AWS Certified Cloud Practitioner CLF-C02 (CLF-C02) — Questions 676–750

Broad network access refers to the ability to access cloud resources over the network via standard protocols, not to detailed usage tracking or cost allocation.

Resource pooling refers to the provider's computing resources being pooled to serve multiple customers, with dynamic assignment of physical and virtual resources. The scenario focuses on detailed usage tracking and cost allocation, not on multi-tenant resource sharing.

Rapid elasticity refers to the ability to quickly scale resources up or down based on demand, not to the detailed usage tracking and cost allocation described in the scenario.

A question describing a company that needs to access its cloud resources from various devices (e.g., laptops, smartphones) over the internet using standard protocols would make broad network access the correct answer.

A company uses a public cloud and notices that its virtual machines run on shared physical hardware with other customers, but the company has no control over which specific hardware it uses. This demonstrates resource pooling.

A question describing a workload that experiences unpredictable spikes in traffic, requiring automatic provisioning and de-provisioning of resources to match demand, would make rapid elasticity the correct answer.

Candidates may confuse the visibility of service usage across a network with the concept of broad network access, thinking that detailed billing data is a form of network access.

Candidates may confuse resource pooling with the ability to allocate costs across departments, thinking that pooling resources implies tracking usage per department, but resource pooling is about multi-tenancy, not cost allocation.

Candidates may confuse the precise measurement of usage (measured service) with the ability to scale resources (rapid elasticity), as both involve dynamic resource management in the cloud.

DynamoDB is a key-value and document database, not optimized for time-series data. It lacks built-in time-series analytics functions and can become expensive and complex to manage for high-frequency sensor data with continuous growth.

Amazon RDS for MySQL is a relational database not optimized for time-series data; it lacks built-in time-series analytics functions and auto-scaling for high-velocity IoT data, requiring manual sharding and indexing.

A company needs a fully managed NoSQL database for a web application that requires single-digit millisecond latency at any scale, with flexible schema for user profiles and session data, and can handle high traffic with auto-scaling.

A company needs a fully managed relational database for a traditional OLTP application with structured data, ACID transactions, and complex joins, and requires MySQL compatibility for existing applications.

Candidates may think DynamoDB's scalability and serverless nature make it suitable for IoT data, but they overlook that it is not purpose-built for time-series workloads and lacks native time-series functions.

Candidates may assume any database can handle time-series data and overlook the specialized requirements, or they may be more familiar with RDS and underestimate the need for a purpose-built service.

The auditor does not have an AWS account, so an S3 bucket policy restricting by IP address would still require the auditor to have AWS credentials to access the bucket, which they lack.

The auditor does not have an AWS account, so cross-account access via an IAM role is not possible. IAM roles require the external user to have an AWS account to assume the role.

CloudFront signed URLs require the auditor to access the content through CloudFront, not directly from S3, and involve setting up a CloudFront distribution with an origin access identity, which is unnecessary for a simple, time-limited direct S3 download.

A company needs to allow access to an S3 bucket only from a specific corporate IP range for all users, and the users have AWS credentials (e.g., IAM users) that can be authenticated via the bucket policy.

A company needs to grant an external partner with their own AWS account temporary access to specific S3 objects. The partner's account must be allowed to assume a role that has permissions to read the objects, and the access should be time-limited via the role's session duration.

A company needs to distribute content globally with low latency and wants to restrict access to specific users using signed URLs or cookies, while also benefiting from CloudFront's caching and DDoS protection. The auditor would access the file via a CloudFront URL, not directly from S3.

Candidates may think IP-based restrictions are sufficient for security and overlook that the auditor has no AWS credentials to authenticate, assuming the policy alone grants access.

Candidates may think cross-account IAM roles are the standard way to grant external access, overlooking the requirement that the auditor lacks an AWS account.

Candidates may confuse CloudFront signed URLs with S3 presigned URLs, thinking both provide time-limited access, but they overlook that CloudFront signed URLs require a CloudFront distribution and are not for direct S3 access.

Scalability refers to the ability to handle increased load by adding resources, but it does not inherently include the ability to automatically reduce resources when demand decreases, which is the key aspect demonstrated by the scenario (cost savings after the event).

High availability focuses on ensuring the application remains accessible despite failures (e.g., across multiple Availability Zones), not on automatically adjusting resources to match fluctuating demand. The scenario describes scaling resources up and down based on load, which is elasticity.

Fault tolerance refers to a system's ability to continue operating without interruption despite component failures. The scenario describes automatic scaling to handle traffic spikes, not recovery from failures.

A scenario where a company plans for future growth by designing a system that can handle increased load over time, such as migrating from a single EC2 instance to a multi-tier architecture with Auto Scaling to support a growing user base, would best demonstrate scalability.

A question describing an application that continues to serve requests without downtime after an EC2 instance fails, due to redundant instances in multiple Availability Zones, would have fault tolerance as the correct answer.

Candidates often confuse elasticity with scalability because both involve adding resources; however, elasticity specifically includes the automatic scaling down to save costs, which is the distinguishing feature in this question.

Candidates may confuse high availability with elasticity because both involve redundancy and automatic responses, but high availability is about uptime and fault tolerance, not dynamic scaling of resources based on demand.

Candidates may confuse the automatic scaling and self-healing aspects of Auto Scaling with fault tolerance, not realizing that fault tolerance specifically addresses failure recovery, not demand-based scaling.

AWS Pricing Calculator is used for estimating future costs, not for generating detailed historical cost and usage data with resource-level attributes and daily delivery to S3.

A company wants to estimate the monthly cost of running a proposed architecture on AWS before deployment, comparing different instance types and pricing models.

Candidates may confuse cost estimation with cost analysis, or think that a calculator can output detailed usage data for querying.

Elasticity refers to automatically scaling resources up or down based on demand, not to quickly provisioning and tearing down test environments for experimentation. The scenario emphasizes rapid setup and teardown for testing, which is agility, not dynamic scaling.

Fault tolerance refers to a system's ability to continue operating despite component failures, not to the rapid provisioning and teardown of test environments with pay-per-use pricing.

A question describing a workload with variable traffic, such as an e-commerce site that scales resources automatically during peak shopping hours and reduces them during low traffic, where the key benefit is paying only for what is used while meeting demand changes.

A question describing a system that must remain operational and serve users without interruption even if individual servers fail, such as a critical e-commerce platform requiring automatic failover and redundancy.

Candidates may confuse the ability to quickly provision resources (agility) with the automatic scaling of resources (elasticity), as both involve dynamic resource management and pay-per-use pricing.

Candidates may confuse the ability to quickly replace failed resources (fault tolerance) with the ability to quickly provision and deprovision resources (agility), as both involve rapid resource changes.

AWS KMS is a service for creating and managing encryption keys, not for provisioning or renewing SSL/TLS certificates. It does not automate certificate renewal or integrate with ALB for HTTPS termination.

AWS WAF is a web application firewall that protects against common web exploits, not a service for managing SSL/TLS certificates. It does not provision or renew certificates.

AWS Secrets Manager is designed to securely store and rotate secrets like database credentials, API keys, and other sensitive configuration data, not to manage SSL/TLS certificates for load balancers. It does not automatically provision or renew certificates for use with AWS services like ALB.

A company needs to encrypt data at rest in Amazon S3 using a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the CMK with automatic rotation enabled.

A company needs to protect an ALB from SQL injection or cross-site scripting attacks, and wants to filter malicious web traffic. AWS WAF would be the correct service to deploy on the ALB for that purpose.

A company needs to store and automatically rotate database credentials or API keys used by an application. The question specifies a requirement for a managed service to rotate secrets on a schedule, and the candidate must choose the service that handles secret rotation without custom code.

Candidates may confuse key management with certificate management, assuming KMS handles SSL/TLS certificates because both involve cryptographic materials.

Candidates may confuse AWS WAF with security-related services and think it handles certificate management, or they may associate it with HTTPS traffic protection without understanding its specific function.

Candidates may confuse Secrets Manager with ACM because both services involve 'secrets' and 'certificates' are also secrets. They might think Secrets Manager can manage SSL/TLS certificates since it handles other types of secrets, but it lacks the integration with AWS services for certificate provisioning and renewal.

The question describes the division of security responsibilities between AWS and the customer, which is the definition of the shared responsibility model, not resource pooling.

Elasticity refers to the ability to automatically scale resources up or down based on demand, not to the division of security responsibilities between AWS and the customer.

Measured service refers to the metering and billing of cloud resource usage, not the division of security responsibilities between AWS and the customer.

Resource pooling would be correct in a question asking about how AWS uses multi-tenant models to serve multiple customers from shared physical resources, such as in a question about the benefits of cloud computing where the provider dynamically assigns resources to customers.

