Comprehensive test

Correct answer: C

Availability Zones are isolated from each other, so a failure in one doesn't reach the other, and the load balancer sends visitors to the healthy server. This is the cheapest option that does the job.

• A: A larger server stays in the same place, so the same failure stops it.
• B: This protects against losing a whole Region, which is more than the clinic needs, and it costs more.
• D: CloudFront caches content, but making a booking still needs the server.

Review: Availability Zones in part 1, and Regions and Zones in the AWS docs.

Correct answer: A

When data is subject to local regulations, meeting them comes before latency, cost and available services. After that, you compare the Regions that remain.

• B: CloudFront speeds up delivery, but the data itself stays in the US.
• C: The production data is still outside the EU, and a backup doesn't change that.
• D: Encryption protects the data, but it doesn't change where the data is.

Review: How to choose a Region in part 1, and What to consider when selecting a Region on the AWS blog.

Correct answer: D

The problem is distance, not the server's capacity. CloudFront caches files at the edge location nearest each student, with nothing new for you to run.

• A: The server isn't under pressure, and the distance stays the same.
• B: This improves availability, but the students are just as far away.
• C: This would work, but it has the most to set up, sync and pay for.

Review: Edge locations in part 1, and What is Amazon CloudFront? in the AWS docs.

Correct answer: B + E

On EC2, the operating system inside the server and the firewall rules around it are yours. Everything from the host and virtualization layer down to the building belongs to AWS.

• A: Hardware belongs to AWS.
• C: The virtualization layer belongs to AWS.
• D: Physical security belongs to AWS.

Review: The shared responsibility model in part 1, and the AWS page on the model.

Correct answer: B

AWS maps Availability Zone names to physical locations differently for each account. An ID such as use1-az1 means the same location in every account.

• A: us-east-1a in one account may not be the same place as us-east-1a in another.
• C: This only confirms the same Region, which they already know.
• D: Edge locations serve content to users, and they don't identify where a subnet is.

Review: Availability Zones in part 1, and Availability Zone IDs in the AWS docs.

Correct answer: C

Wavelength Zones sit inside telecom carriers' 5G networks, which keeps latency to phones very low.

• A: This is farther from the phone than the carrier's own network.
• B: This puts AWS hardware on your own site, which isn't near your players' phones.
• D: You don't run your servers there, and they serve stored content.

Review: Closer still: Local Zones, Wavelength and Outposts in part 1, and Regions and Zones in the AWS docs.

Correct answer: B

A role gives the application temporary credentials that update automatically, so there's nothing to store or rotate.

• A: The same long-term keys are still on the server.
• C: The keys stay, and there's now a script to maintain.
• D: The reports would be open to anyone on the internet.

Review: Roles: permissions without keys in part 2, and IAM roles for applications on EC2 in the AWS docs.

Correct answer: D

AWS gathers all the policies that apply. If any one contains an explicit deny for the request, the request is refused.

• A: How broad an allow is makes no difference against a deny.
• B: Group policies can contain Deny like any other identity policy.
• C: The order of policies has no effect on the result.

Review: How a permission is decided in part 2, and Policy evaluation logic in the AWS docs.

Correct answer: A

s3:ListBucket applies to the bucket itself, while s3:GetObject applies to the objects in it. The policy names only the objects, so listing has nothing to apply to.

• B: This allows writing, and has nothing to do with listing.
• C: This setting concerns public access, not a signed-in user's permissions.
• D: The group would have the same wrong resource.

Review: How to read an IAM policy in part 2, and Identity-based policy examples for S3 in the AWS docs.

Correct answer: A + C

AWS recommends no access keys for the root user, and MFA on its sign-in.

• B: IAM policies in the account can't restrict the root user.
• D: The root password shouldn't be shared without a strict need, and people should use their own identities day to day.
• E: The root user signs in with the account's email address, so there's no username to rename.

Review: The root user in part 2, and Root user best practices in the AWS docs.

Correct answer: C

Last Accessed shows each service the role is allowed to use and when it last tried, which is exactly the evidence needed.

• A: This lists users and the state of their passwords, keys and MFA, not the services a role uses.
• B: This takes a lot of effort, and it can miss calls made by libraries.
• D: This uses failures in production as the test.

Review: Review your permissions in part 2, and Last accessed information in the AWS docs.

Correct answer: C

The t family runs at a baseline and spends credits to go above it, which suits occasional peaks, not hours at full load. Encoding needs sustained CPU, and that's what the c family is for.

• A: A larger t3 still relies on credits, so the fit stays wrong.
• B: The job uses little memory, so you'd pay for what it doesn't need.
• D: This family is for fast local disks, and the bottleneck here is the CPU.

Review: Instance types in part 3, and Key concepts for burstable instances in the AWS docs.

Correct answer: D

A rule can name a security group as its source, and it then covers every server in that group, whatever its address.

• A: This opens the database to the whole internet.
• B: This works, but it adds a script to maintain, and one that can fail.
• C: Security group rules can only allow, so there's no deny rule to add.

Review: Security groups in part 3, and Security group rules in the AWS docs.

Correct answer: A

A timeout means the request never arrived, and the server itself serves the page fine. So the block is on the way in, and the security group is the first place to check.

• B: IAM roles control calls to AWS services, not traffic coming in to the server.
• C: The key pair only concerns SSH, and SSH is working.
• D: Nginx is running and returning the page, so the setup worked.

Review: Security groups in part 3, and Troubleshoot connecting to your instance in the AWS docs.

Correct answer: B

The script runs once, on first boot. After that, the developer can install the package directly, or launch a new server with the updated script.

• A: The role controls what the server can call, and has nothing to do with this.
• C: Stopping doesn't delete User Data, which is why the edit could be saved.
• D: User Data doesn't depend on the type of address.

Review: User Data in part 3, and Run commands at launch with user data in the AWS docs.

Correct answer: C

A stopped server isn't charged for compute, only for its disks, and its data stays. Its regular public IP address will change, though.

• A: Terminating deletes the system disk by default, so the work is lost.
• B: A reboot leaves the server running, and billed.
• D: This lowers the cost, but you still pay all night for a server nobody's using.

Review: Stop or terminate? in part 3, and Instance state changes in the AWS docs.

Correct answer: B

Each kind of load gets the option that fits it: a commitment for what always runs, no commitment for short peaks, and spare capacity for work that can be interrupted.

• A: This is the most expensive way to run servers that never stop.
• C: AWS can take Spot servers back, which could stop the store during a sale.
• D: You'd pay all year for 10 servers needed for a few hours.

Review: How to choose in part 4, and Choosing a purchasing option in the AWS docs.

Correct answer: A

A Dedicated Host is a whole physical server for you, and it shows you its sockets and cores, which is what this kind of licence needs.

• B: These run on isolated hardware, but they don't show you sockets or cores.
• C: These can be interrupted, and they say nothing about licences.
• D: These guarantee capacity in an Availability Zone, and don't give you a physical server of your own.

Review: Pricing options in part 4, and Amazon EC2 Dedicated Hosts in the AWS docs.

Correct answer: D

An Elastic IP belongs to your account and stays the same through stops and starts. Remember that public IPv4 addresses have an hourly charge.

• A: This address changes every time you stop and start the server.
• B: A private address can't be reached from the internet.
• C: An ENI keeps its private address, but doesn't provide a fixed public one by itself.

Review: Addresses in part 4, and Elastic IP addresses in the AWS docs.

Correct answer: C

A partition placement group splits servers into groups on separate racks, and it lets your software see which partition each server is in.

• A: This packs servers close together, so one hardware failure can reach many of them.
• B: This allows at most seven running servers per Availability Zone, far short of 60.
• D: Instance size gives you no control over which racks servers land on.

Review: Placement groups in part 4, and Placement strategies in the AWS docs.

Correct answer: A + E

Hibernation saves memory to the root volume, so that volume must be EBS and encrypted. And it can't be turned on for an existing server, whether running or stopped.

• B: The address type has nothing to do with hibernation.
• C: This is the opposite of what's needed, because instance store can't hold data through a stop.
• D: Hibernation doesn't need dedicated hardware.

Review: Hibernation in part 4, and Prerequisites for hibernation in the AWS docs.

Correct answer: D

A volume is tied to one Availability Zone, while a snapshot can create a new volume in any Availability Zone of the Region.

