-to-optimize-aws-cost/

QUESTION 391
Under the AWS shared responsibility model, which of the following is a customer responsibility?

A.   Installing security patches for the Xen and KVM hypervisors
B.   Installing operating system patches for Amazon DynamoDB
C.   Installing operating system security patches for Amazon EC2 database instances
D.   Installing operating system security patches for Amazon RDS database instances

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 392
The AWS Cost Management tools give users the ability to do which of the following? (Choose two.)

A.   Terminate all AWS resources automatically if budget thresholds are exceeded.
B.   Break down AWS costs by day, service, and linked AWS account.
C.   Create budgets and receive notifications if current of forecasted usage exceeds the budgets.
D.   Switch automatically to Reserved Instances or Spot Instances, whichever is most cost-effective.
E. Move data stored in Amazon S3 to a more cost-effective storage class.

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 393
Under the AWS shared responsibility model, the security and patching of the guest operating system is the responsibility of:

A.   AWS Support
B.   the customer
C.   AWS Systems Manager
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 394
Which AWS service makes it easy to create and manage AWS users and groups, and provide them with secure access to AWS resources at no charge?

A.   AWS Direct Connect
B.   Amazon Connect
C.   AWS Identity and Access Management (IAM)
D.   AWS Firewall Manager

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/console_controlling-access.html
https://aws.amazon.com/iam/

QUESTION 395
Which AWS service provides on-demand of AWS security and compliance documentation?

A.   AWS Directory Service
B.   AWS Artifact
C.   AWS Trusted Advisor
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/artifact/#:~:text=AWS%20Artifact%20is%20your%20go,reports%20and%20select%20online%20agreements.

QUESTION 396
Which AWS service can be used to turn text into life-like speech?

A.   Amazon Polly
B.   Amazon Transcribe
C.   Amazon Rekognition
D.   Amazon Lex

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/polly/#:~:text=Amazon%20Polly%20is%20a%20service,synthesize%20natural%20sounding%20human%20speech.

QUESTION 397
What is one of the core principles to follow when designing a highly available application in the AWS Cloud?

A.   Design using a serverless architecture
B.   Assume that all components within an application can fail
C.   Design AWS Auto Scaling into every application
D.   Design all components using open-source code

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 398
A user needs to generate a report that outlines the status of key security checks in an AWS account. The report must include:

- The status of Amazon S3 bucket permissions.
- Whether multi-factor authentication is enabled for the AWS account root user.
- If any security groups are configured to allow unrestricted access.
Where can all this information be found in one location?

A.   Amazon QuickSight dashboard
B.   AWS CloudTrail trails
C.   AWS Trusted Advisor report
D.   IAM credential report

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/ #Security

QUESTION 399
Which Amazon EC2 pricing model should be used to comply with per-core software license requirements?

A.   Dedicated Hosts
B.   On-Demand Instances
C.   Spot Instances
D.   Reserved Instances

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/dedicated-hosts/pricing/

QUESTION 400
Which of the AWS global infrastructure is used to cache copies of content for faster delivery to users across the globe?

A.   AWS Regions
B.   Availability Zones
C.   Edge locations
D.   Data centers

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
When your web traffic is geo-dispersed, it's not always feasible and certainly not cost effective to replicate your entire infrastructure across the globe. A CDN
provides you the ability to utilize its global network of edge locations to deliver a cached copy of web content such as videos, webpages, images and so on to your
customers. To reduce response time, the CDN utilizes the nearest edge location to the customer or originating request location in order to reduce the response
time. Throughput is dramatically increased given that the web assets are delivered from cache. For dynamic data, many CDNs can be configured to retrieve data
from the origin servers.
https://aws.amazon.com/caching/

QUESTION 401
Using AWS Config to record, audit, and evaluate changes to AWS resources to enable traceability is an example of which AWS Well-Architected Framework pillar?

A.   Security
B.   Operational excellence
C.   Performance efficiency
D.   Cost optimization

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf (12)

QUESTION 402
A user needs to quickly deploy a non-relational database on AWS. The user does not want to manage the underlying hardware or the database software.

Which AWS service can be used to accomplish this?

A.   Amazon RDS
B.   Amazon DynamoDB
C.   Amazon Aurora
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/SQLtoNoSQL.html

QUESTION 403
A Cloud Practitioner is developing a disaster recovery plan and intends to replicate data between multiple geographic areas.

Which of the following meets these requirements?

A. AWS Accounts
B. AWS Regions
C. Availability Zones
D. Edge locations

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://www.botmetric.com/blog/having-a-disaster-recovery-plan-is-pivotal-the-dos-and-donts-on-aws-cloud/

QUESTION 404
Which features and benefits does the AWS Organizations service provide? (Choose two.)

A.   Establishing real-time communications between members of an internal team
B.   Facilitating the use of NoSQL databases
C.   Providing automated security checks
D.   Implementing consolidated billing
E.   Enforcing the governance of AWS accounts

Correct Answer: DE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/organizations/

QUESTION 405
Which AWS service is used to automate configuration management using Chef and Puppet?

A.   AWS Config
B.   AWS OpsWorks
C.   AWS CloudFormation
D.   AWS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/opsworks/

QUESTION 406
Which tool is best suited for combining the billing of AWS accounts that were previously independent from one another?

A.   Detailed billing report
B.   Consolidated billing
C.   AWS Cost and Usage report
D.   Cost allocation report

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 407
The AWS Total Cost of Ownership (TCO) Calculator is used to:

A.   receive reports that break down AWS Cloud compute costs by duration, resource, or tags
B.   estimate savings when comparing the AWS Cloud to an on-premises environment
C.   estimate a monthly bill for the AWS Cloud resources that will be used
D.   enable billing alerts to monitor actual AWS costs compared to estimated costs

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/tco-calculator/

QUESTION 408
Which AWS services can be used to provide network connectivity between an on-premises network and a VPC? (Choose two.)

A.   Amazon Route 53
B.   AWS Direct Connect
C.   AWS Data Pipeline
D.   AWS VPN
E.   Amazon Connect

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/directconnect/faqs/

QUESTION 409
Under the AWS shared responsibility model, which of the following are customer responsibilities? (Choose two.)
A.   Setting up server-side encryption on an Amazon S3 bucket
B.   Amazon RDS instance patching
C.   Network and firewall configurations
D.   Physical security of data center facilities
E.   Compute capacity availability

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 410
What is the MINIMUM AWS Support plan level that will provide users with access to the AWS Support API?

A.   Developer
B.   Enterprise
C.   Business
D.   Basic

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 411
A company has deployed several relational databases on Amazon EC2 instances. Every month, the database software vendor releases new security patches that
need to be applied to the databases.

What is the MOST efficient way to apply the security patches?

A.   Connect to each database instance on a monthly basis, and download and apply the necessary security patches from the vendor.
B.   Enable automatic patching for the instances using the Amazon RDS console.
C.   In AWS Config, configure a rule for the instances and the required patch level.
D.   Use AWS Systems Manager to automate database patching according to a schedule.

Correct Answer: D
Explanation
This scenario is a primary use case of Systems Manager.
Explanation/Reference:
Explanation:
https://aws.amazon.com/rds/faqs/

QUESTION 412
A company wants to use Amazon Elastic Compute Cloud (Amazon EC2) to deploy a global commercial application. The deployment solution should be built with
the highest redundancy and fault tolerance.

Based on this situation, the Amazon EC2 instances should be deployed:

A.   in a single Availability Zone in one AWS Region
B.   with multiple Elastic Network Interfaces belonging to different subnets
C.   across multiple Availability Zones in one AWS Region
D.   across multiple Availability Zones in two AWS Regions

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://jayendrapatil.com/aws-high-availability-fault-tolerance-architecture-certification/

QUESTION 413
A company has an application with users in both Australia and Brazil. All the company infrastructure is currently provisioned in the Asia Pacific (Sydney) Region in
Australia, and Brazilian users are experiencing high latency.

What should the company do to reduce latency?

A. Implement AWS Direct Connect for users in Brazil
B. Use AWS Transit Gateway to quickly route users from Brazil to the application
C. Launch additional Amazon EC2 instances in Sydney to handle the demand

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/transit-gateway/

QUESTION 414
An Amazon EC2 instance runs only when needed yet must remain active for the duration of the process.

What is the most appropriate purchasing option?

A. Dedicated Instances
B. Spot Instances
C. On-Demand Instances
D. Reserved Instances

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://jayendrapatil.com/aws-ec2-instance-purchasing-option/

QUESTION 415
Which AWS dashboard displays relevant and timely information to help users manage events in progress, and provides proactive notifications to help plan for
scheduled activities?

A.   AWS Service Health Dashboard
B.   AWS Personal Health Dashboard
C.   AWS Trusted Advisor dashboard
D.   Amazon CloudWatch dashboard

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/

QUESTION 416
Which AWS hybrid storage service enables a user's on-premises applications to seamlessly use AWS Cloud storage?

A.   AWS Backup
B.   Amazon Connect
C.   AWS Direct Connect
D.   AWS Storage Gateway

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/storagegateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc

QUESTION 417
Which of the following acts as a virtual firewall at the Amazon EC2 instance level to control traffic for one or more instances?

A.   Access keys
B.   Virtual private gateways
C.   Security groups
D.   Access Control Lists (ACL)

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html

QUESTION 418
What is the most efficient way to establish network connectivity from on-premises to multiple VPCs in different AWS Regions?

A.   Use AWS Direct Connect
B.   Use AWS VPN
C.   Use AWS Client VPN
D.   Use an AWS Transit Gateway

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
Reference https://d1.awsstatic.com/whitepapers/building-a-scalable-and-secure-multi-vpc-aws-network-infrastructure.pdf (11)

QUESTION 419
Which AWS Support plan provides access to architectural and operational reviews, as well as 24/7 access to Senior Cloud Support Engineers through email,
online chat, and phone?

A.   Basic
B.   Business
C.   Developer
D.   Enterprise

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/enterprise/

QUESTION 420
Which AWS service or feature helps restrict the AWS services, resources, and individual API actions the users and roles in each member account can access?
A.   Amazon Cognito
B.   AWS Organizations
C.   AWS Shield
D.   AWS Firewall Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html

QUESTION 421
What is the best resource for a user to find compliance-related information and reports about AWS?

A.   AWS Artifact
B.   AWS Marketplace
C.   Amazon Inspector
D.   AWS Support

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/faq/

QUESTION 422
Which Amazon S3 storage class is optimized to provide access to data with lower resiliency requirements, but rapid access when needed such as duplicate
backups?

A.   Amazon S3 Standard
B.   Amazon S3 Glacier Deep Archive
C.   Amazon S3 One Zone-Infrequent Access
D.   Amazon S3 Glacier

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/s3/storage-classes/

QUESTION 423
What is an Availability Zone in AWS?

A.   One or more physical data centers
B.   A completely isolated geographic location
C.   One or more edge locations based around the world
D.   A data center location with a single source of power and networking

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/global-infrastructure/regions_az/

QUESTION 424
Which AWS services can be used as infrastructure automation tools? (Choose two.)

A.   AWS CloudFormation
B.   Amazon CloudFront
C.   AWS Batch
D.   AWS OpsWorks
E.   Amazon QuickSight

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://blog.newrelic.com/engineering/best-cloud-infrastructure-automation-tools/

QUESTION 425
Which AWS service enables users to create copies of resources across AWS Regions?

A.   Amazon ElastiCache
B.   AWS CloudFormation
C.   AWS CloudTrail
D.   AWS Systems Manager

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html
QUESTION 426
A user would like to encrypt data that is received, stored, and managed by AWS CloudTrail.

Which AWS service will provide this capability?

A.   AWS Secrets Manager
B.   AWS Systems Manager
C.   AWS Key Management Service (AWS KMS)
D.   AWS Certificate Manager

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/data-protection.html

QUESTION 427
Which AWS Cloud benefit eliminates the need for users to try estimating future infrastructure usage?

A.   Easy and fast deployment of applications in multiple Regions around the world
B.   Security of the AWS Cloud
C.   Elasticity of the AWS Cloud
D.   Lower variable costs due to massive economies of scale

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 428
What credential components are required to gain programmatic access to an AWS account? (Choose two.)

A.   An access key ID
B.   A primary key
C.   A secret access key
D.   A user ID
E.   A secondary key

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html

QUESTION 429
Which of the following are AWS compute services? (Select two.)

A.   Amazon Lightsail
B.   AWS Systems Manager
C.   AWS CloudFormation
D.   AWS Batch
E.   Amazon Inspector

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/compute-services.html

QUESTION 430
How can a company separate costs for network traffic, Amazon EC2, Amazon S3, and other AWS services by department?

A.   Add department-specific tags to each resource
B.   Create a separate VPC for each department
C.   Create a separate AWS account for each department
D.   Use AWS Organizations

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/custom-tags.html#allocation-how

QUESTION 431
What is a benefit of consolidated billing for AWS accounts?

A.   Access to AWS Personal Health Dashboard
B.   Combined usage volume discounts
C.   Improved account security
D.   Centralized AWS IAM

Correct Answer: B
Explanation
Explanation/Reference:
Explanation:
https://jayendrapatil.com/aws-consolidated-billing/

QUESTION 432
Which AWS service will allow a user to set custom cost and usage limits, and will alert when the thresholds are exceeded?

A.   AWS Organizations
B.   AWS Budgets
C.   Cost Explorer
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/hands-on/control-your-costs-free-tier-budgets/

QUESTION 433
Which AWS service provides the ability to detect inadvertent data leaks of personally identifiable information (PII) and user credential data?

A.   Amazon GuardDuty
B.   Amazon Inspector
C.   Amazon Macie
D.   AWS Shield

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/macie/

QUESTION 434
Which tool can be used to monitor AWS service limits?

A.   AWS Total Cost of Ownership (TCO) Calculator
B.   AWS Trusted Advisor
C.   AWS Personal Health Dashboard
D.   AWS Cost and Usage report

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/mt/monitoring-service-limits-with-trusted-advisor-and-amazon-cloudwatch/

QUESTION 435
A company has distributed its workload on both the AWS Cloud and some on-premises servers.

What type of architecture is this?

A.   Virtual private network
B.   Virtual private cloud
C.   Hybrid cloud
D.   Private cloud

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/hybrid/

QUESTION 436
Which of the following describes a security best practice that can be implemented using AWS IAM?

A.   Disable AWS Management Console access for all users
B.   Generate secret keys for every IAM user
C.   Grant permissions to users who are required to perform a given task only
D.   Store AWS credentials within Amazon EC2 instances

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://cloudcheckr.com/cloud-security/top-5-iam-best-practices/

QUESTION 437
What can be used to automate and manage secure, well-architected, multi-account AWS environments?

A.   AWS shared responsibility model
B.   AWS Control Tower
C.   AWS Security Hub
D.   AWS Well-Architected Tool
Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
Control Tower automates the process of setting up a new baseline multi-account AWS environment that is secure, well-architected, and ready to use. Control
Tower incorporates the knowledge that AWS Professional Service has gained over the course of thousands of successful customer engagements.
https://aws.amazon.com/blogs/aws/aws-control-tower-set-up-govern-a-multi-account-aws-environment/

QUESTION 438
Which AWS service or feature allows a user to easily scale connectivity among thousands of VPCs?

A.   VPC peering
B.   AWS Transit Gateway
C.   AWS Direct Connect
D.   AWS Global Accelerator

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/training-and-certification/explore-the-aws-transit-gateway-networking-and-scaling-digital-course/

QUESTION 439
A company needs protection from expanded distributed denial of service (DDoS) attacks on its website and assistance from AWS experts during such events.

Which AWS managed service will meet these requirements?

A.   AWS Shield Advanced
B.   AWS Firewall Manager
C.   AWS WAF
D.   Amazon GuardDuty

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/waf/latest/developerguide/ddos-overview.html

QUESTION 440
A company's application has flexible start and end times.

Which Amazon EC2 pricing model will be the MOST cost-effective?

A.   On-Demand Instances
B.   Spot Instances
C.   Reserved Instances
D.   Dedicated Hosts

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/

QUESTION 441
Under the AWS shared responsibility model, what are the customer's responsibilities? (Choose two.)

A.   Physical and environmental security
B.   Physical network devices including firewalls
C.   Storage device decommissioning
D.   Security of data in transit
E.   Data integrity authentication

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 442
A cloud practitioner has a data analysis workload that is infrequently executed and can be interrupted without harm.

To optimize for cost, which Amazon EC2 purchasing option should be used?

A.   On-Demand Instances
B.   Reserved Instances
C.   Spot Instances
D.   Dedicated Hosts

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/
QUESTION 443
Which AWS container service will help a user install, operate, and scale the cluster management infrastructure?

A.   Amazon Elastic Container Registry (Amazon ECR)
B.   AWS Elastic Beanstalk
C.   Amazon Elastic Container Service (Amazon ECS)
D.   Amazon Elastic Block Store (Amazon EBS)

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 444
Which of the following allows an application running on an Amazon EC2 instance to securely write data to an Amazon S3 bucket without using long term
credentials?

A.   Amazon Cognito
B.   AWS Shield
C.   AWS IAM role
D.   AWS IAM user access key

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 445
A company with a Developer-level AWS Support plan provisioned an Amazon RDS database and cannot connect to it.

Who should the developer contact for this level of support?

A.   AWS Support using a support case
B.   AWS Professional Services
C.   AWS technical account manager
D.   AWS consulting partners

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 446
What is the purpose of having an internet gateway within a VPC?

A.   To create a VPN connection to the VPC
B.   To allow communication between the VPC and the Internet
C.   To impose bandwidth constraints on internet traffic
D.   To load balance traffic from the Internet across Amazon EC2 instances

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 447
A company must ensure that its endpoint for a database instance remains the same after a single Availability Zone service interruption. The application needs to
resume database operations without the need for manual administrative intervention.

How can these requirements be met?

A.   Use multiple Amazon Route 53 routes to the standby database instance endpoint hosted on AWS Storage Gateway.
B.   Configure Amazon RDS Multi-Availability Zone deployments with automatic failover to the standby.
C.   Add multiple Application Load Balancers and deploy the database instance with AWS Elastic Beanstalk.
D.   Deploy a single Network Load Balancer to distribute incoming traffic across multiple Amazon CloudFront origins.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 448
Which AWS managed service can be used to distribute traffic between one or more Amazon EC2 instances?

A.   NAT gateway
B.   Elastic Load Balancing
C.   Amazon Athena
D.   AWS PrivateLink

Correct Answer: B
Explanation

Explanation/Reference:
QUESTION 449
AWS Trusted Advisor provides recommendations on which of the following? (Choose two.)

A.   Cost optimization
B.   Auditing
C.   Serverless architecture
D.   Performance
E.   Scalability

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 450
Which of the following tasks can only be performed after signing in with AWS account root user credentials? (Choose two.)

A.   Closing an AWS account
B.   Creating a new IAM policy
C.   Changing AWS Support plans
D.   Attaching a role to an Amazon EC2 instance
E.   Generating access keys for IAM users

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 451
Fault tolerance refers to:

A.   the ability of an application to accommodate growth without changing design
B.   how well and how quickly an application's environment can have lost data restored
C.   how secure your application is
D.   the built-in redundancy of an application's components

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 452
A company operating in the AWS Cloud requires separate invoices for specific environments, such as development, testing, and production.

How can this be achieved?

A.   Use multiple AWS accounts
B.   Use resource tagging
C.   Use multiple VPCs
D.   Use Cost Explorer

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 453
Which AWS service can be used in the application deployment process?

A.   AWS AppSync
B.   AWS Batch
C.   AWS CodePipeline
D.   AWS DataSync

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 454
What can be used to reduce the cost of running Amazon EC2 instances? (Choose two.)

A.   Spot Instances for stateless and flexible workloads
B.   Memory optimized instances for high-compute workloads
C.   On-Demand Instances for high-cost and sustained workloads
D.   Reserved Instances for sustained workloads
E.   Spend limits set using AWS Budgets

Correct Answer: AD
Explanation
Explanation/Reference:


QUESTION 455
A company is launching an e-commerce site that will store and process credit card data. The company requires information about AWS compliance reports and
AWS agreements.

