AWS Certified Cloud Practitioner CLF-C02 (CLF-C02) — Questions 376–450

AWS Config records resource configuration changes and compliance, but does not capture detailed API call logs like timestamps, source IPs, or instance types for specific actions. It cannot provide the exact timestamp and source IP of the launch event.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it does not provide a historical audit trail of API calls like launching an EC2 instance. It cannot show the exact timestamp, source IP, and instance type for a specific past event.

AWS Trusted Advisor provides best practice checks and recommendations for cost optimization, performance, security, and fault tolerance, but it does not log or provide detailed event history like API calls or user actions. It cannot show the exact timestamp, source IP, or instance type for a specific EC2 launch.

A question asking: 'Which AWS service can be used to track configuration changes to EC2 instances over time and evaluate compliance against rules?' AWS Config would be correct for auditing resource configurations and detecting drift.

A security team needs to detect and alert on suspicious API activity in real time, such as an unusual number of failed login attempts or a known malicious IP address launching an EC2 instance. GuardDuty would be the correct service to generate findings for such threats.

A security team wants to check if their AWS account follows security best practices, such as whether MFA is enabled on the root account, whether security groups allow unrestricted access, or whether S3 buckets are publicly accessible. In that scenario, AWS Trusted Advisor would be the correct service to use.

Candidates may confuse AWS Config's ability to track resource changes with CloudTrail's API activity logging, thinking Config records all details of who made changes, when, and from where.

Candidates may think GuardDuty can investigate past incidents because it detects threats, but they confuse its real-time detection capabilities with CloudTrail's historical logging of API calls.

Candidates may think Trusted Advisor can help investigate incidents because it has a security category, but they confuse its advisory role with the detailed auditing and logging capabilities of CloudTrail.

AWS Config is used for resource inventory, configuration history, and compliance rules, not for accessing third-party compliance reports like SOC 2 or ISO 27001.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide access to AWS compliance reports like SOC 2 or ISO 27001 certificates. The question specifically requires a centralized portal to download these reports, which is not a feature of Security Hub.

AWS CloudTrail records API activity for auditing, but it does not provide access to compliance reports like SOC 2 or ISO 27001. The question specifically requires a centralized portal for downloading such reports, which is not a CloudTrail feature.

A company needs to continuously monitor and evaluate the configurations of their AWS resources against internal policies or regulatory standards, and receive notifications when resources are non-compliant. AWS Config would be the correct service to set up rules and track configuration changes.

A company wants to centrally view and manage security findings from multiple AWS services, automate compliance checks against standards like CIS or PCI DSS, and receive aggregated security alerts. In that scenario, AWS Security Hub would be the correct service.

A company needs to audit all API calls made in their AWS account to detect unauthorized access or changes. They require a service that logs management and data plane events for security analysis. AWS CloudTrail would be the correct answer.

Candidates may confuse 'compliance reports' with AWS Config's compliance evaluation features, not realizing that AWS Config assesses resource configurations, not provides auditor-ready reports from AWS itself.

Candidates may confuse Security Hub's compliance dashboard with the ability to access compliance reports, or assume that a security-focused service would naturally provide audit evidence documents.

Candidates may associate 'audit' with CloudTrail because it is a primary auditing tool, but they overlook that the question asks for compliance report access, not activity logging.

AWS Budgets does not provide detailed hourly cost data per service, resource, or tag; it only sends alerts when costs or usage exceed budget thresholds.

A company needs to set cost limits and receive notifications when spending approaches or exceeds those limits, without requiring granular hourly data or custom BI integration.

Candidates may think 'Budgets' implies detailed cost breakdowns, but it is primarily an alerting tool, not a reporting tool for granular data export.

AWS Budgets allows you to set custom cost and usage budgets and receive alerts, but it does not combine usage across accounts to achieve volume discounts. It is a monitoring tool, not a billing consolidation feature.

AWS Cost Explorer provides visualization and analysis of costs and usage, but it does not aggregate usage across multiple accounts for volume discount pricing. Consolidated billing via AWS Organizations is required to combine usage and achieve volume discounts.

AWS Trusted Advisor provides recommendations for cost optimization, security, and performance, but it does not combine usage across multiple accounts to achieve volume discount pricing tiers.

A company wants to set a monthly spending limit for its AWS account and receive notifications when costs approach or exceed that limit. AWS Budgets would be the correct service to define budgets and trigger alerts based on actual or forecasted usage.

A company wants to analyze historical cost trends and identify cost drivers across multiple AWS services. AWS Cost Explorer would be the correct tool to create custom reports and forecasts for cost optimization.

A company wants to identify underutilized Amazon EC2 instances across multiple accounts to reduce costs. AWS Trusted Advisor would be the correct feature to use because it checks for idle instances and provides optimization recommendations.

Candidates may think 'Budgets' helps manage costs by setting limits, and mistakenly believe it can aggregate usage across accounts to qualify for discounts, confusing cost monitoring with billing consolidation.

Candidates may confuse Cost Explorer's ability to view costs with the ability to combine usage for discounts, mistakenly thinking that analyzing costs across accounts automatically applies volume pricing tiers.

Candidates may think Trusted Advisor helps with cost optimization, but they confuse its advisory role with the billing aggregation needed for volume discounts.

S3 Object Lock is used to prevent objects from being deleted or overwritten for a fixed retention period, not to automatically transition objects between storage classes based on age.

S3 Replication is used to copy objects across buckets or regions for redundancy, compliance, or latency reduction, not to transition objects between storage classes based on age. It does not automate lifecycle transitions to cost-effective storage.

S3 Transfer Acceleration is designed to speed up uploads over long distances by using edge locations, not for automatically transitioning data between storage classes based on age.

A company needs to store critical financial records in S3 for 7 years and must ensure that no one, including administrators, can delete or modify the data during that period. The compliance policy requires a write-once-read-many (WORM) model.

A company needs to automatically replicate all new objects from an S3 bucket in the US East region to a bucket in the EU West region to ensure data is available locally for users in Europe, with minimal latency. S3 Replication would be the correct feature to configure.

A company has users in different geographic regions uploading large files to a central S3 bucket and wants to minimize upload latency and improve throughput. S3 Transfer Acceleration would be the correct feature to enable faster uploads over long distances.