• A: The volume and the server must be in the same Availability Zone.
• B: Multi-Attach works only within one Availability Zone, and only on io1 and io2.
• C: There's no such setting.

Review: Snapshots in part 5, and Amazon EBS snapshots in the AWS docs.

Correct answer: B

st1 is a low-cost hard disk built for high throughput on frequently accessed data, which is what long sequential reads need.

• A: You'd pay for very high IOPS, which sequential reads don't rely on.
• C: This is for data accessed rarely, and its throughput is lower.
• D: This works, but it's an SSD, and costs more per gigabyte for this job.

Review: Volume types in part 5, and Amazon EBS volume types in the AWS docs.

Correct answer: A

EFS mounts on many Linux servers across Availability Zones at once, and it grows and shrinks by itself.

• B: Multi-Attach works within one Availability Zone only, and needs a file system built for it.
• C: Each server would have its own disk, so nothing is shared.
• D: This works, but you'd run the file server, size it yourself, and depend on one server in one zone.

Review: Shared file system in part 5, and How Amazon EFS works in the AWS docs.

Correct answer: C

Instance store sits inside the machine itself, which makes it very fast. Its data is lost when the server stops, and that's acceptable here because the files can be regenerated.

• A: This is a network disk, and it's slower than a local one.
• B: This is fast, but you'd pay for durability the job doesn't need.
• D: This is a network file system meant for sharing, not for the highest local speed.

Review: Local storage in part 5, and Data persistence for instance store in the AWS docs.

Correct answer: B

With an AMI, the software is already installed when the server boots. User Data can stay for the light settings that differ between servers.

• A: A larger server may install a little faster, but it still installs everything.
• C: Moving the script doesn't change the work it does.
• D: The same installation still has to run, only at another time.

Review: System images in part 5, and Amazon Machine Images in the AWS docs.

Correct answer: B

An ALB understands the content of HTTP requests, so one listener can send each path to its own target group.

• A: An NLB works with connections, and doesn't read the path of a request.
• C: This one is for passing traffic through security appliances.
• D: This uses an old type, and it splits the service across two domains.

Review: How an ALB routes requests in part 6, and Comparing load balancer types on the AWS site.

Correct answer: D

An NLB supports UDP and provides a static IP address in each Availability Zone, and you can assign your own Elastic IP addresses to it.

• A: An ALB is for HTTP and HTTPS, and its addresses aren't fixed.
• B: This one sends traffic through security appliances, and doesn't serve an application directly.
• C: This is an old type, and shouldn't be used for anything new.

Review: Types of load balancer in part 6, and Elastic Load Balancing features on the AWS site.

Correct answer: A

When the source of the servers' rule is the load balancer's security group, requests that come any other way don't get through, even if the address is known.

• B: Health checks watch the servers, and don't control who reaches them.
• C: This keeps a visitor on one server, and has nothing to do with direct access.
• D: Security group rules can only allow, so there's no deny rule to add.

Review: The right security groups in part 6, and Security groups for your Application Load Balancer in the AWS docs.

Correct answer: C

The server sees the load balancer's address, because the connection comes from it. The ALB passes the visitor's real address in this header.

• A: The requests would still arrive through the load balancer.
• B: This changes how requests are spread, not the address the server sees.
• D: This would remove the load balancer and its protection against failures.

Review: How an ALB routes requests in part 6, and X-Forwarded headers in the AWS docs.

Correct answer: B + D

Each server only knows its own sessions. Stickiness keeps a visitor on the same server, and a shared cache makes the session available to every server. The cache is the better design, because sessions survive when a server disappears.

• A: This spreads requests more evenly, and could still send a visitor to a different server.
• C: This concerns requests in progress on a server being removed.
• E: This only delays spotting failed servers.

Review: Settings worth knowing in part 6, and Target group attributes and Make services stateless in the AWS docs.

Correct answer: A

By default, the group looks only at the server's own status, and that's fine here. With ELB health checks on, it also treats a server the load balancer reports as failed as unhealthy, and replaces it.

• B: This allows more servers, but it doesn't replace the failed one.
• C: Scheduled actions change capacity at set times, and don't look at health.
• D: The template decides how servers launch, and the group sees no reason to launch one.

Review: Health checks in part 7, and Health checks for instances in an Auto Scaling group in the AWS docs.

Correct answer: C

The time is known in advance, so raise the capacity ahead of it, and leave a tracking policy to handle anything beyond that.

• A: This reacts after the load has arrived, so servers would be ready six minutes late.
• B: The maximum is only a ceiling, and it doesn't launch any servers by itself.
• D: This also reacts after the load has arrived, even with finer steps.

Review: When to grow and when to shrink in part 7, and Scheduled scaling in the AWS docs.

Correct answer: D

CPU doesn't reflect the load for this application. Requests per server measures the visitors directly, and it's available as a ready-made metric.

• A: CPU still wouldn't track requests, and the group would run more servers than it needs when quiet.
• B: The disk isn't what's limiting this application.
• C: This is the result of scaling, not a measure of load.

Review: When to grow and when to shrink in part 7, and Target tracking policies in the AWS docs.

Correct answer: B

Any server in a group can disappear at any moment, so nothing important should live on it. In S3, the file is available to every server, whatever happens to any of them.

• A: The group loses the savings from scaling in, and a failed server still takes its files with it.
• C: You'd have to manage snapshots, and could still lose up to an hour of uploads.
• D: This also blocks scaling in, and doesn't protect the files from a failed server.

Review: The key rule: a server is replaceable in part 7, and Make services stateless in the Well-Architected Framework.

Correct answer: C

Elastic Beanstalk creates these resources from your code, and they stay visible in your account. The service itself is free, and you pay for what it creates.

• A: Kubernetes takes far more to learn and run than this team needs.
• B: This scales servers, but you'd still build everything else yourself.
• D: A single server has no load balancer, no scaling, and no protection from failures.

Review: Elastic Beanstalk in part 7, and What is AWS Elastic Beanstalk? in the AWS docs.

Correct answer: D

This is immutable infrastructure: nothing changes on a running server. Every server comes from the same tested image, and going back means returning to the previous one.

• A: This is faster, but servers still change while running and can still drift apart.
• B: This helps bring back one server, and doesn't keep them alike.
• C: A server's size has nothing to do with patches.

Review: The key rule: a server is replaceable in part 7, and Use an instance refresh to update instances in an Auto Scaling group in the AWS docs.

Correct answer: A

A scaling plan can manage the capacity of all these resources in one place.

• B: This only scales the group's servers.
• C: This sets up and manages an application's environment, and doesn't gather existing services, tables and replicas into one plan.
• D: This only changes the group's size, at times you set.

Review: When to grow and when to shrink in part 7, and What is a scaling plan? in the AWS docs.

Correct answer: B

Multi-AZ keeps a synchronous standby in another Availability Zone. On failure, RDS points the same DNS name at it, so the application reconnects with no changes.

• A: A replica must be promoted by hand, and it has its own endpoint.
• C: Restoring takes time, and it creates a new database with a new endpoint.
• D: A larger server still sits in one Availability Zone.

Review: Multi-AZ and read replicas in part 8, and Multi-AZ deployments in the AWS docs.

Correct answer: D

A read replica serves those queries on a separate server, which leaves the production database alone. Its small lag is acceptable for these reports.

• A: The standby of a Multi-AZ instance can't serve reads.
• B: This adds disk space, and the problem is the load from queries.
• C: This means redesigning the data and rewriting the application.

Review: Read replicas in part 8, and Working with read replicas in the AWS docs.

Correct answer: A

Point-in-time restore always creates a new database with a new endpoint, using the automatic backups and transaction logs.

• B: A restore doesn't overwrite the existing database.
• C: Automatic backups are enough for this.
• D: The standby is a synchronous copy, so it received the same wrong UPDATE.

Review: Backups and restore in part 8, and Restoring to a specified time in the AWS docs.

Correct answer: C

RDS Proxy reuses a small pool of connections, and the application connects to it as if it were the database.

• A: This adds a standby, which doesn't accept any connections.
• B: Replicas are read-only, so they can't take the writes.
• D: This grows the disk, and the limit here is on connections.

Review: RDS Proxy in part 8, and Amazon RDS Proxy in the AWS docs.

Correct answer: A + D

Aurora separates storage from servers, and that shared storage layer is what keeps replica lag small and failover fast.