A question asks: 'A company experiences unpredictable traffic spikes. Which cloud computing concept allows them to automatically add or remove EC2 instances to handle the load?' Elasticity would be the correct answer.

A question asks: 'Which cloud computing concept describes the ability to monitor, control, and report on resource usage for billing purposes?'

Candidates may confuse resource pooling with the shared responsibility model because both involve the concept of shared resources or responsibilities, but resource pooling refers to infrastructure sharing, not security duties.

Candidates may confuse elasticity with the shared responsibility model because both involve dynamic aspects of cloud computing, but elasticity is about scaling, not security roles.

Candidates may confuse 'measured service' with 'shared responsibility' because both involve accountability, but measured service is about usage tracking, not security roles.

IAM roles with MFA control user access but cannot enforce preventive restrictions across all accounts, including root users, in an AWS Organization.

AWS Config rules with automatic remediation are detective and reactive, not preventive. They can detect noncompliant changes and trigger remediation actions, but they cannot prevent root users or others from making changes in the first place.

AWS Shield Advanced is a DDoS protection service, not a preventive control for restricting actions like disabling CloudTrail or deleting S3 bucket policies across all accounts in an organization.

A question asks for a detective or preventive control to require MFA before performing sensitive actions (e.g., stopping an EC2 instance) for specific IAM users or roles.

A company wants to automatically detect and remediate noncompliant resource configurations, such as ensuring CloudTrail is enabled or S3 bucket policies are not deleted, after they occur. In that scenario, AWS Config rules with automatic remediation would be the correct answer.

A company wants to protect its AWS resources from distributed denial-of-service (DDoS) attacks and needs enhanced detection, mitigation, and cost protection. AWS Shield Advanced would be the correct answer for such a scenario.

Candidates may think MFA provides strong security and assume it can prevent all actions, but it does not block root users or apply organization-wide.

Candidates may confuse 'preventive' with 'detective and corrective' controls, or think that automatic remediation can block actions before they happen, not realizing it only reacts after the fact.

Candidates may confuse 'preventive control' with 'protection' and think Shield Advanced provides broad security controls, or they may not fully understand the scope of SCPs in AWS Organizations.

S3 Transfer Acceleration speeds up uploads to S3, not downloads to users. The question asks about reducing latency for users downloading static assets, so this service does not address the problem.

Adding more EC2 instances in different regions does not distribute static assets closer to users; it only increases compute capacity in specific regions, not the edge locations needed for low-latency content delivery.

An Application Load Balancer distributes traffic among EC2 instances but does not cache or serve static assets from edge locations; it cannot reduce latency for users globally without adding compute resources in each region.

A company needs to upload large files (e.g., video content) to an S3 bucket from geographically distributed locations and wants to minimize upload latency. S3 Transfer Acceleration would be the correct choice to accelerate uploads over long distances.

This option would be correct in a scenario where the company needs to run a globally distributed application with low-latency compute processing (e.g., real-time data processing) and must deploy EC2 instances in multiple regions to reduce latency for compute operations, not for static asset delivery.

A company runs a microservices application on EC2 instances across multiple Availability Zones and needs to distribute incoming HTTP/HTTPS traffic evenly across those instances. An Application Load Balancer with cross-zone load balancing would be the correct choice to ensure high availability and fault tolerance.

Candidates may confuse 'acceleration' with content delivery, assuming it speeds up both uploads and downloads, or they may not fully understand that Transfer Acceleration is only for uploads to S3.

Candidates may think that deploying EC2 instances in multiple regions is a general solution for reducing latency, without understanding that static content delivery requires a CDN like CloudFront, not compute instances.

Candidates may confuse load balancing with content delivery, thinking that distributing traffic across regions reduces latency, but ALB does not cache content or serve from edge locations.

Deploying in a single Availability Zone does not provide fault tolerance if that zone fails, and CloudFront caching alone does not ensure application availability during a data center failure.

A company needs to reduce latency for static content globally and improve load times, but the application runs in a single region and availability is not a primary concern. CloudFront caches content at edge locations to reduce latency.

Candidates may confuse CloudFront's global edge locations with geographic distribution of compute resources, thinking caching alone solves both latency and availability requirements.

A public cloud deployment model does not include on-premises infrastructure or a dedicated private network connection; it relies solely on shared cloud resources over the public internet.

A private cloud is deployed solely for a single organization, but this scenario requires integration between on-premises and AWS, which is a hybrid cloud. The need for a dedicated private connection and consistent management across both environments further confirms hybrid, not private.

A community cloud is shared by several organizations with common concerns, but this question describes a single company combining on-premises and AWS infrastructure, which is a hybrid cloud, not a community cloud.

A company wants to migrate all its applications and data to a cloud provider's infrastructure, with no on-premises components, and needs scalable compute resources accessible over the internet without dedicated private connectivity.

A company wants to run all its applications and data entirely within its own data center using cloud-like technologies (e.g., VMware on-premises) with no connection to any public cloud provider. The question would emphasize full control, dedicated resources, and no external network links.

A question where multiple organizations with shared compliance or security requirements (e.g., healthcare providers sharing patient data) need a cloud environment that is private to that group, using a dedicated network connection between them.

Candidates may think that using AWS for burst capacity automatically means public cloud, overlooking the requirement to keep data on-premises and the need for a dedicated hybrid connection.

Candidates may think that because the company keeps customer data on-premises, the entire architecture is private. They overlook the use of AWS for compute bursts, which makes it hybrid, not purely private.

Candidates may confuse 'community' with 'hybrid' because both involve multiple environments, but community cloud refers to multi-tenant shared infrastructure among organizations, not a single company's on-premises and public cloud mix.

Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, but it does not store messages durably or allow backend polling; if the backend is unavailable, messages are lost unless configured with a dead-letter queue, which is not the primary use case.

Amazon Kinesis Data Streams is designed for real-time streaming of large volumes of data for processing by multiple consumers, not for simple decoupling and reliable message storage with independent scaling of a single backend. It does not inherently guarantee exactly-once message processing or simple queue semantics needed for order processing.

AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue. It does not provide a durable buffer for storing order requests until the backend is ready to process them, nor does it handle traffic spikes by decoupling frontend and backend tiers.

A company needs to send order notifications to multiple subscribers (e.g., email, SMS, and a processing system) simultaneously, and message durability is not the primary concern because the processing system is always available or uses a separate queue.

A company needs to ingest and process real-time clickstream data from a website, analyze it with multiple consumer applications (e.g., for fraud detection, user behavior analytics), and retain the data for up to 7 days. Kinesis Data Streams would be the correct choice for this streaming data pipeline.

A company needs to coordinate a multi-step order processing workflow that involves invoking multiple AWS services (e.g., Lambda, DynamoDB, SNS) in a specific sequence, with error handling and retries. Step Functions would be correct to manage the workflow logic and state transitions.

Candidates may confuse SNS with SQS because both are messaging services, and they might think SNS can store messages for later processing, not realizing SNS is push-based and lacks built-in message persistence.

Candidates may confuse Kinesis Data Streams with a message queue because both can handle data between producers and consumers, but Kinesis is optimized for real-time streaming analytics, not for reliable, decoupled message queuing with independent scaling.

Candidates may confuse Step Functions with a queuing service because it can manage asynchronous tasks and retries, leading them to think it can decouple application tiers. However, it lacks the message buffering and independent scaling capabilities of SQS.

Amazon RDS for PostgreSQL is a relational database that does not natively support horizontal scaling (sharding) without significant application changes, and it cannot guarantee single-digit millisecond latency at any scale for key-value workloads. It also requires manual effort for multi-AZ replication and does not provide the fully managed, auto-scaling key-value store required.

Amazon Redshift is a data warehouse for analytical queries on large datasets, not a low-latency key-value store. It cannot provide single-digit millisecond read/write latency or scale horizontally for real-time transactional workloads.

Amazon ElastiCache for Redis is an in-memory cache, not a durable key-value database. It lacks built-in replication across multiple Availability Zones for high availability and does not provide the fully managed, horizontally scalable key-value store with single-digit millisecond latency required for this use case.

A company needs a fully managed relational database with SQL support, ACID transactions, and multi-AZ replication for a traditional web application with predictable traffic patterns. The workload requires complex joins and queries, and latency requirements are in the tens of milliseconds rather than single-digit.

A company needs to run complex SQL queries and aggregations on petabytes of structured data for business intelligence and reporting, with high performance for analytical workloads. The database must be fully managed and support columnar storage and massively parallel processing.

A company needs a low-latency, in-memory data store for caching frequently accessed data, such as session state or database query results, to reduce load on a primary database. The solution must support sub-millisecond response times and can tolerate data loss on failure.