Candidates may confuse retention requirements with lifecycle management, thinking that Object Lock's retention period can also handle storage class transitions, but it only prevents deletion/modification, not cost optimization.

Candidates may confuse 'replication' with 'transition' or think that replicating data to a different storage class is a way to move data, but replication is about copying, not transitioning existing objects.

Candidates may confuse 'acceleration' with automated lifecycle management, thinking it helps move data faster between storage classes, or they may not fully understand the purpose of Transfer Acceleration.

EC2 Instance Savings Plans apply only to EC2 instances and do not cover AWS Fargate usage, so they lack the cross-platform flexibility required in this scenario.

Reserved Instances (Standard) are tied to a specific instance family, operating system, and tenancy, and do not cover Fargate tasks. The question requires flexibility across instance families, OS, and compute platforms (EC2 or Fargate), which Reserved Instances cannot provide.

Dedicated Hosts provide physical servers dedicated for your use, but they do not offer a discount based on a consistent amount of compute usage ($/hour) and require commitment to specific host types, not flexible across instance families, operating systems, or compute platforms.

A company runs only EC2 instances (no Fargate) and wants to commit to a specific instance family in a single region, but needs flexibility to change instance size or OS within that family. EC2 Instance Savings Plans would then provide the best discount while allowing those changes.

A company runs a stable workload on a specific EC2 instance type (e.g., m5.large) in a single region, does not use Fargate, and wants the highest discount for a 1-year commitment without needing flexibility. They are willing to lock in the instance family and OS.

A company requires dedicated physical servers for licensing or compliance reasons (e.g., Windows Server with per-socket licensing) and is willing to commit to a 1-year or 3-year term to reduce costs. The question would specify that the workload needs to run on a dedicated host and cannot use shared tenancy.

Candidates may confuse EC2 Instance Savings Plans with Compute Savings Plans, assuming both cover all compute, or they may think 'Savings Plans' automatically includes Fargate without reading the specific type.

Candidates may confuse Reserved Instances with Savings Plans, thinking both offer similar discounts, but overlook that Reserved Instances lack the flexibility to change instance families or compute platforms like Fargate.

Candidates may think Dedicated Hosts offer cost savings similar to Reserved Instances or Savings Plans, but they are primarily for licensing and compliance, not for flexible compute discounts across different instance families and platforms.

AWS Config is a service for evaluating resource configurations against rules, but it does not generate audit-ready reports or provide remediation recommendations for compliance frameworks like PCI DSS. The question specifically requires automated evidence collection and report generation, which is the purpose of AWS Audit Manager.

AWS Artifact is a service for downloading compliance reports and agreements, not for automating evidence collection, continuous assessment, or generating audit-ready reports with remediation recommendations.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not automate the collection of evidence for audit reports or generate audit-ready reports with remediation recommendations as required by the question.

AWS Config would be correct if the question asked for a service that continuously monitors and records AWS resource configuration changes, evaluates them against custom or managed rules, and provides a configuration history for compliance auditing, without the need for automated report generation or remediation recommendations.

A company needs to download AWS compliance reports (e.g., SOC, PCI) or review and accept AWS agreements (e.g., Business Associate Addendum) for their own compliance documentation.

A company wants a single place to view and prioritize security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Config) and check compliance against common standards like CIS AWS Foundations. They need a dashboard for security posture, not audit evidence collection.

Candidates may confuse AWS Config's ability to track resource changes and evaluate rules with the more comprehensive compliance reporting and evidence collection capabilities of AWS Audit Manager, especially since both services are used in compliance scenarios.

Candidates confuse Artifact's compliance reports with the automated evidence collection and gap analysis provided by Audit Manager, assuming Artifact can generate custom audit reports.

Candidates may confuse Security Hub's compliance checks (e.g., against CIS benchmarks) with the audit evidence collection and report generation capabilities of Audit Manager, especially since both involve compliance and security standards.

AWS Trusted Advisor provides best-practice checks and recommendations, but it cannot automatically remediate non-compliant S3 buckets by applying encryption settings. It only offers manual or automated remediation for a limited set of checks, not including S3 bucket encryption.

AWS Security Hub aggregates security findings from multiple services but does not automatically remediate non-compliant S3 bucket encryption settings. It lacks the ability to automatically apply encryption; it only provides visibility and centralized alerts.

AWS CloudTrail records API activity but does not continuously monitor configurations or automatically remediate non-compliant resources like S3 buckets without encryption.

A question asks: 'Which AWS service provides a dashboard of best-practice checks for cost optimization, performance, security, and fault tolerance across an AWS account?' In that scenario, AWS Trusted Advisor is the correct answer because it offers those checks and recommendations.

A company wants a single dashboard to view and prioritize security findings (e.g., from AWS Config, GuardDuty, Inspector) across multiple AWS accounts. Security Hub would be correct for aggregating and correlating security alerts, not for automatic remediation.

A question asking which service records all API calls made to S3 buckets for auditing purposes, such as tracking who created a bucket or changed its encryption settings, would have CloudTrail as the correct answer.

Candidates may think Trusted Advisor can enforce security policies because it includes security checks and can perform some automated actions, but they overlook that it does not support automatic remediation for S3 bucket encryption.

Candidates may think Security Hub can enforce encryption because it is a central security service, but it is primarily a findings aggregation and prioritization tool, not a configuration enforcement service.

Candidates may confuse CloudTrail's logging of configuration changes with the ability to monitor and enforce compliance, not realizing it lacks automated remediation capabilities.

AWS Shield Standard provides DDoS protection but does not inspect application-layer payloads like SQL injection strings; it only mitigates volumetric attacks.

Network ACLs are stateless and operate at the subnet level, filtering traffic based on IP addresses, ports, and protocols. They cannot inspect application-layer payloads like SQL injection attempts.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not actively inspect and block HTTP requests at the application layer like a web application firewall. It cannot prevent SQL injection attacks in real-time.

A company wants to protect its EC2 instances from common DDoS attacks (e.g., SYN floods, UDP reflection) at no additional cost. AWS Shield Standard is automatically enabled and would be the correct answer.

A company needs to block traffic from a specific IP range at the subnet boundary to reduce load on the application layer. Network ACLs would be the correct choice because they provide stateless filtering at the VPC subnet level.