Which AWS service provides on-demand access to these items?

A.   AWS Certificate Manager
B.   AWS Config
C.   AWS Artifact
D.   AWS CloudTrail

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 456
Which AWS service or feature allows the user to manager cross-region application traffic?

A.   Amazon AppStream 2.0
B.   Amazon VPC
C.   Elastic Load Balancer
D.   Amazon Route 53

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 457
Which AWS service can be used to track unauthorized API calls?

A.   AWS Config
B.   AWS CloudTrail
C.   AWS Trusted Advisor
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 458
A user needs to regularly audit and evaluate the setup of all AWS resources, identify non-compliant accounts, and be notified when a resource changes.

Which AWS service can be used to meet these requirements?

A.   AWS Trusted Advisor
B.   AWS Config
C.   AWS Resource Access Manager
D.   AWS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 459
A user is planning to launch two additional Amazon EC2 instances to increase availability.

Which action should the user take?

A.   Launch the instances across multiple Availability Zones in a single AWS Region.
B.   Launch the instances as EC2 Reserved Instances in the same AWS Region and the same Availability Zone.
C.   Launch the instances in multiple AWS Regions, but in the same Availability Zone.
D.   Launch the instances as EC2 Spot Instances in the same AWS Region, but in different Availability Zones.

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 460
A company must store critical business data in Amazon S3 with a backup to another AWS Region.

How can this be achieved?

A.   Use an Amazon CloudFront Content Delivery Network (CDN) to cache data globally
B.   Set up Amazon S3 cross-region replication to another AWS Region
C.   Configure the AWS Backup service to back up to the data to another AWS Region
D.   Take Amazon S3 bucket snapshots and copy that data to another AWS Region
Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 461
Which AWS Cloud service can send alerts to customers if custom spending thresholds are exceeded?

A.   AWS Budgets
B.   AWS Cost Explorer
C.   AWS Cost Allocation Tags
D.   AWS Organizations

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 462
What is the recommended method to request penetration testing on AWS resources?

A.   Open a support case
B.   Fill out the Penetration Testing Request Form
C.   Request a penetration test from your technical account manager
D.   Contact your AWS sales representative

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 463
A user needs to automatically discover, classify, and protect sensitive data stored in Amazon S3.

Which AWS service can meet these requirements?

A.   Amazon Inspector
B.   Amazon Macie
C.   Amazon GuardDuty
D.   AWS Secrets Manager

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 464
Which components are required to build a successful site-to-site VPN connection on AWS? (Choose two.)

A.   Internet gateway
B.   NAT gateway
C.   Customer gateway
D.   Transit gateway
E.   Virtual private gateway

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 465
Which Amazon EC2 pricing option is best suited for applications with short-term, spiky, or unpredictable workloads that cannot be interrupted?

A.   Spot Instances
B.   Dedicated Hosts
C.   On-Demand Instances
D.   Reserved Instances

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 466
Which AWS cloud architecture principle states that systems should reduce interdependencies?

A.   Scalability
B.   Services, not servers
C.   Removing single points of failure
D.   Loose coupling

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 467
What is the MOST effective resource for staying up to date on AWS security announcements?

A.   AWS Personal Health Dashboard
B.   AWS Secrets Manager
C.   AWS Security Bulletins
D.   Amazon Inspector

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 468
Which AWS service offers persistent storage for a file system?

A.   Amazon S3
B.   Amazon EC2 instance store
C.   Amazon Elastic Block Store (Amazon EBS)
D.   Amazon ElastiCache

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 469
Which of the following allows AWS users to manage cost allocations for billing?

A.   Tagging resources
B.   Limiting who can create resources
C.   Adding a secondary payment method
D.   Running all operations on a single AWS account

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 470
Which AWS service allows users to download security and compliance reports about the AWS infrastructure on demand?

A.   Amazon GuardDuty
B.   AWS Security Hub
C.   AWS Artifact
D.   AWS Shield

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 471
Which of the following AWS services are serverless? (Choose two.)

A.   AWS Lambda
B.   Amazon Elasticsearch Service
C.   AWS Elastic Beanstalk
D.   Amazon DynamoDB
E.   Amazon Redshift

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 472
Which AWS managed services can be used to extend an on-premises data center to the AWS network? (Choose two.)

A.   AWS VPN
B.   NAT gateway
C.   AWS Direct Connect
D.   Amazon Connect
E.   Amazon Route 53

Correct Answer: AC
Explanation
Explanation/Reference:


QUESTION 473
Which requirement must be met for a member account to be unlinked from an AWS Organizations account?

A.   The linked account must be actively compliant with AWS System and Organization Controls (SOC).
B.   The payer and the linked account must both create AWS Support cases to request that the member account be unlinked from the organization.
C.   The member account must meet the requirements of a standalone account.
D.   The payer account must be used to remove the linked account from the organization.

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 474
What AWS benefit refers to a customer's ability to deploy applications that scale up and down the meet variable demand?

A.   Elasticity
B.   Agility
C.   Security
D.   Scalability

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 475
During a compliance review, one of the auditors requires a copy of the AWS SOC 2 report.

Which service should be used to submit this request?

A.   AWS Personal Health Dashboard
B.   AWS Trusted Advisor
C.   AWS Artifact
D.   Amazon S3

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 476
A company wants to set up a highly available workload in AWS with a disaster recovery plan that will allow the company to recover in case of a regional service
interruption.

Which configuration will meet these requirements?

A.   Run on two Availability Zones in one AWS Region, using the additional Availability Zones in the AWS Region for the disaster recovery site.
B.   Run on two Availability Zones in one AWS Region, using another AWS Region for the disaster recovery site.
C.   Run on two Availability Zones in one AWS Region, using a local AWS Region for the disaster recovery site.
D.   Run across two AWS Regions, using a third AWS Region for the disaster recovery site.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/startups/large-scale-disaster-recovery-using-aws-regions/

QUESTION 477
A company has a 500 TB image repository that needs to be transported to AWS for processing.

Which AWS service can import this data MOST cost-effectively?

A.   AWS Snowball
B.   AWS Direct Connect
C.   AWS VPN
D.   Amazon S3

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/storage/migrating-hundreds-of-tb-of-data-to-amazon-s3-with- aws-datasync/

QUESTION 478
Which AWS service can run a managed PostgreSQL database that provides online transaction processing (OLTP)?

A.   Amazon DynamoDB
B.   Amazon Athena
C.   Amazon RDS
D.   Amazon EMR
Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/rds/postgresql/

QUESTION 479
Which of the following assist in identifying costs by department? (Choose two.)

A.   Using tags on resources
B.   Using multiple AWS accounts
C.   Using an account manager
D.   Using AWS Trusted Advisor
E.   Using Consolidated Billing

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 480
A company wants to allow full access to an Amazon S3 bucket for a particular user.

Which element in the S3 bucket policy holds the user details that describe who needs access to the S3 bucket?

A.   Principal
B.   Action
C.   Resource
D.   Statement

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html

QUESTION 481
Which AWS service allows for effective cost management of multiple AWS accounts?

A.   AWS Organizations
B.   AWS Trusted Advisor
C.   AWS Direct Connect
D.   Amazon Connect

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/aws-organizations-policy-based-management-for-multiple-aws-accounts/

QUESTION 482
A company is piloting a new customer-facing application on Amazon Elastic Compute Cloud (Amazon EC2) for one month.

What pricing model is appropriate?

A.   Reserved Instances
B.   Spot Instances
C.   On-Demand Instances
D.   Dedicated Hosts

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/pricing/

QUESTION 483
Which AWS tools automatically forecast future AWS costs?

A.   AWS Support Center
B.   AWS Total Cost of Ownership (TCO) Calculator
C.   AWS Simple Monthly Calculator
D.   Cost Explorer

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-forecast.html

QUESTION 484
Under the AWS shared responsibility model, which of the following is a responsibility of AWS?
A.   Enabling server-side encryption for objects stored in S3
B.   Applying AWS IAM security policies
C.   Patching the operating system on an Amazon EC2 instance
D.   Applying updates to the hypervisor

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/?ref=wellarchitected

QUESTION 485
A user is able to set up a master payer account to view consolidated billing reports through:

A.   AWS Budgets.
B.   Amazon Macie.
C.   Amazon QuickSight.
D.   AWS Organizations.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 486
Performing operations as code is a design principle that supports which pillar of the AWS Well-Architected Framework?

A.   Performance efficiency
B.   Operational excellence
C.   Reliability
D.   Security

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 487
Which design principle is achieved by following the reliability pillar of the AWS Well-Architected Framework?

A.   Vertical scaling
B.   Manual failure recovery
C.   Testing recovery procedures
D.   Changing infrastructure manually

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 488
What is a characteristic of Convertible Reserved Instances (RIs)?

A.   Users can exchange Convertible RIs for other Convertible RIs from a different instance family.
B.   Users can exchange Convertible RIs for other Convertible RIs in different AWS Regions.
C.   Users can sell and buy Convertible RIs on the AWS Marketplace.
D.   Users can shorten the term of their Convertible RIs by merging them with other Convertible RIs.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-convertible-exchange.html

QUESTION 489
The user is fully responsible for which action when running workloads on AWS?

A.   Patching the infrastructure components
B.   Implementing controls to route application traffic
C.   Maintaining physical and environmental controls
D.   Maintaining the underlying infrastructure components

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 490
An architecture design includes Amazon EC2, an Elastic Load Balancer, and Amazon RDS.
What is the BEST way to get a monthly cost estimation for this architecture?

A.   Open an AWS Support case, provide the architecture proposal, and ask for a monthly cost estimation.
B.   Collect the published prices of the AWS services and calculate the monthly estimate.
C.   Use the AWS Simple Monthly Calculator to estimate the monthly cost.
D.   Use the AWS Total Cost of Ownership (TCO) Calculator to estimate the monthly cost.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/pricing-calculator/latest/userguide/aws-pc.pdf

QUESTION 491
Which are benefits of using Amazon RDS over Amazon EC2 when running relational databases on AWS? (Choose two.)

A.   Automated backups
B.   Schema management
C.   Indexing of tables
D.   Software patching
E.   Extract, transform, and load (ETL) management

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html

QUESTION 492
What does the Amazon S3 Intelligent-Tiering storage class offer?

A.   Payment flexibility by reserving storage capacity
B.   Long-term retention of data by copying the data to an encrypted Amazon Elastic Block Store (Amazon EBS) volume
C.   Automatic cost savings by moving objects between tiers based on access pattern changes
D.   Secure, durable, and lowest cost storage for data archival

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2018/11/s3-intelligent-tiering/

QUESTION 493
A company has multiple data sources across the organization and wants to consolidate data into one data warehouse.

Which AWS service can be used to meet this requirement?

A.   Amazon DynamoDB
B.   Amazon Redshift
C.   Amazon Athena
D.   Amazon QuickSight

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/redshift/faqs/

QUESTION 494
Which AWS service can be used to track resource changes and establish compliance?

A.   Amazon CloudWatch
B.   AWS Config
C.   AWS CloudTrail
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html

QUESTION 495
A user has underutilized on-premises resources.

Which AWS Cloud concept can BEST address this issue?

A.   High availability
B.   Elasticity
C.   Security
D.   Loose coupling

Correct Answer: B
Explanation
Explanation/Reference:
Explanation:
https://www.gremlin.com/blog/implementing-cost-saving-strategies-on-amazon-ec-2-with- chaos-engineering/

QUESTION 496
A user has a stateful workload that will run on Amazon EC2 for the next 3 years.

What is the MOST cost-effective pricing model for this workload?

A.   On-Demand Instances
B.   Reserved Instances
C.   Dedicated Instances
D.   Spot Instances

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
On-demand instances are useful for running stateful workloads without making a long-term commitment, but if your workloads are stateless or can tolerate shorter
run cycles, there's a more cost-effective instance type called a Spot Instance.
https://www.gremlin.com/blog/implementing-cost-saving-strategies-on-amazon-ec-2-with-chaos-engineering/

QUESTION 497
A cloud practitioner needs an Amazon EC2 instance to launch and run for 7 hours without interruptions.

What is the most suitable and cost-effective option for this task?

A.   On-Demand Instance
B.   Reserved Instance
C.   Dedicated Host
D.   Spot Instance

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/spot/details/

QUESTION 498
Which of the following are benefits of using AWS Trusted Advisor? (Choose two.)

A.   Providing high-performance container orchestration
B.   Creating and rotating encryption keys
C.   Detecting underutilized resources to save costs
D.   Improving security by proactively monitoring the AWS environment
E.   Implementing enforced tagging across AWS resources

Correct Answer: DE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2016/06/aws-support-enables-tagging-capabilities-for-trusted-advisor/

QUESTION 499
A developer has been hired by a large company and needs AWS credentials.

Which are security best practices that should be followed? (Choose two.)

A.   Grant the developer access to only the AWS resources needed to perform the job.
B.   Share the AWS account root user credentials with the developer.
C.   Add the developer to the administrator's group in AWS IAM.
D.   Configure a password policy that ensures the developer's password cannot be changed.
E.   Ensure the account password policy requires a minimum length.

Correct Answer: AE
Explanation

Explanation/Reference:


QUESTION 500
Which AWS storage service is designed to transfer petabytes of data in and out of the cloud?

A.   AWS Storage Gateway
B.   Amazon S3 Glacier Deep Archive
C.   Amazon Lightsail
D.   AWS Snowball

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/snowball/latest/ug/transfer-petabytes.html
QUESTION 501
Which service provides a user the ability to warehouse data in the AWS Cloud?

A.   Amazon EFS
B.   Amazon Redshift
C.   Amazon RDS
D.   Amazon VPC

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/redshift/

QUESTION 502
A user is planning to migrate an application workload to the AWS Cloud.

Which control becomes the responsibility of AWS once the migration is complete?

A.   Patching the guest operating system
B.   Maintaining physical and environmental controls
C.   Protecting communications and maintaining zone security
D.   Patching specific applications

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 503
Which services can be used to deploy applications on AWS? (Choose two.)

A.   AWS Elastic Beanstalk
B.   AWS Config
C.   AWS OpsWorks
D.   AWS Application Discovery Service
E.   Amazon Kinesis

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://d0.awsstatic.com/whitepapers/overview-of-deployment-options-on-aws.pdf

QUESTION 504
Which AWS service can be used to provide an on-demand, cloud-based contact center?

A.   AWS Direct Connect
B.   Amazon Connect
C.   AWS Support Center
D.   AWS Managed Services

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/connect/customers/

QUESTION 505
What tool enables customers without an AWS account to estimate costs for almost all AWS services?

A.   Cost Explorer
B.   TCO Calculator
C.   AWS Budgets
D.   Simple Monthly Calculator

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/aws-cost-management/aws-cost-explorer/

QUESTION 506
Which component must be attached to a VPC to enable inbound Internet access?

A.   NAT gateway
B.   VPC endpoint
C.   VPN connection
D.   Internet gateway

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper.pdf (41, 42, 43)

QUESTION 507
Which pricing model would result in maximum Amazon Elastic Compute Cloud (Amazon EC2) savings for a database server that must be online for one year?

A.   Spot Instance
B.   On-Demand Instance
C.   Partial Upfront Reserved Instance
D.   No Upfront Reserved Instance

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html

QUESTION 508
A company has a MySQL database running on a single Amazon EC2 instance. The company now requires higher availability in the event of an outage.

Which set of tasks would meet this requirement?

A.   Add an Application Load Balancer in front of the EC2 instance
B.   Configure EC2 Auto Recovery to move the instance to another Availability Zone
C.   Migrate to Amazon RDS and enable Multi-AZ
D.   Enable termination protection for the EC2 instance to avoid outages

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

QUESTION 509
A company wants to ensure that AWS Management Console users are meeting password complexity requirements.

How can the company configure password complexity?

A.   Using an AWS IAM user policy
B.   Using an AWS Organizations service control policy (SCP)
C.   Using an AWS IAM account password policy
D.   Using an AWS Security Hub managed insight

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account- policy.html

QUESTION 510
Under the AWS shared responsibility model, which of the following is the customer's responsibility?

A.   Patching guest OS and applications
B.   Patching and fixing flaws in the infrastructure
C.   Physical and environmental controls
D.   Configuration of AWS infrastructure devices

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 511
Which of the following tasks is required to deploy a PCI-compliant workload on AWS?

A.   Use any AWS service and implement PCI controls at the application layer
B.   Use an AWS service that is in-scope for PCI compliance and raise an AWS support ticket to enable PCI compliance at the application layer
C.   Use any AWS service and raise an AWS support ticket to enable PCI compliance on that service
D.   Use an AWS service that is in scope for PCI compliance and apply PCI controls at the application layer

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html

QUESTION 512
A company is building an application that requires the ability to send, store, and receive messages between application components. The company has another
requirement to process messages in first-in, first-out (FIFO) order.

Which AWS service should the company use?

A. AWS Step Functions
B. Amazon Simple Notification Service (Amazon SNS)
C. Amazon Kinesis Data Streams
D. Amazon Simple Queue Service (Amazon SQS)

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/sqs/faqs/

QUESTION 513
AnyCompany recently purchased Example Corp. Both companies use AWS resources, and AnyCompany wants a single aggregated bill.

Which option allows AnyCompany to receive a single bill?

A.   Example Corp. must submit a request to its AWS solutions architect or AWS technical account manager to link the accounts and consolidate billing.
B.   AnyCompany must create a new support case in the AWS Support Center requesting that both bills be combined.
C.   Send an invitation to join the organization from AnyCompany's AWS Organizations master account to Example Corp.
D.   Migrate the Example Corp. VPCs, Amazon EC2 instances, and other resources into the AnyCompany AWS account.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/awsaccountbilling-aboutv2.pdf

QUESTION 514
Which tool can be used to create alerts when the actual or forecasted cost of AWS services exceeds a certain threshold?

A.   Cost Explorer
B.   AWS Budgets
C.   AWS Cost and Usage Report
D.   AWS CloudTrail

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/hands-on/control-your-costs-free-tier-budgets/

QUESTION 515
A user has limited knowledge of AWS services, but wants to quickly deploy a scalable Node.js application in the AWS Cloud.

Which service should be used to deploy the application?

A.   AWS CloudFormation
B.   AWS Elastic Beanstalk
C.   Amazon EC2
D.   AWS OpsWorks

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/elasticbeanstalk/

QUESTION 516
Which AWS Trusted Advisor check is available to all AWS users?

A.   Core checks
B.   All checks
C.   Cost optimization checks
D.   Fault tolerance checks

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://www.amazonaws.cn/en/support/trustedadvisor/faq/#checks

QUESTION 517
A web developer is concerned that a DDoS attack could target an application.

Which AWS services or features can help protect against such an attack? (Choose two.)

A.   AWS Shield
B.   AWS CloudTrail
C.   Amazon CloudFront
D.   AWS Support Center
E.   AWS Service Health Dashboard

Correct Answer: AB
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/shield/

QUESTION 518
Which AWS service gives users on-demand, self-service access to AWS compliance control reports?

A.   AWS Config
B.   Amazon GuardDuty
C.   AWS Trusted Advisor
D.   AWS Artifact

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/artifact

QUESTION 519
A company wants to provide one of its employees with access to Amazon RDS. The company also wants to limit the interaction to only the AWS CLI and AWS
software development kits (SDKs).

Which combination of actions should the company take to meet these requirements while following the principles of least privilege? (Choose two.)

A.   Create an IAM user and provide AWS Management Console access only.
B.   Create an IAM user and provide programmatic access only.
C.   Create an IAM role and provide AWS Management Console access only.
D.   Create an IAM policy with administrator access and attach it to the IAM user.
E.   Create an IAM policy with Amazon RDS access and attach it to the IAM user.

Correct Answer: BE
Explanation


QUESTION 520
A company has a compliance requirement to record and evaluate configuration changes, as well as perform remediation actions on AWS resources.

Which AWS service should the company use?