• B: Aurora is compatible only with MySQL and PostgreSQL.
• C: One server writes, and the readers only read.
• E: That's how RDS read replicas work, while Aurora's readers share storage.

Review: Aurora in part 8, and What is Amazon Aurora? in the AWS docs.

Correct answer: C

The answer rarely changes, so the database doesn't need to work it out again each time. Memory answers in under a millisecond, and even a short TTL removes most of the load.

• A: The standby doesn't serve reads, so the load stays the same.
• B: This buys capacity, but the same query still runs every time.
• D: Redshift is for large reports, not for answering a page quickly.

Review: What a cache is in part 9, and Caching strategies in the AWS docs.

Correct answer: A

A sorted set keeps players ordered by score and returns the top entries instantly, and Valkey supports replicas with automatic failover.

• B: Memcached stores simple values, and it has no copies in a cluster you design.
• C: Sorting millions of rows on every request puts heavy load on the database.
• D: S3 isn't built for a file that changes constantly and must be read live.

Review: Choosing an engine in part 9, and Comparing engines in the AWS docs.

Correct answer: D

Lazy loading alone leaves data stale until it expires. Handling the cache on each write keeps it current, and a shorter TTL limits the damage if a write is ever missed.

• A: This solves staleness, but brings all the load back to the database.
• B: This makes the problem worse.
• C: The stale value comes from the cache, not from the database.

Review: Write-through in part 9, and Caching strategies in the AWS docs.

Correct answer: B

When keys expire together, requests for all of them go to the database at the same moment. Randomizing the TTL spreads those expiries over time.

• A: The problem is in the database at the moment of expiry, not in the cache's size.
• C: Keys would never refresh, so stale data would stay.
• D: This protects the cache from failures, and the keys still expire together.

Review: TTL and eviction in part 9, and Best practices for TTLs and jitter in the AWS docs.

Correct answer: A + C

Evictions mean the cache is full and is pushing keys out, which turns into misses. Either make room with more memory, or stop filling it with what nobody reads.

• B: This helps the database, but it doesn't change the cache's memory.
• D: Encryption has nothing to do with evictions, and you'd lose its protection.
• E: S3 is far slower, and this removes the point of having a cache.

Review: Security and monitoring in part 9, and ElastiCache for e-commerce in the AWS docs.

Correct answer: B

Linked data, transactions and queries you can't fully predict all point to a relational database. It's the sensible default unless there's a clear reason otherwise.

• A: You'd design around known queries up front, and new reports would be hard to add.
• C: A cache isn't a source of truth, so it can't be where payments live.
• D: Neptune suits deep webs of connections, not ordinary linked tables.

Review: Relational or NoSQL? in part 10, and Choosing an AWS database service in the AWS docs.

Correct answer: D

The value here is in the relationships themselves, and Neptune is built to walk through large numbers of them with low latency.

• A: This works for one or two hops, but joins get heavy as the hops increase.
• B: You could store ready-made lists, but something still has to work them out.
• C: This is for readings over time, and has nothing to do with relationships.

Review: Services you'll come across in part 10, and Choosing an AWS database service in the AWS docs.

Correct answer: A

These are readings over time, which is what a time series database is built to store and aggregate.

• B: This is for connections between things.
• C: This is for JSON documents with varied fields.
• D: This is mainly for searching text and analyzing logs.

Review: Types of database in part 10, and What is Timestream for InfluxDB? in the AWS docs.

Correct answer: C

DocumentDB is compatible with MongoDB, so the application's document model and much of its code can stay as they are.

• A: This has a different API and data model, so the data access code would be rewritten.
• B: This is compatible with Cassandra, not MongoDB.
• D: This is relational, so the documents would need redesigning as tables.

Review: Services you'll come across in part 10, and What is Amazon DocumentDB? in the AWS docs.

Correct answer: B + E

Both move heavy analysis away from production. Redshift suits frequent, heavy reports, and Athena suits occasional questions without any servers to run.

• A: One heavy query can still hurt anything else running then, and it's a relational database that isn't built for this scale of analysis.
• C: A cache is a temporary copy, and far too small and costly for five years of data.
• D: The standby in a Multi-AZ instance can't be read from.

Review: Common mistakes in part 10, and What is Amazon Athena? in the AWS docs.

Correct answer: D

An Alias works on the root domain and follows the load balancer's changing addresses for you, and queries to AWS resources like this one are free.

• A: A CNAME isn't allowed on the root domain.
• B: Once the addresses change, the record points to the wrong place.
• C: A TXT record holds free text, and browsers don't use it to find a server.

Review: CNAME or Alias? in part 11, and Choosing between alias and non-alias records in the AWS docs.

Correct answer: A

Geolocation chooses by where the visitor is rather than by speed, which is what a licensing rule needs.

• B: This sends the visitor to the fastest Region, which could be Frankfurt.
• C: This splits traffic by percentages, whatever the visitor's country.
• D: This returns several healthy records, with no regard for country.

Review: Routing policies in part 11, and Geolocation routing in the AWS docs.

Correct answer: C

Route 53's checkers come from the internet, so they can't reach a private address. A CloudWatch alarm can watch a metric from the servers, and the health check follows the alarm.

• A: The checkers are outside the network, and can't reach a private address.
• B: This breaks the requirement that the servers stay private.
• D: This only combines other checks, and those still can't reach the servers.

Review: Health checks in part 11, and Configuring failover in a private hosted zone in the AWS docs.

Correct answer: B

Buying a name and answering for it are separate things. Once the registrar lists Route 53's name servers, Route 53 is the one answering.

• A: A transfer is optional, and isn't needed to manage the records.
• C: A private zone only answers inside the VPCs you choose, not for the public.
• D: This lets an office network ask about private names, and has nothing to do with public answers.

Review: A domain bought elsewhere in part 11, and Making Route 53 the DNS service for a domain that's in use in the AWS docs.

Correct answer: A + E

Weighted records split the answers by the shares you set, and a short TTL means a change reaches visitors quickly, since resolvers only remember an answer for that long.

• B: This chooses by place, not by a share of visitors.
• C: Resolvers would keep the old answer for up to a day, so going back would be slow.
• D: A Simple record gives you no way to set a share.

Review: Routing policies and Choosing a TTL in part 11, and Weighted routing in the AWS docs.

Correct answer: B

Global Accelerator carries any TCP or UDP over AWS's network from the nearest edge location, and gives you two static addresses that can go in a firewall.

• A: CloudFront serves HTTP and HTTPS, not a game's UDP traffic.
• C: This only picks a Region, so the traffic still crosses the public internet, and the addresses aren't static.
• D: This copies S3 objects, and has nothing to do with live game traffic.

Review: Global Accelerator: a faster road in part 12, and AWS Global Accelerator FAQs on the AWS site.

Correct answer: C

With OAC, CloudFront signs its requests to S3 and the bucket policy accepts only those, so the bucket stays closed to everyone else.

• A: This limits countries inside CloudFront, and the bucket's URL stays open.
• B: This controls who gets through CloudFront, and the bucket's URL stays open.
• D: This clears copies from the cache, and changes nothing about who can reach the bucket.

Review: Origins in part 12, and Restrict access to an Amazon S3 origin in the AWS docs.

Correct answer: D

A behavior applies its own rules to a path pattern, so one distribution on one domain can keep images for a long time and pass the API straight through.

• A: This splits the site across two domains for no need.
• B: Invalidations take time and aren't made for every request, and the paths stop being free after the monthly allowance.
• C: This doesn't cache anything, so it does nothing for the images.

Review: What gets cached, and for how long? in part 12, and Cache behavior settings in the AWS docs.

Correct answer: A

A new version means a new URL, so visitors get the new copy at once, with no waiting for the old one to expire and no invalidations to run.

• B: Visitors would keep the old copy for even longer.
• C: This gives up the speed, and puts the load back on the origin.
• D: This adds more copies to keep in sync, and the old one stays in the cache.

Review: Clearing the cache in part 12, and Use file versioning to update or remove content in the AWS docs.

Correct answer: B + D

Every extra value in the key splits one page into many copies, and a short lifetime sends requests back to the origin soon after. With both fixed, more visitors find a ready copy.

• A: This empties the cache, so the problem gets worse.
• C: This doesn't cache, so requests would still reach the origin.
• E: It would have the same key and lifetime, so the same problem would repeat.

Review: What gets cached, and for how long? in part 12, and Increase the proportion of requests that are served directly from the CloudFront caches in the AWS docs.