Candidates may confuse key-value databases with relational databases or assume that RDS can be used for any data storage need, overlooking the specific requirements for horizontal scaling and low latency at scale.

Candidates may confuse Redshift's high-performance capabilities with low-latency requirements, or assume that any AWS database service can handle key-value workloads due to its scalability features.

Candidates may confuse ElastiCache for Redis as a key-value database due to its key-value data model and low latency, overlooking that it is primarily a cache and not a durable, fully managed database with built-in replication across AZs.

IAM policies are attached to IAM users, groups, or roles within a single account and cannot be centrally applied across all member accounts in an organization. They also cannot prevent actions by the root user.

AWS Config rules with automatic remediation can detect and fix non-compliant S3 public access settings, but they cannot prevent the root user from making changes, and they apply only after the fact, not as a preventive control. Additionally, they are not centrally managed across all accounts in an organization without additional setup.

AWS Trusted Advisor provides best-practice recommendations but cannot enforce policies or prevent actions like disabling S3 Block Public Access across accounts.

An IAM policy would be correct if the question asked for restricting S3 'Block Public Access' settings for specific IAM users or roles within a single AWS account, and root user actions were not a concern.

A company needs to automatically detect and remediate S3 buckets that have public access enabled in individual accounts, ensuring compliance with a security policy after the fact. The solution should be account-specific and not require organization-wide enforcement.

A company wants to identify which S3 buckets have public access enabled and receive recommendations to secure them. Trusted Advisor would be correct for checking compliance against AWS best practices.

Candidates may confuse IAM policies with SCPs, thinking that IAM policies can be applied account-wide, or they may overlook the requirement to restrict the root user and centrally manage across multiple accounts.

Candidates may think that automatic remediation provides a preventive control, but it is reactive. They might also confuse AWS Config's ability to enforce rules with the preventive nature of SCPs.

Candidates may think Trusted Advisor can enforce security policies because it offers security checks, but it only advises, not prevents actions.

AWS Elastic Beanstalk is a PaaS service that abstracts infrastructure management, but it does not allow defining resources as reusable, version-controlled JSON/YAML templates; it uses environment configurations and platform settings instead.

AWS CodeDeploy automates code deployments to running instances, but it does not provision or manage infrastructure resources like EC2, RDS, or security groups. The question requires defining and provisioning the entire infrastructure stack using templates, which is beyond CodeDeploy's scope.

A company wants to quickly deploy a web application without managing underlying infrastructure, using automatic scaling and monitoring, and is okay with less control over individual resources. The question would specify 'minimal operational overhead' and 'rapid deployment' as key requirements.

A company wants to automate the deployment of application code to EC2 instances in a rolling update fashion, ensuring minimal downtime. They already have the infrastructure managed separately (e.g., via CloudFormation) and need a service to handle code releases and rollbacks.

Candidates may confuse Elastic Beanstalk's environment configuration files (e.g., .ebextensions) with CloudFormation templates, or think Elastic Beanstalk supports JSON/YAML for resource definition, when it primarily uses them for environment customization, not full infrastructure provisioning.

Candidates may confuse CodeDeploy with infrastructure provisioning because both involve 'deployment,' but CodeDeploy focuses on application code, not infrastructure resources.

AWS Budgets is used to set custom cost and usage budgets and receive alerts when thresholds are exceeded, not to compare TCO between on-premises and AWS environments.

AWS Cost Explorer analyzes historical cost data and forecasts future spending, but it does not compare on-premises TCO with AWS costs or include hardware, software, labor, and facilities costs.

AWS Trusted Advisor provides recommendations for cost optimization, security, and performance, but it does not generate a detailed TCO comparison between on-premises and AWS environments, including hardware, software, labor, and facilities costs.

A company wants to set a monthly spending limit for its AWS services and receive notifications when costs approach or exceed that limit. AWS Budgets would be the correct tool to create and monitor these budgets.

A company wants to visualize and analyze its AWS spending patterns over time, identify cost drivers, and create custom cost and usage reports to optimize existing AWS costs.

A company wants to identify underutilized EC2 instances and receive recommendations to reduce costs by resizing or terminating them. AWS Trusted Advisor would be the correct tool to use for this specific cost optimization check.

Candidates may confuse cost management tools and think that any tool with 'cost' in its name can provide TCO comparisons, overlooking the specific purpose of each tool.

Candidates may confuse cost analysis tools, thinking Cost Explorer can provide cost comparisons, but it only works with AWS usage data, not on-premises costs.

Candidates may confuse Trusted Advisor's cost optimization recommendations with a TCO analysis, assuming it can compare on-premises vs. AWS costs because it provides cost-saving suggestions.

Availability Zones are distinct physical locations within an AWS Region that provide high availability and fault tolerance for applications, but they do not cache content or serve as edge locations for content delivery to end users globally.

Regional Edge Caches are used for caching content that is less frequently accessed, not for delivering static content to end users as close as possible. Edge Locations are the correct choice for caching static content at locations near users globally.

AWS Direct Connect Locations are physical sites where you can establish dedicated network connections from your on-premises data center to AWS, not for caching content at edge locations close to end users.

An exam question asking which AWS infrastructure component should be used to deploy an application across multiple isolated locations within a single region to achieve high availability and fault tolerance would have Availability Zones as the correct answer.

A company has a large amount of content that is not accessed frequently but still needs to be cached to reduce latency for occasional users. The question specifies that content is less popular and the goal is to reduce load on origin servers while still providing some caching benefit.

A company needs a dedicated, private, low-latency connection from its on-premises network to AWS, bypassing the public internet, for consistent network performance or regulatory compliance.

Candidates may confuse Availability Zones with edge locations because both are geographically distributed, but they serve different purposes: Availability Zones are for compute and storage resilience, not for content caching at the edge.

Candidates may confuse Regional Edge Caches with Edge Locations, thinking both serve similar purposes, or they may overestimate the role of Regional Edge Caches in global content delivery.

Candidates may confuse 'Direct Connect' with 'direct access' to AWS infrastructure, thinking it provides faster content delivery, but it is a network connectivity service, not a caching service.

AWS Budgets does not generate custom cost and usage reports with line items, tags, or resource-level details, nor does it support SQL querying. It only provides budget alerts and tracking against set thresholds.

AWS Cost Explorer provides visualization and analysis of cost and usage data but does not generate custom reports with every line item, user-defined cost allocation tags, and resource-level details, nor does it support SQL querying.

AWS Trusted Advisor does not generate cost and usage reports with line items, cost allocation tags, or resource-level details; it provides best-practice recommendations for cost optimization, security, and performance.

A company needs to set cost thresholds and receive alerts when spending exceeds or is forecasted to exceed a defined budget. AWS Budgets would be the correct answer for monitoring and alerting on cost usage.

When a company needs to visualize historical cost and usage data, identify trends, and create custom cost reports with filtering and grouping by dimensions like service or region, but does not require line-item detail or SQL querying.

A company wants to check for idle resources or underutilized Amazon EC2 instances to reduce costs. AWS Trusted Advisor would provide the correct recommendations for cost optimization.

Candidates may confuse budgeting with cost reporting, thinking AWS Budgets provides detailed usage data because it tracks costs, but it lacks the granularity and SQL querying capabilities required.

Candidates may confuse Cost Explorer's reporting and filtering capabilities with the more granular, exportable data provided by the Cost and Usage Report, or assume it supports SQL queries due to its analytical features.

Candidates may confuse Trusted Advisor's cost optimization checks with actual cost reporting, assuming it provides detailed usage data when it only offers high-level recommendations.

EC2 with Auto Scaling requires provisioning and managing EC2 instances, even with Auto Scaling. It does not charge only for compute time used during execution (you pay for running instances even when idle) and requires ongoing infrastructure management, contradicting the fully managed, pay-per-execution requirements.

Amazon ECS with Fargate still requires managing task definitions, container images, and cluster scaling policies, and it charges for provisioned resources (vCPU and memory) even when idle, not just for execution time. The question demands a fully managed service that charges only for compute time during execution, which AWS Lambda meets with its per-request billing.

Amazon Lightsail is a simplified VPS service that requires manual scaling and does not automatically scale to handle thousands of requests per second during flash sales. It also charges for fixed monthly pricing, not just for compute time used during execution.

A company needs to run a long-lived application (e.g., a web server) that requires full control over the operating system, software installations, and persistent storage. The workload is predictable and requires consistent performance, and the company is willing to manage scaling policies and instance lifecycle.

A company needs to run containerized applications that require persistent background processes, long-running jobs (over 15 minutes), or specific container configurations (e.g., custom networking, GPU support). The workload is steady or predictable, and the company prefers to manage containers without provisioning servers.