A company wants to detect potential security threats across AWS accounts and workloads by analyzing VPC Flow Logs, DNS logs, and CloudTrail events, and receive alerts about suspicious activity such as compromised instances or reconnaissance attempts.

Candidates may confuse 'security' broadly with 'attack protection' and assume Shield covers all attack types, including application-layer threats like SQL injection.

Candidates may confuse network-layer filtering with application-layer inspection, assuming that any security control at the network perimeter can block SQL injection attacks.

Candidates may confuse GuardDuty's threat detection capabilities with active request filtering, assuming it can block attacks because it identifies malicious patterns, but it is a detection-only service without inline prevention.

AWS Cost Explorer provides visualization and analysis of historical costs and usage, but it does not automatically monitor Free Tier limits or send proactive notifications when approaching those limits.

AWS Trusted Advisor provides best practice recommendations for cost optimization, security, and performance, but it does not automatically monitor usage against Free Tier limits and send proactive notifications when approaching those limits.

A company wants to analyze their AWS spending patterns over the past 6 months to identify cost trends and forecast future costs. They need a tool to visualize usage and costs by service and linked account.

A company wants to check if their AWS account is following best practices for cost optimization, such as identifying idle resources or underutilized EC2 instances, and receive recommendations to reduce costs. In that scenario, AWS Trusted Advisor would be the correct service.

Candidates may think Cost Explorer can monitor usage because it shows cost and usage data, but it lacks the alerting and budget threshold capabilities needed for proactive Free Tier limit monitoring.

Candidates may think Trusted Advisor monitors all aspects of AWS usage, including Free Tier limits, because it offers cost optimization checks and recommendations, leading them to incorrectly assume it handles Free Tier alerts.

Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, but it does not buffer or store messages durably. If the application cannot keep up, messages are dropped, and SNS does not allow the application to process orders at a manageable pace.

Amazon Kinesis Data Firehose is designed for streaming data ingestion into data stores and analytics services, not for buffering and decoupling application processing. It does not provide the message-level buffering and decoupling needed to allow the monolithic application to process orders at a manageable pace without loss.

Amazon ElastiCache is an in-memory caching service, not a durable buffer. It does not guarantee persistence of messages; data can be lost on node failure or restart, so it cannot ensure no orders are lost.

A company needs to send real-time notifications (e.g., email, SMS) to customers when an order is placed, and the system must be fully managed and scalable. In that scenario, Amazon SNS would be the correct service.

A company needs to capture real-time order data from multiple sources, transform it, and load it into Amazon S3 and Amazon Redshift for analytics. The solution must be fully managed and handle data delivery with near-real-time latency.

A company needs to reduce database load for a read-heavy application by caching frequently accessed data, such as product catalog information, to improve response times and reduce latency. The solution must be fully managed and support sub-millisecond performance.

Candidates may confuse SNS with SQS because both are messaging services, and they might think SNS can also buffer messages, not realizing SNS is push-based and lacks durable storage and decoupling capabilities.

Candidates may confuse Kinesis Data Firehose's buffering capability with the message queuing needed for decoupling application components, or they may think 'streaming' applies to order processing bursts.

Candidates may confuse ElastiCache's in-memory data store capability with a message queue, thinking it can buffer orders in memory, but they overlook the durability requirement and the fact that ElastiCache is not designed for persistent message storage.

Amazon GuardDuty does not monitor S3 bucket encryption settings; it detects threats like suspicious API calls or unauthorized access, not compliance with encryption policies.

AWS Trusted Advisor's S3 Bucket Permissions check only reviews bucket access policies and permissions, not default encryption settings. It cannot detect or remediate missing encryption, nor does it provide compliance scoring or automated remediation.

CloudTrail logs S3 API calls but cannot detect encryption status or enforce compliance; CloudWatch alarms only react to metrics, not audit encryption settings.

If the question asked for a service to detect anomalous S3 access patterns or potential security threats (e.g., credential compromise), GuardDuty would be correct.

AWS Trusted Advisor would be correct if the question asked for a service to identify S3 buckets with public read/write access or overly permissive bucket policies, and the requirement was for a one-time or periodic advisory check without automated remediation or compliance scoring.

If the requirement were to detect unauthorized S3 API calls (e.g., PutObject without encryption) and alert in real time, CloudTrail with CloudWatch alarms would be correct.

Candidates may confuse GuardDuty's security monitoring capabilities with compliance monitoring, assuming it can check encryption settings.

Candidates may confuse Trusted Advisor's security checks with encryption checks, or assume it covers all security best practices including encryption, leading them to select it as a monitoring tool.

Candidates may think logging all S3 API calls (CloudTrail) plus alerting (CloudWatch) can monitor encryption, but they lack the continuous compliance evaluation and automated remediation needed.

AWS CloudTrail logs API calls but does not provide continuous analysis with machine learning to identify threats or generate findings for automated remediation.

AWS Config is a service for evaluating resource configurations against desired policies, not for continuous threat detection or analyzing API call logs for suspicious activity. It does not use machine learning to identify threats or generate findings for security incidents.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that analyzes API call logs for suspicious activity using machine learning.

A question that asks for a service to record API activity for auditing, compliance, and governance, without requiring threat detection or automated response, would make CloudTrail the correct answer.

A company needs to continuously monitor and record changes to AWS resource configurations, ensuring compliance with internal policies and auditing standards. They want automated checks for configuration drift and the ability to trigger remediation via AWS Lambda when non-compliant changes occur.

A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and deviations from security best practices, with findings reported for remediation. Amazon Inspector would be the correct choice.

Candidates may confuse CloudTrail's logging capability with the threat detection and automated response features that GuardDuty provides, assuming that logging alone satisfies the security monitoring requirement.

Candidates may confuse AWS Config's compliance monitoring and rule evaluation with security threat detection, especially since it can trigger Lambda for remediation, but it lacks the ML-based threat detection and API call log analysis required in this question.

Candidates may confuse Inspector's security assessment capabilities with threat detection, or assume it can analyze API logs because it is a security service, but it focuses on host-level vulnerabilities, not API call analysis.

EC2 Instance Savings Plans apply only to EC2 instance usage, not to Lambda functions, and they require commitment to a specific instance family in a region, lacking the flexibility to change instance families, sizes, or regions.

Reserved Instances require a commitment to a specific instance family and region, and they do not cover Lambda usage. The question demands flexibility across instance families, sizes, regions, and coverage of both EC2 and Lambda.