A.   AWS Config
B.   AWS Secrets Manager
C.   AWS CloudTrail
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/config/

QUESTION 521
What are the advantages of deploying an application with Amazon EC2 instances in multiple Availability Zones? (Choose two.)

A.   Preventing a single point of failure
B.   Reducing the operational costs of the application
C.   Allowing the application to serve cross-region users with low latency
D.   Increasing the availability of the application
E.   Increasing the load of the application

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-increase-availability.html

QUESTION 522
A workload on AWS will run for the foreseeable future by using a consistent number of Amazon EC2 instances.

What pricing model will minimize cost while ensuring that compute resources remain available?

A.   Dedicated Hosts
B.   On-Demand Instances
C.   Spot Instances
D.   Reserved Instances

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html

QUESTION 523
Which tool can be used to identify scheduled changes to the AWS infrastructure?

A. AWS Personal Health Dashboard
B. AWS Trusted Advisor
C. Billing Dashboard
D. AWS Config

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/

QUESTION 524
Which of the following is the customer's responsibility when using Amazon RDS?

A.   Patching the operating system of underlying hardware
B.   Controlling traffic to and from the database through security groups
C.   Running backups that enable point-in-time recovery of a DB instance
D.   Replacing failed DB instances

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html

QUESTION 525
What is the customer's responsibility when using AWS Lambda?

A.   Operating system configuration
B.   Application management
C.   Platform management
D.   Code encryption

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/lambda/security-overview-of-aws-lambda/

QUESTION 526
A company wants to be notified when its AWS Cloud costs or usage exceed defined thresholds.

Which AWS service will support these requirements?

A.   AWS Budgets
B.   Cost Explorer
C.   AWS CloudTrail
D.   Amazon Macie

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/aws-cost-management/aws-budgets/

QUESTION 527
Which AWS service provides the ability to host a NoSQL database in the AWS Cloud?

A.   Amazon Aurora
B.   Amazon DynamoDB
C.   Amazon RDS
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/nosql/

QUESTION 528
Which AWS service allows customers to purchase unused Amazon EC2 capacity at an often discounted rate?

A.   Reserved Instances
B.   On-Demand Instances
C.   Dedicated Instances
D.   Spot Instances

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/spot/

QUESTION 529
Which AWS service or feature requires an internet service provider (ISP) and a colocation facility to be implemented?
A.   AWS VPN
B.   Amazon Connect
C.   AWS Direct Connect
D.   Internet gateway

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/directconnect/partners/

QUESTION 530
Which AWS services offer compute capabilities? (Choose two.)

A.   Amazon EC2
B.   Amazon S3
C.   Amazon Elastic Block Store (Amazon EBS)
D.   Amazon Cognito
E.   AWS Lambda

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/compute-services.html

QUESTION 531
Which AWS service can be used to privately store and manage versions of source code?

A.   AWS CodeBuild
B.   AWS CodeCommit
C.   AWS CodePipeline
D.   AWS CodeStar

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html

QUESTION 532
Which AWS service should a cloud practitioner use to identify security vulnerabilities of an AWS account?

A.   AWS Secrets Manager
B.   Amazon Cognito
C.   Amazon Macie
D.   AWS Trusted Advisor

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://www.coalfire.com/the-coalfire-blog/march-2019/aws-trusted-advisor-for-security-compliance

QUESTION 533
A company wants to ensure its infrastructure is designed for fault tolerance and business continuity in the event of an environmental disruption.

Which AWS infrastructure component should the company replicate across?

A.   Edge locations
B.   Availability Zones
C.   Regions
D.   Amazon Route 53

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://d36cz9buwru1tt.cloudfront.net/AWS_Building_Fault_Tolerant_Applications.pdf (3)

QUESTION 534
Which AWS service or feature is used to send both text and email messages from distributed applications?

A.   Amazon Simple Notification Service (Amazon SNS)
B.   Amazon Simple Email Service (Amazon SES)
C.   Amazon CloudWatch alerts
D.   Amazon Simple Queue Service (Amazon SQS)

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/sns/faqs/

QUESTION 535
Which AWS Cloud design principles can help increase reliability? (Choose two.)

A.   Using monolithic architecture
B.   Measuring overall efficiency
C.   Testing recovery procedures
D.   Adopting a consumption model
E.   Automatically recovering from failure

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
https://wa.aws.amazon.com/wat.pillar.reliability.en.html

QUESTION 536
A company is planning to launch an ecommerce site in a single AWS Region to a worldwide user base.

Which AWS services will allow the company to reach users and provide low latency and high transfer speeds? (Choose two.)

A.   Application Load Balancer
B.   AWS Global Accelerator
C.   AWS Direct Connect
D.   Amazon CloudFront
E.   AWS Lambda

Correct Answer: BD
Explanation
Global Accelerator is used to send user traffic through the AWS global network infrastructure. Global Accelerator improves your internet user performance by up to 60%. CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds.
Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudfront/faqs/

QUESTION 537
A company wants to connect to AWS over a private, low-latency connection from its remote office.

What is the recommended method to meet these requirements?

A.   Create a VPN tunnel
B.   Connect across the public internet
C.   Use VPC peering to create a connection.
D.   Use AWS Direct Connect.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/projects/connect-data-center-to-aws/

QUESTION 538
Which AWS service can be used to retrieve compliance reports on demand?

A.   AWS Secrets Manager
B.   AWS Artifact
C.   AWS Security Hub
D.   AWS Certificate Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/artifact/

QUESTION 539
A company has an AWS-hosted website located behind an Application Load Balancer. The company wants to safeguard the website from SQL injection or cross-
site scripting.

Which AWS service should the company use?

A.   Amazon GuardDuty
B.   AWS WAF
C.   AWS Trusted Advisor
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/waf/faq/

QUESTION 540
How should a web application be deployed to ensure high availability in the AWS Cloud?
A.   Deploy multiple instances of the application in multiple Availability Zones.
B.   Deploy multiple instances of the application in a single Availability Zone.
C.   Deploy the application to a compute-optimized Amazon EC2 instance in a single Availability Zone.
D.   Deploy the application in one Amazon EC2 instance in an Auto Scaling group.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.betsol.com/blog/how-to-make-high-availability-web-applications-on-amazon-web-services/

QUESTION 541
A company is running a self-managed Oracle database directly on Amazon EC2 for its steady-state database. The company wants to reduce compute costs.

Which option should the company use to maximize savings over a 3-year term?

A.   EC2 Dedicated Instances
B.   EC2 Spot Instances
C.   EC2 Reserved Instances
D.   EC2 On-Demand Instances

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/choosing-a-cloud-platform/

QUESTION 542
An external auditor has requested that a company provide a list of all its IAM users, including the status of users' credentials and access keys.

What it the SIMPLEST way to provide this information?

A.   Create an IAM user account for the auditor, granting the auditor administrator permissions.
B.   Take a screenshot of each user's page in the AWS Management Console, then provide the screenshots to the auditor.
C.   Download the IAM credential report, then provide the report to the auditor.
D.   Download the AWS Trusted Advisor report, then provide the report to the auditor.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

QUESTION 543
What are the benefits of consolidated billing for AWS Cloud services? (Choose two.)

A.   Volume discounts
B.   A minimal additional fee for use
C.   One bill for multiple accounts
D.   Installment payment options
E.   Custom cost and usage budget creation

Correct Answer: CE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html

QUESTION 544
A company is expecting a short-term spike in internet traffic for its application. During the traffic increase, the application cannot be interrupted. The company also
needs to minimize cost and maximize flexibility.

Which Amazon EC2 instance type should the company use to meet these requirements?

A.   On-Demand Instances
B.   Spot Instances
C.   Reserved Instances
D.   Dedicated Hosts

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/ec2/faqs/

QUESTION 545
A company wants to track AWS resource configuration changes for compliance reasons.

Which AWS feature can be used to meet this requirement?

A.   AWS Cost and Usage Report
B.   AWS Organizations service control policies (SCPs)
C.   AWS Config rules
D.   VPC Flow Logs
Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/config/

QUESTION 546
A company is building an application that needs to deliver images and videos globally with minimal latency.

Which approach can the company use to accomplish this in a cost effective manner?

A.   Deliver the content through Amazon CloudFront.
B.   Store the content on Amazon S3 and enable S3 cross-region replication.
C.   Implement a VPN across multiple AWS Regions.
D.   Deliver the content through AWS PrivateLink.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/industries/how-to-build-a-global-scalable-low-latency-and- secure-machine-learning-medical-imaging-analysis-platform-on-aws/

QUESTION 547
The AWS IAM best practice for granting least privilege is to:

A.   apply an IAM policy to an IAM group and limit the size of the group.
B.   require multi-factor authentication (MFA) for all IAM users.
C.   require each IAM user who has different permissions to have multiple passwords.
D.   apply an IAM policy only to IAM users who require it.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://kirkpatrickprice.com/blog/best-practices-for-privilege-management-in-aws/

QUESTION 548
Which cloud computing benefit does AWS demonstrate with its ability to offer lower variable costs as a result of high purchase volumes?

A.   Pay-as-you-go pricing
B.   High availability
C.   Global reach
D.   Economies of scale

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://innovationtactics.com/amazon-business-model-amazon-web-services/

QUESTION 549
A pharmaceutical company operates its infrastructure in a single AWS Region. The company has thousands of VPCs in a various AWS accounts that it wants to
interconnect.

Which AWS service or feature should the company use to help simplify management and reduce operational costs?

A.   VPC endpoint
B.   AWS Direct Connect
C.   AWS Transit Gateway
D.   VPC peering

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/building-a-scalable-and-secure-multi-vpc-aws-network- infrastructure.pdf (9)

QUESTION 550
How can AWS enable a company to control expenses as an application's usage changes unpredictably?

A.   AWS will refund the cost difference if a customer moves to larger servers.
B.   The application can be built to scale up or down automatically as resources are needed
C.   Spot instances will automatically be used if the price is lower than on-demand instances.
D.   Amazon CloudWatch will automatically predict what resources are needed.

Correct Answer: B
Explanation


QUESTION 551
Which AWS service or feature can be used to prevent SQL injection attacks?

A. Security groups
B. Network ACLs
C. AWS WAF
D. IAM policy

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-sql-conditions.html

QUESTION 552
Which AWS service can help a company detect an outage of its website servers and redirect users to alternate servers?

A.   Amazon CloudFront
B.   Amazon GuardDuty
C.   Amazon Route 53
D.   AWS Trusted Advisor

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2013/02/11/announcing-dns-failover-for-route- 53/

QUESTION 553
Which of the following IT tasks does AWS perform to offload a company's IT resource management responsibilities? (Choose two.)

A.   Configuring operating system firewalls
B.   Setting up access controls for data
C.   Backing up databases
D.   Configuring database user accounts
E.   Installing operating systems

Correct Answer: CE
Explanation


QUESTION 554
According to security best practices, how should an Amazon EC2 instance be given access to an Amazon S3 bucket?

A.   Hard code an IAM user's secret key and access key directly in the application, and upload the file.
B.   Store the IAM user's secret key and access key in a text file on the EC2 instance, read the keys, then upload the file.
C.   Have the EC2 instance assume a role to obtain the privileges to upload the file.
D.   Modify the S3 bucket policy so that any service can upload to it at any time.

Correct Answer: C
Explanation


QUESTION 555
A user can increase operational efficiency in the AWS Cloud by:

A.   leveraging AWS managed services.
B.   right-sizing AWS infrastructure.
C.   manually creating all necessary resources.
D.   managing their own software license.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://www.ibexlabs.com/improve-operational-efficiency-via-digital-transformation-on-aws/

QUESTION 556
Which AWS service automatically handles application health monitoring?

A.   Amazon API Gateway
B.   AWS Elastic Beanstalk
C.   AWS Lambda
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/elasticbeanstalk/

QUESTION 557
Under the AWS shared responsibility model, which task is the customer's responsibility when managing AWS Lambda functions?

A.   Creating versions of Lambda functions
B.   Maintaining server and operating systems
C.   Scaling Lambda resources according to demand
D.   Updating the Lambda runtime environment
Correct Answer: C
Explanation


QUESTION 558
A company needs to track the activity in its AWS accounts, and needs to know when an API call is made against its AWS resources.

Which AWS tool or service can be used to meet these requirements?

A.   Amazon CloudWatch
B.   Amazon Inspector
C.   AWS Cloud Trail
D.   AWS IAM

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudtrail/

QUESTION 559
According to the AWS shared responsibility model, which of the following are AWS responsibilities? (Choose two.)

A.   Network infrastructure and virtualization of infrastructure
B.   Security of application data
C.   Guest operating systems
D.   Physical security of hardware
E.   Credentials and policies

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 560
Which of the following services can be used to block network traffic to an instance? (Choose two.)

A.   Security groups
B.   Amazon Virtual Private Cloud (Amazon VPC) flow logs
C.   Network ACLs
D.   Amazon CloudWatch
E.   AWS CloudTrail

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-block-or-allow-ips/

QUESTION 561
A company wants to transfer petabytes of data as quickly as possible from on-premises locations to the AWS Cloud.

Which AWS service should the company use?

A.   AWS Snowball
B.   AWS Global Accelerator
C.   Amazon S3 Transfer Acceleration
D.   Amazon Connect

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/projects/migrate-petabyte-scale-data/

QUESTION 562
A company has refined its workload to use specific AWS services to improve efficiency and reduce cost.

Which best practice for cost governance does this example show?

A.   Resource controls
B.   Cost allocation
C.   Architecture optimization
D.   Tagging enforcement

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/whitepapers/architecture/AWS-Cost-Optimization-Pillar.pdf

QUESTION 563
A company hosts images in an Amazon S3 bucket for a public-facing website that is viewed by millions of users around the globe.
Which AWS service will deliver this content with reduced latency?

A.   AWS WAF
B.   Amazon CloudWatch
C.   Amazon Cloud Front
D.   AWS CloudFormation

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/getting-started/hands-on/deliver-content-faster/

QUESTION 564
Which of the following is an AWS best practice for managing an AWS account root user?

A.   Keep the root user password with the security team.
B.   Enable multi-factor authentication (MFA) for the root user.
C.   Create an access key for the root user.
D.   Keep the root user password consistent for compliance purposes.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 565
A company wants to securely access an Amazon S3 bucket from an Amazon EC2 instance without accessing the internet.

What should the company use to accomplish this goal?

A.   VPN connection
B.   Internet gateway
C.   VPC endpoint
D.   NAT gateway

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/

QUESTION 566
Which statement is true about AWS global infrastructure?

A.   Availability Zones can span multiple AWS Regions.
B.   A VPC can have different subnets in different AWS Regions.
C.   AWS Regions consist of multiple Availability Zones.
D.   A single subnet can span multiple Availability Zones.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://digitalcloud.training/certification-training/aws-certified-cloud-practitioner/aws-global-infrastructure/

QUESTION 567
Which AWS service or feature provides information about ongoing or upcoming scheduled events that can affect an AWS account?

A.   AWS Config
B.   AWS Systems Manager
C.   AWS Personal Health Dashboard
D.   AWS Trusted Advisor

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/

QUESTION 568
A bank needs to store recordings of calls made to its contact center for 6 years. The recordings must be accessible within 48 hours from the time they are
requested.
Which AWS service will provide a secure and cost-effective solution for retaining these files?

A.   Amazon DynamoDB
B.   Amazon S3 Glacier
C.   Amazon Connect
D.   Amazon ElastiCache

Correct Answer: C
Explanation
Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/connect/latest/adminguide/set-up-recordings.html

QUESTION 569
A media company wants to distribute video content to millions of users worldwide over the internet. The company wants to use the AWS global network backbone
to distribute cached content with low latency and high data transfer speeds.

Which AWS service will meet these requirements?

A.   Amazon CloudFront
B.   AWS Global Accelerator
C.   AWS Direct Connect
D.   Amazon Connect

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudfront/

QUESTION 570
The AWS global infrastructure consists of Regions, Availability Zones, and what else?

A.   VPCs
B.   Data centers
C.   Dark fiber network links
D.   Edge locations

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://www.inqdo.com/aws-explained-global-infrastructure/?lang=en

QUESTION 571
Which AWS Trusted Advisor feature is available exclusively to users with AWS Business Support or AWS Enterprise Support?

A.   Notification setup
B.   Refresh checks
C.   AWS Support API
D.   Action links

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

QUESTION 572
which of the following are benefits of running a database on amazon RDs compared to an on premises database?

A.   RDS backup are managed by AWS
B.   RDS supports any relational database
C.   RDs has no database engineer licensing costs.
D.   RDS database compute capacity can be easily scaled.
E.   RDS inbound traffic content (for example, security groups) is managed by AWS.

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 573
which AWS tools or services can be used to list all aws lambda functions running in an account?

A.   AWS CLI
B.   AWS CloudFormation
C.   AWS SDKs
D.   AWS CloudTrail
E.   Amazon Cloud Directory

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 574
Which management service can be used to set alarms for AWS resources?

A. Amazon CloudWatch
B. Amazon Simple Notification Service (Amazon SNS)
C. Amazon Simple Email Service (Amazon SES)
D. AWS CloudTrail

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 575
Which of the following are AWS b s practices? (Select TWO.)

A.   Enable AWS Multi-Factor Authentication (AWS MFA) for users.
B.   Enable access key sharing among users.
C.   Use the inline policies instead of user managed policies.
D.   Configure strong password policies for users.
E.   Avoid rotating credentials.

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 576
What AWS billing support resource is available to all support levels?

A.   AWS Support concierge
B.   AWS Customer Service
C.   AWS technical account manager
D.   AWS Business Support

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 577
Which AWS service enables users to security connect to AWS resources over the public interne ?

A.   Amazon VPC peering
B.   AWS Direct Connect
C.   AWS VPN
D.   Amazon Pinpoint

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 578
Which actions support the reliability pillar of the AWS Architected Framework? (Select TWO.)

A.   Enforce higher security specifically in regard to designed for failure.
B.   Ensure that backend components include multiple Availability Zone deployments.
C.   Avoid the use of automatic scaling to simplify the cloud architecture.
D.   Enable object versioning within Amazon S3 and replicating data to another AWS Region.
E.   Include an Application Load Balancer to distribute traffic to multiple Amazon EC2 instance in separate Availability Zones

Correct Answer: BD
Explanation

Explanation/Reference:


QUESTION 579
Which AWS service securely delivers data, videos, applications, and APIS to users globally with low latency and high transfer speeds?

A.   AWS CloudFormation
B.   Amazon CloudFornt
C.   Amazon Pinpoint
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 580
A cloud practitioner launched a blog hosted on AWS and needs to register a domain name for the blog. Which AWS service will meet this requirement?

A.   Amazon Connect
B.   Amazon Route 53
C.   Amazon CloudFront
D.   AWS Global Accelerator
Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 581
An Availability Zone consists of:

A.   one or more data centers in a single location.
B.   two or more data centers in multiple locations.
C.   one or more physical hosts in a single data center.
D.   two or more physical hosts in multiple data centers.

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 582
A cloud practitioner needs to obtain AWS compliance reports before migrating an environment to the AWS Cloud. How can these reports be generated?

A.   Contact the AWS Compliance team.
B.   Download the reports from AWS Artifact.
C.   Open a case with AWS Support.
D.   Generate the reports with Amazon Made.

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 583
Which AWS services help to improve application performance by reducing latency while accessing content globally? (Select TWO.)

A.   Amazon CloudFront
B.   AWS VPN
C.   AWS Direct Connect
D.   AWS Global Accelerator
E.   Amazon S3 Glacier

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 584
An application is receiving SQL injection attacks from multiple external resources. Which AWS service or feature can help automate mitigation against these
attacks?

A.   AWS WAF
B.   Security groups
C.   Elastic Load Balancer
D.   Network ACL

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 585
A user needs to quickly deploy a non relational database on AWS. The user does not want to manage the underlying hardware or the database software.
Which AWS service cart be used to accomplish this?

A.   Amazon RDS
B.   Amazon DynamoDB
C.   Amazon Aurora
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 586
Which of the following are AWS Cloud security resources? (Select TWO.)