Correct answer: A

A subnet becomes public when its route table points to an internet gateway. Without that route, packets have no way out, even with a public address.

• B: NAT lets private servers go out, and accepts no connection started from outside.
• C: A security group remembers the connection, so the reply goes out automatically.
• D: Peering connects two VPCs, and gives no path to the internet.

Review: Route tables and the internet gateway in part 13, and Enable internet access for a VPC using an internet gateway in the AWS docs.

Correct answer: D

AWS reserves 5 addresses in every subnet. A /27 has 32, which leaves 27, so it falls short. A /26 has 64, which leaves 59.

• A: The smallest subnet AWS allows is /28, so this can't even be created.
• B: This leaves only 11 usable addresses.
• C: This leaves 27 usable addresses, three short of what's needed.

Review: Subnets in part 13, and Subnet CIDR blocks in the AWS docs.

Correct answer: B

A zonal NAT Gateway lives in one zone, so that zone's failure cuts off everyone relying on it. With one in each zone, a failure stays in its own zone. A Regional NAT Gateway gets you the same result automatically.

• A: A VPC has one internet gateway, and private subnets don't route to it.
• C: More addresses don't move it out of the failed zone.
• D: A NAT Gateway sits in a public subnet, and this would cut it off from the internet.

Review: NAT Gateway: out without in in part 13, and NAT gateway basics in the AWS docs.

Correct answer: C

A NACL doesn't remember connections, and a new one denies everything you haven't allowed, so the replies need their own rule. Inbound accepted with outbound rejected points straight at the NACL.

• A: A security group can only allow, so it can't hold a deny rule.
• B: A security group remembers the connection, so it was already letting the reply out.
• D: This would block the requests as well.

Review: Two firewalls: security groups and NACLs and Flow Logs in part 13, and Custom network ACLs for your VPC in the AWS docs.

Correct answer: C + E

Both reach the server with no public address and no extra server to run. Session Manager also needs no port 22, and it logs sessions.

• A: This is the extra server the team wants to avoid.
• B: A NAT Gateway only lets traffic out, and accepts no connection started from outside.
• D: This gives the servers public addresses, which is what must be avoided.

Review: How do you reach a private server? in part 13, and Session Manager and EC2 Instance Connect Endpoint in the AWS docs.

Correct answer: B

An EC2 server normally has to be the source or destination of its traffic. A NAT instance passes on traffic for others, so this check has to be off.

• A: Private servers go out through the NAT instance's address, and don't need their own.
• C: The public subnet only needs its route to the internet gateway, and this adds nothing.
• D: Gateway endpoints reach S3 and DynamoDB, not the internet.

Review: NAT Gateway: out without in in part 13, and Enable private resources to communicate outside the VPC in the AWS docs.

Correct answer: C

A gateway endpoint adds a route to DynamoDB that skips NAT, with no extra charge and no code changes.

• A: This exposes servers that should stay private, and public addresses cost money too.
• B: DynamoDB isn't a VPC you can peer with.
• D: This links your own site to AWS, and has nothing to do with traffic inside the VPC.

Review: VPC endpoints: AWS services without the internet in part 14, and Gateway endpoints for Amazon DynamoDB in the AWS docs.

Correct answer: B

With PrivateLink, each consumer gets a private interface in its own subnet that leads only to that service, so overlapping ranges cause no conflict.

• A: Peering doesn't work with overlapping ranges, and it connects whole networks.
• C: Gateway endpoints are only for S3 and DynamoDB.
• D: This puts an internal API on the internet.

Review: VPC endpoints: AWS services without the internet in part 14, and AWS PrivateLink in the AWS docs.

Correct answer: A

Site-to-Site VPN crosses the internet through an encrypted tunnel, and can be set up quickly at low cost.

• B: Setting it up takes weeks or months, and it costs more at first.
• C: This is for individual employees' devices, rather than a whole office network.
• D: This connects VPCs to each other, and can't reach an office.

Review: Connecting your office: Site-to-Site VPN in part 14, and What is AWS Site-to-Site VPN? in the AWS docs.

Correct answer: D

Transit Gateway is a central hub for VPCs and VPNs, its route tables decide who talks to whom, and it can be shared across accounts through RAM.

• A: Thirty networks would need 435 connections, each with its own routes.
• B: This connects offices to each other through one gateway, not a set of VPCs.
• C: Peering isn't transitive, so the others couldn't reach each other through it.

Review: Transit Gateway: one hub in part 14, and What is AWS Transit Gateway for Amazon VPC? in the AWS docs.

Correct answer: A + C

A second line in a second location keeps the bank connected if a line or a whole location fails. MACsec or a VPN on top adds the encryption the line doesn't have by default.

• B: A faster line is still one line, and still unencrypted.
• D: This reaches S3 and DynamoDB from inside a VPC, and has nothing to do with the line.
• E: This is still one line, and a partner doesn't encrypt it for you.

Review: Direct Connect: a private line in part 14, and Encryption in AWS Direct Connect and AWS Direct Connect Resiliency Toolkit in the AWS docs.

Correct answer: C

With versioning on, a delete only adds a marker and an overwrite creates a new version, so the old data stays and you can go back to it.

• A: This stops public access, and does nothing about deletes or overwrites.
• B: This needs versioning on anyway, and adds a second bucket to pay for.
• D: This speeds up uploads over long distances, and keeps no old copies.

Review: Versioning in part 15, and Retaining multiple versions of objects with S3 Versioning in the AWS docs.

Correct answer: A

CloudFront gives you HTTPS on your own domain, and OAC lets only CloudFront read from the bucket, so the bucket stays closed.

• B: The website endpoint only works over HTTP, and the bucket has to be public.
• C: The website endpoint needs public objects, so with the lock on visitors get 403.
• D: This adds a server to run and patch for a site that doesn't need one.

Review: Hosting a static site in part 15, and Website endpoints in the AWS docs.

Correct answer: D

Multipart upload sends a file in parts, in parallel, and if one part fails you repeat only that part. It's also required for anything above 5 GB.

• A: These are for downloading part of a file, not for uploading.
• B: This shortens the path over long distances, but a failed upload would still start over.
• C: This keeps old versions, and doesn't help an upload finish.

Review: Performance in part 15, and Uploading and copying objects using multipart upload in the AWS docs.

Correct answer: B

A replication rule copies only new objects, so existing ones need Batch Replication. Together they give you a full copy in the second Region that stays current.

• A: This copies only the objects written after the rule is set.
• C: This keeps the copy in the same Region, which doesn't meet the requirement.
• D: Lifecycle rules change a file's class or delete it, and don't move it between Regions.

Review: Replication in part 15, and Replicating objects within and across Regions in the AWS docs.

Correct answer: A + D

A role gives the server temporary credentials with no keys to store, and a bucket policy is how you let another account in. Neither of them makes anything public.

• B: Keys in a file can leak, and a role avoids them altogether.
• C: This exposes the data to everyone, and the lock would stop it anyway.
• E: This adds copies to manage, and a volume isn't how another account reads your data.

Review: Who can reach it? in part 15, and Example 2: Bucket owner granting cross-account bucket permissions and Use an IAM role to grant permissions to applications running on Amazon EC2 instances in the AWS docs.

Correct answer: D

It watches each file's use and moves it between tiers by itself, for a small monitoring fee and with no retrieval fees.

• A: This charges for every retrieval, so a heavily read file can end up costing more.
• B: This also charges for retrieval, and keeps data in a single Availability Zone.
• C: Files here need a restore before reading, which can take hours.

Review: Intelligent-Tiering: when you don't know in part 16, and Managing storage costs with Amazon S3 Intelligent-Tiering in the AWS docs.

Correct answer: B

The copies can be regenerated, so losing them with a zone isn't a disaster, and there's no need to pay for three zones. Retrieval stays instant.

• A: This works, but at a higher price for protection this data doesn't need.
• C: A restore here takes 12 to 48 hours.
• D: Files here need a restore before reading, which takes minutes to hours.

Review: The classes in part 16, and Understanding and managing Amazon S3 storage classes in the AWS docs.

Correct answer: A

A lifecycle rule moves files to a cheaper class at the age you set and deletes them later, with nothing for you to run.

• B: This works, but it's code you have to write and maintain.
• C: This shows you numbers, and doesn't move or delete anything.
• D: This makes more copies, and neither archives nor removes the originals.