Spot Instances are not a pricing commitment option; they are spare compute capacity offered at variable discounts with potential interruptions, and they cannot cover Lambda usage or provide a consistent dollar-per-hour commitment.

A company runs only EC2 instances and wants to commit to a consistent amount of compute (e.g., $10/hour) for 1 or 3 years, with flexibility to change instance size within the same family (e.g., c5.large to c5.xlarge) and operating system, but does not need to cover Lambda or change instance families or regions.

A company needs to run a steady-state workload on specific EC2 instance types in a single region for a 1- or 3-year term, and does not use Lambda or need flexibility. Reserved Instances would provide the highest discount for that fixed configuration.

A company runs a fault-tolerant, stateless application that can handle interruptions, and wants to achieve the highest possible discount for EC2 compute without any upfront commitment or guarantee of availability.

Candidates may confuse EC2 Instance Savings Plans with Compute Savings Plans, thinking both offer flexibility, but they overlook that EC2 Instance Savings Plans are restricted to a specific instance family and do not cover Lambda.

Candidates may confuse Reserved Instances with Savings Plans, as both involve upfront commitments for discounts, but fail to recognize that Reserved Instances lack the flexibility to change instance families or regions and do not cover Lambda.

Candidates may think Spot Instances are a cost-saving commitment because they offer significant discounts, but they confuse interruptible capacity with a savings plan that guarantees a consistent discount rate.

AWS Elastic Beanstalk is a PaaS service for deploying applications, not for declaratively defining infrastructure resources like EC2 instances, security groups, and load balancers in JSON/YAML templates. It abstracts infrastructure management, whereas the question requires explicit resource definition and version control.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, not declarative JSON/YAML templates for defining infrastructure. It focuses on managing server configurations and application stacks, not on provisioning all AWS resources in a declarative, version-controlled template.

AWS CodePipeline is a continuous delivery service for automating build, test, and deploy phases, not for defining infrastructure resources in declarative templates. It does not directly manage or provision AWS resources like EC2 instances or security groups.

A company wants to quickly deploy a web application without managing the underlying infrastructure, and needs automatic scaling, load balancing, and monitoring. They want to upload their code and have the service handle provisioning and configuration automatically.

A company wants to manage server configurations and automate application deployment using Chef or Puppet recipes, with a need for lifecycle management of EC2 instances and on-premises servers. AWS OpsWorks would be the correct choice for such configuration management scenarios.

A company wants to automate the build, test, and deployment pipeline for its application code, integrating with source control and running automated tests before deploying to multiple environments. CodePipeline would be the correct service to orchestrate these steps.

Candidates may confuse Elastic Beanstalk's environment management with infrastructure-as-code, or think its configuration files (e.g., .ebextensions) are equivalent to declarative templates like CloudFormation.

Candidates may confuse OpsWorks with CloudFormation because both can automate infrastructure, but OpsWorks is more about configuration management and application stacks, not declarative infrastructure provisioning.

Candidates may confuse CodePipeline with infrastructure automation because it automates deployments, but it focuses on application code delivery, not infrastructure provisioning via declarative templates.

AWS Budgets allows you to set cost and usage thresholds and receive alerts, but it does not combine multiple accounts into a single invoice, aggregate usage for volume discounts, or apply a single payment method.

AWS Cost Explorer provides visualization and analysis of costs and usage, but it does not consolidate billing across multiple accounts, aggregate usage for volume discounts, or enable a single payment method.

AWS Cost and Usage Report (CUR) provides detailed cost and usage data but does not consolidate billing across accounts, aggregate usage for volume discounts, or enable a single payment method. It is a reporting tool, not a billing consolidation feature.

A company wants to monitor spending across multiple AWS accounts and receive notifications when costs exceed predefined limits. AWS Budgets would be the correct answer for setting up cost alerts and tracking budget usage.

A company wants to visualize historical cost trends, forecast future spending, and identify cost drivers across a single account or multiple linked accounts. AWS Cost Explorer would be the correct tool for this analysis.

A company needs to generate a detailed, granular report of AWS costs and usage (e.g., by hour, resource, or tag) for custom analysis or to import into a third-party tool. The question would specify that the team wants raw data for their own reporting, not consolidated billing or discounts.

Candidates may confuse budgeting and cost management features, thinking that AWS Budgets can consolidate billing or manage payments, when it only provides monitoring and alerts.

Candidates may confuse Cost Explorer's ability to view costs across accounts with the actual consolidation of billing and payment, or think that analyzing costs implies the ability to aggregate usage for discounts.

Candidates may confuse the Cost and Usage Report with consolidated billing because both involve multiple accounts and cost data, but CUR is for reporting, not for combining invoices or payment methods.

AWS Config tracks resource configuration changes and evaluates compliance against rules, but it cannot automate patching or apply updates to EC2 instances. It lacks the capability to execute patching workflows.

Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, but it does not automate patching or track patch compliance across instances.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not automate patching of EC2 instances or track patch compliance across multiple Regions.

A company needs to ensure that all EC2 instances are configured with specific security groups and that no unauthorized changes occur. AWS Config can continuously monitor and alert on configuration drift, enforcing compliance rules without modifying instances.

A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and receive a report of findings, without requiring manual scans or agent installation (using SSM Agent).

A company wants to check its AWS account against AWS best practices for security, cost, or performance and receive recommendations for improvement, without needing to automate remediation. For example, identifying EC2 instances that are not using Multi-Factor Authentication or have underutilized resources.

Candidates may confuse configuration compliance (AWS Config) with patch compliance, or assume that tracking changes implies the ability to remediate patches, but Config only evaluates state, not actions.

Candidates may confuse vulnerability scanning (Inspector) with patch management, or assume that a security assessment service also handles remediation and compliance tracking.

Candidates may confuse Trusted Advisor's security checks with patch management capabilities, assuming it can enforce patching because it offers security recommendations.

AWS Cost Explorer analyzes historical costs and usage, but cannot generate upfront cost estimates for migrating to different instance types, regions, or pricing models before deployment.

AWS Budgets is used to set cost and usage budgets and receive alerts when you exceed or are forecasted to exceed them, not to generate upfront cost estimates for migration planning.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not allow you to generate upfront cost estimates for different EC2 instance types, regions, and pricing models before migration.