A.   Real-time vulnerability scans from Amazon Kinesis.
B.   AWS security solutions in the AWS Marketplace.
C.   Open-source penetration testing results available in Amazon Cognito.
D.   AWS whitepapers related to security best practices.
E.   Security analyses of README.md files within application repositories stored in AWS CodeCommit.
Correct Answer: BD
Explanation

Explanation/Reference:


QUESTION 587
How can a user achieve high availability for a web application hosted on AWS?

A.   Use a Classic Load Balancer across multiple AWS Regions
B.   Use an Application Load Balancer across multiple Availability Zones in one AWS Region
C.   Set up automatic scaling and load balancing with another application instance running on premises
D.   Use the AWS Region with the highest number of Availability Zones

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 588
Which of the following is an example of how moving to the AWS Cloud reduces upfront cost?

A.   By replacing large variable costs with lower capital investments
B.   By replacing large capital investments with lower variable costs
C.   By allowing the provisioning of compute and storage at a fixed level to meet peak demand
D.   By replacing the repeated scaling of virtual servers with a simpler fixed-scale model

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 589
According to the AWS shared responsibility model, which of the following tasks are AWS responsibilities? (Select TWO.)

A.   The physical security of AWS facilities.
B.   Encrypting customer data.
C.   Patching and updating the hypervisor.
D.   Patching operating systems on Amazon EC2.
E.   Defining network firewalls inside the VPC.

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 590
Which feature of the AWS Cloud can help minimize application downtime?

A.   Global reach
B.   High availability
C.   Elasticity
D.   Agility

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 591
Management at a large company wants to avoid long-term contracts and is interested in AWS to move from fixed costs to variable costs. What is the value
proposition of AWS for this company?

A.   Economy of scale
B.   Pay-as-you-go pricing
C.   Volume discounts
D.   Cost optimization

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 592
A security officer wants a list of any potential vulnerabilities in Amazon EC2 security groups. Which AWS service should the officer use?

A.   Amazon GuardDuty
B.   AWS Trusted Advisor
C.   AWS CloudTrail
D.   AWS Artifact

Correct Answer: A
Explanation
Explanation/Reference:


QUESTION 593
A company is considering a migration from on premises to the AWS Cloud. The company's IT team needs to offload support of the workload. What should the IT
team do to accomplish this goal?

A.   Use AWS Managed Services to provision run and support the company in infrastructure
B.   Build hardware refreshes into the operational calendar to ensure availability
C.   Use Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances
D.   Overprovision compute capacity for seasonal events and traffic spikes to prevent downtime

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 594
A company with AWS Enterprise Support needs help understanding its monthly AWS bill and wants to implement billing best practices. Which AWS tool or
resource is available to accomplish these goals?

A.   Resource lagging
B.   AWS Concierge Support team
C.   AWS Abuse team
D.   AWS Support

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 595
A company needs 247 phone, email, and chat access, with a response time of less than 1 hour it a production system has a service interruption. Which AWS
Support plan meets these requirements at the LOWEST cost?

A.   Basic
B.   Developer
C.   Business
D.   Enterprise

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 596
In which of the following is Amazon CloudFront content cached?

A.   Availability Zones
B.   Local Zones
C.   AWS Regions
D.   Edge locations

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 597
Which AWS cloud architecture principle states that systems should reduce inter dependences?

A.   Scalability
B.   Services not servers
C.   Removing single points of failure
D.   Loose coupling

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 598
Which AWS service or feature allows a user to establish a dedicated network connection between a company's on-premises data center and the AWS Cloud?

A.   AWS Direct Connect
B.   VPC peering
C.   AWS VPN
D.   Amazon Route 53

Correct Answer: A
Explanation

Explanation/Reference:
QUESTION 599
What can a cloud practitioner use to retrieve AWS security and compliance documents and submit them as evidence to an auditor or regulator?

A.   AWS Certificate Manager
B.   AWS Systems Manager
C.   AWS Artifact
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 600
Which AWS service does AWS Snowball Edge natively support?

A.   AWS Server Migration Service (AWS SMS)
B.   Amazon Aurora
C.   AWS Trusted Advisor
D.   Amazon EC2

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 601
A user needs to import 100 TB of video files into Amazon S3. The user has estimated that it will take months to move the files over an on-premises internet
connection. Which AWS service can be used to improve the data transport time?

A.   Amazon S3 Transfer Accelerator
B.   AWS Snowball
C.   AWS Storage Gateway
D.   AWS DataSync

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 602
A user wants to move legacy applications to the AWS Cloud to reduce the total cost. Which option is the MOST cost-effective according to best practices?

A.   Rewrite the legacy applications in an open-source language, such as Python.
B.   Right-size the Amazon EC2 instances to prevent over-provisioning in terms of compute and memory.
C.   Migrate relational databases to Amazon DynamoDB
D.   Reserve a data center facility with an upfront payment, which provides an additional discount

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 603
A company is building a new archiving system on AWS that will store terabytes of data. The company will NOT retrieve the data often.
Which Amazon S3 storage class will MINIMIZE the cost of the system?

A.   S3 Standard-Infrequent Access (S3 Standard-IA)
B.   S3 Glacier
C.   S3 Intelligent-Tiering
D.   S3 One Zone-Infrequent Access (S3 One Zone-IA)

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 604
Which AWS feature or service provides visibility into abuse events that have been reported on a given AWS account?

A.   AWS Trusted Advisor
B.   Amazon GuardDuty
C.   AWS Personal Health Dashboard
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 605
According to the AWS shared responsibility model, which of the following is the customer responsible for if they are using a managed service such as Amazon
Relational Database Service (Amazon RDS)? {Select TWO.)

A.   Operating system patching
B.   Setting up and managing network controls
C.   Managing platform-level identity and access management (IAM)
D.   Physical security of the data center
E.   Environmental controls

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 606
Which AWS Cloud service provides performance recommendations for an AWS account?

A.   Amazon Inspector
B.   AWS Trusted Advisor
C.   Amazon CloudWatch
D.   AWS CloudTrail

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 607
A company needs to allocate AWS costs across three different departments running in a single VPC. Each department has a number of Amazon EC2 instances
dedicated to the applications fnar are specific to the given department.
How can the costs be allocated across the three departments?

A.   Have each department tag their resources, then run a cost allocation report.
B.   Create an AWS IAM account with billing access and use the AWS CLI to view EC2 instance use statistics.
C.   Enable billing alerts through Amazon CloudWatch
D.   Configure three VPCs. allocating one tor each department

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 608
Which AWS service should be used to monitor Amazon EC2 instances for CPU and network utilization?

A.   Amazon Inspecto
B.   AWS CloudTtail
C.   Amazon CloudWatch
D.   AWS Config

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 609
A company is designing a new stateful application to run on AWS. Which design patterns will help reduce risk? (Select TWO.)

A.   Consume compute resources using Amazon EC2 Spot instance types.
B.   Use Amazon S3 with a bucket policy that ensures the least restrictive access to the data.
C.   Separate the database tier from the application tier using Amazon RDS.
D.   Consolidate application resources into one or two large instance types to minimize the number of components to be managed.
E.   Build a micro services-based architecture to break out application services into containers for the application tier.

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 610
Which of the following is Amazon Aurora compatible with? (Select TWO.)

A.   MySQL
B.   Microsoft SOL Server
C.   Oracle
D.   PostgreSQL
E.   MahaDB

Correct Answer: AD
Explanation

Explanation/Reference:
QUESTION 611
Which of the following acts as an instance-level firewall to control inbound and outbound access?

A.   Network access control list
B.   Security groups
C.   AWS Trusted Advisor
D.   Virtual private gateways

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 612
A company has launched a product that requires private connectivity from an on-premises network to a VPC. Which AWS service or functionality should the
company use?

A.   AWS Direct Connect
B.   VPC peering
C.   NAT gateway
D.   Internal gateway

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 613
Who is responsible for managing IAM user access and secret keys according to the AWS shared responsibility model?

A.   IAM access and secret keys are static, so there is no need to rotate them
B.   The customer is responsible for rotating keys.
C.   AWS will rotate the keys whenever required.
D.   The AWS Support team will rotate keys when requested by the customer

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 614
What type of database is Amazon DynamoDB?

A.   In-memory
B.   Relational
C.   Key-value
D.   Graph

Correct Answer: C
Explanation: Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It is designed to provide fast and predictable performance with seamless scalability.

Explanation/Reference:


QUESTION 615
Which of the following services has a primarily encryption-related purpose?

A.   AWS Security Token Service (AWS STS)
B.   Amazon EMR
C.   AWS Key Management Service (AWS KMS)
D.   Amazon Macie

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 616
Which are customer responsibilities when using Amazon EC2? (Select TWO.)

A.   Underlying hardware maintenance
B.   File-system-level encryption
C.   Guest operating system firewall configuration
D.   Hypervisor-level software patching
E.   Physical security at data center facilities

Correct Answer: AB
Explanation

Explanation/Reference:


QUESTION 617
Which AWS feature enables users to categorize and track their AWS costs?
A.   Cost Allocation Tags
B.   AWS Trusted Advisor
C.   AWS Price List API
D.   AWS Organizations

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 618
Which functions can users perform using AWS KMS?

A.   Create and manage AWS access keys for the AWS account root user.
B.   Create and manage AWS access keys for an AWS account IAM user.
C.   Create and manage keys for encryption and decryption on data.
D.   Create and manage keys for multi-factor authentication.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 619
Which AWS service or feature can be used to allow users access to compliance reports as self-service downloads?

A.   AWS Service Catalog
B.   AWS Security Hub
C.   AWS Artifact
D.   AWS Support Center

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 620
An external auditor needs to verify the compliance and security of the AWS data center facilities where a company's data is stored.
How should this request be addressed?

A.   Create a support case using the AWS account root user credentials requesting that a concierge accompany the auditor to the facility.
B.   Contact an AWS technical account manager and request access to the next scheduled facility tour.
C.   Access the AWS Artifact portal and download the required reports to provide to the auditor.
D.   Access the AWS Artifact portal and create an access URL for the auditor to download the required reports,

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 621
A user needs to demonstrate which AWS services are compliant with the Payment Card Industry Data Security Standard (PCI DSS).
Which AWS resource can be used to meet this requirement?

A.   AWS Artifact
B.   AWS Certificate Manager
C.   AWS Systems Manager
D.   AWS Secrets Manager

Correct Answer: A
Explanation

Explanation/Reference: https://aws.amazon.com/compliance/pci-dss-level-1-faqs/


QUESTION 622
A user warts to securely automate me management and rotation of credentials that are shared between applications, while spending the least amount of time on
managing tasks. Which AWS service or feature can be used to accomplish this?

A.   AWSCloudHSM
B.   AWS Key Management Service (AWS KMS)
C.   AWS Secret Manager
D.   Server-side encryption

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 623
A company is using Amazon Elastic Container Service (Amazon ECS) for a development environment AWS is responsible for which Amazon ECS components?
(Select TWO.)

A. Network rules
B.   IAM
C.   Host platform
D.   Physical infrastructure
E.   Guest operating system

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 624
A company needs a data store for highly transactional workloads. Which AWS service would meet this requirement?

A.   Amazon RDS
B.   Amazon Redshift
C.   Amazon S3
D.   Amazon S3 Glacier

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 625
Which duty is a responsibility of AWS under the AWS shared responsibility model?

A.   Identity and access management
B.   Server-side encryption (SSE)
C.   Firewall configuration
D.   Maintaining physical hardware

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 626
Which AWS service enables risk auditing of an AWS account by tracking and recording user actions and source IP addresses?

A.   AWS X-Ray
B.   AWS Shield
C.   AWS Trusted Advisor
D.   AWS CloudTrail

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 627
When comparing AWS to on-premises total cost of ownership (TCO), what costs are included with AWS?

A.   Data center security
B.   Business analysis
C.   Project management
D.   Operating system administration

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 628
Which of the following can be used to describe infrastructure as code in the AWS Clouds?

A.   AWS CLI
B.   AWS CloudFormation
C.   AWS CodeDeploy
D.   AWS Amplify

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 629
Where can a user receive help with deploying popular technologies based on AWS best practices, including architecture and deployment instructions?

A.   Amazon QuickSight
B.   AWS Artifact
C.   AWS Config
D.   AWS Quick Starts
Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 630
Which architecture concept describes the ability to deploy resources on demand and release resources when they are no longer needed?

A.   High availability
B.   Decoupled architecture
C.   Resilience
D.   Elasticity

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 631
When a user wants to utilize their existing per-socket per-core, or per-virtual machine software licenses for a Microsoft Windows server running on AWS, which
Amazon EC2 instance type is required?

A.   Spot Instances
B.   Dedicated instances
C.   Dedicated Hosts
D.   Reserved Instances

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 632
Service control policies (SCPs) manage permissions for which of the following?

A.   Availability Zones
B.   AWS Regions
C.   AWS Organizations
D.   Edge locations

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 633
Which architecture concept describes the ability to deploy resources on demand and release resources when they are no longer needed?

A.   High availability
B.   Decoupled architecture
C.   Resilience
D.   Elasticity

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 634
A company is looking for a way to encrypt data stored on Amazon S3. Which AWS managed service can be used to help to accomplish this?

A.   AWS Certifi ate Manager (ACM)
B.   AWS Secrets Manager
C.   AWS Resource Access Manager
D.   AWS Key Management Service (AWS KMS)

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 635
A user has an AWS account with a Business-level AWS Support plan and needs assistance with handling a production service disruption. Which action should the
user take?

A.   Contact the dedicated AWS technical account manage (TAM)
B.   Contact the dedicated AWS Concierge Support team
C.   Open a business-critical system down support case
D.   Open a production system down support case

Correct Answer: C
Explanation
Explanation/Reference:


QUESTION 636
Which of the following is a fully managed MySQL-compatible database?

A.   Amazon S3
B.   Amazon DynamoDB
C.   Amazon Redshift
D.   Amazon Aurora

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 637
A company would like to host i s MySQL databases on AWS and maintain full control over the operating system, database installation, and configuration.
Which AWS service should the company use to host the databases?

A.   Amazon RDS
B.   Amazon EC2
C.   Amazon DynamoDB
D.   Amazon Aurora

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 638
An AWS user wants to proactively detect when an Instance or account might be compromised or if there are threats from attacks. Which AWS service should the
user choose?

A.   Amazon GuardDuty
B.   AWSWAF
C.   AWS Shield
D.   Amazon Inspector

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 639
Which AWS service will track user activity on AWS?

A.   Amazon GuardDuty
B.   AWS Trusted Advisor
C.   AWS CloudTrail
D.   Amazon CloudWatch

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 640
What does the AWS Concierge Support team provide?

A.   A technical expert dedicated to the user
B.   A primary point of contact for AWS Billing and AWS Support
C.   A partner to help provide scaling guidance for an event launch
D.   A dedicated AWS staff member who reviews the user's application architecture

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 641
Which AWS service allows users to provision resources using a consistent and repeatable process?

A.   AWS Systems Manager
B.   AWS Cloud Formation
C.   AWS Batch
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:
QUESTION 642
What is the best resource for a user to find compliance-related information and reports about AWS?

A.   AWS Artifact
B.   AWS Marketplace
C.   Amazon Inspector
D.   AWS Support

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 643
What are characteristics of AWS IAM users and groups? (Select TWO.)

A.   Groups can be nested and can contain other groups.
B.   A user can be a member of multiple groups.
C.   Groups can contain users only and cannot be nested.
D.   A user can only be a member of a single group at n time.
E.   All new users are automatically added to a defaul g oup.

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 644
Which AWS tool gives users the ability to plan their service usage, service costs, and instance reservations, and also allows them to set custom alerts when their
costs or usage exceed established thresholds?

A.   Cost Explorer
B.   AWS Budgets
C.   AWS Cost and Usage Report
D.   Reserved Instance reporting

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 645
Which AWS service provides the ability to quickly run one-time queries on data in Amazon S3?

A.   Amazon EMR
B.   Amazon DynamoDB
C.   Amazon Redshift
D.   Amazon Athena

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 646
Which task requires the use of AWS account root account user credentials?

A.   Closing an AWS account
B.   Creating a log file
C.   Modifying IAM user permissions
D.   Deleting IAM users

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 647
Which of the following are benefits of running a database on Amazon RDS compared to an on- premises database? (Select TWO)

A.   RDS backups are managed by AWS
B.   RDS supports any relational database
C.   RDS has no database engine licensing costs
D.   RDS database compute capacity can be easily scaled
E.   RDS inbound traffic control (for example, security groups) is managed by AWS

Correct Answer: AB
Explanation

Explanation/Reference:
QUESTION 648
How can consolidated billing within AWS Organizations help lower overall monthly expenses?

A.   By providing a consolidated view of monthly billing across multiple accounts
B.   By pooling usage across multiple accounts to achieve a pricing tier discount
C.   By automating the creation of new accounts through APIs
D.   By leveraging service control policies (SCPs) tor centralized service management

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 649
A company needs to migrate an existing on-premises database to the AWS Cloud. The company must be able to install custom software on the database instance.
Which AWS service can the company use to meet these requirements?

A.   Amazon DynamoDB
B.   Amazon RDS
C.   Amazon EC2
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 650
Which AWS service can be used to run Amazon EC2 instances on-premises at a user site?

A.   AWS Snowball Edge
B.   Amazon CloudFront
C.   Lambda@Edge
D.   AWS Lambda

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 651
A company needs to perform a one-time migration of 40 TB of data from its on-premises storage servers to Amazon S3. The transfer must happen a quickly as
possible while keeping costs to a minimum. The company has 100 Mbps internet connectivity.
Which AWS service will meet these requirements?

A.   AWS Snowball
B.   AWS Direct Connect
C.   AWS Storage Gateway
D.   Amazon S3 Transfer Acceleration

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 652
A company wants to ensure that two Amazon EC2 instances are in separate data centers with minimal communication latency between the data centers. How can
the company meet this requirement?

A.   Place the EC2 instances in two separate AWS Regions connected with a VPC peering connection.
B.   Place the EC2 instances in two separate Availability Zones within the same AWS Region.
C.   Place one EC2 instance on premises and the other in an AWS Region Then connect them by using an AWS VPN connection.
D.   Place both EC2 instances in a placement group for dedicated bandwidth.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 653
Which AWS service or feature enables users to block the incoming or outgoing traffic associated with specific IP addresses flowing through a VPC?

A.   Network ACLs
B.   Security groups
C.   AWS Identity and Access Management (IAM)
D.   AWS WAF

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 654
Which of the following is a fully managed graph database service on AWS?

A.   Amazon Aurora
B.   Amazon FSx
C.   Amazon DynamoDB
D.   Amazon Neptune

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 655
A company wants to build a new architecture with AWS services. The company needs to compare service costs at various scales Which AWS service, tool, or
feature should the company use to meet the requirement?

A.   AWS Compute Optimizer
B.   AWS Pricing Calculator
C.   AWS Trusted Advisor
D.   Cost Explorer rightsizing recommendations

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 656
A company has performance and regulatory requirements that call for it to run its workload only in its on-premises data center Which AWS services or resources
should the company use? (Select TWO )

A.   Amazon Pinpoint
B.   Amazon WorkLin
C.   AWS Out costs
D.   AWS Snowball Edge
E.   AWS AppSync

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 657
A company needs to migrate its on-premises data to the AWS Cloud. The company requires elastic, highly optimized connectivity. Which AWS service meets
these requirements?

A.   Amazon S3 Glacier
B.   AWS Storage Gateway
C.   AWS Backup
D.   Amazon Elastic File System (Amazon EFS)

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 658
Which AWS service offers the LEAST expensive means of storing static images?

A.   Amazon S3
B.   Amazon DynamoDB
C.   AWS Snowball
D.   Amazon Elastic Block Store (Amazon EBS)

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 659
Which AWS services or features help decrease network latency for a globally dispersed user base? ( Select TWO.)

A.   Amazon VPC
B.   Elastic Load Balancer
C.   Amazon CloudFront
D.   AWS Direct Connect
E.   AWS Global Accelerator

Correct Answer: CE
Explanation

Explanation/Reference:
QUESTION 660
Which AWS service or feature allows a user to set up consolidated billing?