Review: Lifecycle in part 16, and Managing the lifecycle of objects in the AWS docs.

Correct answer: C

In this class a file has to be restored before it can be read, and Expedited typically makes a file this size available in 1 to 5 minutes.

• A: A missing permission returns AccessDenied, not this error.
• B: This is the cheapest option, but it takes 5 to 12 hours.
• D: Lifecycle moves only go down the stairs, never back up to Standard.

Review: Glacier Flexible and Deep Archive: request before reading in part 16, and Understanding archive retrieval options in the AWS docs.

Correct answer: B + C

A 10 KB image is billed as 128 KB in this class, and its low storage price only pays off for data that's rarely read. Data this small and this busy belongs in Standard.

• A: The monitoring fee belongs to Intelligent-Tiering.
• D: It costs less per gigabyte, which is why it looks attractive.
• E: It uses three or more zones just like Standard, so the extra cost doesn't come from there.

Review: The classes in part 16, and Understanding and managing Amazon S3 storage classes in the AWS docs.

Correct answer: B

Reading an SSE-KMS object needs permission on S3 and on the KMS key together, which is why this error appears even when the S3 policy is right.

• A: These lower the number of KMS requests and the cost, and don't grant any permission.
• C: CORS is a browser rule, and has nothing to do with a role's permissions.
• D: This enforces HTTPS, and it denies rather than grants.

Review: Watch out with SSE-KMS in part 17, and Using server-side encryption with AWS KMS keys in the AWS docs.

Correct answer: D

A pre-signed URL carries a signature and an expiry and works with the signer's permissions, so the bucket stays private.

• A: Anyone could read any invoice this way, at any time.
• B: Creating and managing users for customers is heavy, and there's no need for it.
• C: This is a browser permission between sites, and doesn't open private files to anyone.

Review: Sharing a private file: signed links in part 17, and Download and upload objects with presigned URLs in the AWS docs.

Correct answer: A

CORS is a browser protection. The browser asks the bucket whether this origin is allowed, while curl doesn't ask, which is why only the browser complained.

• B: The request already succeeds from curl, so access isn't the problem.
• C: Encryption has nothing to do with the origins a browser accepts.
• D: This keeps old versions, and changes nothing the browser checks.

Review: CORS: when the browser stops you in part 17, and Using cross-origin resource sharing (CORS) in the AWS docs.

Correct answer: C

In Compliance mode, no user can delete or overwrite a locked version until its period ends, including the root user, and the period can't be shortened.

• A: This only asks for an MFA code, so the root user holding that device can still delete.
• B: Users with a special permission can still delete in this mode.
• D: Someone with enough permissions can simply change the policy.

Review: Object Lock modes in part 17, and Locking objects with Object Lock in the AWS docs.

Correct answer: C + E

The policy rejects any unencrypted request, and with SSE-KMS you can audit the use of the key in CloudTrail.

• A: This stops public access, and doesn't look at HTTP or HTTPS.
• B: S3 holds the key entirely here, so you get no record of each use.
• D: This protects against deletion, and meets neither requirement.

Review: Encryption at rest and Encryption in transit in part 17, and Security best practices for Amazon S3 and Using server-side encryption with AWS KMS keys in the AWS docs.

Correct answer: A

This gives Windows applications a real SMB file share tied into Active Directory, and AWS runs it for you.

• B: EFS is a shared file system for Linux, over NFS.
• C: This is for high-performance computing, and works with Linux devices only.
• D: S3 is reached through an API, and isn't a folder an application can open over SMB.

Review: Amazon FSx: ready-made file systems in part 18, and What is FSx for Windows File Server? in the AWS docs.

Correct answer: C

Lustre is built for this speed and integrates with S3, and Scratch is the cheap option for temporary data, since nothing here depends on the data surviving a failure.

• A: This is for SMB file shares, not high-performance Linux clusters.
• B: This suits long-term data, and you'd pay for copies the team doesn't need.
• D: This is a general shared folder, and isn't built for this level of performance.

Review: Amazon FSx: ready-made file systems in part 18, and Deployment and storage class options for FSx for Lustre file systems in the AWS docs.

Correct answer: B

This presents a virtual tape library to the backup software, and the data goes to S3 and then Glacier.

• A: This shows applications an NFS or SMB folder, while this software writes to tape.
• C: This shows servers an iSCSI disk, not a tape library.
• D: This receives files over protocols such as SFTP, which tape-based software doesn't use.

Review: Storage Gateway: your office and the cloud in part 18, and What is Tape Gateway? in the AWS docs.

Correct answer: D

The team takes its own storage devices to a physical AWS site with a high-speed connection and uploads from there, so the slow line no longer matters.

• A: At full speed, 100 TB over this line takes about 93 days.
• B: This is closed to new customers.
• C: Setting it up takes weeks and sometimes months, so it could miss the deadline.

Review: When your data outgrows the internet in part 18, and What is Data Transfer Terminal? in the AWS docs.

Correct answer: B + E

DataSync copies the NFS data, and on each later run moves only what changed. Transfer Family gives partners a managed SFTP endpoint, with their files going to S3 or EFS.

• A: This is for backup software that writes to tape.
• C: This is a high-performance file system, and doesn't move data out of a data center.
• D: This shows on-site servers an iSCSI disk, and the company is leaving its site.

Review: DataSync and Transfer Family in part 18, and How AWS DataSync works and What is AWS Transfer Family? in the AWS docs.

Correct answer: B

The queue holds the orders, and workers write them at a pace the database can handle. It suits this case because the customer doesn't need the final answer immediately.

• A: Replicas serve reads, and the overload here comes from writes.
• C: SNS delivers right away and doesn't store messages, so the peak would still arrive all at once.
• D: The standby takes no load, so the overload stays.

Review: Scaling with the queue in part 19, and What is Amazon Simple Queue Service? in the AWS docs.

Correct answer: A

After 30 seconds the message reappears while the first worker is still on it, so another worker takes it too. The timeout has to be longer than the work.

• B: This cuts empty responses, and doesn't change when a message reappears.
• C: This catches messages that keep failing, and these ones are succeeding, repeatedly.
• D: More workers would only pick up the reappearing messages faster.

Review: Visibility timeout in part 19, and Amazon SQS visibility timeout in the AWS docs.

Correct answer: D

SNS delivers one message to every subscriber, and each service's queue holds it until that service is ready. A new service simply subscribes a new queue.

• A: Each message goes to only one consumer, so the other services would miss it.
• B: The publisher would need changing with every new service.
• C: SNS only retries for a while and doesn't store messages, so a long outage could lose them.

Review: Fan-out: SNS with SQS in part 19, and What is Amazon SNS? in the AWS docs.

Correct answer: C

Records stay in the stream for the retention period whether they've been read or not, and each consumer reads from its own position, so one can go back without disturbing the others. The default retention is only 24 hours.

• A: A message goes to one consumer, and it's gone once deleted.
• B: SNS doesn't store messages, so there's nothing to re-read.
• D: This buffers data and delivers it to storage, so it offers neither instant reads nor replay.

Review: Kinesis Data Streams: a stream that stays in part 19, and Change the data retention period in the AWS docs.

Correct answer: B + D

A FIFO queue keeps order within a message group and removes duplicates within a 5-minute window, and a group for each account lets different accounts run in parallel.

• A: This doesn't guarantee order, and a message can arrive twice.
• C: This forces every transaction into one line, so nothing runs in parallel.
• E: This gives workers more time, and has no effect on order.

Review: FIFO queues in part 19, and FIFO queue delivery logic in Amazon SQS in the AWS docs.

Correct answer: D

It takes live video from devices, stores it, and lets you watch or process it, live or later.

• A: This delivers records to storage, and isn't built for live video from devices.
• B: A message holds up to 1 MiB, which doesn't suit video.
• C: This pushes short messages to subscribers, and stores nothing.

Review: Kinesis Data Streams: a stream that stays in part 19, and What is Amazon Kinesis Video Streams? in the AWS docs.

Correct answer: D

The task role belongs to your code inside the container. The task's normal start shows the execution role is already doing its job.

• A: ECS uses this one to prepare the task, such as pulling the image and sending logs.
• B: A security group controls network traffic, and this error is about permissions.
• C: Fargate has no servers for you to attach anything to, so instance profiles aren't available.

Review: Two IAM roles, and confusing them is a classic in part 20, and Amazon ECS task IAM role in the AWS docs.