A company wants to analyze past EC2 spending trends to identify cost-saving opportunities or forecast future costs based on historical usage patterns.

A company wants to set a monthly spending limit for its EC2 usage and receive notifications when costs approach or exceed that limit. AWS Budgets would be the correct tool to create and monitor such budgets.

A company wants to identify underutilized EC2 instances to reduce costs and receives recommendations for Reserved Instance purchases based on existing usage. AWS Trusted Advisor would be the correct tool for this scenario.

Candidates confuse cost estimation for a new workload with cost analysis of existing usage, assuming Cost Explorer can also predict costs for planned resources.

Candidates may confuse cost estimation with cost monitoring, assuming that a tool named 'Budgets' can also help estimate costs before migration.

Candidates may confuse Trusted Advisor's cost optimization recommendations with the ability to estimate costs for new workloads, assuming it can generate upfront pricing estimates.

The scenario describes not knowing the physical server and sharing hardware with other customers, which directly illustrates resource pooling. On-demand self-service refers to the ability to provision resources without human interaction, which is not the focus here.

Rapid elasticity refers to the ability to quickly scale resources up or down based on demand, not to the lack of knowledge about physical server location or multi-tenant hosting.

Measured service refers to the ability to monitor, control, and report usage for billing purposes. The scenario describes lack of knowledge about physical servers and multi-tenant hosting, which is about resource pooling, not metering.

A question stating: 'A developer wants to launch an EC2 instance without contacting IT support. Which characteristic does this represent?' would make on-demand self-service the correct answer.

A question describing an e-commerce site that automatically adds EC2 instances during flash sales and removes them afterward to handle traffic spikes would make rapid elasticity the correct answer.

A company wants to track and optimize its cloud spending by analyzing resource usage per department. The question asks which characteristic enables pay-per-use billing and usage monitoring. Measured service would be correct.

Candidates may confuse the ability to provision instances via the AWS console (self-service) with the underlying multi-tenant architecture, leading them to choose on-demand self-service instead of resource pooling.

Candidates may confuse the dynamic allocation of resources in resource pooling with the scaling aspect of rapid elasticity, or they may think that not knowing the physical server implies automatic scaling.

Candidates may confuse 'measured service' with any cloud feature involving monitoring or abstraction, but here the focus is on physical resource sharing, not usage metering.

AWS Basic Support does not provide a Technical Account Manager (TAM), quarterly business reviews, proactive architectural guidance, or a 15-minute response time for critical failures. It only offers basic support for account and billing issues.

AWS Developer Support does not provide a designated Technical Account Manager (TAM), quarterly business reviews, or proactive architectural guidance, and its response time for critical cases is 1 hour, not 15 minutes.

A company with a non-production workload that requires only basic account and billing support, with no need for technical support or architectural guidance, would choose AWS Basic Support. For example, a small development team running a test environment with minimal support needs.

A startup running a non-production environment with a few developers needs support for early-stage development, including best-practice guidance and a 1-hour response for critical issues, but does not require a TAM or 15-minute response.

Candidates may mistakenly think Basic Support is sufficient for any workload, or they may overlook the specific requirements for a TAM and fast response times, assuming basic support covers all needs.

Candidates may confuse Developer Support with Enterprise Support, thinking it includes a TAM and faster response times, or underestimate the support requirements for PHI workloads.

The workflow describes developers launching and deleting environments quickly, which emphasizes rapid scaling and de-scaling of resources, not the ability to provision resources without human interaction (on-demand self-service).

Resource pooling refers to the provider's multi-tenant model where computing resources are pooled to serve multiple consumers, not to the rapid provisioning and de-provisioning of resources by a single team.

Measured service refers to the metering and billing of cloud resource usage. The scenario emphasizes rapid provisioning and deprovisioning of environments, not tracking or charging for usage.

On-demand self-service would be correct if the question focused on a developer provisioning an EC2 instance directly via the AWS Management Console or CLI without needing to submit a ticket or get approval from IT.

A question describing how AWS uses shared infrastructure to serve multiple customers, with resources dynamically assigned and reassigned based on demand, would make resource pooling the correct answer.

A question describing a company that uses AWS to automatically track and bill different departments based on their exact resource consumption (e.g., EC2 hours, data transfer) would make 'Measured service' the correct answer.

Candidates may confuse the ability to provision resources quickly (rapid elasticity) with the concept of self-service provisioning, as both involve user-initiated actions without manual intervention.

Candidates may confuse the concept of sharing resources (pooling) with the ability to quickly allocate and release resources, especially when multiple developers share the same CloudFormation templates.

Candidates may confuse the automated creation/deletion of resources with metering, or think that because CloudFormation tracks stack resources, it exemplifies measured service.

S3 Standard is designed for frequently accessed data with low latency and high throughput, making it cost-ineffective for rarely accessed data that must be retained for 10 years. The storage cost is significantly higher than archival classes like S3 Glacier Deep Archive.

S3 Intelligent-Tiering is designed for data with unknown or changing access patterns, but this question specifies that records are accessed very rarely (only for audits/legal requests). Intelligent-Tiering incurs monitoring and automation fees that make it less cost-effective than S3 Glacier Deep Archive for data with predictable, infrequent access.

S3 One Zone-IA stores data in a single Availability Zone, which does not meet the durability and availability requirements for critical patient medical records that must be retained for 10 years. Regulatory compliance typically mandates multi-AZ redundancy to prevent data loss from zone failures.

A question where data requires immediate, frequent access (e.g., a web application serving user-generated content) and must be stored with low latency and high durability. For example: 'A media company needs to store video files that are accessed multiple times per day by users.'

A company stores customer transaction logs that are accessed frequently for the first 30 days, then accessed sporadically for the next year, and rarely thereafter. S3 Intelligent-Tiering would automatically move data between tiers based on changing access patterns, optimizing costs without manual intervention.

A company needs cost-effective storage for non-critical, easily reproducible data that can tolerate the loss of an Availability Zone, such as temporary backup copies or cached data that can be regenerated from primary sources.

Candidates may default to S3 Standard as the default or most familiar storage class, overlooking the cost implications of long-term, rarely accessed data. They might not fully consider the trade-offs between access frequency and storage cost.