A.   AWS Billing Management Console
B.   AWS Organ ati ns
C.   AWS Cost and Usage Report
D.   AWS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 661
What is an IAM best practice for AWS account root user access keys?

A.   Delete all root user access keys, if possible.
B.   Use root user credentials to access sensitive information stored on AWS.
C.   Allow the system administrator group to use the root user credentials for daily access.
D.   Use root user credentials to access production database instances.

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 662
Which security practices are the customer's responsibility under the AWS shared responsibility model? (Select TWO.)

A.   Rotation of IAM access keys
B.   Patching of Amazon RDS instances
C.   Physical access to a data center
D.   Encryption of Amazon Elastic Block Store (Amazon EBS) volumes
E.   Decommissioning of storage devices

Correct Answer: CE
Explanation

Explanation/Reference:


QUESTION 663
Which AWS service or feature can be used to monitor for potential disk write spikes on a system running on Amazon EC2?

A.   AWS CloudTrail
B.   AWS Personal Health Dashboard
C.   AWS Trusted Advisor
D.   Amazon CloudWatch

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 664
Which of the following should be considered when performing a Total Cost of Ownership (TCO) analysis?

A.   Currency fluctuations
B.   Data center overhead
C.   Data security model
D.   Network port utilization

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 665
A company's procurement department wants volume discounts on AWS services for the company, but numerous departments have separate AWS accounts.
Which AWS service or tool can the company use to receive volume discounts across multiple AWS accounts?

A.   Cost Explorer
B.   AWS Budgets
C.   AWS Cost and Usage Report
D.   AWS Organizations

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 666
Which actions are the responsibility of AWS. According to the AWS shared responsibility model? (Select TWO.)
A.   Securing the virtualization layer
B.   Patching the operating system on Amazon EC2 instances
C.   Enforcing a strict password policy for IAM users
D.   Patching the operating system on Amazon RDS instances
E.   Configuring security groups and network ACLs

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 667
A user needs a relational database but does not have the resources to manage the hardware, resiliency, and replication. Which AWS service option meets the
user's requirements?

A.   Run MySQL on Amazon Elastic Container Service (Amazon ECS).
B.   Run MySQL on Amazon EC2.
C.   Choose Amazon RDS for MySQL.
D.   Choose Amazon ElastiCache for Redis.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 668
How can AWS enable a company to control expenses as an application's usage changes unpredictably?

A.   AWS w ll refund the cost difference if a customer moves to larger servers.
B.   The application can be built to scale up or down automatically as resources are needed
C.   Spot instances will automatically be used if the price is lower than on-demand instances.
D.   Amazon CloudWatch will automatically predict what resources are needed.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 669
Which aspect of AWS infrastructure enables global deployment of compute and storage?

A.   Availability Zones
B.   Regions
C.   Tags
D.   Resource groups

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 670
Which Amazon EC2 pricing model provides the MOST cost savings for an always-up, right-sized database server running for a project that will last 1 year?

A.   On-Demand Instances
B.   Convertible Reserved Instances
C.   Spot Instances
D.   Standard Reserved Instances

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 671
Which AWS service or feature natively provides an encrypted connection that can be used to move data from on premises infrastructure to the AWS Cloud?

A.   AWS Direct Connect
B.   VPC endpoint
C.   AWS VPN
D.   AWS PrivateLink

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 672
According to the AWS shared responsibility model, which task is the customer's responsibility?

A. Maintaining the infrastructure needed to run AWS Lambda
B. Updating the operating system of Amazon DynamoDB instances
C. Maintaining Amazon S3 infrastructure
D. Updating the guest operating system on Amazon EC2 instances

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 673
Which AWS service or tool simplifies the creation, maintenance, validation, sharing and deployment of Linux or Windows Server templates for use with Amazon
EC2 and on premises VMs?

A.   AWS CodePipeline
B.   Amazon EC2 Image Builder
C.   AWS CloudFormation
D.   Amazon EC2 Amazon Machine Image (AMI)

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 674
Which AWS service uses a combination of publishers and subscribers?

A.   AWS Lambda
B.   Amazon Simple Notification Service (Amazon SNS)
C.   Amazon CloudWatch
D.   AWS CloudFormation

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 675
A company needs to improve the response rate of high-volume queries to its relational database Which AWS service should the company use to offload requests
to the database and improve overall response time ?

A.   Amazon DynamoDB Accelerator (DAX)
B.   Amazon ElastiCache
C.   Elastic Load Balancing
D.   AWS Global Accelerator

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 676
Which AWS service facilitates transporting 50 GB of data from an on-premises data center to an Amazon S3 bucket without using a network connection?

A.   AWS Snowball
B.   AWS CodeDeploy
C.   AWS Backup
D.   AWS Direct Connect

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 677
A user wants to transport data between AWS and an on-premises environment using a private network connection. Which AWS service or feature can be used to
meet these requirements?

A.   NAT gateway
B.   AWS Direct Connect
C.   Amazon VPC
D.   Internet gateway

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 678
According to the AWS shared responsibility model, the customer is responsible for maintaining:

A. physical access to the AWS network.
B. the patching of the host operating system.
C. data encryption in Amazon S3.
D. the operating system for Amazon DynamoDB

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 679
Which AWS service is designed to help users who want to use machine learning for natural language processing (NLP) but do not have experience in machine
learning?

A.   Amazon Comprehend
B.   Amazon SageMaker
C.   AWS Deep Learning AMIs (DLAMI
D.   Amazon Rekognition

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 680
What is one of the core principles to follow when designing a highly available application in the AWS Cloud?

A.   Design using a serverless architecture.
B.   Assume that all components within an application can fail.
C.   Design AWS Auto Scaling into every application.
D.   Design all components using open-source code

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 681
A user needs to determine whether an Amazon EC2 instance's security groups were modified in the last month. How can the user see if a change was made?

A.   Use Amazon EC2 to see if the security group was changed.
B.   Use AWS Identity and Access Management (IAM) to see which user or role changed the security group.
C.   Use AWS CloudTrail to see if the security group was changed.
D.   Use Amazon CloudWatch to see if the security group was changed.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 682
A company is building distributed, loosely coupled applications. The company needs to publish messages from applications and immediately.
Which AWS service can the company use to meet these requirements?

A.   Amazon Simple Queue Service (Amazon SQS)
B.   Amazon Simple Notification Service (Amazon SNS)
C.   Amazon S3
D.   Amazon Simple Email Service (Amazon SES)

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 683
What is an IAM best practice for AWS account root user access keys?

A.   Delete all root user access keys, if possible.
B.   Use root user credentials to access sensitive information stored on AWS.
C.   Allow the system administrator group to use the root user credentials for daily access.
D.   Use root user credentials to access production database instances.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 684
An administrator observed that multiple AWS resources were deleted yesterday. Which AWS service will help identify the cause and determine which user deleted
the resources?

A.   AWS CloudTrail
B.   Amazon Inspector
C.   Amazon GuardDuty
D.   AWS Trusted Advisor
Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 685
What is the recommended method to request penetration testing on AWS resources?

A.   Open a support case.
B.   Fill out the Penetration Testing Request Form
C.   Request a penetration test from your technical account manager.
D.   Contact your AWS sales representative.

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 686
A company wants to connect to AWS over a private low-latency connection from its remote office. What is the recommended method to meet these requirements'?

A.   Create a VPN tunnel
B.   Connect acr ss the public internet
C.   Use VPC peering to create a connection
D.   Use AWS Direct Connect

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 687
What are the benefits of consolidated billing for AWS Cloud services? (Select TWO.)

A.   Volume discounts
B.   A minimal additional tee for use
C.   One bill tor multiple accounts
D.   Installment payment options
E.   Custom cost usage and budget creation

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 688
An online retail company has seasonal sales spikes several times a year, primarily around holidays Demand is lower at other times. The company finds it difficult
to predict the increasing infrastructure demand for each season.
Which advantages of moving to the AWS Cloud would MOST benefit the company? (Select TWO )

A.   Global footprint
B.   Elasticity
C.   AWS service quotas
D.   AWS shared responsibility model
E.   Pay-as-you-go pricing

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 689
Which AWS service or tool should a company use to centrally request and track service limit increases?

A.   AWS Config
B.   Service Quotas
C.   AWS Service Catalog
D.   AWS Budgets

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 690
Which AWS services after compute capabilities? (Select TWO.)

A.   Amazon EC2
B.   Amazon S3
C.   Amazon Elastic Block Store (Amazon EBS)
D.   Amazon Cognito
E.   AWS lambda
Correct Answer: AE
Explanation

Explanation/Reference:


QUESTION 691
A retail company has recently migrated its website to AWS. The company wants to ensure that it is protected from SQL injection attacks. The website uses an
Application Load Balancer to distribute traffic to multiple Amazon EC2 instances
Which AWS service or feature can be used to create a custom rule that blocks SQL injection attacks?

A.   Security groups
B.   AWS WAF
C.   Network ACLs
D.   AWS Shield

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 692
A company learns that a user's API key has been exposed in a public code repository. The user has access to sensitive data.
What is the FIRST step the compa y should take to ensure the security of its data?

A.   Email the user to inform them of their mistake
B.   Create a new API key for the user in AWS Identify and Access Management (IAM).
C.   Review the API activity of the key in AWS CloudTrail.
D.   Deactivate the user s API key in AWS Identity and Access Management (IAM)

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 693
Which AWS service provides the capability to view end-to-end performance metrics and troubleshoot distributed applications?

A.   AWSCIoud9
B.   AWS CodeStar
C.   AWS Cloud Map
D.   AWSX-Ray

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 694
AnyCompany recently purchased Example Corp Both companies use AWS resources, and AnyCompany wants a single aggregated bill Which option allows
AnyCompany to receive a single bill?

A.   Example Corp. must submit a request to its AWS solutions architect or AWS technical account manager to link the accounts and consolidate billing
B.   AnyCompany must create a new support case in the AWS Support Center requesting that both bills be combined
C.   Send an invitation to join the organization from AnyCompany's AWS Organizations master account to Example Corp
D.   Migrate the Example Corp VPCs, Amazon EC2 instances, and other re ources into the AnyCompany AWS account

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 695
Which AWS service can be used to turn text into lite-like speech?

A.   Amazon Polly
B.   Amazon Transcribe
C.   Amazon Rekognition
D.   Amazon Lex

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 696
A user is building a simple online calculator and wants to use AWS compute as cost-effectively as possible. The calculator must be hig ly available for even a small
number of users.
Where should the code for calculations be hosted?

A. On an Amazon EC2 Memory Optimized Reserved Instance
B. On an Amazon EC2 Compute Optimized Reserved Instance
C. On an Amazon EC2 Compute Optimized Spot Instance
D. In an AWS Lambda function

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 697
A company needs to perform data processing once a week that typically lakes about 5 hours to complete. Which AWS service should the company use for this
workload?

A.   AWS Lambda
B.   Amazon EC2
C.   AWS CodeDeploy
D.   AWS Wavelength

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 698
A company has a compliance requirement to encrypt data in transit and at rest. The company is serving the content through Amazon EC2 instances behind an
Elastic Load Balancer and is storing data in Amazon Elastic Block Store (Amazon EBS) volumes Which combination of AWS services should the company use to
stay compliant with this requirement? (Select TWO )

A.   Amazon GuardDuty
B.   AWS Shield
C.   AWS Certificate Manager (ACM)
D.   AWS Secrets Manager
E.   AWS Key Management Service (AWS KMS)

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 699
Which AWS service can help a company detect an outage of its website servers and redirect users to alternate servers?

A.   Amazon CloudFront
B.   Amazon GuardDuty
C.   Amazon Route 53
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 700
Which of the following Amazon EC2 pricing models allows customers to use existing server-bound software licenses?

A.   Spot instances
B.   Reserved instances
C.   Dedicated Hosts
D.   On-Demand Instances

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 701
A company needs a storage solution that:

-    Is low-cost.
-    Is for infrequently accessed data.
-    Quickly accesses data when required.
-    Does not require data lo be resilient

Which Amazon S3 storage option should the company use?

A.   S3 Standard-Infrequent Access (S3 Standard-IA)
B.   S3 Standard
C.   S3 One Zone-Infrequent Access (S3 One Zone IA)
D.   S3 Glacier

Correct Answer: A
Explanation

Explanation/Reference:
QUESTION 702
Which AWS services can be used to set up NoSQL databases? (Select TWO.)

A.   Amazon Redshilt
B.   Amazon Aurora
C.   Amazon DynamoDB
D.   Amazon S3
E.   Amazon DocumentDB (with MongoDB compalibility)

Correct Answer: CE
Explanation

Explanation/Reference:


QUESTION 703
Which tool can be used to identity scheduled changes to the AWS infrastructure?

A.   AWS Personal Health Dashboard
B.   AWS Trusted Advisor
C.   Billing Dashboard
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 704
A company is requesting Payment Card Industry (PCI) reports that validate the operating effectiveness of AWS security controls.
How should the company obtain these reports?

A.   Contact AWS Support.
B.   Download reports from AWS Artifact.
C.   Download reports from AWS Security Hub
D.   Contact an AWS technical account manager (TAM)

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 705
Which AWS service provides business analytics that enable users to create and publish interactive dashboards?

A.   Amazon Kinesis
B.   Amazon CloudWatch
C.   AWS X Ray
D.   Amazon QuickSight

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 706
Which AWS service acts as a data extract transform and load (ETL) tool to make it easy to prepare data for analytics?

A.   Amazon QuickSight
B.   Amazon Athena
C.   AWS Glue
D.   AWS Elastic Beanstalk

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 707
Which AWS service does AWS snow does AWS snowball Edge natively support?

A.   AWS Server Migration Service (AWS SMS)
B.   Amazon Aurora
C.   AWS Trusted Advisor
D.   Amazon EC2

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 708
To avoid malicious compute activities, a user needs a quick way to determine if any Amazon EC2 instances have ports that allow Unrestricted access.
Which AWS service will support this requirement?
A.   VPC Flow Logs
B.   AWS WAI
C.   AWS CloudTrai
D.   AWS Trus ed Advisor

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 709
AWS trusted advisor can monitor and provide advice on what characteristics of an AWS account?

A.   Compliance with security best practices
B.   Application performance
C.   Network utilization
D.   Cost optimization
E.   Compliance status

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 710
Which AWS service will allow a user to set custom cost and usage limits, and will alert when the thresholds are exceeded?

A.   AWS Organizations
B.   AWS Budgets
C.   Cost Explorer
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 711
A company previously lost data that was stored in an on-premises data center. To protect against future of data, the company wants to use AWS to automatically
launch thousands of its machines in a fully provisioned state in minutes, in a format that supports data restoration. Which AWS service should the company use to
meet these requirements?

A.   AWS Direct Connect
B.   AWS Storage Gateway
C.   Cloud Disaster Recovery
D.   AWS Backup

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 712
Which tasks require using AWS account root user credentials? (Select TWO.)

A.   Creating an Amazon EC2 key pair
B.   Removing an IAM user from the administrators group
C.   Changing the AWS Support plan
D.   Creating an Amazon CloudFront key pair
E.   Granting an IAM user full administrative

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 713
If a user has an AWS account with an enterprise level AWS support plan, who is the primary point of contact for billing or account inquiries?

A.   Solutions architect
B.   AWS Concierge Support team
C.   An AWS Marketplace seller
D.   AWS Partner Network (APN) partner

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 714
A company has existing software licenses that it wants bring to AWS, but the licensing model requires licensing physical cores.
How can the company meet this requirement in the AWS cloud?

A.   Launch an Amazon EC2 instance with default tenancy
B.   Launch an Amazon EC2 instance on a Dedicated Host
C.   Create an On-Demand Capacity Reservation
D.   Purchase Dedicated Reserved Instances

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 715
When using Amazon RDS what is the customer responsible for?

A.   Patching and maintenance of the underlying operating system
B.   Managing automatic backups of the database
C.   Controlling network access through security groups
D.   Replacing failed instances in the event of a hardware failure

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 716
Which AWS services offer compute capabilities?

A.   Amazon FC2
B.   Amazon S3
C.   Amazon Elastic Block Store (Amazon EBS)
D.   Amazon Cognito
E.   AWS Lambda

Correct Answer: AE
Explanation

Explanation/Reference:


QUESTION 717
A company wants an in-memory data store that is compatible with open source in the cloud Which AWS service should the company use?

A.   Amazon DynamoDB
B.   Amazon ElastiCache
C.   Amazon Elastic Block Store (Amazon EBS)
D.   Amazon Redshift

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 718
When comparing AWS cloud with premises total cost of ownership which expenses must be considered?

A.   Physical storage hardware
B.   Operating system administration
C.   Network infrastructure of data center
D.   Project management
E.   Database schema development

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 719
A company is required lo store its data close to its primary users. Which benefit of the AWS Cloud supports this requirement?

A.   Security
B.   High availability
C.   Elasticity
D.   Global footprint

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 720
A company has a globally distributed user base. The company needs its application to be highly available and have low latency for end users.
Which AWS architectural approach will most effectively support these requirements?
A.   Single-Region, Multi-AZ architecture
B.   Multi-Region, active-active architecture
C.   Multi-Region, active-password architecture
D.   Sign-Region, Single-AZ architecture

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 721
Which encryption types can be used to protect objects at rest amazon S3?

A.   Server side encryption with S3 managed encryption keys (SSE-S3)
B.   Server side encryption with AWS KMS managed encryption keys (SSE KMS)
C.   TLS
D.   SSL
E.   Transparent Data Encryption (TDE)

Correct Answer: AB
Explanation

Explanation/Reference:


QUESTION 722
According to the AWS shared responsibility model, when using amazon RDS who is responsible for scheduling and performing backups?

A.   AWS is responsible f r both tasks
B.   The customer is responsible for scheduling and AWS is responsible for performing backups
C.   The customer is responsible for both tasks
D.   AWS is esponsible for scheduling and the user is responsible lot performing backups

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 723
Which of the following are AWS compute services? (Select TWO.)

A.   Amazon Lightsail
B.   AWS Systems Manager
C.   AWS CloudFormation
D.   AWS Batch
E.   Amazon Inspector

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 724
A company with an AWS Business Support plan wants to identify Amazon EC2 Reserved that are scheduled to expire.
Which AWS service or feature can the company use to accomplish this goal?

A.   AWS Personal Health Dashboard
B.   Elastic Load Balancing health checks
C.   AWS Trusted Advisor
D.   EC2 instance status checks

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 725
Which pricing model will interrupt a running amazon EC2 instance if capacity becomes temporarily unavailable?

A.   on-Demand Instances
B.   Standard Reserved Instances
C.   Spot Instances
D.   Convertible Reserved Instances

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 726
A company uses Amazon DynamoDB in its AWS Cloud architecture. According to the AWS shared responsibility model, which of the following are responsibilities
of the company? (Select TWO )
A.   Operating system patching and upgrades
B.   Application of appropriate permissions with IAM tools
C.   Configuration of data encryption options
D.   Creation of DynamoDB endpoints
E.   Infrastructure provisioning and maintenance

Correct Answer: AB
Explanation

Explanation/Reference:


QUESTION 727
Which type of AWS infrastructure deployment puts AWS compute, storage database, and other select services closer to end users to run latency-sensitive
applications?

A.   AWS Regions
B.   Availability Zones
C.   Local Zones
D.   Edge locations

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 728
Which AWS service uses a combination of publishers and subscribers?

A.   AWS Lambda
B.   Amazon Simple Notification Service (Amazon SNS)
C.   Amazon CloudWatch
D.   AWS CloudFormation

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 729
A cloud practitioner needs an effective method to decrease application latency and increase performance for end users
Which services will help?

A.   Amazon Elastic Container Service (Amazon ECS) for Kubernetes
B.   Amazon S3
C.   Amazon AppStream 2.0
D.   Amazon ElasliCache
E.   Amazon CtoudFront

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 730
Which AWS service allows customers to purchase unused amazon EC2 capacity at an often discounted rate ?