A company needs a simple, predictable-cost virtual private server for a small web application with steady traffic, and wants to avoid managing EC2 instances directly. The workload does not require automatic scaling or a pay-per-execution model.

Candidates may think Auto Scaling provides automatic scaling and is serverless-like, but they overlook that EC2 still requires server management and charges for idle time, not just execution time.

Candidates may confuse Fargate's 'serverless containers' with Lambda's 'serverless functions,' overlooking that Fargate still incurs costs for idle resources and requires more configuration, while Lambda is truly pay-per-execution and simpler for short-lived, event-driven tasks.

Candidates may choose Lightsail because it is marketed as a simple, fully managed service, but they overlook its lack of automatic scaling and pay-per-execution billing, which are key requirements in this question.

AWS Config is a detective control that evaluates and reports on compliance, but it does not prevent the creation of public buckets. It can only detect and alert after a bucket has been made public, not block the action proactively.

An IAM policy with a condition denying s3:PutBucketPolicy for actions granting public access is not a preventive control that applies automatically to all buckets without changes to individual bucket policies. It only restricts who can set bucket policies, but does not prevent existing public access or apply to buckets created by users who are not bound by that IAM policy.

GuardDuty is a detective control that identifies threats and generates findings, not a preventive control that blocks public access. It cannot prevent S3 buckets from being configured with public access; it only alerts after the fact.

A company wants to continuously monitor and automatically remediate S3 buckets that are publicly accessible, using a combination of AWS Config rules and AWS Systems Manager Automation to revoke public access. In that scenario, AWS Config with the s3-bucket-public-read-prohibited rule would be the correct detective and remediation tool.

This option would be correct in a scenario where the security team needs to restrict specific IAM users or roles from configuring bucket policies that grant public access, while allowing other authorized administrators to manage bucket policies. The control would apply only to those identities, not to all buckets account-wide.

A security team wants to automatically detect and alert on any S3 bucket that becomes publicly accessible, and they need a managed threat detection service that can analyze S3 access patterns and generate findings for review. GuardDuty would be the correct choice for this detective requirement.

Candidates may confuse detective controls (AWS Config) with preventive controls (S3 Block Public Access), or assume that a managed rule can block actions, when in fact it only evaluates existing configurations.

Candidates may think an IAM policy with a condition can enforce a blanket ban on public access across all buckets, but they overlook that it only applies to the users/roles it is attached to and does not affect existing public access or buckets created by other principals.

Candidates may confuse GuardDuty's ability to detect public access with a preventive capability, or they may think that a 'finding suppression rule' can block the action, not realizing GuardDuty only monitors and reports.

Network Load Balancer operates at Layer 4 and does not support WebSocket protocol or sticky sessions based on application-level cookies, which are required for the real-time chat application.

Classic Load Balancer does not support WebSocket connections or sticky sessions based on application-level cookies; it only supports TCP and HTTP/HTTPS with basic sticky sessions using duration-based cookies, which are insufficient for long-lived WebSocket connections.

Amazon Route 53 is a DNS web service, not a load balancer. It cannot distribute incoming WebSocket traffic or preserve connections with sticky sessions.

A company needs to handle millions of requests per second with ultra-low latency, using TCP or UDP traffic, and requires static IP addresses for whitelisting. The application does not need HTTP/WebSocket features or sticky sessions.

A Classic Load Balancer would be correct for distributing HTTP/HTTPS traffic for a legacy web application that requires simple sticky sessions (duration-based) and does not need WebSocket support, advanced routing, or integration with modern AWS services like AWS WAF or Lambda functions.

Route 53 would be correct in a scenario where the question asks for a service to route users to the nearest application endpoint based on latency or geographic location, without requiring connection-level load balancing or sticky sessions.

Candidates may confuse NLB's ability to preserve connections (via TCP) with WebSocket support, or assume that any modern load balancer handles WebSocket, overlooking that ALB is specifically designed for Layer 7 protocols like WebSocket.

Candidates may recall that Classic Load Balancer supports sticky sessions and assume it works for WebSocket connections, not realizing that WebSocket support requires the Application Load Balancer's native WebSocket protocol handling and application-level stickiness.

Candidates may confuse Route 53's traffic flow features (like latency-based routing) with actual load balancing, or think DNS-level routing can handle WebSocket connections.

The scenario involves a dedicated, encrypted connection between an on-premises data center and AWS, which is a hybrid cloud setup. Public cloud alone does not include on-premises infrastructure.

The scenario involves a hybrid setup where on-premises infrastructure is combined with AWS cloud services, not a private cloud that would be entirely dedicated to a single organization and typically hosted on-premises or in a provider's data center without public cloud integration.

The scenario describes a hybrid cloud because it combines on-premises infrastructure with AWS cloud services. Multi-cloud involves using multiple public cloud providers, not a mix of on-premises and cloud.

A company uses only AWS services (e.g., EC2, S3) with no on-premises infrastructure, and all data and applications reside in AWS. The question would ask: 'Which cloud deployment model uses resources owned and operated by a third-party provider and accessed over the internet?'

A company wants to run all its workloads on AWS but needs to ensure that the infrastructure is not shared with other organizations due to compliance requirements. The correct answer would be 'Private cloud' if the question described using AWS Outposts or a dedicated VPC with no public internet access.

A company uses AWS for compute and Azure for storage, with no on-premises data center. The question asks which model uses multiple public cloud providers.

Candidates may think that because AWS is a public cloud provider, any use of AWS is public cloud, ignoring the hybrid aspect of connecting on-premises infrastructure.

Candidates may confuse 'private cloud' with on-premises infrastructure or think that a dedicated encrypted connection implies a private cloud, not realizing that hybrid cloud specifically describes the combination of on-premises and public cloud resources.

Candidates may confuse hybrid cloud (on-premises + cloud) with multi-cloud (multiple public clouds), especially when the scenario involves a dedicated connection to AWS.

AWS Trusted Advisor provides best practice checks and recommendations, but it does not continuously evaluate IAM user access key age against a custom 90-day policy and generate findings. It offers a limited set of predefined checks, not custom compliance rules.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating IAM user access key age or compliance with rotation policies.

AWS IAM Access Analyzer identifies resources shared with external entities, not the age of IAM user access keys. It does not evaluate access key rotation compliance.

A company wants a one-time review of its AWS account to identify IAM access keys older than 90 days and receive recommendations for remediation, without needing ongoing evaluation or custom rules. AWS Trusted Advisor's security checks can flag such keys in its dashboard.

A company wants to automatically scan EC2 instances for missing security patches and unintended network access. Amazon Inspector would be the correct service to assess these vulnerabilities and generate findings.

An exam question asking which AWS service can identify IAM roles or resources that are accessible from outside an AWS account (e.g., cross-account access) and generate findings about unintended public or cross-account access would have IAM Access Analyzer as the correct answer.

Candidates may think Trusted Advisor covers all security best practices, including access key rotation, because it does check for expired or unused keys. However, it lacks the ability to enforce custom policies or provide continuous evaluation and automated notifications.

Candidates may confuse 'Inspector' with a general compliance or auditing service, or mistakenly think it can inspect IAM credentials due to its name implying broad inspection capabilities.

The name 'Access Analyzer' suggests it analyzes access, and candidates may mistakenly think it covers all access-related checks, including key age, rather than focusing on external access analysis.

AWS Cost Explorer is for analyzing historical costs, not estimating future charges for an unbuilt architecture. Basic Support does not provide a guaranteed response time of less than 12 hours for production-impacting issues.

AWS Budgets allows you to set cost alerts but does not provide cost estimation for unknown architectures. Business Support offers 1-hour response for production-impacting issues, but the question requires a guaranteed response time of less than 12 hours, which Developer Support meets (less than 12 hours for production systems impaired).

The TCO Calculator compares on-premises vs. cloud costs, not estimating monthly AWS charges for a new architecture. Enterprise Support is overkill and expensive for a startup with limited budget needing <12 hour response for production issues.

A company with existing AWS usage wants to analyze past spending patterns to optimize costs, and only needs 24/7 access to documentation and basic support without any response time guarantees.

A company already has a detailed architecture and wants to set cost thresholds and receive alerts when spending exceeds a certain amount, while needing faster support (1-hour response) for critical production issues. In that case, AWS Budgets + Business Support would be appropriate.

A question where a company wants to compare the total cost of ownership between running workloads on-premises versus on AWS, and requires the highest level of support with <15 minute response for critical issues, such as a large enterprise with compliance needs.

Candidates may confuse Cost Explorer with a pricing estimation tool, and assume Basic Support is sufficient for development, overlooking the specific response time requirement.