Correct answer: B

EKS runs the Kubernetes control plane for you, and the team's tools keep working, here and elsewhere.

• A: This is a fine start for most applications, but it's AWS's own system, not Kubernetes.
• C: This builds an ECS web service from an image, and it isn't Kubernetes either.
• D: This runs functions in response to events, and has no Kubernetes in it.

Review: ECS or EKS? in part 20, and What is Amazon EKS? in the AWS docs.

Correct answer: C

The schedule starts a task that stops when it's done, and on Fargate you pay only while it runs.

• A: You'd pay for a task 24 hours a day, for two hours of work.
• B: A Lambda run ends at 15 minutes, far short of two hours.
• D: You'd pay for the server around the clock, and have to manage it too.

Review: Not just web services in part 20, and Using Amazon EventBridge Scheduler to schedule Amazon ECS tasks in the AWS docs.

Correct answer: A

EFS is a shared file system that tasks can mount on both Fargate and EC2, and the files live outside any one task.

• B: A container's disk disappears with it, and isn't shared with other tasks.
• C: This is a temporary disk on a server, and Fargate gives you no server to attach it to.
• D: This stores container images, not application files.

Review: Storage in part 20, and Use Amazon EFS volumes with Amazon ECS in the AWS docs.

Correct answer: A + E

Service Auto Scaling changes the number of tasks, and a capacity provider adds servers when tasks need them. On EC2 you need both layers.

• B: This lets ECS pull images and send logs, and has nothing to do with scaling.
• C: This looks for vulnerabilities in images.
• D: This spreads traffic across the tasks that exist, and doesn't add any.

Review: Scaling in part 20, and Automatically scale your Amazon ECS service and Amazon ECS capacity providers for EC2 workloads in the AWS docs.

Correct answer: B

ECS Anywhere registers your own servers or virtual machines in an ECS cluster, so the team keeps its tools.

• A: These are Kubernetes components to run and support yourself, and the team uses ECS.
• C: This runs tasks on AWS capacity at a lower price, not on your servers.
• D: This runs in AWS, and no longer accepts new customers.

Review: Containers on your own servers in part 20, and Amazon ECS clusters for external instances in the AWS docs.

Correct answer: C

Once attached to a VPC, a function loses its internet access unless its subnet goes through a NAT gateway.

• A: A public subnet gives the function neither internet access nor a public address.
• B: There's no path to the internet, so more time won't help.
• D: This handles database connections, and the problem is the path out.

Review: Lambda inside a VPC in part 21, and Enable internet access for VPC-connected Lambda Event Functions in the AWS docs.

Correct answer: D

A global secondary index organizes the data by a different key, so you can query by status directly.

• A: This reads every item each time, so it gets slower and costlier as the table grows.
• B: DynamoDB has no joins.
• C: This speeds up reads you can already do, and doesn't add a new way to query.

Review: Tables, items and keys in part 21, and Using Global Secondary Indexes in DynamoDB in the AWS docs.

Correct answer: A

DAX is a cache in front of the table that works with DynamoDB's API, so it takes only minimal changes.

• B: This can be fast too, but your application has to manage what goes in and out of the cache.
• C: This places copies in several Regions, and doesn't bring reads down to microseconds.
• D: This is a log of changes, and doesn't speed up reads.

Review: Additions worth knowing in part 21, and In-memory acceleration with DynamoDB Accelerator (DAX) in the AWS docs.

Correct answer: B

REST APIs have all of these. HTTP APIs are simpler and cheaper because they leave such features out.

• A: This has neither API keys nor caching.
• C: This is for two-way connections, such as chat.
• D: This is a direct link to a function, without any of these extras.

Review: API Gateway: the front door in part 21, and Choose between REST APIs and HTTP APIs in the AWS docs.

Correct answer: A + C

Reserved concurrency sets aside a share for checkout that no other function can take, and Provisioned Concurrency keeps environments ready so they have no cold start.

• B: This lowers startup time without guaranteeing to remove it, and can't be combined with Provisioned Concurrency.
• D: This adds temporary disk space, and has nothing to do with either problem.
• E: CPU rises with memory, so this would make responses slower.

Review: Concurrency and Cold starts in part 21, and Configuring reserved concurrency for an Event Function and Configuring provisioned concurrency for an Event Function in the AWS docs.

Correct answer: C

One RCU covers one strongly consistent read per second of up to 4 KB, so a 6 KB item needs two. Fifty reads per second need 100.

• A: This counts each read as half a unit, which doesn't cover a 6 KB item.
• B: This would be enough if the same reads were eventually consistent.
• D: This multiplies by the item's size, while units are counted per 4 KB.

Review: Capacity modes in part 21, and DynamoDB provisioned capacity mode in the AWS docs.

Correct answer: D

A Standard workflow can last up to a year, its definition holds the retries, failures and waiting, and the console shows you each execution's path as a drawing.

• A: These run for at most five minutes, so they can't wait for days.
• B: The retries and failure handling end up in your code, and nothing shows you where an order is.
• C: This delivers to every subscriber at once, with no order between the steps.

Review: Step Functions: workflows in part 22, and Choosing workflow type in Step Functions in the AWS docs.

Correct answer: A

The Identity Pool swaps the token for temporary keys tied to an IAM role, and a policy variable limits them to that user's folder.

• B: A User Pool token says who the user is, and it isn't a set of AWS keys.
• C: IAM is for your team and services, not for huge numbers of app users.
• D: Anyone could pull these keys out of the app, and they'd work for everyone's folders.

Review: Cognito: your users in part 22, and Amazon Cognito identity pools and IAM roles in the AWS docs.

Correct answer: B

The request finishes once the user is written, and the email happens through an event, so a failed email doesn't affect the sign-up.

• A: Users would wait even longer, and failures would still reach them.
• C: This removes cold starts, and the slowness comes from the email.
• D: Retrying inside the request makes users wait even longer.

Review: Design two: a global website in part 22, and DynamoDB Streams and AWS Lambda triggers in the AWS docs.

Correct answer: C

The files don't change, so they suit caching very well. Most requests stop at the edge, the group barely has to grow, and data going out through CloudFront costs less than going out directly.

• A: The servers would still handle every download, and the same data would still go out.
• B: This is a rewrite, and API Gateway's 10 MB limit is too small for large files.
• D: This shortens the road but doesn't cache, so every download still reaches the servers.

Review: A cheap win: CloudFront in front of what you have in part 22, and What is Amazon CloudFront? in the AWS docs.

Correct answer: A + E

An event can be delivered more than once, so a duplicate has to be harmless. And a dead-letter queue keeps what failed so you can inspect it, rather than losing it silently.

• B: This makes the function faster, and duplicates still arrive.
• C: This eases cold starts, and has nothing to do with either problem.
• D: This keeps environments ready, and has nothing to do with either problem.

Review: Design principles in part 22, and How Lambda handles errors and retries with asynchronous invocation and Capturing records of Lambda asynchronous invocations in the AWS docs.

Correct answer: C

This is a data warehouse's job. Redshift stores data by column and splits each query across many nodes, so heavy, repeated reports run fast.

• A: This suits occasional questions, and with this many queries you'd pay for every scan.
• B: This takes load off production, but it still stores data by row and isn't built for this scale of analysis.
• D: This is for text search and log analysis.

Review: Athena or Redshift? in part 23, and What is Amazon Redshift? in the AWS docs.

Correct answer: A

A Glue ETL job runs Spark with no servers to manage, and job bookmarks remember what's been processed, so each run handles only the new files.

• B: A crawler works out the columns and updates the catalog, and doesn't convert anything.
• C: This could do the conversion, but it's a cluster you'd have to run.
• D: This moves files between classes, and doesn't change their format.

Review: AWS Glue: preparing the data in part 23, and Tracking processed data using job bookmarks in the AWS docs.

Correct answer: D

Lake Formation grants access down to the column and row, and those permissions apply through services like Athena.

• A: S3 knows about files, not the columns inside them.
• B: A crawler only describes the data, and controls nobody's access.
• C: This gives a team its own door to a bucket, and still works at the level of files.

Review: Lake Formation: permissions for the lake in part 23, and Data filtering and cell-level security in Lake Formation in the AWS docs.

Correct answer: B

OpenSearch finds any word in any field. Streams and Lambda keep it up to date, so you search there, then fetch the full item from the table.