Candidates may think Intelligent-Tiering is always the most cost-effective because it automatically optimizes costs, but they overlook the monitoring fees and that for truly archival data with no access pattern changes, a dedicated archival class is cheaper.

Candidates may choose S3 One Zone-IA because it offers lower storage costs than S3 Standard and S3 Standard-IA, and they overlook the single-AZ risk, assuming 'IA' (Infrequent Access) is sufficient for rarely accessed data without considering durability requirements.

On-demand self-service refers to the ability to provision computing resources without human interaction, but the question focuses on automatically scaling resources up and down based on demand, which is rapid elasticity, not the provisioning method.

Broad network access refers to the ability to access resources over the network via standard protocols, not to automatically scaling resources based on demand. The scenario focuses on dynamic scaling, not network accessibility.

Measured service refers to the metering and billing of cloud resources based on usage, such as pay-per-hour or per-GB. The scenario describes automatic scaling to handle traffic spikes, which is about rapid elasticity, not about tracking or charging for usage.

A scenario where a user can provision an EC2 instance through the AWS Management Console without needing to contact AWS support would demonstrate on-demand self-service. For example, a developer launching an instance for a test environment without manual approval.

A question describing a company that needs to ensure its cloud resources are accessible from various devices (e.g., laptops, smartphones, tablets) over the internet using standard protocols would make broad network access the correct answer.

A company uses AWS to deploy a web application and wants to track and report resource consumption for cost allocation across departments. The cloud provider offers detailed usage metrics and billing per hour or per GB. This demonstrates measured service.

Candidates may confuse the ability to automatically scale (elasticity) with the ability to provision resources on demand, as both involve responding to user needs without manual intervention.

Candidates may confuse the concept of accessing cloud services over a network with the ability to scale resources, as both involve network connectivity and cloud capabilities.

Candidates may confuse the automatic scaling (which involves adding/removing resources) with the idea of paying only for what you use, which is a characteristic of measured service. However, measured service is about metering and billing, not about dynamic resource adjustment.

High availability refers to systems remaining operational despite failures, not to cost reduction from aggregated demand. The scenario focuses on lower prices due to shared infrastructure, not uptime.

Elasticity refers to the ability to scale resources up or down on demand, not to cost advantages from aggregated demand and optimized operations.

The question focuses on cost reduction through aggregated demand and optimized operations, which is economies of scale, not global reach. Global reach refers to deploying resources in multiple geographic regions, not cost advantages.

A question asks: 'A company wants to ensure its application remains accessible even if one Availability Zone fails. Which cloud benefit does this requirement illustrate?' Then high availability is correct.

A question describing a startup that needs to handle unpredictable traffic spikes by automatically adding and removing EC2 instances would make elasticity the correct answer.

A company needs to serve users across multiple continents with low latency. The correct answer would be global reach because cloud providers have data centers worldwide, enabling rapid deployment in diverse regions.

Candidates may confuse 'high availability' with any benefit of cloud computing, assuming that AWS's large scale inherently ensures availability, but the question specifically addresses cost savings.

Candidates may confuse the cost savings from economies of scale with the ability to scale resources, as both involve 'scale' but in different contexts.

Candidates may confuse the large scale of cloud providers with their global presence, thinking that global reach inherently leads to lower costs, but the question specifically ties cost to aggregated demand and operational optimization.

High availability focuses on ensuring the application remains accessible despite component failures, not on dynamically scaling resources up and down based on demand. The scenario describes automatic scaling to match traffic spikes, which is elasticity.

Fault tolerance refers to a system's ability to continue operating without interruption when one or more components fail. The scenario describes scaling resources up and down based on demand, not handling component failures.

Disaster recovery focuses on restoring IT infrastructure and data after a catastrophic event (e.g., natural disaster, cyberattack), not on automatically scaling resources to handle traffic spikes.

A question describing an architecture with EC2 instances distributed across multiple Availability Zones and an Application Load Balancer that automatically reroutes traffic if an instance fails, ensuring the application stays up even during an AZ outage, would illustrate high availability.

An exam question describing an application that runs on multiple EC2 instances across different Availability Zones, and if one instance or AZ fails, the application continues to function seamlessly without any downtime.

A question describing a company that replicates its entire infrastructure across multiple AWS regions and uses automated failover to recover from a regional outage would make disaster recovery the correct answer.

Candidates may confuse elasticity with high availability because both involve handling increased load, but high availability is about redundancy and failover, not dynamic scaling.

Candidates may confuse elasticity with fault tolerance because both involve multiple instances and automated responses, but fault tolerance focuses on failure resilience, not dynamic scaling to meet demand.

Candidates may confuse the ability to handle sudden load increases with the need to recover from failures, or they might think that scaling out during high traffic is a form of recovery from capacity shortages.

AWS Budgets is used to set spending limits and receive alerts, not to generate detailed, itemized cost estimates for comparing configurations before incurring charges.

AWS Cost Explorer analyzes historical costs and usage, but does not provide upfront cost estimates for planned configurations without incurring actual charges.

AWS Cost and Usage Report provides detailed billing data after charges have been incurred, not a pre-migration cost estimate without actual charges. It cannot compare instance types or pricing models before deployment.

A solutions architect needs to set a monthly cost threshold for an existing AWS account and receive notifications when spending approaches or exceeds the budget.

A solutions architect needs to analyze past EC2 usage patterns to identify cost-saving opportunities, such as rightsizing instances or purchasing Reserved Instances based on historical data.

A solutions architect needs to analyze historical cost and usage data for an existing AWS environment to identify cost-saving opportunities, such as rightsizing EC2 instances or identifying underutilized resources. The tool must provide granular, hourly-level data for custom reports.

Candidates may confuse budgeting with cost estimation, thinking that a tool named 'Budgets' can provide cost estimates for future usage.

Candidates may confuse Cost Explorer's cost analysis capabilities with the ability to estimate future costs, not realizing it requires existing usage data.

Candidates may confuse 'cost estimate' with 'cost reporting' and think that a detailed report would help estimate costs, not realizing that the report only shows past incurred costs, not future projections.

IAM policies attached to users/roles do not apply to the root user or new accounts automatically, and they require manual attachment to every principal, failing the 'minimal ongoing administration' and 'every account including new ones' requirements.

AWS Config with a custom Lambda function is a detective and reactive control, not a preventive one. It would terminate resources after creation, not block them, and requires ongoing maintenance of the Lambda function and Config rules.