A.   Reserved Instances
B.   On Demand Instances
C.   Dedicated Instances
D.   Spot Instances

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 731
Which of the following are benefits of the AWS business support plan?

A.   Dedicated AWS technical account manager (TAM)
B.   Response time of less than 15 minutes for business critical cases
C.   Phone, email and chat support 24 hours a day 7 days a week
D.   Full set of AWS trusted Advisor best practice checks
E.   Well-Architected reviews

Correct Answer: CD
Explanation

Explanation/Reference:


QUESTION 732
A customer is deploying a now serverless application running on AWS Lambda. Which of the following are the customer's responsibilities under the AWS shared
responsibility model? (Select TWO )

A.   Application management
B.   Platform management
C.   Application identity and access
D.   Storage infrastructure
E.   AWS global infrastructure

Correct Answer: AC
Explanation

Explanation/Reference:


QUESTION 733
A company uses Amazon EC2 infrastructure to host steady-state workloads and needs to achieve significant cost savings.
Which EC2 instance pricing model should the company select?

A.   Reserved Instances
B.   On Demand Instances
C.   Spot Instances
D.   Dedicated Hosts

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 734
Which design principles are enabled by the AWS cloud to improve the operation of workloads?

A.   Minimize upfront design
B.   Loose coupling
C.   Disposable resources
D.   Server design and concurrency
E.   Minimal viable product

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 735
A user an optimize Amazon EC2 costs by performing which of the following tasks? (Select TWO )

A.   Implementing Auto Scaling group, to add and remove instances based on demand
B.   Creating a policy to restrict IAM users from creating new instances
C.   Setting a budget to limit spending on EC2 instances using AWS Budgets
D.   Purchasing Reserved Instances
E.   Adding EC2 instances to a second AWS Region that is geographically close to the end users

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 736
Which AWS service would identify if unrestricted access to a resource has been allowed by a security group?

A.   AWS Trusted Advisor
B.   Amazon CloudWatch
C.   VPC Flow Logs
D.   AWS CloudTrail

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 737
Which pillar of the AWS well-architected framework refers to the ability of a system to recover from infrastructure or service disruptions and dynamically acquire
computing resources to meet demand?

A.   Security
B.   Reliability
C.   Performance efficiency
D.   Cost optimization

Correct Answer: B
Explanation

Explanation/Reference:
QUESTION 738
Which of the following can be used to identify a specific user who stopped an amazon EC2 instance?

A.   AWS CloudTrail
B.   Amazon Inspector
C.   Amazon CloudWatch
D.   VPC Flow Logs

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 739
Which security-related task is the responsibility of the customer in the AWS cloud?

A.   Securing infrastructure at data centers
B.   Maintaining firewall configurations at a hardware level
C.   Maintaining networking among hardware components
D.   Maintaining server side encryption

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 740
Which amazon S3 storage class allows users to store data backups for long periods of time at the LOWEST cost?

A.   S3 Standard -infrequent Access (S3 Standard IA)
B.   S3 Standard
C.   S3 Glacier
D.   S3 One Zone Infrequent Access (S3 One Zone IA)

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 741
A company is building a business intelligence solution and wants to use dashboards for reporting purposes.
Which AWS service can be used?

A.   Amazon Redshift
B.   Amazon Elasticsearc Service (Amazon ES)
C.   Amazon QuicKSight
D.   Amazon A thena

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 742
A company needs to transfer a large volume of data from an on-premises data center to the AWS Cloud. The company's internet connectivity is slow and
unreliable. Which AWS service can facilitate this data transfer?

A.   Amazon S3 Glacier
B.   AW5 Snowball
C.   AWS Storage Gateway
D.   Amazon Elastic File System (Amazon EFS)

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 743
Which of the following technologies provides a secure network connection from on-premises to AWS?

A.   Virtual Private Network
B.   AWS Snowball
C.   Amazon Virtual Private Cloud (Amazon VPC)
D.   AWS Mobile Hub

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 744
Which AWS service or component allows inbound traffic from the internet to access a VPC?
A.   Internet gateway
B.   NAT gateway
C.   AWS WAF
D.   VPC peering

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 745
The AWS cost management tools give users the ability to do which of the following?

A.   Terminate all AWS resources automatically if budget thresholds are exceeded.
B.   Break down AWS costs by day, service, and linked AWS account
C.   Create budgets and receive notifications if current or forecasted usage exceeds the budgets.
D.   Switch automatically to Reserved Instances or Spot Instances, whichever is most cost-effective
E.   Move data stored in Amazon S3 to a more cost-effective storage class.

Correct Answer: BC
Explanation

Explanation/Reference:


QUESTION 746
A company has a managed IAM policy that does not grant the necessary permission for users to accomplish required tasks
How can this be resolved?

A.   Enable AWS Shield Advanced
B.   Create a custom IAM policy
C.   Use a third party web application firewall (WAF) managed rule from the AWS Marketplace
D.   Use AWS Key Management Service (AWS KMS) to create a customer managed key

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 747
What are the market advantages of running workloads in the AWS cloud?

A.   Less staff time is required to deploy new workloads
B.   Increased time to market for new application features
C.   Higher acquisition costs to support peak workloads
D.   Increased productivity for application development teams
E.   A decrease in the average server CPU utilization

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 748
Which factor will have the MOST effect on cost?

A.   The selection of S3 storage tiers
B.   Charges to transfer existing data into Amazon S3
C.   The addition of S3 bucket policies
D.   S3 ingest fees for each request

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 749
To optimize costs and resource usage, a company needs to monitor the operations health of its entire system of AWS Cloud resources.
Which AWS service will meet these requirements?

A.   AWS Organizations
B.   Amazon CloudWatch
C.   AWS CloudTrail
D.   AWS Config

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 750
Which cloud computing advantage is a company applying when it users in different countries ?
A.   Pay-as-you go pricing
B.   Capacity forecasting
C.   Economies of scale
D.   Global reach

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 751
AWS trusted advisor provides recommendations on which of the following?

A.   Cost optimization
B.   Auditing
C.   Serverless architecture
D.   Performance
E.   Scalability

Correct Answer: AD
Explanation

Explanation/Reference:


QUESTION 752
Which of the following is an AWS value proportion that describes a user's ability to scale infrastructure based on demand?

A.   Speed of innovation
B.   Resource elasticity
C.   Decoupled architecture
D.   Global deployment

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 753
An application that runs on Amazon EC2 needs to accommodate a flexible workload that can run or terminate at any time of day. Which pricing model will
accommodate these requirements at the LOWEST cost?

A.   Spot Instances
B.   Reserved Instances
C.   On-Demand Instances
D.   Dedicated Host

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 754
A company wants to implement an automated security assessment of the scanty and network accessibility of its Amazon EC2 instances. Which AWS service can
be used To accomplish this?

A.   Amazon Inspector
B.   AWSConfig
C.   AWS Trusted Advisor
D.   Amazon GuardDuty

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 755
A security engineer wants a single-tenant AWS solution to create, control, and manage their own cryptographic keys to meet regulatory compliance requirements
for data security. Which AWS service should the engineer use?

A.   AWS Key Management Service (AWS KMS)
B.   AWS Certificate Manager (ACM)
C.   AWS CloudHSM
D.   AWS Systems Manager

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 756
Which AWS service does AWS Snowball Edge natively support?
A.   AWS Server Migration Service (AWS SMS)
B.   Amazon Aurora
C.   AWS Trusted Advisor
D.   Amazon EC2

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 757
Which AWS service provides a report that enables users to assess AWS infrastructure compliance?

A.   AWS Certificate Manager (ACM)
B.   Amazon DocumentDB (with MongoDB compatibility)
C.   AWS Artifact
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 758
A solutions architect needs to maintain a fleet of Amazon EC2 instances so that any Impaired instances are replaced with new ones. Which AWS service should
the solutions architect use?

A.   Amazon Elastic Container Service (Amazon ECS)
B.   Amazon GuardDuty
C.   AWS Shield
D.   AWS Auto Scaling

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 759
What does Amazon CloudFront provide?

A.   Automatic scaling for all resources to power an application from a single unified interface
B.   Secure delivery of data, videos application. and APIs to users globally with low latency
C.   Ability to directly manage traffic globally through a variety of routing types, including latency- based routing, geo ONS. Geoproximity, and weighted round robin
D.   Automatic distribution of incoming application traffic across multiple targets, such as Amazon EC2 instances, containers. IP addresses, and AWS Lambda
     functions

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 760
A company uses Amazon EC2 Instances in its AWS account tor several different workloads. The company needs to perform an analysis to understand the cost of
each. workload. What is the MOST operationally efficient way to meet this requirement?

A.   Move the EC2 instances for each workload into separate AWS accounts.
B.   Use a different EC2 instance family for each of the workloads.
C.   Add cost allocation tags to each EC2 instance, and activate the tags
D.   Update the workload applications to publish usage data to a cost allocation database.

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 761
A company wants to use an AWS service to continuously monitor the health of its application endpoints based on proximity to application users. The company also
needs to route traffic to healthy Regional endpoints and to improve application availability and performance.
Which service will meet these requirements?

A.   Amazon Inspector
B.   Amazon CloudWatch
C.   AWS Global Accelerator
D.   AWS Cloud Formation

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 762
Which guideline is a well-architected design principle for building cloud applications?
A.   Keep static data closer to compute resources.
B.   Provision resources for peak capacity.
C.   Design for automated recovery from failure.
D.   Use tightly coupled components

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 763
AWS services offer gateway VPC endpoints that can be used to avoid sending traffic over the internet? (Select TWO )

A.   Amazon Simple Notification Service (Amazon SNS)
B.   Amazon Simple Queue Service (Amazon SQS)
C.   AWS CodeBuild
D.   Amazon S3
E.   Amazon DynamoDB

Correct Answer: DE
Explanation


QUESTION 764
Which AWS Cloud deployment model uses AWS Outposts as part of the application deployment infrastructure?

A.   On-premises
B.   Serverless
C.   Cloud-native
D.   Hybrid

Correct Answer: D
Explanation


QUESTION 765
Which are benefits of using Amazon RDS over Amazon EC2 when running relational databases on AWS? (Select TWO )

A.   Automated backups
B.   Schema management
C.   Indexing of tables
D.   Software patching
E.   Extract, transform, and load (ETL) management

Correct Answer: AD
Explanation


QUESTION 766
A company wants to allow full access to an Amazon S3 bucket for a particular user.
Which element in the S3 bucket policy holds the user details that describe who needs access to the S3 bucket?

A.   Principal
B.   Action
C.   Resource
D.   Statement

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 767
Which AWS service should a company use to provision, manage, and deploy SSL/TLS certificates?

A.   AWS Secrets Manager
B.   Amazon Inspector
C.   AWS CodeDeploy
D.   AWS Certificate Manager (ACM)

Correct Answer: D
Explanation


QUESTION 768
A company wants to enhance security by launching a third-party ISP intrusion detection system from its AWS account.
Which AWS service or resource should the company use to meet this requirement?

A.   AWS Security Hub
B.   AWS Marketplace
C.   AWS Quick Starts
D.   AWS Security Center

Correct Answer: D
Explanation
Explanation/Reference:


QUESTION 769
Which of the following are benefits of using the AWS Cloud? (Select TWO )

A.   100% fault tolerance
B.   Total control over underlying infrastructure
C.   Fast provisioning of IT resources
D.   Outsourcing all application coding to AWS
E.   Ability to go global quickly

Correct Answer: AB
Explanation


QUESTION 770
Which AWS service requires the customer to patch the guest operating system?

A.   AWS Lambda
B.   Amazon Elasticsearch Service (Amazon ES)
C.   Amazon EC2
D.   Amazon ElastiCache

Correct Answer: C
Explanation


QUESTION 771
Which actions allow a company's security team to improve the security procedures for employees accessing AWS resources? (Select TWO )

A.   Create IAM users for groups of employees to share
B.   Create IAM policies based on least privilege principles
C.   Create IAM users in different Availability Zones
D.   Enable multi-factor authentication for privileged users
E.   Specify an individual IAM user for each Amazon EC2 instance

Correct Answer: BD
Explanation


QUESTION 772
A company is deploying a machine learning (ML) research project that will require a lot of compute power over several months.
The ML processing jobs do not need to run at specific times.
Which Amazon EC2 instance purchasing option will meet these requirements at the lowest cost?

A.   On-Demand Instances
B.   Spot Instances
C.   Reserved Instances
D.   Dedicated Instances

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 773
What does the AWS Cloud provide to increase the speed and agility of execution for customers? (Select TWO.)

A.   Readily available resources with low provisioning times
B.   Scalable compute capacity
C.   Free Tier services usage
D.   Access to AWS data centers
E.   Lower resource provisioning cost

Correct Answer: AB
Explanation


QUESTION 774
A batch workload takes 5 hours to finish on an Amazon EC2 instance. The amount of data to be processed doubles monthly and the processing time is
proportional.
What is the best cloud architecture to address this consistently growing demand?

A.   Run the application on a bigger EC2 instance size.
B.   Switch to an EC2 instance family that better matches batch requirements
C.   Distribute the application across multiple EC2 instances and run the workload in parallel.
D.   Run the application on a bare metal EC2 instance.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 775
How can users protect against distributed denial of service (DDoS) attacks in the AWS Cloud?

A.   Use Amazon CloudWatch monitoring.
B.   Configure a firewall.
C.   Use Amazon Redshift
D.   Monitor AWS CloudTrail logging

Correct Answer: B
Explanation


QUESTION 776
Which AWS service or feature gives end users the ability to access AWS resources from any location by using an encrypted connection?

A.   Amazon CloudFront
B.   AWS Client VPN
C.   AWS Direct Connect
D.   AWS PrivateLink

Correct Answer: A
Explanation


QUESTION 777
Which AWS service provides recommendations for rightsizing AWS resources such as Amazon EC2 instances, Amazon Elastic Block Store (Amazon EBS)
volumes and Amazon RDS databases to help users reduce costs?

A.   Amazon Inspector
B.   AWS Trusted Advisor
C.   AWS Service Health Dashboard
D.   Amazon Forecast

Correct Answer: C
Explanation


QUESTION 778
A company has an AWS environment that consists of a VPC. multiple subnets, and many Amazon EC2 instances in the subnets.
An engineer wants to restrict inbound traffic to one particular EC2 instance without affecting the other EC2 instances.
Which AWS service or feature should the engineer use to meet this requirement?

A.   Network ACLs
B.   Security groups
C.   Amazon GuardDuty
D.   AWS Shield

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 779
Which tasks require the use of the AWS account root user? (Select TWO )

A.   Launching a new Amazon EC2 instance
B.   Viewing AWS CloudTrail logs
C.   Contacting AWS Support
D.   Changing AWS Support plans
E.   Changing billing currency

Correct Answer: BE
Explanation


QUESTION 780
Which AWS service enables users to identify the changes made to a resource over time?

A.   AWS CloudFormation
B.   AWSConfig
C.   AWS Service Catalog
D.   AWS Identity and Access Management (IAM)

Correct Answer: A
Explanation


QUESTION 781
A company has a MySQL database running on a single Amazon EC2 instance.
The company now requires higher availability in the event of an outage.
Which set of tasks would meet this requirement?

A.   Add an Application Load Balancer in front of the EC2 instance
B.   Configure EC2 Auto Recovery to move the instance to another Availability Zone.
C.   Migrate to Amazon RDS and enable Multi-AZ.
D.   Enable termination protection for the EC2 instance to avoid outages.

Correct Answer: C
Explanation

Explanation/Reference:


QUESTION 782
Which of the following are security best practices for using AWS Identity and Access Management (IAM)? (Select TWO)

A.   Use AWS account root user credentials for IAM tasks
B.   Rotate credentials regularly
C.   Do not remove credentials, even if they are never used
D.   Enable multi-factor authentication (MFA)
E.   Use inline policies instead of customer managed policies

Correct Answer: AB
Explanation


QUESTION 783
A user is building an application on AWS that requires a backend database.
The application requires access to the operating system of the instance where the database is installed in order to run scripts.
Where should the database be hosted if the user's goal is to create minimum management overhead?

A.   On Amazon RDS
B.   On Amazon EC2
C.   On Amazon DynamoDB
D.   On Amazon S3

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 784
Which feature of AWS Auto Scaling will forecast future traffic to schedule changes in the number of Amazon EC2 instances at the appropriate times?

A.   Scheduled scaling
B.   Predictive scaling
C.   Target tracking scaling
D.   Step scaling

Correct Answer: A
Explanation


QUESTION 785
A company wants to build an application for a new line of business.
According to the AWS Well-Architected Framework, what design principles should be implemented? (Select TWO.)

A.   Consolidate multiple AWS accounts into a single account
B.   Buy and host hardware in the AWS Cloud.
C.   Decouple the AWS Cloud architecture to break up monolithic deployments.
D.   Move on-premises network hardware to VPCs.
E.   Design elasticity into the AWS Cloud design

Correct Answer: CE
Explanation

Explanation/Reference:


QUESTION 786
Which AWS Trusted Advisor check includes the verification of AWS CloudTrail logging?

A.   Performance
B.   Fault tolerance
C.   Security
D.   Service limits

Correct Answer: A
Explanation


QUESTION 787
Which design principles of the AWS Well-Architected Framework help increase reliability? (Select TWO.)

A.   Automatically recover from failure
B.   Enable traceability.
C.   Scale horizontally to increase workload availability.
D.   Automate security best practices
E.   Keep people away from data

Correct Answer: AC
Explanation


QUESTION 788
A company believes an unauthorized user copied data from an Amazon S3 bucket to their own account.

Which AWS service will record the actions taken by the user?

A.   Amazon CloudWatch
B.   AWS CloudTrail
C.   AWS Infrastructure Event Management
D.   AWS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html

QUESTION 789
Which AWS service provides a simple way to set up a new multi-account AWS environment and govern it at scale?

A.   AWS Trusted Advisor
B.   AWS Security Hub
C.   AWS Control Tower
D.   AWS Resource Access Manager

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2020/04/you-can-now-use-aws-control-tower-to-set-up-new-multi-account-aws-environments-in-aws-organizations/

QUESTION 790
How does the AWS global infrastructure offer high availability and fault tolerance to its users?

A. The AWS infrastructure is made up of multiple AWS Regions within various Availability Zones located in areas that have low flood risk, and are interconnected
   with low-latency networks and redundant power supplies.
B. The AWS infrastructure consists of subnets containing various Availability Zones with multiple data centers located in the same geographic location.
C. AWS allows users to choose AWS Regions and data centers so that users can select the closest data centers in different Regions.
D. The AWS infrastructure consists of isolated AWS Regions with independent Availability Zones that are connected with low-latency networking and redundant
   power supplies.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/global-infrastructure.html

QUESTION 791
How can moving to the AWS Cloud help users reduce the time dedicated to operating system patching? (Choose two.)

A.   Users can take advantage of managed services on AWS.
B.   Users can outsource operating system patching to the AWS Support team.
C.   AWS Professional Services will upgrade instances to the latest operating system versions.
D.   Users have the ability to use license-included Amazon EC2 instances.
E.   Users can take advantage of AWS Systems Manager features.

Correct Answer: AE
Explanation


QUESTION 792
A user has an AWS Business Support plan and requires detailed billing information.

Which AWS resource will help?

A.   AWS Concierge Support
B.   AWS Service Catalog
C.   AWS Budgets
D.   AWS Cost and Usage Report

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/faqs/

QUESTION 793
A company has enabled billing alerts in its AWS account and wants to receive a notification through Amazon Simple Notification Service (Amazon SNS) whenever
its monthly bill exceeds a set amount.

Which AWS service or tool should the company use to achieve this?

A.   Amazon CloudWatch
B.   Cost Explorer
C.   AWS Cost and Usage Report
D.   AWS Pricing Calculator
Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html

QUESTION 794
A user wants to move legacy applications to the AWS Cloud to reduce the total cost.

Which option is the MOST cost-effective according to best practices?