• A: An index finds items by key, not by any word inside a long text.
• C: This reads the whole table for every search, so it's slow and costly.
• D: This speeds up reads by key, and adds no text search.

Review: OpenSearch in part 23, and Loading streaming data into Amazon OpenSearch Service in the AWS docs.

Correct answer: B + E

Athena charges for the data it scans. Parquet lets a query read only its columns, and partitions let it skip the other months.

• A: Files in this class have to be restored before they can be read.
• C: The price depends on what's read, not on when.
• D: This keeps old versions, and changes nothing about what a query reads.

Review: Read less, pay less in part 23, and Use columnar storage formats and Partition your data in the AWS docs.

Correct answer: A

Data Exchange is where you find other companies' data sets and subscribe to them.

• B: This receives files over SFTP and the like, so the provider would still have to send them to you.
• C: This describes data you already have, and doesn't bring in new data.
• D: You'd have to write what feeds it, which is the work the team wants to avoid.

Review: How does the data arrive? in part 23, and What is AWS Data Exchange? in the AWS docs.

Correct answer: B

Textract understands a document's structure, so it returns forms as field-and-value pairs, and tables as rows and columns.

• A: This can read words in an image, but it doesn't understand forms and tables.
• C: This extracts meaning from text you already have, and doesn't read scanned files.
• D: This turns speech into text.

Review: Documents: Textract in part 24, and What is Amazon Textract? in the AWS docs.

Correct answer: D

Knowledge Bases finds the relevant passages and hands them to a model along with the question, so there's nothing to train.

• A: This no longer accepts new customers, and AWS points to Knowledge Bases instead.
• B: This needs machine learning expertise, and answering from documents doesn't need a trained model.
• C: This builds bots around intents you define, and doesn't answer from documents by itself.

Review: Knowledge Bases: answers from your documents in part 24, and Retrieve data and generate AI responses with Amazon Bedrock Knowledge Bases in the AWS docs.

Correct answer: A

This is predicting from data only the bank has, which needs a model of its own. SageMaker AI covers preparing the data, training, then serving predictions from an endpoint.

• B: This starts from a ready model, and doesn't train a prediction model on the bank's records.
• C: This builds recommendations from user behavior, such as "you might also like".
• D: This extracts meaning from text, such as sentiment and entities.

Review: Your own model: SageMaker AI in part 24, and Amazon Bedrock or Amazon SageMaker AI? in the AWS docs.

Correct answer: C

Transcribe turns each recording into text, and Comprehend's sentiment analysis shows which calls were negative.

• A: Polly does the opposite of what's needed, turning text into speech.
• B: Rekognition analyzes images and video, and Translate only changes the language.
• D: Textract reads documents, and Personalize builds recommendations.

Review: Chaining services in part 24, and What is Amazon Transcribe? and Sentiment in the AWS docs.

Correct answer: C + E

Comprehend supports Arabic, including sentiment, and Translate handles the translation.

• A: This reads documents, and it doesn't support Arabic.
• B: This voices text, and doesn't analyze or translate it.
• D: This analyzes images and video.

Review: And Arabic? in part 24, and Languages supported in Amazon Comprehend and Supported languages and language codes in the AWS docs.

Correct answer: B

The default metrics come from outside the server, so they don't include memory. The agent sends it from inside, and then you can put an alarm on it.

• A: This sends the same metrics more often, and memory still isn't among them.
• C: This records who called what, not how a server is performing.
• D: This records resource settings, not what's happening inside a server.

Review: CloudWatch metrics in part 25, and Metrics collected by the CloudWatch agent in the AWS docs.

Correct answer: D

CloudTrail records who called what, when and from where. Management events like this one stay there for 90 days, with nothing to set up.

• A: These show numbers over time, not who did anything.
• B: These show the traffic that was accepted or rejected, not who changed a rule.
• C: This searches logs your applications send, not the calls made to AWS.

Review: CloudTrail: who did what in part 25, and Working with CloudTrail event history in the AWS docs.

Correct answer: A

A Config rule judges each bucket's settings and marks it as non-compliant, and a remediation can run a Systems Manager Automation document to fix it. On its own, a rule prevents nothing.

• B: Size says nothing about who can reach the bucket.
• C: This spots unusual activity, and doesn't judge or fix settings.
• D: This searches logs when you ask, and fixes nothing.

Review: AWS Config: your settings over time in part 25, and Remediating Noncompliant Resources with AWS Config in the AWS docs.

Correct answer: C

CloudTrail records the call, EventBridge matches it, and SNS tells you right away.

• A: This finds them eventually, which could be days too late.
• B: A dashboard nobody's looking at alerts nobody.
• D: This judges settings, and doesn't react to a deleted table or a sign-in.

Review: CloudTrail: who did what in part 25, and AWS service events delivered via AWS CloudTrail in the AWS docs.

Correct answer: A + D

Logs are kept forever by default, so a retention period removes the old ones. A subscription filter delivers matching lines in near real time.

• B: This is a batch job that isn't immediate, and the originals stay and keep costing money.
• C: This sends EC2 metrics more often, and has nothing to do with logs.
• E: This records operations inside resources, and has nothing to do with your log bill or error lines.

Review: CloudWatch Logs in part 25, and Working with log groups and log streams and Real-time processing of log data with subscriptions in the AWS docs.

Correct answer: C

X-Ray follows each request across your services and their calls, and shows which step is slow or failing.

• A: This records who called which API, not how long each step of a request took.
• B: This records resource settings.
• D: This shows top contributors, such as the addresses sending the most requests, not a request's path.

Review: X-Ray: following one request in part 25, and What is AWS X-Ray? in the AWS docs.

Correct answer: B

It shows the events affecting AWS services and your resources, with no setup and at no cost.

• A: This shows the calls made in your account, and those didn't change here.
• C: This shows how your settings changed, and those didn't change here.
• D: This checks your account against best practices, and doesn't report outages.

Review: Other views in part 25, and What is AWS Health? in the AWS docs.

Correct answer: C

An SCP sets a ceiling for every user and role in the accounts beneath it, including the root user. It grants nothing, so people still need their own IAM permissions.

• A: An account's administrators could simply change these.
• B: This limits one user or role at a time, and an administrator could remove it.
• D: This marks resources as non-compliant, and stops nothing.

Review: Service Control Policies (SCPs) in part 26, and Service control policies (SCPs) in the AWS docs.

Correct answer: A

A permissions boundary sets the maximum for a user or role and grants nothing itself, so a role can never go beyond it, whatever policy it's given.

• B: This limits the whole account, while other work in it may need other services.
• C: A written rule stops nobody.
• D: These give people access to accounts, and don't limit the roles they create.

Review: Permissions boundaries in part 26, and Permissions boundaries for IAM entities in the AWS docs.

Correct answer: D

Employees sign in once and see the accounts and roles available to them, with temporary credentials. A permission set becomes a role in each account you assign it to.

• A: This means thousands of users and long-term keys to manage.
• B: This loses track of who did what, and shares long-term keys.
• C: This builds a landing zone and creates accounts, and doesn't give people their sign-in by itself.

Review: IAM Identity Center: one sign-in in part 26, and Manage AWS accounts with permission sets in the AWS docs.

Correct answer: B

With a resource policy the application keeps its own permissions, so it can use the table in A and the bucket in B at once.

• A: While in that role it gives up its original permissions, so it loses the table in A.
• C: An SCP grants nothing.
• D: A boundary grants nothing.

Review: A role or a resource policy? in part 26, and Cross account resource access in IAM in the AWS docs.

Correct answer: B + D

S3 actions work at two levels: listing applies to the bucket and reading applies to the objects, so each needs its own ARN.

• A: Listing applies to the bucket, so this ARN gives AccessDenied.
• C: Reading applies to objects, so this ARN gives AccessDenied.
• E: This works, but it gives far more than needed, on every bucket.

Review: A classic S3 mistake in part 26, and Grant read and write access to Amazon S3 bucket objects in the AWS docs.

Correct answer: D

The job calls AssumeRole, and STS checks the role's trust policy and returns temporary credentials, so there are no long-term keys to store.

• A: These are the long-term keys the team forbids.
• B: Roles aren't copied between accounts, and access still needs a trust policy.
• C: An SCP grants nothing.

Review: A role or a resource policy? in part 26, and Temporary security credentials in IAM in the AWS docs.

Correct answer: B

The pipeline proves who it is with a token from GitHub and gets temporary credentials through the role, so there are no keys to store.