VPC endpoint policies only control traffic to AWS services through VPC endpoints, not resource creation across all accounts and regions. They cannot block deployments in non-approved regions for accounts not using VPC endpoints.

If the question asked for a solution to restrict resource deployment for specific IAM users or roles within a single account, and did not require coverage of new accounts or the root user, then an IAM policy with a Region condition would be correct.

This option would be correct if the question asked for a detective control that automatically remediates non-compliant resources after they are created, or if the requirement was to audit and report on resources in non-approved Regions rather than prevent them.

A question asking how to restrict access to AWS services (e.g., S3, DynamoDB) to only traffic originating from a specific VPC or on-premises network, using VPC endpoints and endpoint policies.

Candidates may think IAM policies are the standard way to control permissions and overlook that SCPs are needed for organization-wide preventive controls across all accounts.

Candidates may think AWS Config can enforce policies proactively, but it only detects and can trigger remediation after the fact, not block the action. The Lambda function seems like a powerful automation, but it doesn't meet the preventive requirement.

Candidates may confuse network-level controls (VPC endpoints) with organization-wide governance controls (SCPs), thinking that restricting traffic to approved regions via endpoints prevents resource creation.

Amazon CloudFront is a content delivery network (CDN) that primarily handles HTTP/HTTPS traffic and does not support UDP traffic, which is required for the real-time game communication. It also does not provide static IP addresses for whitelisting.

Amazon Route 53 does not provide static IP addresses for whitelisting; it uses DNS-based routing, which can change IP addresses. It also does not natively handle UDP traffic for real-time communication with static IPs.

AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but it does not provide global traffic routing to the nearest healthy endpoint, nor does it offer static IP addresses for whitelisting by ISPs. It is not designed for global traffic distribution or UDP optimization.

A company wants to deliver static and dynamic web content (e.g., images, videos, API responses) with low latency and high transfer speeds to a global audience. The solution must support HTTP/HTTPS and integrate with AWS origins like S3, EC2, or ALB.

A company needs to route users to the nearest healthy application endpoint based on latency, using DNS-based traffic management, and does not require static IP addresses or UDP support. The application is HTTP/HTTPS-based and can tolerate DNS caching delays.

A company needs a dedicated, private, low-latency connection between its on-premises data center and AWS VPC to support consistent throughput for large data transfers, and compliance requires avoiding the public internet. Direct Connect would be the correct answer.

Candidates may associate CloudFront with global edge locations and low-latency content delivery, but overlook its lack of UDP support and static IP address capabilities.

Candidates may think Route 53's latency-based routing and health checks can solve the problem, overlooking the requirement for static IP addresses and UDP support, which are not provided by Route 53.

Candidates may think Direct Connect provides static IPs and low latency, but it is a physical connection solution, not a global traffic routing service, and does not handle UDP optimization or endpoint health checks across regions.

AWS Trusted Advisor does not provide budget alerts or spending limits by tag; it offers cost optimization checks but not per-department budget tracking or email alerts at spending thresholds.

AWS Budgets can send alerts, but Amazon QuickSight is not needed for a visual dashboard comparing actual vs. budgeted spending; AWS Cost Explorer provides that visualization directly. QuickSight is an overkill and not the simplest solution for this requirement.

AWS Pricing Calculator is used for estimating future costs, not for setting budgets, tracking spending, or creating dashboards. It cannot send alerts or provide a visual comparison of actual vs. budgeted spending.

A company wants to identify cost savings opportunities and check service limits for multiple accounts. AWS Cost Explorer visualizes cost trends, and Trusted Advisor provides recommendations for cost optimization and service limit checks.

If the question required advanced, customizable visualizations (e.g., drill-downs, interactive dashboards) or needed to combine cost data with other business data (e.g., HR data), then AWS Budgets for alerts and Amazon QuickSight for custom dashboards would be the correct choice.

A company wants to estimate the cost of migrating its on-premises workloads to AWS before committing to a migration. They need to compare pricing for different instance types and regions. AWS Pricing Calculator provides detailed cost estimates, and AWS Cost Explorer can analyze historical usage to validate estimates.

Candidates may think Trusted Advisor covers cost alerts because it includes cost optimization checks, and Cost Explorer provides visualization, but they overlook the need for budget-based alerts and tag-based limits.

Candidates may think QuickSight is necessary for any visual dashboard, not realizing that Cost Explorer already offers built-in budget vs. actual charts. They also might over-engineer the solution by adding a BI tool when a simpler one suffices.

Candidates may think AWS Pricing Calculator is involved in budgeting because it deals with costs, and they may not fully understand that it is only for estimation, not for tracking or alerting on actual spending.

The scenario emphasizes detailed usage tracking and cost allocation based on actual consumption (instance hours, data transfer, storage), which is the definition of measured service. On-demand self-service refers to the ability to provision resources without human interaction, which is not the focus here.

Resource pooling refers to the provider's ability to serve multiple customers from shared physical resources, not to the detailed tracking and reporting of usage for cost allocation. The question focuses on the granular usage data enabling cost allocation, which is a characteristic of measured service.

A company needs to spin up EC2 instances and create S3 buckets directly through the AWS Management Console without contacting AWS support. This scenario demonstrates on-demand self-service because users can provision resources automatically as needed.

A company notices that its EC2 instances are running on the same physical host as another customer's instances, and they are concerned about security isolation. This scenario demonstrates resource pooling, where the provider pools resources to serve multiple customers.

Candidates may confuse the ability to access and use AWS services on-demand (self-service) with the metering and billing aspect (measured service), especially since both involve user-initiated actions and consumption tracking.

Candidates may confuse resource pooling with the idea that resources are shared and thus usage is tracked, but the key point of the question is the metering and reporting aspect, not the sharing of resources.

AWS Audit Manager helps audit AWS resource usage by creating evidence and reports, but it does not provide pre-existing compliance reports like SOC 2 or ISO 27001; those are available only through AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, but it does not provide downloadable SOC 2 or ISO 27001 reports. Those reports are accessed via AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but does not provide downloadable compliance reports like SOC 2 or ISO 27001 certifications.

A company needs to continuously monitor and collect evidence of its own AWS resource configurations against SOC 2 or ISO 27001 controls, and automate audit report generation. AWS Audit Manager would be the correct service to use.