Candidates may think 'Budgets' helps estimate costs and 'Business Support' is better than Developer, overlooking that the question asks for cost estimation before committing to an architecture and only requires less than 12-hour response.

Candidates may think 'TCO Calculator' estimates costs (confusing it with Pricing Calculator) and assume 'Enterprise Support' is always best, overlooking the startup's budget constraints and specific support response requirement.

AWS Basic Support does not provide technical support with a response time of under 1 hour for critical failures, nor does it include AWS Trusted Advisor recommendations for cost optimization, performance, and security.

AWS Developer Support does not include a response time of under 1 hour for critical production failures; it offers only general guidance with a response time of less than 12 hours for critical cases. It also does not provide full access to AWS Trusted Advisor for cost optimization, performance, and security recommendations.

Enterprise Support is more expensive than Business Support and includes features like a Technical Account Manager (TAM) and infrastructure event management, which are not required by the question. The minimum-cost plan that meets the requirements (under 1-hour response for critical failures and Trusted Advisor for cost optimization, performance, and security) is Business Support.

A company that only needs access to AWS documentation, whitepapers, and support forums, with no requirement for technical support response times or Trusted Advisor, and wants the lowest cost support plan.

A company running a non-production environment (e.g., development or test) that requires technical support during business hours with a response time of less than 12 hours for critical issues, and does not need Trusted Advisor best-practice checks, would find AWS Developer Support the minimum-cost appropriate plan.

A company requires a Technical Account Manager (TAM) for proactive guidance, needs infrastructure event management, or demands a response time of under 15 minutes for critical failures. In such cases, Enterprise Support is the correct choice despite higher cost.

Candidates may mistakenly believe that Basic Support is sufficient for production workloads because it is free, overlooking the specific requirements for fast response times and Trusted Advisor access.

Candidates may mistakenly believe Developer Support is sufficient because it is the lowest paid tier, overlooking the specific requirements for fast critical response and full Trusted Advisor access that only Business Support provides.

Candidates may assume that only Enterprise Support offers Trusted Advisor recommendations or that the 1-hour response time for critical cases is exclusive to Enterprise, but Business Support also provides both features.

AWS Config is a service for evaluating resource configurations against desired policies, not for aggregating security findings from GuardDuty, Inspector, and Macie or providing a security score and compliance tracking against CIS AWS Foundations.

Amazon Detective is designed for root-cause analysis of security findings, not for aggregating findings from multiple services or providing a security score and compliance tracking.

A company needs to continuously monitor and evaluate the configurations of AWS resources for compliance with internal policies or industry standards like PCI DSS, and automatically remediate non-compliant resources using AWS Config rules and auto-remediation.

A security team needs to investigate the root cause of suspicious API calls identified by GuardDuty. Which AWS service can analyze and visualize the underlying resource interactions to determine the cause?

Candidates may confuse AWS Config's compliance evaluation capabilities with the centralized security findings aggregation and scoring provided by Security Hub, as both involve compliance tracking.

Candidates may confuse Detective's investigative capabilities with Security Hub's aggregation and dashboard features, assuming any security service can centralize findings.

AWS Security Hub aggregates findings from multiple services but does not itself track configuration history or provide compliance rules for security group changes. It cannot detect unrestricted RDP access or maintain a configuration history for forensic analysis.

AWS CloudTrail records API activity for governance and audit, but it does not evaluate security group rules against compliance rules or send notifications for non-compliant configurations. It also does not track configuration history of resources like security groups; it tracks API calls, not resource state changes.

A company wants a single pane of glass to view high-priority security alerts from GuardDuty, Inspector, and Macie across multiple accounts, and needs to automate remediation workflows based on those findings.

A company needs to audit all API calls made to create or modify security groups across multiple AWS accounts for forensic analysis, and they want to receive notifications for specific API events. They do not need to evaluate the actual configuration of security groups against a rule.

Candidates may think Security Hub provides comprehensive security monitoring and compliance checks, but it relies on other services like AWS Config for resource configuration tracking and rule evaluation.

Candidates may confuse CloudTrail's ability to log API calls with the ability to evaluate resource configurations and track configuration history, assuming that logging security group changes is sufficient for compliance monitoring.

AWS Business Support provides full Trusted Advisor checks and a 15-minute response time for critical issues, but the question requires a guaranteed response time of less than 15 minutes, which is only offered by Enterprise Support (15-minute SLA for business-critical systems).

AWS Developer Support does not provide access to the complete set of Trusted Advisor checks (only core checks) and has a response time of less than 12 hours for critical issues, not 15 minutes.

AWS Basic Support does not provide access to the complete set of Trusted Advisor checks (only core checks) and offers no guaranteed response times for support cases.

A company needs full Trusted Advisor checks and a 1-hour response time for critical issues, but does not require a sub-15-minute SLA. In that case, Business Support would be the correct choice.

A startup with a small team needs access to AWS technical support via email and chat during business hours, with a response time of less than 12 hours for critical issues, and does not require full Trusted Advisor checks or a 15-minute response.

If the question stated that the company only needs basic account and billing support, with no requirement for Trusted Advisor checks or fast response times, then Basic Support would be sufficient.

Candidates may confuse the 15-minute response time for critical issues (Business Support) with the sub-15-minute guarantee (Enterprise Support), or assume Business Support covers all requirements without noticing the strict timing requirement.

Candidates may confuse Developer Support as offering faster response times or more Trusted Advisor checks than it actually does, or assume it is sufficient for production workloads without reading the specific SLA details.

Candidates may assume Basic Support includes all Trusted Advisor checks or overlook the response time requirement, thinking basic support is enough for cost optimization and performance checks.

Amazon EC2 with ECS EC2 launch type requires managing EC2 instances and the container orchestration control plane, contradicting the requirement to minimize operational overhead and not manage servers.

AWS Elastic Beanstalk with a Docker platform still requires managing underlying EC2 instances or a container orchestration control plane, and it does not offer the per-container billing model that Fargate provides.

AWS Lambda is designed for short-running, event-driven functions, not for containerized microservices that require long-running processes or stateful workloads. It also has limitations on execution time (15 minutes max) and container image size, making it unsuitable for general containerized applications.

If the question specified that the team has existing EC2 instances to utilize, needs to optimize costs for predictable workloads, or requires full control over the underlying infrastructure for compliance or performance tuning.

A team wants to deploy a Docker-based application with minimal configuration, but they are willing to manage the underlying EC2 instances for cost optimization or to have full control over the environment. They also need built-in auto-scaling and load balancing without managing the container orchestration layer directly.

A question asking for a serverless compute service to run code in response to events (e.g., S3 uploads, API Gateway requests) with automatic scaling and pay-per-execution pricing, where the code is packaged as a container image and execution time is under 15 minutes.

Candidates may associate ECS with containers and overlook the distinction between EC2 and Fargate launch types, assuming ECS inherently abstracts server management.

Candidates may think Elastic Beanstalk abstracts away all infrastructure management, but it still involves provisioning and managing EC2 instances, which contradicts the 'no servers' requirement in the question.

Candidates may confuse 'serverless' with 'no server management' and assume Lambda can run any containerized app, overlooking its execution duration and stateless nature constraints.

Amazon ECS with the EC2 launch type requires managing underlying EC2 instances, which violates the requirement to not manage any underlying servers or clusters. Additionally, you pay for the EC2 instances even when idle, not just for the vCPU and memory consumed by each container.

Amazon EKS with managed node groups still requires managing EC2 instances (the node groups), which violates the requirement to not manage any underlying servers or clusters. Additionally, you pay for the EC2 instances even when idle, not just for vCPU and memory consumed per container.

AWS Lambda is event-driven and designed for short-running, stateless functions, not for long-running containerized microservices. It does not support running arbitrary Docker containers directly, and its pricing is based on invocations and duration, not vCPU/memory per container.

A team wants to deploy containers on AWS but needs full control over the underlying EC2 instances for compliance or custom configuration, and is willing to manage the cluster and pay for idle capacity.

This option would be correct if the team needed to run Kubernetes-based containers and was willing to manage the worker nodes (even if the control plane is managed), or if they required specific Kubernetes features not available on Fargate, and they accepted paying for idle EC2 capacity.

A team needs to run a small, event-driven data processing task that executes in under 15 minutes, such as resizing images uploaded to S3. They want to pay only for compute time used and avoid managing servers. In that case, AWS Lambda is the correct choice.

Candidates may confuse ECS with Fargate, thinking ECS always abstracts servers, but the EC2 launch type does not; they overlook the 'without managing servers' constraint.

Candidates may think 'managed node groups' means fully serverless, but it only manages the control plane; the worker nodes are still EC2 instances that incur costs and require management.