• A: This shortens the keys' life, and they're still stored.
• C: This is for people signing in, not for systems such as a pipeline.
• D: This is for your application's users, not for access to your AWS account.

Review: Federation: identities from outside in part 26, and Identity providers and federation into AWS in the AWS docs.

Correct answer: A

Secrets Manager changes the password on a schedule and updates the database too. The application asks for the current value each time, so it doesn't notice.

• B: This stores the value encrypted, but has no built-in rotation.
• C: This rotates an encryption key, not a database password.
• D: Someone would have to change it by hand on every server.

Review: Secrets Manager in part 27, and Rotate AWS Secrets Manager secrets in the AWS docs.

Correct answer: C

AWS managed keys can't be shared, so the snapshot has to be re-encrypted with your own key first. The other account then needs access to both the snapshot and the key.

• A: AWS managed keys can't be shared with other accounts.
• B: Only unencrypted snapshots can be shared publicly, and this would expose the data to anyone.
• D: An encrypted snapshot can't simply be switched to unencrypted.

Review: Key policies in part 27, and Share an Amazon EBS snapshot with other AWS accounts in the AWS docs.

Correct answer: D

CloudFront needs its certificate in us-east-1, wherever your application is. The ALB keeps using the one in its own Region.

• A: A normal ACM certificate can't be exported.
• B: The application can stay where it is, and only CloudFront's certificate has to be there.
• C: A renewal doesn't change a certificate's Region.

Review: ACM: certificates without the hassle in part 27, and Requirements for using SSL/TLS certificates with CloudFront in the AWS docs.

Correct answer: B

CloudFront is the first to see the visitor's address, so the block belongs there. An IP set or a rate-based rule in WAF does the job.

• A: Requests reach the subnet from CloudFront's addresses, so the attacker's address never appears there.
• C: A security group only allows, and can't deny.
• D: This is automatic protection from common network attacks, with no address lists of your own.

Review: Blocking one address: where? in part 27, and Using AWS WAF with Amazon CloudFront in the AWS docs.

Correct answer: A + E

Inspector scans what you run for known vulnerabilities, and Macie finds sensitive data in S3.

• B: This detects suspicious activity in an account, such as stolen credentials being used.
• C: This protects against DDoS attacks.
• D: This filters web requests.

Review: Detecting threats in part 27, and What is Amazon Inspector? and What is Amazon Macie? in the AWS docs.

Correct answer: C

CloudHSM gives you a cluster of HSMs dedicated to you, and you control the keys and users yourself.

• A: AWS manages this key and the hardware, and you can't change its permissions.
• B: You control this key's policy, but AWS manages the hardware behind it.
• D: This stores secrets such as passwords, and isn't a hardware module.

Review: CloudHSM: your own hardware in part 27, and What is AWS CloudHSM? in the AWS docs.

Correct answer: A + D

Artifact gives you AWS's compliance reports on demand, and Detective links the logs together to find the root cause of a finding.

• B: This finds sensitive data in S3.
• C: This records and judges your own resources' settings, not AWS's compliance.
• E: This looks for known vulnerabilities in what you run.

Review: Compliance documents: AWS Artifact and Detecting threats in part 27, and What is AWS Artifact? and What is Amazon Detective? in the AWS docs.

Correct answer: D

RPO is the data you can lose, which is up to the six hours since the last backup. RTO is the time you're down, which is the two hours of restoring.

• A: This swaps the two numbers.
• B: The numbers measure different things, so they don't add together.
• C: Anything written since the last backup is lost, so the RPO isn't zero.

Review: RPO and RTO in part 28, and Business Continuity Plan (BCP) in the AWS docs.

Correct answer: B

Pilot light keeps the data replicating with the servers ready but stopped, which gets you back in tens of minutes for little running cost.

• A: Recovery can take up to 24 hours, and you'd lose hours of data.
• C: This also meets the need, but you'd pay for a full copy running all the time.
• D: This meets it too, at by far the highest cost.

Review: Four strategies in part 28, and Disaster recovery options in the cloud in the AWS docs.

Correct answer: A

In compliance mode nobody can delete a backup before it expires, not even the root user.

• B: An administrator can simply change the policy.
• C: Encrypted backups can still be deleted.
• D: You'd hear about the deletion, but the backups would already be gone.

Review: AWS Backup: everything in one place in part 28, and AWS Backup Vault Lock in the AWS docs.

Correct answer: C

An agent on each server replicates its disks continuously to AWS, so you can test at will, then switch over in minutes.

• A: This moves databases, not whole servers.
• B: This moves files.
• D: This imports virtual machine images, with no continuous replication.

Review: Migrating servers and whole data centers in part 28, and What Is AWS Transform MGN? in the AWS docs.

Correct answer: C + E

The engines differ, so the tables and code are converted first. DMS then copies the data and keeps sending changes until you're ready to switch.

• A: This moves servers as they are, so the database would stay on Oracle.
• B: This moves files, and can't keep a live database in sync.
• D: Aurora read replicas come from RDS for MySQL or PostgreSQL, not from Oracle.

Review: Migrating databases: DMS in part 28, and What is AWS Database Migration Service? and Converting database schemas using DMS Schema Conversion in the AWS docs.

Correct answer: A

Quotas are per Region, so the standby needs limits high enough for production capacity before a disaster. You raise them from the Service Quotas console.

• B: This keeps even less running, and would hit the same limit when it grows.
• C: This protects data, and doesn't change the limit.
• D: Quotas are per Region, so this doesn't help the standby.

Review: Tips that make the difference in part 28, and Disaster recovery options in the cloud and What is Service Quotas? in the AWS docs.

Correct answer: B

Data between servers in one Availability Zone is free over private addresses, while traffic through a public address is charged.

• A: Crossing zones is charged in each direction.
• C: A NAT gateway adds a charge for every gigabyte.
• D: The size of the server doesn't change what the transfer costs.

Review: Where does the network money go? in part 29, and EC2 On-Demand Instance Pricing on the AWS site.

Correct answer: A

A budget can alert on forecasted spending as well as actual spending, and the monitoring itself is free.

• B: This charts your spending and forecasts it, but someone has to go and look.
• C: This recommends suitable sizes, and sends no spending alerts.
• D: This records settings, not spending.

Review: Tools that watch your bill in part 29, and Managing your costs with AWS Budgets in the AWS docs.

Correct answer: D

The tool asks you questions about your workload, and shows you the risks. It's free in the console.

• A: This scans what you run for known vulnerabilities, and doesn't review a design.
• B: This checks your account's resources by itself, and doesn't ask about a workload.
• C: This records who called what.

Review: The Well-Architected Framework in part 29, and AWS Well-Architected Tool FAQs on the AWS site.

Correct answer: C

A template builds the same stack every time and sits in Git. Change sets show what will change, and drift detection reveals manual edits.

• A: This runs commands on servers, and doesn't describe infrastructure.
• B: This repeats a server's contents, not the network and other resources around it.
• D: This records settings and judges them, but doesn't build anything.

Review: CloudFormation: your infrastructure in a file in part 29, and Update CloudFormation stacks using change sets and Detect unmanaged configuration changes to stacks and resources with drift detection in the AWS docs.

Correct answer: B + E

Patch Manager applies the updates, and Maintenance Windows sets when they're allowed to happen.

• A: This gives you a terminal, one session at a time.
• C: This stores settings and simple secrets.
• D: This recommends suitable sizes based on your use.

Review: Systems Manager: running your servers in part 29, and AWS Systems Manager Patch Manager and AWS Systems Manager Maintenance Windows in the AWS docs.

Correct answer: B + E

Tags only reach cost reports once they're activated, and the Cost and Usage Report delivers the most detailed data as files in S3.

• A: This records resource settings, not costs.
• C: This recommends suitable sizes.
• D: This records operations inside resources, not costs.

Review: Tools that watch your bill in part 29, and What are AWS Cost and Usage Reports? and Organizing and tracking costs using AWS cost allocation tags in the AWS docs.

Correct answer: C

Recovery brings the server back on new hardware, keeping its instance ID and its private, public and Elastic IP addresses.

• A: This is a rewrite, and the code can't change.
• B: The replacement is a new server, with new addresses.
• D: You'd have to restore it by hand, onto a new server with new addresses.

Review: Applications you can't change in part 29, and Automatic instance recovery in the AWS docs.