A company needs to continuously monitor and evaluate the configuration of its AWS resources against internal policies or specific compliance frameworks (e.g., PCI DSS, HIPAA) and receive automated compliance score. AWS Config rules and aggregators would be the correct service.

A question asking which AWS service provides real-time guidance to provision resources following AWS best practices, such as checking for unused resources or security group rules that allow unrestricted access.

Candidates may confuse 'audit' in the service name with the need for compliance reports, not realizing Audit Manager is for internal audits, not for downloading AWS's own certifications.

Candidates may confuse 'compliance' in the question with AWS Config's compliance features, not realizing that AWS Config monitors resource configurations, not provides third-party audit reports.

Candidates may confuse Trusted Advisor's security checks with compliance reporting, assuming it can generate evidence for audits.

VPC peering requires managing individual connections between each pair of VPCs, which does not scale to hundreds of VPCs and lacks centralized routing management. It also does not natively integrate with on-premises networks via Direct Connect.

AWS PrivateLink is used for private connectivity between VPCs and services, not for routing traffic between multiple VPCs or to on-premises networks. It does not provide a hub-and-spoke architecture or centralized routing management.

AWS Site-to-Site VPN connects individual VPCs to on-premises networks but does not provide a centralized hub for inter-VPC connectivity or simplify peering complexity across multiple VPCs and accounts.

When a company needs to connect a small number of VPCs (e.g., 2-5) with simple, direct connectivity and does not require centralized routing or integration with on-premises networks. The question would specify a limited number of VPCs and no need for hub-and-spoke architecture.

A company needs to expose a service privately from one VPC to multiple consumer VPCs without VPC peering or transit gateway, ensuring traffic does not traverse the public internet. PrivateLink would be the correct answer.

A company needs to connect a single VPC to an on-premises data center over the internet with encrypted tunnels, and does not require inter-VPC connectivity or a hub-and-spoke architecture.

Candidates may think VPC peering is the default way to connect VPCs and overlook its scalability limitations, especially when the question mentions 'simplify connectivity' without explicitly stating the need for a hub.

Candidates may confuse PrivateLink's ability to connect VPCs privately with the need for a network hub, overlooking that PrivateLink only supports point-to-point service connections, not full mesh or hub-and-spoke routing.

Candidates may confuse Site-to-Site VPN with Transit Gateway because both can connect on-premises networks, but Site-to-Site VPN lacks the centralized routing and multi-VPC aggregation capabilities needed for this scenario.

AWS Cost Explorer analyzes historical cost data and provides forecasts, but it cannot generate cost estimates for hypothetical scenarios before resources are launched, such as comparing On-Demand vs. Reserved Instance pricing for a new application.

AWS Budgets is used to set cost and usage alerts, not to generate upfront cost estimates comparing different pricing models like On-Demand vs. Reserved Instances.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not generate cost estimates for comparing pricing models like On-Demand vs. Reserved Instances.

A company wants to visualize and analyze their existing AWS spending patterns over the past few months, identify cost trends, and create custom reports to understand which services or accounts are driving costs.

A company wants to set a monthly budget cap for its EC2 usage and receive alerts when spending exceeds 80% of that budget. AWS Budgets would be the correct tool to create cost budgets and configure notifications.

A question asks: 'Which AWS service provides recommendations to reduce costs by identifying idle resources or reserved instance opportunities?' In that context, Trusted Advisor would be correct.

Candidates may confuse Cost Explorer with a cost estimation tool because its name suggests exploring costs, and it does provide cost forecasting, but it requires existing usage data to function.

Candidates may confuse cost management tools, thinking that 'Budgets' can also estimate costs, or they may assume any cost-related tool can provide pricing comparisons.

Candidates may confuse Trusted Advisor's cost optimization recommendations with the ability to generate detailed cost estimates, assuming it can compare pricing models directly.

AWS Cost Explorer provides cost visualization and analysis but cannot automatically take actions like stopping EC2 instances based on spending thresholds.

AWS Trusted Advisor provides cost optimization recommendations but cannot automatically stop EC2 instances based on spending thresholds; it lacks native budget action capabilities.

AWS Config is a service for resource inventory, configuration history, and compliance auditing, not for cost-based automated actions. It cannot directly stop EC2 instances based on spending thresholds.

A company wants to analyze historical cost trends and forecast future spending to identify cost-saving opportunities, without needing automated actions.

A company wants to identify underutilized EC2 instances that could be stopped to reduce costs, and needs a service that provides best-practice recommendations without automation. AWS Trusted Advisor would be the correct answer.

A company needs to automatically remediate non-compliant EC2 instances (e.g., those without required tags) by stopping them. AWS Config rules with auto-remediation actions would be the correct choice.

Candidates may confuse cost analysis tools with cost management actions, assuming Cost Explorer can trigger automated responses.

Candidates may confuse Trusted Advisor's cost optimization checks with the ability to enforce actions, assuming it can automatically stop instances based on cost thresholds.

Candidates may confuse AWS Config's ability to trigger actions (via AWS Config rules and Systems Manager Automation) with budget-based automation, overlooking that AWS Config does not natively monitor cost metrics.

Amazon RDS Single-AZ does not provide automatic failover to a standby instance; if the primary fails, the database becomes unavailable until manual intervention restores it.

Amazon DynamoDB Global Tables is a NoSQL database service, not a relational database, and the question specifies a relational database requirement.

Amazon S3 is an object storage service, not a relational database. It cannot provide the high availability, automatic failover, or relational database capabilities required for this web application.

A company runs a development/test web application on Amazon EC2 that uses a relational database and wants to minimize costs while still using a managed database service. They do not require high availability or automatic failover.

A company needs a globally distributed, multi-region, multi-active NoSQL database with automatic replication and high availability for a web application that can tolerate eventual consistency.

A company needs to store and retrieve large amounts of unstructured data (e.g., images, videos, backups) with high durability and availability, and requires serverless storage with no database management overhead.

Candidates may think Single-AZ is sufficient because they overlook the requirement for automatic failover, focusing only on the managed database aspect.

Candidates may confuse 'Global Tables' with high availability and automatic failover, not realizing DynamoDB is NoSQL and not relational.

Candidates may confuse high availability and durability features of S3 with database availability, or think S3 can serve as a database due to its scalability and low cost.