Candidates may think Lambda's serverless model and pay-per-use pricing align with the requirement to avoid managing servers and pay only for consumed resources, overlooking that Lambda does not support containerized microservices with persistent workloads.

AWS Config is a service for resource inventory and configuration history, not for providing Trusted Advisor checks. Trusted Advisor's full set of checks, including cost optimization, requires a Business or Enterprise Support plan.

The Developer Support plan does not include the full set of Trusted Advisor checks; only Business and Enterprise Support plans provide access to all checks, including cost optimization recommendations.

The AWS Basic Support plan only provides a limited set of Trusted Advisor checks (e.g., S3 bucket permissions and service limits). Cost optimization checks like idle load balancers and underutilized EC2 instances require a Business or Enterprise Support plan.

If the question asked which service to use to evaluate resource configurations against best practices and automate remediation (e.g., detecting non-compliant security groups), enabling AWS Config would be correct.

If the question asked which support plan provides access to AWS Support API and a 12-hour response time for impaired systems, then upgrading to Developer Support would be correct.

If the question stated that the company already has a Business or Enterprise Support plan, or if the scenario involved only the checks available in Basic Support (e.g., S3 bucket permissions and service limits), then no action would be needed.

Candidates may confuse AWS Config's compliance checks with Trusted Advisor's recommendations, assuming both offer similar cost optimization features.

Candidates may confuse the Developer plan as a higher tier than Basic, but they don't realize that the full Trusted Advisor checks require Business or Enterprise level.

Candidates may assume that all Trusted Advisor checks are free and available to all support plans, not realizing that cost optimization and advanced checks are restricted to higher-tier plans.

AWS Certificate Manager manages SSL/TLS certificates, not secure shell sessions. It does not provide remote access to EC2 instances.

AWS CloudHSM provides hardware security modules for cryptographic key storage, not remote shell access to EC2 instances. It cannot establish SSH or RDP sessions.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a tool for establishing secure shell sessions to manage EC2 instances.

A question asking for a service to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services or internal resources, without needing to handle certificate renewals manually.

A question asking for a service to manage cryptographic keys in a dedicated HSM appliance, especially for compliance with FIPS 140-2 Level 3, where you need to offload key generation and storage from application servers.

A question asking: 'Which AWS service continuously monitors for malicious or unauthorized behavior to help protect AWS accounts and workloads?' would make GuardDuty the correct answer.

Candidates may confuse 'secure shell' with 'secure certificates' due to the word 'secure', or think that certificates are required for SSH authentication.

Candidates may confuse 'secure shell' with 'security' and think CloudHSM provides secure access, or they may misread the question as needing a secure key management solution for instance authentication.

Candidates may confuse GuardDuty's security monitoring capabilities with the ability to provide secure access, or they might think it can manage sessions due to its 'security' label.

Multi-AZ deployment provides automatic failover to a standby in a different AZ but does not offload read traffic; the standby is not used for reads. The requirement to offload SELECT queries requires Read Replicas.

Read Replicas only offload read traffic but do not provide automatic failover to a standby in a different Availability Zone; they require manual promotion for failover, which does not meet the automatic failover requirement.

Cross-Region Read Replicas are designed for disaster recovery and reducing latency for geographically distant users, not for offloading read traffic within the same region or providing automatic failover to a standby in a different Availability Zone within the same region.

A company needs high availability and automatic failover for a production database with no need to offload read traffic. The question would specify that read performance is not a concern, only fault tolerance across AZs.

A company needs to offload read queries from a primary database to improve read performance, but does not require automatic failover or high availability. For example, a reporting application that can tolerate brief downtime during manual promotion.

A company needs to offload read queries from a primary database and also requires disaster recovery across AWS regions, with the ability to promote a read replica to a standalone database in another region if the primary fails. The question would specify that the standby must be in a different AWS region, not just a different Availability Zone.

Candidates may think Multi-AZ includes read scaling because the standby is available, but AWS RDS Multi-AZ standby is not accessible for reads; it only serves as a failover target.

Candidates may think that Read Replicas alone can handle both read offloading and failover, overlooking that automatic failover is a distinct feature of Multi-AZ deployments.

Candidates may confuse 'different Availability Zone' with 'different region' or think that cross-region replicas inherently provide failover, not realizing that Multi-AZ is needed for automatic failover within a region.

AWS Cost Explorer analyzes existing costs from past usage, but the startup has no AWS account or resources yet, so there is no historical data to analyze.

AWS Budgets is used to set spending limits and receive alerts when costs exceed thresholds, not to generate detailed cost estimates based on assumptions about instance types, storage, and data transfer before creating any resources.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not allow users to input assumptions about instance types, storage, and data transfer to generate a detailed cost estimate before creating resources.

A company with an existing AWS account wants to visualize and analyze their past EC2 and RDS spending trends to identify cost-saving opportunities.

A company wants to set a monthly spending limit for its existing EC2 and RDS resources and receive alerts when actual or forecasted costs exceed that limit. AWS Budgets would be the correct tool for monitoring and alerting on cost usage.

When a company already has an AWS account and running resources, and wants to identify cost savings opportunities, such as underutilized EC2 instances or idle RDS databases, AWS Trusted Advisor would be the correct tool to use.

Candidates may confuse cost estimation for future resources with cost analysis of existing usage, assuming Cost Explorer can generate estimates from scratch.

Candidates may confuse 'budgeting' with 'cost estimation' because both involve planning for costs, but AWS Budgets focuses on monitoring and alerting on actual spending, not upfront estimation.

Candidates may confuse Trusted Advisor's cost optimization checks with cost estimation, assuming it can provide upfront pricing estimates, but it only analyzes existing usage.

Amazon CloudFront does not provide a fixed set of static IP addresses for firewall allowlisting; its IP addresses can change. The question requires static IPs, which CloudFront cannot guarantee.

Network Load Balancer (NLB) operates at the transport layer and does not provide global traffic routing, static IP address management across multiple regions, or health-based routing to the nearest endpoint. It is designed for regional load balancing, not global acceleration with fixed IPs.

Amazon Route 53 latency-based routing does not provide static IP addresses for firewall allowlisting; it resolves to dynamic IP addresses of resources like ALBs, which change over time.

A company needs to deliver static and dynamic content with low latency and high transfer speeds, and does not require static IP addresses for allowlisting. CloudFront would be correct for content delivery network (CDN) use cases with edge caching.

A company needs to distribute TCP/UDP traffic across multiple targets in a single AWS Region, requiring ultra-low latency and handling millions of requests per second, while preserving the source IP address of clients for backend processing.

A company needs to route traffic to the nearest healthy endpoint based on latency, and clients can accept dynamic IP addresses or use DNS-based routing without requiring a fixed set of static IPs.

Candidates may think CloudFront can provide both content delivery and static IPs, but it does not offer a fixed IP set; Global Accelerator is the correct service for static IPs and traffic routing.

Candidates may confuse NLB's ability to provide static IPs (via Elastic IPs) with the global static IP capability of Global Accelerator, overlooking the need for multi-region routing and latency-based endpoint selection.

Candidates may confuse latency-based routing with Global Accelerator's similar latency optimization, overlooking the static IP requirement in the question.

AWS Cost Explorer provides visualization and analysis of cost data but does not automatically send email alerts based on budget thresholds without custom code or third-party tools.

AWS Trusted Advisor provides cost optimization recommendations and checks, but it does not natively support setting custom budget thresholds or sending email alerts when costs reach specific percentages of a budget.

AWS Organizations is a service for centrally managing multiple AWS accounts and consolidating billing, but it does not natively send budget alerts via email. The question requires a managed service that automatically sends notifications when costs reach thresholds, which is a feature of AWS Budgets, not Organizations.

A company needs to analyze historical cost trends and forecast future spending, with no requirement for automated alerts. They want an interactive dashboard to explore cost data by service, linked account, or tags.

A company wants to receive best-practice recommendations to reduce costs, improve performance, or increase security, and needs a managed service that automatically checks their AWS environment against AWS best practices without custom code.

AWS Organizations would be correct if the question asked: 'Which service allows a company to centrally manage policies and consolidate billing across multiple AWS accounts?' or 'Which service enables the creation of service control policies (SCPs) to restrict actions across accounts?'

Candidates confuse Cost Explorer's cost analysis capabilities with the alerting functionality of AWS Budgets, assuming that a cost analysis tool can also send notifications.

Candidates may confuse Trusted Advisor's cost optimization checks with budget alerts, assuming it can monitor and notify about cost thresholds because it provides cost-related recommendations.