A.   Rewrite the legacy applications in an open-source language, such as Python.
B.   Right-size the Amazon EC2 instances to prevent over-provisioning in terms of compute and memory.
C.   Migrate relational databases to Amazon DynamoDB.
D.   Reserve a data center facility with an upfront payment, which provides an additional discount.

Correct Answer: B
Explanation


QUESTION 795
According to the AWS shared responsibility model, which task is the responsibility of AWS for workloads running on Amazon EC2?

A.   Updating the physical hardware
B.   Updating the operating system
C.   Updating the database engine
D.   Updating the user data

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/

QUESTION 796
A user needs to identify underutilized Amazon Elastic Block Store (Amazon EBS) volumes to reduce costs.

Which AWS service or feature will meet this requirement?

A.   AWS CloudTrail
B.   AWS Budgets
C.   AWS Trusted Advisor
D.   AWS Personal Health Dashboard

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-storage-optimization/optimizing-amazon-ebs-storage.html

QUESTION 797
Which AWS service will help a company identify the user who deleted an Amazon EC2 instance yesterday?

A.   Amazon CloudWatch
B.   AWS Trusted Advisor
C.   AWS CloudTrail
D.   Amazon Inspector

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudtrail/

QUESTION 798
A company has existing software licenses that it wants to bring to AWS, but the licensing model requires licensing physical cores.

How can the company meet this requirement in the AWS Cloud?

A.   Launch an Amazon EC2 instance with default tenancy.
B.   Launch an Amazon EC2 instance on a Dedicated Host.
C.   Create an On-Demand Capacity Reservation.
D.   Purchase Dedicated Reserved Instances.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/compute/byol-and-oversubscription/

QUESTION 799
A company must keep records of all resource changes that are made through the AWS Management Console and AWS APIs.

Which AWS service should the company use to meet this requirement?
A.   Amazon CloudWatch
B.   AWS CloudTrail
C.   AWS X-Ray
D.   Amazon Inspector

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudtrail/

QUESTION 800
A company requires an isolated environment within AWS for security purposes.

Which action can be taken to accomplish this?

A.   Create a separate Availability Zone to host the resources.
B.   Create a separate VPC to host the resources.
C.   Create a placement group to host the resources.
D.   Create an AWS Direct Connect connection between the company and AWS.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/infrastructure-security.html

QUESTION 801
A company needs to monitor and forecast AWS costs and usage. The company also must set event-driven alert notifications that occur if spending limits are
exceeded.

Which AWS service or tool should the company use to meet these requirements?

A.   AWS Budgets
B.   Amazon CloudWatch
C.   AWS Config
D.   AWS Service Catalog

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/aws-cost-management/aws-budgets/

QUESTION 802
Which of the following is a best practice for creating policies for IAM users?

A.   Start with a large set of permissions and remove the permissions that are not required.
B.   Use only Amazon managed policies.
C.   Start with a minimum set of permissions and grant additional permissions as necessary.
D.   Attach policies directly to each user individually.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 803
A user with an AWS Basic Support plan has determined that illegal activities are being run on their AWS resources

What is the recommended method for the user to report the activity to AWS?

A.   Contact the AWS Concierge Support team.
B.   Contact an AWS technical account manager.
C.   Contact the AWS Abuse team.
D.   Contact the AWS Support team.

Correct Answer: C
Explanation


QUESTION 804
AWS can relieve a company's IT staff of which of the following IT tasks? (Choose two.)

A.   Patching database software
B.   Storage capacity planning
C.   Creating database schemas
D.   Setting up access controls for data
E.   Writing application code

Correct Answer: AC
Explanation
QUESTION 805
A company's security team requires that all Amazon EC2 workloads use approved Amazon Machine Images (AMIs).

Which AWS service should the company use to verify that the EC2 instances are using approved AMIs?

A.   Amazon CloudWatch
B.   Amazon Inspector
C.   AWS Config
D.   AWS Trusted Advisor

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/

QUESTION 806
Which of the following are benefits of using the AWS Cloud? (Choose two.)

A.   100% fault tolerance
B.   Total control over underlying infrastructure
C.   Fast provisioning of IT resources
D.   Outsourcing all application coding to AWS
E.   Ability to go global quickly

Correct Answer: CE
Explanation


QUESTION 807
Which of the following security-related aspects of running an Amazon Elastic Compute Cloud (Amazon EC2) instance is the responsibility of AWS?

A.   Security of private keys
B.   Hypervisor software updates
C.   Security updates to software running on the instance
D.   Policies controlling instance access

Correct Answer: B
Explanation


QUESTION 808
Which AWS service aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services?

A.   Amazon Detective
B.   Amazon Inspector
C.   Amazon Macie
D.   AWS Security Hub

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/security-hub/?aws-security-hub-blogs.sort-by=item.additionalFields.createdDate&aws-security-hub-blogs.sort-order=desc

QUESTION 809
A developer has an AWS account and needs access to another account's test database.

Which AWS service or feature can the developer use to gain access to the test database?

A.   Amazon Macie
B.   Security groups
C.   IAM roles
D.   AWS Trusted Advisor

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

QUESTION 810
Using Amazon Elastic Container Service (Amazon ECS) to break down a monolithic architecture into microservices is an example of:

A.   a loosely coupled architecture.
B.   a tightly coupled architecture.
C.   a stateless architecture.
D.   a stateful architecture.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/migrating-applications-from-monolithic-to-microservice-on-aws/
QUESTION 811
Which service enables customers to audit API calls in their AWS accounts?

A.   AWS CloudTrail
B.   AWS Trusted Advisor
C.   Amazon Inspector
D.   AWS X-Ray

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudtrail/

QUESTION 812
Which VPC component provides a layer of security at the subnet level?

A.   Security groups
B.   Network ACLs
C.   NAT gateways
D.   Route tables

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

QUESTION 813
Which benefit is available for Convertible Reserved Instances but NOT Standard Reserved Instances?

A.   The instances can be exchanged for instances of a different instance size.
B.   The instances can be exchanged for instances of a different instance family.
C.   The instances can be changed to a different Availability Zone.
D.   The instances can be changed to a different AWS Region.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/whats-new/2016/09/amazon-ec2-convertible-reserved-instances-and-the-reserved-instance-regional-benefit/

QUESTION 814
Which of the following enables users to leverage the power of AWS services programmatically?

A.   AWS Command Line Interface (AWS CLI)
B.   AWS Trusted Advisor
C.   AWS CodeDeploy
D.   AWS Management Console

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/aws/category/aws-management-console/

QUESTION 815
Which security credentials are required to run commands by using the AWS Command Line Interface (AWS CLI)?

A.   Access Key ID and Secret Access Key
B.   AWS root user email and password
C.   Amazon Elastic Compute Cloud (Amazon EC2) key pairs
D.   AWS Identity and Access Management (IAM) user name and password

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

QUESTION 816
Which are customer responsibilities when using Amazon EC2? (Choose two.)

A.   Underlying hardware maintenance
B.   File-system-level encryption
C.   Guest operating system firewall configuration
D.   Hypervisor-level software patching
E.   Physical security at data center facilities

Correct Answer: CD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/compliance/shared-responsibility-model/?ref=wellarchitected

QUESTION 817
A web developer has limited knowledge of AWS networking services such as Amazon VPC, Elastic Load Balancing, and Auto Scaling, but wants to host a highly
available web application.

Which AWS service would automatically handle the deployment and reduce the complexity for the developer?

A.   AWS CodeDeploy
B.   AWS Resource Access Manager
C.   AWS Elastic Beanstalk
D.   AWS CloudFormation

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/Welcome.html

QUESTION 818
A company wants to route its traffic directly and privately to a VPC without going over the public internet.

Which connectivity option provides this capability?

A.   AWS VPN
B.   AWS Direct Connect
C.   VPC NAT gateway
D.   VPC internet gateway

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/vpc/faqs/

QUESTION 819
A company wants to build an application for a new line of business.

According to the AWS Well-Architected Framework, what design principles should be implemented? (Choose two.)

A.   Consolidate multiple AWS accounts into a single account.
B.   Buy and host hardware in the AWS Cloud.
C.   Decouple the AWS Cloud architecture to break up monolithic deployments.
D.   Move on-premises network hardware to VPCs.
E.   Design elasticity into the AWS Cloud design.

Correct Answer: DE
Explanation


QUESTION 820
A company wants to forecast its AWS Cloud costs for the upcoming year by analyzing its past AWS Cloud spending trends.

Which AWS service should the company use to meet this requirement?

A.   AWS Control Tower
B.   Cost Explorer
C.   AWS OpsWorks
D.   AWS CloudFormation

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-forecast.html

QUESTION 821
Which AWS service or feature can help a company determine if it has Amazon S3 buckets that are publicly available?

A.   AWS Service Health Dashboard
B.   Amazon CloudWatch Logs
C.   AWS Trusted Advisor
D.   AWS Service Catalog

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://d1.awsstatic.com/product-marketing/S3/Amazon_S3_Security_eBook_2020.pdf

QUESTION 822
A company's newly launched application is gaining in popularity very quickly. To improve customer service, the company wants to set up a phone number to
manage the increasing volume of calls received by the company's support staff.

Which AWS service should be used to meet this requirement?
A.   Amazon Connect
B.   Amazon CloudFront
C.   Amazon DirectConnect
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

QUESTION 823
Which credentials used to sign in to the AWS Management Console meet security best practices? (Choose two.)

A.   An access key
B.   Multi-factor authentication
C.   X.509 certificates
D.   A secret key
E.   User name and password

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/getting-started-follow-security-best-practices-as-you-configure-your-aws-resources/

QUESTION 824
Which of the following are ways to improve security on AWS? (Choose two.)

A.   Using AWS Artifact
B.   Granting the broadest permissions to all IAM roles
C.   Running application code with AWS Cloud9
D.   Enabling multi-factor authentication (MFA) with Amazon Cognito
E.   Using AWS Trusted Advisor security checks

Correct Answer: DE
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/top-10-security-items-to-improve-in-your-aws-account/

QUESTION 825
Which AWS service or resource helps on-premises applications connect to AWS Cloud-based storage and caches the data locally for low-latency access?

A.   AWS Direct Connect
B.   AWS Storage Gateway
C.   Amazon S3
D.   AWS Snowball Edge

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/storagegateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc

QUESTION 826
An online retail company has seasonal sales spikes several times a year, primarily around holidays. Demand is lower at other times. The company finds it difficult
to predict the increasing infrastructure demand for each season.

Which advantages of moving to the AWS Cloud would MOST benefit the company? (Choose two.)

A.   Global footprint
B.   Elasticity
C.   AWS service quotas
D.   AWS shared responsibility model
E.   Pay-as-you-go pricing

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

QUESTION 827
A company wants to ensure that two Amazon EC2 instances are in separate data centers with minimal communication latency between the data centers.

How can the company meet this requirement?

A.   Place the EC2 instances in two separate AWS Regions connected with a VPC peering connection.
B.   Place the EC2 instances in two separate Availability Zones within the same AWS Region.
C.   Place one EC2 instance on premises and the other in an AWS Region. Then connect them by using an AWS VPN connection.
D.   Place both EC2 instances in a placement group for dedicated bandwidth.
Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 828
Which AWS service supports a hybrid architecture that gives users the ability to extend AWS infrastructure, AWS services, APIs, and tools to data centers, co-
location environments, or on-premises facilities?

A.   AWS Snowmobile
B.   AWS Local Zones
C.   AWS Outposts
D.   AWS Fargate

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/outposts/

QUESTION 829
A company wants to eliminate the need to guess infrastructure capacity before deployments. The company also wants to spend its budget on cloud resources only
as the company uses the resources.

Which advantage of the AWS Cloud matches the company's requirements?

A.   Reliability
B.   Global reach
C.   Economies of scale
D.   Pay-as-you-go pricing

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

QUESTION 830
A retail company wants to provision only the necessary amount of resources to handle the current demand.

Which cloud benefit is the company trying to achieve with this goal?

A.   Reliability
B.   Global reach
C.   Scalability
D.   High availability

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

QUESTION 831
A company wants to migrate a small website and database quickly from on-premises infrastructure to the AWS Cloud. The company has limited operational
knowledge to perform the migration.

Which AWS service supports this use case?

A.   Amazon EC2
B.   Amazon Lightsail
C.   Amazon S3
D.   AWS Lambda

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/migrate-small-sets-of-data-from-on-premises-to-amazon-s3-using-aws-sftp.html

QUESTION 832
Which AWS service or feature allows a user to set up consolidated billing?

A.   AWS Billing Management Console
B.   AWS Organizations
C.   AWS Cost and Usage Report
D.   WAS Systems Manager

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html
QUESTION 833
Which AWS service can be used to encrypt data at rest?

A.   Amazon GuardDuty
B.   AWS Shield
C.   AWS Security Hub
D.   AWS Key Management Service (AWS KMS)

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/security/how-to-protect-data-at-rest-with-amazon-ec2-instance-store-encryption/

QUESTION 834
What is an IAM best practice for AWS account root user access keys?

A.   Delete all root user access keys, if possible.
B.   Use root user credentials to access sensitive information stored on AWS.
C.   Allow the system administrator group to use the root user credentials for daily access.
D.   Use root user credentials to access production database instances.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 835
A company has performance and regulatory requirements that call for it to run its workload only on its on-premises data center.

Which AWS services or resources should the company use? (Choose two.)

A.   Amazon Pinpoint
B.   Amazon WorkLink
C.   AWS Outposts
D.   AWS Snowball Edge
E.   AWS AppSync

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/worklink/
https://aws.amazon.com/outposts/

QUESTION 836
Elasticity in the AWS Cloud refers to which of the following? (Choose two.)

A.   How quickly an Amazon EC2 instance can be restarted
B.   The ability to rightsize resources as demand shifts
C.   The maximum amount of RAM an Amazon EC2 instance can use
D.   The pay-as-you-go billing model
E.   How easily resources can be produced when they are needed

Correct Answer: BE
Explanation

Explanation/Reference:
Explanation:
https://blog.turbonomic.com/blog/on-technology/cloud-elasticity-vs-cloud-scalability

QUESTION 837
A company wants to migrate to AWS and use the same security software it uses on premises. The security software vendor offers its security software as a service
on AWS.

Where can the company purchase the security solution?

A.   AWS Partner Solutions Finder
B.   AWS Support Center
C.   AWS Management Console
D.   AWS Marketplace

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/marketplace

QUESTION 838
A company needs to improve the response rate of high-volume queries to its relational database.

Which AWS service should the company use to offload requests to the database and improve overall response times?

A. Amazon DynamoDB Accelerator (DAX)
B. Amazon ElastiCache
C. Elastic Load Balancing
D. AWS Global Accelerator

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 839
Which AWS services or features enable users to connect on-premises networks to a VPC? (Choose two.)

A.   AWS VPN
B.   Elastic Load Balancing
C.   AWS Direct Connect
D.   VPC peering
E.   Amazon CloudFront

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/vpn/faqs/

QUESTION 840
Which pillar of the AWS Well-Architected Framework specifies that resources be provisioned in a timely manner and scale as needed to maintain effectiveness as
demand changes?

A.   Cost optimization
B.   Security
C.   Operational excellence
D.   Performance efficiency

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/wellarchitected/latest/framework/wellarchitected-framework.pdf (24)

QUESTION 841
An IT department provisions more servers than are needed to run a workload.

Which cloud architecture design principle supports changing this approach?

A.   Protect data in transit and at rest.
B.   Stop guessing capacity.
C.   Improve through game days.
D.   Annotate documentation.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:

QUESTION 842
A solutions architect needs to create a cost estimate for running workloads on AWS. The cost estimate must then be exported for management review.

Which AWS service or feature should be used to accomplish these task?

A.   Cost Explorer
B.   Amazon QuickSight
C.   AWS Pricing Calculator
D.   AWS Budgets

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/pricing-calculator/latest/userguide/aws-pc.pdf

QUESTION 843
Which AWS service should a company use to decouple large monolithic applications into smaller microservices components?

A.   AWS Direct Connect
B.   Amazon Lightsail
C.   Amazon Simple Queue Service (Amazon SQS)
D.   Amazon CloudWatch

Correct Answer: C
Explanation

Explanation/Reference:
QUESTION 844
A company has defined the AWS resources that it needs for a new application. The company needs to estimate the costs of running the application on AWS.

What should the company do to meet this requirement?

A.   Take advantage of AWS on-demand pricing.
B.   Use the AWS Pricing Calculator to generate an approximate dollar amount.
C.   Use Amazon QuickSight to analyze current on-premises spending.
D.   Use Amazon AppStream 2.0 for real-time pricing analytics.

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/estimating-aws-resource-costs/

QUESTION 845
A company has a globally distributed user base. The company needs its application to be highly available and have low latency for end users.

Which AWS architectural approach will MOST effectively support these requirements?

A.   Single-Region, Multi-AZ architecture
B.   Multi-Region, active-active architecture
C.   Multi-Region, active-passive architecture
D.   Single-Region, Single-AZ architecture

Correct Answer: B
Explanation

Explanation/Reference:


QUESTION 846
Which AWS service or feature for technical assistance is available to a user who has the AWS Basic Support plan?

A.   AWS senior support engineers
B.   AWS technical account manager (TAM)
C.   AWS Trusted Advisor
D.   AWS Discussion Forums

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 847
A company needs to migrate its on-premises data to the AWS Cloud. The company requires elastic, highly optimized connectivity.

Which AWS service meets these requirements?

A.   Amazon S3 Glacier
B.   AWS Storage Gateway
C.   AWS Backup
D.   Amazon Elastic File System (Amazon EFS)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/storagegateway/faqs/

QUESTION 848
When an Amazon EC2 instance is terminated, which AWS service can identify the user that made the API call?

A.   Amazon CloudWatch
B.   AWS CloudTrail
C.   AWS X-Ray
D.   AWS Identity and Access Management (IAM)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html

QUESTION 849
Which controls does the customer fully inherit from AWS in the AWS shared responsibility model?

A.   Patch management controls
B.   Awareness and training controls
C.   Physical and environmental controls
D.   Configuration management controls

Correct Answer: C
Explanation
Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/shared-responsibility.html

QUESTION 850
Which feature can be used to protect Amazon S3 buckets from accidental overwrites or deletes?

A.   Lifecycle policy
B.   object versioning
C.   Server-side encryption
D.   Bucket ACL

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://medium.com/tensult/how-to-protect-objects-from-accidental-deletion-and-overwrite-using-s3-object-versioning-5222796ab156

QUESTION 851
Which of the following are AWS security best practices for using AWS Identity and Access Management (IAM) to manage an AWS account root user? (Choose
two.)

A.   Set up multi-factor authentication (MFA) for the root user.
B.   Remove all IAM policies from the root user.
C.   Delete the root user access keys.
D.   Use the root user for daily tasks.
E.   Assign a read-only access policy to the root user.

Correct Answer: AE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

QUESTION 852
Service control policies (SCPs) manage permissions for which of the following?

A.   Availability Zones
B.   AWS Regions
C.   AWS Organizations
D.   Edge locations

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

QUESTION 853
A database administrator is trying to determine who deleted a critical Amazon Redshift cluster.

Which AWS service helps with monitoring and retaining this type of account activity?

A.   AWS CloudTrail
B.   AWS Organizations
C.   AWS Identity and Access Management (IAM)
D.   AWS Trusted Advisor

Correct Answer: A
Explanation

Explanation/Reference:


QUESTION 854
Which pillar of the AWS Well-Architected Framework includes the AWS shared responsibility model?

A.   Operational excellence
B.   Performance efficiency
C.   Reliability
D.   Security

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

QUESTION 855
A company runs its business-critical web application on Amazon Elastic Container Service (Amazon ECS) and Amazon DynamoDB. The workload spikes up to 10
times the normal workload multiple times during the day.

Which AWS Cloud feature enables the company to meet these changes in demand?
A.   Agility
B.   Global reach
C.   Scalability
D.   Security

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/autoscaling/

QUESTION 856
A company's traffic logs show that IP addresses owned by AWS are being used in an attempt to flood ports on system resources.