Candidates may confuse AWS Organizations with budget management because Organizations provides consolidated billing and cost reports, leading them to think it can also send budget alerts without realizing that AWS Budgets is the dedicated service for setting and alerting on budgets.

AWS Config is a service for assessing, auditing, and evaluating configurations of AWS resources, not for providing compliance reports like SOC 2 or PCI DSS AOC. The question specifically asks for obtaining these documents directly from AWS, which is the function of AWS Artifact.

AWS Audit Manager helps audit evidence collection and report generation, but it does not provide direct access to AWS compliance reports like SOC 2 or PCI DSS AOC. The question specifically asks for obtaining these documents directly from AWS, which is the function of AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide compliance reports like SOC 2 or PCI DSS AOC.

AWS Config would be correct in a scenario where a company needs to continuously monitor and record AWS resource configurations to demonstrate compliance with internal policies or regulatory standards, such as automatically checking that security groups do not allow unrestricted SSH access.

AWS Audit Manager would be correct if the question asked for a service to continuously audit AWS resource usage against PCI DSS requirements, automate evidence collection, and generate audit reports for internal compliance teams, rather than requesting pre-existing AWS compliance reports.

A company wants to check its AWS account against AWS best practices for security and cost optimization, such as identifying unused resources or open security groups. AWS Trusted Advisor would be the correct service to use.

Candidates may confuse AWS Config's compliance evaluation capabilities with the ability to provide formal compliance reports, or they may think that 'audit' implies obtaining audit documents.

The name 'Audit Manager' suggests it manages audits and compliance, leading candidates to think it provides compliance documents, but it actually helps with internal auditing, not distributing AWS's own compliance reports.

Candidates may think Trusted Advisor covers security and compliance checks, and mistakenly believe it can generate compliance reports, not realizing it only offers advisory checks.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across accounts, but it does not offer downloadable PDFs of AWS compliance reports like PCI DSS. The question specifically requires an official document that can be downloaded as a PDF, which is a feature of AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing against custom rules, not for providing official AWS compliance reports or downloadable PDFs like PCI DSS documentation.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports or official documents like PCI DSS attestation PDFs.

A company wants to centrally view and manage security findings from multiple AWS services, such as Amazon GuardDuty and Amazon Inspector, and check overall compliance against standards like CIS AWS Foundations. AWS Security Hub would be the correct service to aggregate and prioritize these security alerts.

A company needs to continuously monitor and evaluate the configuration of their AWS resources against internal policies or regulatory standards (e.g., ensuring EC2 instances have encryption enabled). AWS Config would be the correct service to set up rules and receive compliance notifications.

A company wants to check its AWS account against AWS best practices for security (e.g., whether security groups are overly permissive) and receive actionable recommendations. The compliance officer would use AWS Trusted Advisor to identify potential security risks and improve the account's security posture.

Candidates may associate Security Hub with compliance because it provides compliance checks and security best practice scores, leading them to mistakenly believe it can generate official compliance documents like PCI DSS reports.

Candidates may confuse 'compliance' in the question with AWS Config's compliance evaluation feature, not realizing that AWS Artifact is the specific service for accessing official compliance reports and agreements.

Candidates may think Trusted Advisor covers compliance because it includes security checks, but it does not produce official compliance documents like AWS Artifact does.

EC2 Instance Savings Plans apply to a specific instance family within a region, so changing instance families would incur a penalty or require a new plan, failing the flexibility requirement.

Convertible Reserved Instances allow changing instance families but require a 1-year or 3-year commitment and do not offer the flexibility to switch without financial penalty; exchanging instances may result in different pricing terms or fees.

Standard Reserved Instances require a 1-year commitment to a specific instance family and region, and switching instance families would incur a financial penalty or require selling the reservation on the Reserved Instance Marketplace, which does not meet the flexibility requirement.

A company runs a consistent workload on a specific EC2 instance family (e.g., M5) and is willing to commit to a 1-year term to reduce costs, with no plans to change instance families. EC2 Instance Savings Plans would provide the highest discount for that specific family.

A company needs to reserve EC2 capacity for a 3-year term with the ability to change instance families, operating systems, or tenancies to adapt to evolving workloads, and is willing to manage exchange processes.

A company has a predictable workload running on a specific EC2 instance family (e.g., m5.large) in a single region, is willing to commit to a 1- or 3-year term, and does not anticipate changing instance families or regions. They want the highest discount possible for that fixed configuration.

Candidates may confuse EC2 Instance Savings Plans with Compute Savings Plans, thinking both offer flexibility, but EC2 Instance Savings Plans are limited to a specific instance family, which is less flexible.

Candidates may confuse Convertible RIs with Savings Plans, thinking the ability to change instance families provides penalty-free flexibility, but they overlook the commitment and exchange constraints.

Candidates may think Standard Reserved Instances are the default cost-saving option for any 1-year commitment, overlooking that they lock in instance family and region, which conflicts with the requirement for flexibility to switch instance families without penalty.

Amazon EC2 Auto Scaling only manages the scaling of EC2 instances based on demand; it does not handle application deployment, environment provisioning, or health monitoring at the application level. The team would still need to manually configure EC2 instances, load balancers, and deployment processes.

AWS CloudFormation is an Infrastructure as Code service that requires manual definition and management of resources like EC2 instances and load balancers. It does not automatically monitor application health or allow deployment by simply uploading a zip file, which are key requirements in the question.

AWS OpsWorks uses Chef or Puppet for configuration management, requiring manual setup of stacks and layers, and does not automatically manage infrastructure or allow deployment by simply uploading a zip file.

A question where the requirement is to automatically adjust the number of EC2 instances based on traffic patterns, without needing to manage application deployment or environment setup. For example: 'A company wants to ensure its web application can handle variable traffic by automatically adding or removing EC2 instances based on CPU utilization.'

A company needs to provision and manage a complex, multi-tier infrastructure with strict compliance and version control requirements. They want to define all AWS resources as code, automate deployments across environments, and ensure consistent configurations, but they are willing to manually handle scaling and health monitoring.

A company needs to manage infrastructure using Chef or Puppet recipes, with existing automation scripts, and requires fine-grained control over application configuration and deployment across multiple environments.

Candidates may confuse Auto Scaling with Elastic Beanstalk because both involve scaling, but Auto Scaling is a lower-level service that requires manual setup of other components, whereas Elastic Beanstalk provides a fully managed platform including scaling, deployment, and monitoring.

Candidates may confuse CloudFormation with Elastic Beanstalk because both can automate infrastructure, but they overlook that CloudFormation requires manual resource definition and does not provide built-in application health monitoring or simple zip-based deployments.

Candidates may confuse OpsWorks with Elastic Beanstalk because both are orchestration services, but OpsWorks requires more manual configuration and is not designed for simple zip-based deployments.

AWS Budgets allows you to set cost and usage alerts, but it does not provide interactive visualization or historical trend analysis for the past six months across services and accounts.

AWS Trusted Advisor provides best-practice recommendations for cost optimization, but it does not offer interactive cost trend analysis, filtering by service/account, or data visualization; it is not a cost exploration tool.

AWS Cost and Usage Reports (CUR) provides detailed, raw cost data but requires setting up Amazon Athena or other tools for interactive querying and visualization, whereas the question explicitly asks for an interactive tool without complex report setup.

A company needs to set proactive alerts to notify the finance team when spending exceeds a defined threshold for a specific service or account, and does not require historical analysis or interactive charts.

A company wants to check if its AWS resources follow best practices for cost optimization, performance, security, and fault tolerance, and needs automated recommendations to reduce costs and improve efficiency.

A company needs to generate granular, hourly cost and usage data for custom analysis in a data warehouse or business intelligence tool, and is willing to set up Amazon Athena or Amazon QuickSight to query and visualize the CUR data.

Candidates may confuse Budgets with Cost Explorer because both involve cost monitoring, but Budgets focuses on alerts rather than interactive exploration of historical data.

Candidates may confuse Trusted Advisor's cost optimization checks with cost analysis capabilities, assuming it can provide detailed cost trends and visualizations like Cost Explorer.

Candidates may confuse CUR with Cost Explorer because both involve cost data, but CUR is more detailed and less interactive, leading to a mistaken belief that CUR can directly provide the required interactive visualization.

Elasticity refers to the ability to automatically scale resources up or down based on demand, not to maintain operation during an AZ failure. The question specifically asks about surviving an AZ failure, which is fault tolerance.

Scalability refers to the ability to increase or decrease resources to handle varying load, not to maintain operation during an AZ failure. The requirement is about surviving a failure, not adjusting to demand.

Resource pooling refers to the provider's ability to serve multiple customers from shared physical resources, not to application availability across AZ failures.

A question that asks: 'A web application experiences variable traffic spikes. Which cloud computing concept allows the system to automatically add or remove EC2 instances to match the current load?' would make elasticity the correct answer.

A question asking: 'A company expects a sudden spike in traffic for a new product launch. Which cloud concept ensures the application can automatically add EC2 instances to handle the increased load?' would make scalability correct.

A question asking which cloud characteristic allows multiple customers to use the same physical infrastructure securely and independently would make resource pooling the correct answer.

Candidates may confuse elasticity with high availability or fault tolerance because both involve handling changes in the environment, but elasticity is about scaling, not surviving failures.

Candidates may confuse fault tolerance with scalability because both involve multiple instances, but scalability focuses on performance under load, not failure resilience.

Candidates may confuse resource pooling with high availability or fault tolerance because both involve distributing workloads across multiple resources.

Rapid elasticity refers to the ability to quickly scale resources up or down based on demand, not to the immediate provisioning of resources without manual intervention. The scenario focuses on eliminating the need for a ticket and manual approval, which is about self-service, not scaling.

Resource pooling refers to the provider's computing resources being pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. This scenario is about developers provisioning resources without manual intervention, which is on-demand self-service, not resource pooling.

Measured service refers to the ability to monitor, control, and report usage for billing purposes, not to the immediate provisioning of resources without manual intervention.

A company experiences unpredictable spikes in traffic and needs its application to automatically add or remove compute instances within minutes to handle the load. The question would ask: 'Which cloud characteristic allows resources to be scaled up and down rapidly based on demand?'

A question describing how a cloud provider serves multiple customers from the same physical infrastructure, with resources dynamically allocated and reallocated based on demand, would make resource pooling the correct answer. For example: 'A cloud provider uses shared servers to host multiple customers' workloads, automatically adjusting resource allocation as usage fluctuates.'

A company needs to track and optimize cloud resource usage across departments, with detailed billing reports showing each team's consumption of compute, storage, and bandwidth. Measured service would be the correct answer because it describes the metering and pay-per-use billing model.

Candidates may confuse 'immediate availability' with 'rapid scaling,' thinking that spinning up instances instantly is a form of elasticity, but elasticity is about adjusting capacity, not the self-service provisioning model.

Candidates may confuse resource pooling with the ability to quickly provision resources, as both involve dynamic allocation. They might think that 'pooling' resources enables instant availability, but the key distinction is that resource pooling is about multi-tenancy, not self-service provisioning.

Candidates may confuse 'measured service' with the idea of resources being 'available immediately' because they think measurement implies quick provisioning, but measured service is about usage tracking, not instant access.

IaaS provides virtualized computing resources like servers and storage, but the user must manage the operating system, runtime, and middleware. The question specifies the team wants to avoid managing these components, so IaaS does not meet the requirement.

SaaS provides ready-to-use software applications accessed over the internet, not a platform for deploying custom code. The team needs to write and deploy their own application code, which SaaS does not support.

FaaS (Function as a Service) requires code to be deployed as individual functions triggered by events, not as a full web application. The question specifies uploading application code and having it run with automatic capacity provisioning and load balancing, which aligns with PaaS, not the event-driven, stateless function model of FaaS.

A scenario where the team needs full control over the operating system, runtime, and middleware, such as installing custom software or configuring network settings, and is willing to manage patching and scaling. For example, migrating an existing on-premises application to the cloud with minimal changes.

A company wants to use a customer relationship management (CRM) system without building or maintaining any software, simply subscribing to a service like Salesforce. The question specifies that no custom code development is required.

A question where the team needs to run individual pieces of code in response to events (e.g., file uploads, API calls) without managing servers, and the code is short-lived and stateless. For example: 'A team wants to process images automatically when uploaded to a storage bucket, with no server management.'

Candidates may confuse IaaS with PaaS because both involve cloud-hosted infrastructure, but IaaS requires more operational overhead. They might think 'uploading code' implies IaaS, missing that PaaS abstracts the underlying platform.

Candidates may confuse 'operational overhead' with 'no management at all,' thinking SaaS eliminates all responsibility, but they overlook the need to deploy custom application code.

Candidates may confuse FaaS with PaaS because both abstract server management. However, FaaS is more granular (functions vs. applications) and event-driven, not suited for a full web app with persistent requests.

IAM does not provide SSO with corporate credentials or centralized permission management across multiple AWS accounts; it is designed for user and permission management within a single account.

AWS Directory Service provides managed Microsoft Active Directory but does not offer single sign-on (SSO) to the AWS Management Console or centralized permission management across multiple accounts; it only integrates with IAM for directory-based authentication.

Amazon Cognito is designed for customer identity and access management (CIAM) for web and mobile apps, not for workforce SSO with corporate Active Directory. It does not integrate with AWS Organizations to centrally manage permissions across multiple AWS accounts.

A company needs to create individual IAM users with long-term credentials for direct AWS API access, and does not require federation with an external identity provider or SSO across multiple accounts.

A company needs to extend its on-premises Active Directory to AWS for EC2 instances to join the domain, or to enable LDAP-based authentication for applications, without requiring SSO or multi-account permission management.

A company builds a mobile app and wants to allow users to sign in with their social media accounts (e.g., Facebook, Google) or through a custom identity provider. Amazon Cognito user pools would be the correct service to handle authentication and provide temporary AWS credentials for accessing backend resources.

Candidates may think IAM is the default AWS identity service and assume it can handle SSO and multi-account permissions, overlooking that IAM Identity Center is specifically built for these use cases.

Candidates see 'Microsoft Active Directory' and assume Directory Service is the solution, overlooking that the question specifically requires SSO and centralized permissions across accounts, which are provided by IAM Identity Center.

Candidates may confuse Amazon Cognito's ability to federate with external identity providers (like Active Directory) with the workforce SSO scenario, not realizing that Cognito is primarily for customer-facing apps, not for managing employee access to AWS accounts.

The Developer plan does not include a Technical Account Manager (TAM) and offers a maximum response time of 12 hours for general guidance, not 15 minutes for production system down cases.

The Business support plan does not include a designated Technical Account Manager (TAM) and offers a 1-hour response time for production system down, not the required 15 minutes.

Enterprise On-Ramp does not include a designated Technical Account Manager (TAM) or a 15-minute response time for production system down cases; it offers a 30-minute response time and access to a pool of TAMs.

A startup or small team building a non-critical application with limited budget needs basic support for development and testing, and does not require a TAM or fast response times.

A company needs 24/7 support with a 1-hour response time for production system down, but does not require a designated TAM or architectural guidance. The Business plan would be the correct choice.

A company with workloads that require architectural guidance and proactive support, but not the highest severity response, and with a support budget lower than Enterprise, would choose Enterprise On-Ramp. For example, a mid-sized enterprise migrating to AWS with less than $500K monthly spend.

Candidates may mistakenly think 'Developer' implies the highest level of support for developers, or they overlook the specific requirements for a TAM and 15-minute response time.

Candidates may confuse the Business plan's production system down support (1-hour response) with the Enterprise plan's 15-minute response, or assume 'Business' implies higher tier than it actually is.

Candidates may confuse 'Enterprise On-Ramp' as a lower-cost version of Enterprise that still includes a TAM and fast response, but it actually has reduced SLAs and no dedicated TAM.

This option requires manual effort to enable CloudTrail in each account individually and does not automatically include new accounts added in the future, violating the 'minimal ongoing manual effort' requirement.

AWS Config records resource configuration changes, not API activity. It does not capture all API calls like CloudTrail, and it cannot guarantee delivery of all API events to a centralized S3 bucket for auditing.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a service for recording all API activity for auditing. It does not deliver a complete log of all API calls to an S3 bucket.

If the company does not use AWS Organizations or needs to enable CloudTrail only for a subset of accounts that are not part of an organization, enabling per-account trails with cross-account S3 access would be appropriate.

A question asks: 'A company needs to track configuration changes to AWS resources across multiple accounts and automatically remediate noncompliant resources. Which service should be used?' In that case, AWS Config with multi-account aggregation would be correct.

A company wants to detect and alert on suspicious API activity across multiple accounts, with findings centralized in an S3 bucket for analysis. GuardDuty would be the correct choice for threat detection, not for comprehensive audit logging.

Candidates may think that enabling CloudTrail per account and configuring cross-account access is a straightforward way to centralize logs, overlooking the automation benefits of an organization trail.

Candidates may confuse AWS Config's ability to record configuration history with CloudTrail's API logging, or think Config can capture API calls because it integrates with CloudTrail for some features.

Candidates may confuse GuardDuty's monitoring capabilities with CloudTrail's logging, or think that 'monitor API activity' implies recording all API calls, when GuardDuty only analyzes for threats.