To whom should the cloud practitioner report this issue?

A.   AWS Professional Services
B.   AWS Abuse team
C.   AWS Partner Network (APN)
D.   AWS technical account manager (TAM)

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/

QUESTION 857
An Amazon EC2 instance previously used for development is inaccessible and no longer appears in the AWS Management Console.

Which AWS service should be used to determine what action made this EC2 instance inaccessible?

A.   Amazon CloudWatch Logs
B.   AWS Security Hub
C.   Amazon Inspector
D.   AWS CloudTrail

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/troubleshooting-launch.html

QUESTION 858
Which AWS service is a highly available and scalable DNS web service?

A.   Amazon VPC
B.   Amazon CloudFront
C.   Amazon Route 53
D.   Amazon Connect

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/route53/

QUESTION 859
A company is moving its office and must establish an encrypted connection to AWS.

Which AWS service will help meet this requirement?

A.   AWS VPN
B.   Amazon Route 53
C.   Amazon API Gateway
D.   Amazon Connect

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/vpn/

QUESTION 860
Which statement explains the benefit of agility in the AWS Cloud?

A.   Agility gives users the ability to host applications in multiple AWS Regions around the world.
B.   Agility gives users the ability to pay upfront to reduce cost.
C.   Agility provides customizable physical hardware at the lowest possible cost.
D.   Agility provides the means for users to provision resources in minutes.

Correct Answer: D
Explanation
Explanation/Reference:
Explanation:
https://blog.clairvoyantsoft.com/true-economics-of-cloud-computing-part-1-what-it-really-means-to-be-agile-1ed14a1696a5

QUESTION 861
Which of the following are user authentication services managed by AWS? (Choose two.)

A.   Amazon Cognito
B.   AWS Lambda
C.   AWS License Manager
D.   AWS Identity and Access Management (IAM)
E.   AWS CodeStar

Correct Answer: AD
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cognito/
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

QUESTION 862
Which AWS service or tool helps identify underutilized Amazon EC2 instances and idle Amazon RDS DB instances at no additional charge?

A.   Cost Explorer
B.   AWS Budgets
C.   AWS Organizations
D.   AWS Trusted Advisor

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/

QUESTION 863
Which of the following are customer responsibilities under the AWS shared responsibility model? (Choose two.)

A.   Physical security of AWS facilities
B.   Configuration of security groups
C.   Encryption of customer data on AWS
D.   Management of AWS Lambda infrastructure
E.   Management of network throughput of each AWS Region

Correct Answer: DE
Explanation

Explanation/Reference:


QUESTION 864
A user should contact the AWS Abuse team to report which situations? (Choose two.)

A.   A DDoS attack is being made on an AWS resource.
B.   A SQL injection attack is being made from an IP address that is not an AWS address.
C.   AWS resources are being used to host objectionable or illegal content.
D.   A company's resources are being used in a way that is inconsistent with corporate policy.
E.   A company is receiving HTTPS requests on a web server that is serving HTTP.

Correct Answer: AC
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/

QUESTION 865
A company uses Amazon DynamoDB in its AWS Cloud architecture.

According to the AWS shared responsibility model, which of the following are responsibilities of the company? (Choose two.)

A.   Operating system patching and upgrades
B.   Application of appropriate permissions with IAM tools
C.   Configuration of data encryption options
D.   Creation of DynamoDB endpoints
E.   Infrastructure provisioning and maintenance

Correct Answer: BD
Explanation

Explanation/Reference:


QUESTION 866
What should a user do to deploy an application in geographically separate locations?

A. Deploy the application in different placement groups.
B. Deploy the application to a VPC.
C. Deploy the application to multiple AWS Regions.
D. Deploy the application by using Amazon CloudFront.

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/about-aws/global-infrastructure/regions_az/

QUESTION 867
A company wants to rightsize its infrastructure to control costs.

At which points should the company rightsize? (Choose two.)

A.   Rightsize before a migration occurs to the cloud.
B.   Rightsize continuously after the cloud onboarding process.
C.   Rightsize when AWS Support calls and explains that rightsizing is needed.
D.   Rightsize when seasonal workloads are at their peak.
E.   Rightsize after purchasing all Reserved Instances.

Correct Answer: DE
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-right-sizing/tips-for-right-sizing-your-workloads.html

QUESTION 868
Which tasks should a user perform if the user suspects that an AWS account has been compromised? (Choose two.)

A.   Remove any multi-factor authentication (MFA) tokens.
B.   Rotate and delete all AWS access keys.
C.   Move resources to a different AWS Region.
D.   Delete AWS CloudTrail resources.
E.   Contact AWS Support.

Correct Answer: BE
Explanation

Explanation/Reference:


QUESTION 869
A company needs a content delivery network that provides secure delivery of data, videos, applications, and APIs to users globally with low latency and high
transfer speed.

Which AWS service meets these requirements?

A.   Amazon CloudFront
B.   Elastic Load Balancing
C.   Amazon S3
D.   Amazon Elastic Transcoder

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/cloudfront/

QUESTION 870
Which AWS Cloud benefit is shown by an architecture's ability to withstand failures with minimal downtime?

A.   Agility
B.   Elasticity
C.   Scalability
D.   High availability

Correct Answer: D
Explanation

Explanation/Reference:


QUESTION 871
A company is moving its development and test environments to AWS to increase agility and reduce cost. Because these are not production workloads and the
servers are not fully utilized, occasional unavailability is acceptable.

What is the MOST cost-effective Amazon EC2 pricing model that will meet these requirements?

A.   Reserved Instances
B.   On-Demand Instances
C.   Spot Instances
D.   Dedicated Instances

Correct Answer: C
Explanation
Explanation/Reference:


QUESTION 872
Which guidelines are key AWS architectural design principles? (Choose two.)

A.   Design for fixed resources.
B.   Build scalable architectures.
C.   Use tightly coupled components.
D.   Use managed services when possible.
E.   Design for human interaction

Correct Answer: BD
Explanation

Explanation/Reference:
Explanation:
https://www.botmetric.com/blog/aws-cloud-architecture-design-principles/

QUESTION 873
What is the LEAST expensive AWS Support plan that provides 24-hour access to AWS customer service and AWS communities?

A.   AWS Enterprise Support
B.   AWS Business Support
C.   AWS Developer Support
D.   AWS Basic Support

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/plans/

QUESTION 874
A company with AWS Enterprise Support has questions about its consolidated bill.

Which AWS service, feature, or tool should the company use for assistance?

A.   AWS Pricing Calculator
B.   AWS Concierge Support
C.   AWS Trusted Advisor
D.   AWS Budgets

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

QUESTION 875
A company needs to perform a one-time migration of 40TB of data from its on-premises storage servers to Amazon S3. The transfer must happen as quickly as
possible while keeping costs to a minimum. The company has 100 Mbps internet connectivity.

Which AWS service will meet these requirements?

A.   AWS Snowball
B.   AWS Direct Connect
C.   AWS Storage Gateway
D.   Amazon S3 Transfer Acceleration

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Snowball is better for 40TB transfer. It will make transfer while keeping the costs at minimum. With 100 mbps, it will be quick.

QUESTION 876
A company uses Amazon S3 buckets. One of the company's departments enabled S3 Cross-Region Replication for those buckets to meet new requirements. The
company's bill for that month was larger than usual.

Which AWS service or feature can the company use to confirm that the cost increase was caused by the data replication?

A.   Consolidated billing
B.   Cost Explorer
C.   AWS Pricing Calculator
D.   AWS Trusted Advisor

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
https://aws.amazon.com/aws-cost-management/aws-cost-explorer/

QUESTION 877
A company wants to store data with high availability, encrypt the data at rest, and have direct access to the data over the internet.
Which AWS service will meet these requirements MOST cost-effectively?

A.   Amazon Elastic Block Store (Amazon EBS)
B.   Amazon S3
C.   Amazon Elastic File System (Amazon EFS)
D.   AWS Storage Gateway

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can encrypt data using any encryption method you want, and then upload the encrypted data using the Amazon Simple Storage Service (Amazon S3) APIs.
Most common application languages include cryptographic libraries that allow you to perform encryption in your applications. Two commonly available open source
tools are Bouncy Castle and OpenSSL. Once you have encrypted an object and safely stored the key in your KMI, the encrypted object can be uploaded to
Amazon S3 directly with a PUT request.
Reference: https://d0.awsstatic.com/whitepapers/aws-securing-data-at-rest-with-encryption.pdf

QUESTION 878
How do AWS users trade infrastructure expenses for operational expenses?

A.   Secure their physical infrastructure to prevent malicious attacks.
B.   Use AWS Budgets to ensure that spending on AWS resources does not exceed preset thresholds.
C.   Eliminate the electricity costs that are associated with the hosting of physical servers.
D.   Use AWS Auto Scaling to dynamically increase and decrease compute resources as needed.

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
The service provides a simple, powerful user interface that lets you build scaling plans for resources including Amazon EC2 instances and Spot Fleets, Amazon
ECS tasks, Amazon DynamoDB tables and indexes, and Amazon Aurora Replicas.
Reference: https://aws.amazon.com/autoscaling/

QUESTION 879
A network engineer needs to establish a dedicated 10 Gbps network connection from an on-premises environment to AWS.

Which AWS service or feature should the engineer use?

A.   Amazon Route 53
B.   AWS Direct Connect
C.   AWS PrivateLink
D.   AWS VPN

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Direct Connect can create a dedicated network connection between your premises and AWS.
Reference: https://aws.amazon.com/directconnect/

QUESTION 880
Which AWS service or feature provides an online, managed software catalog that helps users purchase and deploy third-party software?

A.   AWS Support
B.   AWS Marketplace
C.   Amazon EC2 private Amazon Machine Images (AMIs)
D.   AWS reseller programs

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Marketplace is a curated digital catalog that makes it easy for customers to find, buy, deploy, and manage the third-party software.
Reference: https://aws.amazon.com/marketplace/campaigns/software-procurement

QUESTION 881
A company has a Java web application. The company wants to use auto deployment to create the AWS environment and deploy new versions of its application.

Which AWS service will meet these requirements?

A.   AWS Auto Scaling
B.   AWS Elastic Beanstalk
C.   AWS Control Tower
D.   Amazon EC2

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
You can simply upload your code and Elastic Beanstalk automatically handles the deployment.
Reference: https://aws.amazon.com/elasticbeanstalk/

QUESTION 882
Which action will provide documentation to help a company evaluate whether its use of the AWS Cloud is compliant with local regulatory standards?
A.   Running Amazon GuardDuty
B.   Using AWS Artifact
C.   Creating an AWS Support ticket
D.   Evaluating AWS CloudTrail logs

Correct Answer: B
Explanation

Explanation/Reference:
Explanation:
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS' security and compliance
reports and select online agreements.
Reference: https://aws.amazon.com/artifact/

QUESTION 883
A company is launching a new application in the AWS Cloud. The application will run on an Amazon EC2 instance. More EC2 instances will be needed when the
workload increases.

Which AWS service or tool can the company use to launch the number of EC2 instances that will be needed to handle the workload?

A.   Elastic Load Balancing
B.   Amazon EC2 Auto Scaling
C.   AWS App2Container (A2C)
D.   AWS Systems Manager

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Elastic Load Balancing automatically distributes your incoming application traffic across all the EC2 instances that you are running. Elastic Load Balancing helps to
manage incoming requests by optimally routing traffic so that no one instance is overwhelmed.
Reference: https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.html

QUESTION 884
A company has infrastructure in one AWS Region and is expanding operations to a second AWS Region. The company is using the same AWS CloudFormation
template in the second Region that the company uses in the original Region. The company attempts to launch Amazon EC2 On-Demand Instances in the second
Region and receives error messages.

What could cause these error messages?

A.   A new EC2 key pair has not been created for the EC2 instances.
B.   The requested EC2 instance types are not available in the second Region.
C.   The company cannot operate in a second Region until it updates its AWS contract.
D.   The company has not configured AWS Budgets to monitor the budget for the EC2 instances.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
The key pair <key pair associated with your EC2 instance> does not exist. Launching EC2 instance failed.
Reference: https://docs.aws.amazon.com/autoscaling/ec2/userguide/ts-as-instancelaunchfailure.html

QUESTION 885
Which of the following is a software development framework that a company can use to define cloud resources as code and provision the resources through AWS
CloudFormation?

A.   AWS CLI
B.   AWS Developer Center
C.   AWS Cloud Development Kit (AWS CDK)
D.   AWS CodeStar

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
The AWS Cloud Development Kit (AWS CDK) is an open source software development framework to define your cloud application resources using familiar
programming languages.
Provisioning cloud applications can be a challenging process that requires you to perform manual actions, write custom scripts, maintain templates, or learn
domain-specific languages. AWS CDK uses the familiarity and expressive power of programming languages for modeling your applications. It provides you with
high-level components called constructs that preconfigure cloud resources with proven defaults, so you can build cloud applications without needing to be an
expert. AWS CDK provisions your resources in a safe, repeatable manner through AWS CloudFormation.
Reference: https://aws.amazon.com/cdk/

QUESTION 886
Which options are available to a user who wants to contact AWS Support? (Choose two.)

A.   Create an email case in the AWS Support Center.
B.   Visit a local AWS Support Center.
C.   Use live chat functionality.
D.   Call the customer service phone number.
E.   Use the video conference functionality of the AWS Support console.

Correct Answer: CD
Explanation

Explanation/Reference:
Explanation:
If you select Chat, you can chat online with a representative from AWS Support.
If you select Phone, you're prompted for a callback number. You receive a call from AWS Support as soon as you create the case.
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/aws-phone-support/

QUESTION 887
A global company is building a simple time-tracking mobile app. The app needs to operate globally and must store collected data in a database. Data must be
accessible from the AWS Region that is closest to the user.

What should the company do to meet these data storage requirements with the LEAST amount of operational overhead?

A.   Use Amazon EC2 in multiple Regions to host separate databases.
B.   Use Amazon RDS cross-Region replication.
C.   Use Amazon DynamoDB global tables.
D.   Use AWS Database Migration Service (AWS DMS).

Correct Answer: C
Explanation

Explanation/Reference:
Explanation:
Hundreds of thousands of AWS customers have chosen DynamoDB as their key-value and document database for mobile, web, gaming, ad tech, IoT, and other
applications that need low-latency data access at any scale. Create a new table for your application and let DynamoDB handle the rest.
Reference: https://aws.amazon.com/dynamodb/

QUESTION 888
A company plans to store sensitive data in an Amazon S3 bucket.

Which task is the responsibility of AWS?

A.   Activate encryption at rest for the data.
B.   Provide security for the physical infrastructure.
C.   Train the company's employees about cloud security.
D.   Remove personally identifiable information (PII) from the data.

Correct Answer: A
Explanation

Explanation/Reference:
Explanation:
Amazon S3 can often house sensitive and confidential information. To help secure your data within Amazon S3, you should be using AWS Key Management
Service (AWS KMS) with server-side encryption at rest for Amazon S3. It is also important that you secure the S3 buckets so that you only allow access to the
developers and users who require that access.
Reference: https://aws.amazon.com/blogs/security/strengthen-the-security-of-sensitive-data-stored-in-amazon-s3-by-using-additional-aws-services/

QUESTION 889
A company needs a firewall that will control network connections to and from a single Amazon EC2 instance. This firewall will not control network connections to
and from other instances that are in the same subnet.

Which AWS service or feature can the company use to meet these requirements?

A.   Network ACL
B.   AWS WAF
C.   Route table
D.   Security group

Correct Answer: D
Explanation

Explanation/Reference:
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

QUESTION 890
Which of the following are AWS Trusted Advisor support categories? (Choose two.)

A.   Operational excellence
B.   Cost optimization
C.   Security
D.   Well-Architected Framework
E.   Rightsizing

Correct Answer: BC
Explanation

Explanation/Reference:
Explanation:
AWS Trusted Advisor
Reduce costs, improve performance, improve security
Reference: https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

QUESTION 891
Which of the following is entirely the responsibility of AWS, according to the AWS shared responsibility model?

A.   Patching of the guest operating system
B.   Security awareness and training
C.   Physical and environmental controls
D.   Development of an IAM password policy

Correct Answer: C
Explanation

Explanation/Reference:

QUESTION 892
A company is developing a new application that will be hosted in the AWS Cloud. The company needs to make changes to the application and the AWS resources that it uses. Which of the following is a characteristic of the AWS Cloud that would meet this specific requirement?

A.   Elasticity
B.   Reliability
C.   Performance
D.   Agility

Correct Answer: D
Explanation:
Agility is the ability to deploy resources such as computing, storage, or databases in a matter of minutes.
Reference: For more information about the advantages of cloud computing, see Six Advantages of Cloud Computing.

QUESTION 893
Which term lengths are available when a company purchases Amazon EC2 Reserved Instances directly from AWS? (Select TWO.)

A.   6 months
B.   1 year
C.   3 years
D.   4 years

Correct Answer: BC
Explanation:
Users can purchase a Reserved Instance directly from AWS for a 1-year or 3-year commitment. The 3-year commitment offers a larger discount.
Reference: see Amazon EC2 Reserved Instances

QUESTION 894
Which pillar of the AWS Well-Architected Framework has the design principle "perform operations as code"?

A.   Performance efficiency
B.   Operational excellence
C.   Reliability
D.   Security

Correct Answer: B
Explanation: he principle to perform operations as code is a design principle of the operational excellence pillar. By performing operations as code, you limit human error and enable consistent responses to events.
Reference: see Design Principles

QUESTION 895
Which architecture design principle applies to the concept of rightsizing the AWS Cloud infrastructure?

A.   Scale horizontally for increased workload availability.
B.   Optimize for cost.
C.   Make frequent, small, reversible changes.
D.   Perform operations as code.

Correct Answer: B
Explanation: You can use metrics from the currently running workload to select the right size and type to optimize for cost. This solution is one of the best practices on the cost optimization pillar for the Well-Architected Framework.
Reference: See Cost Optimization.

QUESTION 896
Which AWS service supports encryption by default?

A.   Amazon Redshift
B.   Amazon RDS
C.   Amazon S3 Glacier
D.   Amazon Elastic File System (Amazon EFS)

Correct Answer: C
Explanation: S3 Glacier enables encryption by default.
Reference: see Amazon S3 Features.

QUESTION 897
Which AWS security mechanisms can be used to restrict or permit access to resources within a VPC? (Select TWO.)

A.   Network ACL
B.   Elastic network interface
C.   Route table
D.   Security group
E.   VPC Flow Logs

Correct Answer: AD
Explanation: A network ACL is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. A security group acts as a virtual firewall for your instance to control inbound and outbound traffic.
Reference: 

QUESTION 898
Which AWS service helps to automate common administrative tasks and perform one-time configuration changes at scale on Amazon EC2 instances?

A.   AWS Systems Manager
B.   AWS CloudTrail
C.   AWS CloudFormation
D.   AWS Config

Correct Answer: A
Explanation: You can use Systems Manager to remotely and securely manage the configuration of your managed instances. A managed instance is any EC2 instance or on-premises machine in your hybrid environment that has been configured for Systems Manager. With Systems Manager, you can automate common administrative tasks and perform one-time configuration changes at scale.
Reference:

QUESTION 899
Which element defines an AWS Availability Zone?

A.   One or more physical data centers with redundant power and network
B.   A geographic location that is completely isolated from other AWS locations
C.   One or more edge locations based around the world
D.   A data center location with a single source of power and networking

Correct Answer: A
Explanation: The AWS infrastructure is built with redundancy to avoid single points of failure. Availability Zones have low-latency connections between them within an AWS Region.
Reference:

QUESTION 900
Which AWS service installs, operates, and scales infrastructure for container cluster management?

A.   Amazon Elastic Container Registry (Amazon ECR)
B.   Amazon ElastiCache
C.   Amazon Elastic Container Service (Amazon ECS)
D.   Amazon Elastic Block Store (Amazon EBS)

Correct Answer: C
Explanation: Amazon ECS is a highly scalable, fast container management service that makes it easy to run, stop, and manage containers on a cluster.
Reference: