s3

Which AWS pricing benefit means that the more AWS services you use across your organization, the greater the volume discounts you receive on some services?

A company is migrating a large enterprise workload to AWS. They want to understand all the migration strategies available. Which framework categorizes cloud migration strategies as the '7 Rs'?

A company runs a monthly data processing job that requires 100 Amazon EC2 instances to complete within 4 hours. The job is not needed at any other time. The company previously ran this job on its on-premises servers, which required maintaining enough capacity to handle the peak load year-round, leading to low average utilization. The company has now migrated the job to AWS. Each month, the company automatically provisions the 100 instances, runs the job, and then terminates the instances. Which essential characteristic of cloud computing does this scenario best illustrate?

A company runs a set of Amazon EC2 instances that handle a consistent, predictable workload 24 hours a day, 7 days a week. The company expects to continue running this workload for the next three years. The finance team wants to minimize the total cost of these EC2 instances while maintaining flexibility to change instance families if needed. Which AWS pricing option should the company choose to meet these requirements?

Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?

A company uses AWS CloudTrail to log all API calls in their AWS account for compliance and security auditing. Their compliance officer needs to prove to an external auditor that the CloudTrail log files have not been altered or deleted after they were created. The company must use the most cost-effective and built-in AWS feature to detect any tampering with the log files. What should the company enable?

A company is planning to migrate its on-premises database and web application to AWS. The solutions architect needs to provide a detailed monthly cost estimate for the AWS resources that will be used, including Amazon EC2 instances, Amazon RDS database instances, and Amazon S3 storage. The architect wants to specify instance types, storage sizes, data transfer amounts, and other parameters to get a precise estimate before building the environment. Which AWS tool should the architect use?

Which Amazon EC2 pricing option allows customers to bid for unused EC2 capacity with potential savings of up to 90%, while accepting that instances may be interrupted?

Drag and drop the steps to set up CloudFront with an S3 origin in the correct order.

Which AWS service automatically moves S3 objects between storage classes based on access patterns without requiring upfront knowledge of how frequently data will be accessed?

Which AWS storage class is optimized for long-term archival where data is rarely accessed and retrieval time of several hours is acceptable?

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any user, including account administrators, from creating Amazon S3 buckets that are publicly accessible across the entire organization. The policy must be centrally managed and cannot be overridden by individual account administrators. Which AWS feature should the security team use?

A cloud provider uses shared physical infrastructure to serve many customers. Each customer's compute and storage resources are logically isolated and secure, but the underlying hardware is pooled across all customers. Which essential characteristic of cloud computing does this scenario BEST describe?

A company wants to automatically receive an email alert whenever their monthly AWS spend is forecasted to exceed $10,000, or if it actually exceeds $10,000. Which AWS service provides this capability?

Which AWS service allows you to create a private network connection between your on-premises data center and AWS without using the public internet?

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits, including SQL injection and cross-site scripting (XSS). The solution must integrate directly with the ALB and allow custom rules to be defined. Which AWS service should the company use?

A company is planning to migrate its on-premises workloads to AWS. The cloud architect needs to create a detailed estimate of the monthly AWS bill based on specific configuration details, such as the number of Amazon EC2 instances with particular instance types, storage volumes, data transfer amounts, and Amazon RDS database instances. The architect wants to input these known specifications and obtain an estimated monthly cost breakdown before launching any resources. Which AWS tool should the architect use to meet this requirement?

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

A large enterprise runs business-critical workloads on AWS and needs 24/7 phone and chat access to Cloud Support Engineers, a designated Technical Account Manager (TAM), and access to proactive guidance and architectural reviews. Which AWS Support plan includes all of these features?

A company runs its web application on a fleet of Amazon EC2 instances. The operations team does not know which specific physical servers host their instances, nor does the team have any control over the underlying hardware. However, the team can be confident that if one physical server fails, AWS will automatically launch replacement instances on different hosts. The team can also specify the general geographic region (e.g., us-west-2) but not the exact data center. This scenario best describes which essential characteristic of cloud computing?

Which IAM feature allows you to grant temporary, limited access to AWS resources for users who don't have AWS accounts, such as third-party contractors?

Which Amazon EC2 instance type provides the best performance for a relational database that requires very high IOPS with consistent sub-millisecond storage latency?

A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?

Which AWS service provides a managed graph database for storing and querying highly connected data?

A company stores large amounts of data in Amazon S3 and wants to query it using standard SQL without loading it into a database. They need queries to complete in seconds. Which query optimization technique should they apply?

A company is evaluating cloud adoption. Which of the following is a benefit of moving to the cloud over traditional on-premises infrastructure? (Select all that apply in context: which single answer best captures the operational model shift?)

Which tool allows a company to estimate the monthly cost of running a new AWS architecture before deploying any resources?

A company operates an e-commerce website that sends transactional emails such as order confirmations, password reset links, and shipping updates to customers. The company expects email volume to grow significantly during promotional events. The development team wants a fully managed AWS service that can reliably send high volumes of transactional emails, provide real-time tracking of bounces and complaints, and allow integration through a simple API. The team does not want to manage any email servers. Which AWS service should the team use?

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?

A development team needs to create a new Amazon RDS MySQL database for a temporary testing environment. A developer logs into the AWS Management Console, selects the desired instance type, storage, and network settings, and clicks 'Create database'. The database is available within 10 minutes, and the developer did not need to submit a request or wait for IT approval. Which essential characteristic of cloud computing does this process best demonstrate?

A company's public-facing web application is being attacked with SQL injection and cross-site scripting (XSS) attempts. Which AWS service should they deploy to detect and block these web application attacks?

A company runs a web application on AWS that experiences unpredictable traffic spikes. The operations team wants the infrastructure to automatically add compute capacity when demand increases and remove it when demand decreases, without manual intervention. The team also wants to pay only for the compute resources they actually use. Which cloud computing concept does this scenario best describe?

A SaaS company wants to expose their service to AWS customers through the AWS Marketplace and allow customers to access it privately without traversing the public internet. Which technology enables this?

A company is migrating a three-tier web application to AWS. The application will run on Amazon EC2 instances using a custom Linux distribution, and a self-managed MySQL database will be installed on the same instances. The company's security team needs to understand which security responsibilities belong to AWS and which belong to the company under the AWS Shared Responsibility Model. According to this model, who is responsible for applying operating system security patches to the EC2 instances and for updating the MySQL database software?

A company generates large log files from its application and stores them in an Amazon S3 bucket. During the first 30 days, logs are frequently accessed for troubleshooting. After 30 days, logs are accessed infrequently (a few times per month). After 90 days, logs are rarely accessed but must be retained for compliance for one year, with retrieval possible within minutes if needed. The company wants to minimize storage costs while meeting these access and retention requirements. Which S3 feature should the company configure?

A company currently runs its infrastructure in a colocation data center. The CIO wants to estimate the total cost of ownership (TCO) of migrating the existing workload to AWS, compared to continuing with the on-premises solution. The company has detailed data on current server specifications, power, cooling, and labor costs. Which AWS tool should the company use to perform this analysis?

A company needs to generate detailed AWS billing reports segmented by department. Each department uses distinct AWS accounts under an AWS Organization. Which two mechanisms work together to provide department-level cost allocation?

A company wants to purchase and deploy a third-party security software solution (a firewall appliance) directly to their AWS environment, with licensing costs added to their AWS monthly bill. Where can they find and subscribe to this software?

A development team uses AWS developer tools for their entire software delivery process: a Git-based code repository, automated compilation and testing, and automated deployment to EC2 instances. Which combination of AWS services provides these three capabilities?

Which AWS pricing model provides the largest discount compared to On-Demand pricing in exchange for a 1 or 3-year commitment with full upfront payment?

AWS builds and operates large physical data centres and uses virtualisation to serve thousands of customers simultaneously on shared hardware while keeping each customer's data logically isolated. Which cloud computing characteristic does this describe?

A gaming company launches a new online multiplayer game. During peak hours (evenings and weekends), the player count spikes dramatically, requiring dozens of Amazon EC2 instances to handle the load. During off-peak hours, the player count drops to near zero. The company configures an Amazon EC2 Auto Scaling group that automatically adds instances when CPU utilization exceeds 70% and removes instances when utilization drops below 30%. Which characteristic of cloud computing does this configuration best demonstrate?

A company uses multiple AWS accounts and wants to enforce cost governance. The company needs to set a monthly cost budget of $10,000 for each account. When an account's actual or forecasted costs exceed this budget, the company wants to automatically apply a restrictive IAM policy that prevents the creation of new resources in that account. Additionally, the company wants to receive an email notification when the budget is exceeded. Which AWS feature should the company use to meet these requirements?

A company uses a variety of AWS services and wants to automatically detect unexpected cost spikes that might indicate resource misuse, billing errors, or unauthorized activity. The company needs a managed service that uses machine learning to analyze spending patterns and provide alerts when costs deviate from expected trends. The finance team does not want to manually define thresholds for every service. Which AWS service should the finance team use?

A company runs a data processing job once per month. The job takes approximately 3 hours to complete when run on a single server. The company wants to minimize operational overhead and pay only for the compute time used during the job. The job does not require user interaction and must be able to automatically retry if a task fails. Which AWS service should the company use?

A company wants to deploy their application globally and needs AWS to automatically route users to the nearest healthy application endpoint with improved network performance. Which AWS service uses the AWS global network backbone for routing optimization?

A startup founder is evaluating whether to build their own data center or use AWS. Which cloud benefit eliminates the need for guessing future infrastructure requirements and making large upfront investments?

A media company processes user-uploaded images. When a user uploads a high-resolution image to an Amazon S3 bucket, the company must automatically generate three resized thumbnail versions (small, medium, large) within seconds. The company wants a solution that requires no infrastructure management and scales automatically to handle thousands of concurrent uploads. Which AWS service should the company use to execute the thumbnail generation code?

A company has workloads that must remain on-premises due to data residency regulations but want to use the same AWS APIs, tools, and services they use in the cloud — including EC2, RDS, and S3 — on their on-premises hardware. Which AWS service enables this?

Which AWS service provides centralized governance and compliance across multiple AWS accounts in an organization?

A company hosts a web application on Amazon EC2 instances in two AWS Regions: us-east-1 and eu-west-1. The application serves a global user base. The company wants to improve performance by directing users to the nearest healthy regional endpoint with minimal latency. Additionally, the company requires two static Anycast IP addresses that remain constant, representing the application entry point. The solution should automatically reroute traffic if a regional endpoint becomes unhealthy. Which AWS service should the company use?

A multinational corporation has a policy that all cloud resources must be provisioned through a centralized IT team. This has caused delays, as developers sometimes wait days for a test environment to be created. The company wants to migrate to AWS to allow individual project teams to provision their own resources (such as Amazon EC2 instances and Amazon S3 buckets) directly through the AWS Management Console or API, without any manual approval process from IT. Which characteristic of cloud computing does this desired capability best represent?

A financial services company stores sensitive transaction data in Amazon S3. The company must encrypt the data at rest using keys that are stored in a hardware security module (HSM) validated under FIPS 140-2 Level 3. Additionally, the company requires full control over the key lifecycle, including rotation and deletion, and AWS must not have any access to the keys. Which AWS service should the company use to generate and store the encryption keys?

A company wants to deploy AWS services in a specific geographic location within a metropolitan area to reduce latency for end users in that city, while still using standard AWS APIs. Which AWS infrastructure type addresses this?

Which statement accurately describes the relationship between AWS Regions and Availability Zones?

A healthcare company is required to encrypt all protected health information (PHI) stored in Amazon S3. The company must maintain control over the encryption keys, rotate them annually, and log all key usage. Which AWS service or feature should they use to meet these requirements?

A company uses AWS Organizations to manage multiple accounts. The operations team runs hundreds of Amazon EC2 instances across these accounts for various applications. The security team requires that all EC2 instances be patched with the latest security updates within 7 days of release. Currently, the operations team manually applies patches by logging into each account and using Systems Manager Patch Manager individually. The team wants to centralize patch compliance management so that a single operations team can define patch baselines, schedule patching, and view compliance status across all accounts from a single pane of glass, without needing to switch between accounts. Which AWS service or feature should the team use to meet these requirements?

A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?

An e-commerce company runs a MySQL database on-premises to support its transactional workload. The company plans to migrate this database to AWS to reduce operational overhead. The company requires a fully managed database solution that automatically replicates data across multiple Availability Zones to provide failover in the event of an Availability Zone failure. The company does not want to manage database patching, backup scheduling, or replication. Which AWS service should the company use to meet these requirements?

A company runs hundreds of Amazon EC2 instances for its application. The operations team manually reviews instance utilization metrics once a month to identify instances that are over-provisioned (e.g., using only 10% of CPU) or under-provisioned. They want to automate this analysis and receive rightsizing recommendations to optimize costs and performance. The solution must be natively provided by AWS and must use historical utilization data to generate recommendations. Which AWS service should the company use?

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application serves dynamic content that changes frequently, but also serves static assets (CSS, JavaScript, images) that change rarely. The company wants to improve the overall performance and reduce the load on the EC2 instances by caching the static assets at edge locations while still routing dynamic requests to the ALB. Which combination of AWS services should the company use?

A company is developing a real-time multiplayer game that requires extremely low latency (under 10ms) for player interactions. The game will be accessed by mobile users on 5G networks in select metropolitan areas. The company wants to run the game server logic as close to the users as possible, leveraging the low latency of 5G and avoiding the round trip to an AWS Region. Which AWS service should the company use to deploy the game server compute at the edge of the 5G network?

A media company runs a website that serves video content globally. Users request video previews, which require the generation of thumbnail images on-the-fly. The company wants to generate these thumbnails at AWS edge locations so that the processing occurs close to users, reducing latency and offloading the origin servers. The solution must run custom code in response to CloudFront events without provisioning any servers. Which AWS service should the company use to meet these requirements?

A company needs to synchronize data in real time between its on-premises Oracle database and an Amazon RDS MySQL instance during a migration. Which AWS service handles ongoing data replication between heterogeneous databases?

Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?

A mid-size company is planning to migrate its IT infrastructure to the AWS Cloud. The Chief Information Officer (CIO) expresses concern that multiple customers' virtual servers might run on the same physical hardware, potentially increasing the risk of data exposure. Which cloud computing characteristic describes this shared infrastructure model, where computing resources are pooled to serve multiple customers using a multi-tenant model?

A company runs a web application that accepts customer orders. During peak hours, the order processing component often becomes overloaded, causing orders to be dropped. The company wants to ensure that every order is reliably stored and processed, and that the web tier and the processing tier can scale independently without losing data. Which AWS service should the company use to decouple the application components and provide a durable buffer for incoming orders?

A company needs to run a data processing job that typically takes 2 hours to complete. The job is stateless and can be parallelized across multiple workers. The company wants to minimize operational overhead and only pay for the compute time consumed. The job runs only once a month. Which AWS compute service should the company use?

Which Amazon EC2 instance family is optimized for memory-intensive workloads such as in-memory databases, real-time big data analytics, and high-performance computing?

Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?

A company runs a web application on AWS that experiences unpredictable traffic spikes. The company wants to configure its infrastructure to automatically increase compute capacity during peak times and decrease it during low traffic, minimizing costs. Which cloud computing concept does this scenario BEST represent?

Drag and drop the steps to migrate an on-premises database to Amazon RDS using AWS DMS in the correct order.

Which type of Elastic Load Balancer routes HTTP/HTTPS traffic based on content such as URL path, hostname, and HTTP headers, enabling advanced request routing rules?

Which Amazon S3 storage class is most cost-effective for data that is accessed frequently?

A company archives compliance records that must be retained for 7 years but will almost never be accessed. They need the absolute lowest storage cost with retrieval times of several hours being acceptable. Which S3 storage class should they use?

A healthcare organization stores sensitive patient records in Amazon S3. The organization's compliance team learns that AWS stores data from multiple customers on the same physical hardware. They are concerned that data from different customers could be mixed or accessed by another customer. Which fundamental characteristic of cloud computing explains how AWS allows customers to share physical infrastructure while keeping each customer's data logically isolated?

A company is building a serverless order-processing application. The workflow consists of several steps that must run in a defined order: validate the order, check inventory, process payment, and then update the database. Some steps, such as shipping notification and invoice generation, can run in parallel after payment is confirmed. The company needs a managed service to orchestrate these steps, automatically handle retries if a step fails, and provide a visual representation of the workflow's execution state. Which AWS service should the company use?

A company's finance team wants to receive an email alert when monthly AWS costs exceed 80% of the budgeted amount. Additionally, they want to automatically apply a specific IAM policy to restrict further resource provisioning if costs exceed 100% of the budget. Which AWS feature should the team configure to meet both requirements?

A company must encrypt all data at rest stored in Amazon S3 and wants AWS to manage the encryption keys. Which S3 encryption option requires the least operational overhead?

A startup is running a pilot application on AWS and wants to control costs strictly. The finance team sets a monthly budget of $1,000. They need to receive an email notification when actual or forecasted spending reaches 80% of the budget. Additionally, if the budget is exceeded, they want to automatically stop a non-critical Amazon EC2 instance to prevent further cost overruns. Which combination of AWS services should they use to meet all these requirements with minimal operational overhead?

A company runs database servers that require consistent EC2 capacity 24/7 for the next 3 years. Which EC2 purchasing option provides the greatest discount compared to On-Demand pricing?

A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?

Which AWS service provides a fully managed workflow orchestration service that coordinates multiple AWS services into serverless workflows using visual state machines?

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

A company runs a stateless web application on a single Amazon EC2 instance in the us-east-1a Availability Zone. The application stores session data in an external Amazon ElastiCache cluster. Due to a power failure in the data center hosting us-east-1a, the EC2 instance becomes unavailable. The company wants to redesign the architecture so that the application recovers automatically in minutes if a single Availability Zone fails. Which design principle should the company implement?

Which AWS service provides a private, dedicated network connection between an organization's on-premises environment and AWS through a colocation facility or telecommunications partner?

Which AWS storage type provides the lowest latency storage for a single EC2 instance, with data stored on NVMe SSDs physically attached to the host computer?

Drag and drop the steps to launch an EC2 instance in the correct order.

A company manages 15 AWS accounts through AWS Organizations. The finance team needs to perform custom analysis of monthly costs across all accounts. They want to download a detailed, hourly-level CSV file that breaks down usage and costs by service, by member account, and by user-defined cost allocation tags. The file must be delivered to an Amazon S3 bucket daily, and the team will then query the data using Amazon Athena and create dashboards in Amazon QuickSight. Which AWS feature should they configure to meet these requirements?

A company is migrating its workloads to AWS. The IT team is concerned that they will lose visibility into which specific physical server is running their application. A solutions architect explains that AWS abstracts the underlying hardware, allowing customers to focus on their applications without managing physical infrastructure. The architect also notes that AWS pools resources from a large number of data centers to serve multiple customers, and changes the physical location of resources dynamically. Which essential characteristic of cloud computing does this scenario best describe?

A company has multiple AWS accounts consolidated under AWS Organizations. The finance team wants to set a hard monthly cost limit for a development account. If the forecasted costs for the month exceed that limit, the team wants AWS to automatically stop all non-critical Amazon EC2 instances in that account to prevent overspending. The team also needs to receive an email alert when the cost threshold is first crossed. Which AWS service or feature should the team use to define the budget and configure the automated action?

A media company stores video files in Amazon S3 and needs to transcode them into multiple formats for different devices. Which AWS service is purpose-built for this workflow?

Which AWS compute service is best suited for running batch processing jobs that require specific compute resources and can run for hours or days without user interaction?

A financial services company runs a high-frequency stock trading platform on AWS. The platform must continue processing trades without any interruption, even if an entire AWS Availability Zone experiences a complete outage. The architecture is designed with duplicate infrastructure in multiple Availability Zones, and all components are active simultaneously. The system is engineered so that if one AZ fails, the remaining AZs continue processing trades instantly, with zero downtime for end users. Which cloud computing concept does this requirement BEST represent?

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) at the edge, before the requests reach the application. The company wants to use pre-built rule sets maintained by AWS to quickly enable protection, and the solution should be fully managed with no servers to manage. Which AWS service should the company use?

A startup runs its web application on a few Amazon EC2 instances. Over time, the company scales its infrastructure, adding hundreds more instances to support a growing user base. The company notices that the per-hour cost per instance does not increase as it uses more resources. In fact, AWS has steadily lowered prices for compute and storage services over the years. Which cloud computing concept does this scenario best illustrate?

A company runs a customer-facing web application on a single Amazon EC2 instance. To ensure the application remains accessible if the instance fails, the company launches a second EC2 instance in a different Availability Zone and configures an Application Load Balancer to distribute traffic. The application continues to serve users with minimal downtime during the failure of any single instance. This scenario best demonstrates which cloud computing concept?

A company hosts a web application on an Amazon EC2 instance. The company installs its own application software and configures the operating system. The company also uses AWS Key Management Service (AWS KMS) to create a customer-managed key to encrypt data on the Amazon Elastic Block Store (Amazon EBS) volume attached to the instance. According to the AWS shared responsibility model, which of the following is the responsibility of AWS?

A hospital is evaluating a move of its patient records system to the AWS Cloud. The hospital's compliance officer is concerned that the underlying physical servers in the cloud are shared with other customers, which could potentially expose sensitive patient data. The hospital wants a clear explanation of how AWS prevents one customer from accessing another customer's data even though they reside on the same physical hardware. Which essential characteristic of cloud computing best describes the mechanism that achieves this isolation?

A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?

A company runs multiple workloads in separate Amazon VPCs within the same AWS Region. The networking team needs to enable connectivity between all VPCs using private IP addresses. Additionally, the team must connect all VPCs to the company's on-premises data center through a single AWS Site-to-Site VPN connection to minimize costs and simplify management. The solution must support transitive routing so that any VPC can communicate with any other VPC and with the on-premises network. Which AWS service should the networking team use to meet these requirements?

A company is deploying an application that processes payment card data. Which AWS compliance program provides assurance that AWS infrastructure meets Payment Card Industry Data Security Standard requirements?

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The security team requires that no long-term access keys be stored on the instance. Which IAM feature should be used to grant the EC2 instance permission to access S3?

A company has a web application deployed on AWS in the us-west-2 Region. The application is accessed by users across the globe, including Europe, Asia, and South America. The company wants to improve the application's performance for international users by reducing latency and packet loss. The solution must route user traffic over the AWS global network to the closest edge location. Which AWS service should the company use?

A company runs a read-heavy web application on Amazon EC2 instances that queries an Amazon RDS database. As traffic grows, the database CPU utilization is consistently high, causing slow response times for users. The company wants to reduce the load on the database by caching frequently accessed query results. They need a fully managed, in-memory caching service that can be set up quickly and integrates with common programming languages. Which AWS service should they use?

A company is launching a new application and expects user demand to grow gradually over the next 12 months. To control upfront costs, the company plans to start with a small number of Amazon EC2 instances and manually add more instances each month as the user base increases. The operations team will monitor usage and adjust capacity based on observed trends. Which cloud computing concept does this approach BEST illustrate?

A company wants to take advantage of AWS's global infrastructure to replicate their database to a second geographic region for disaster recovery. Which benefit of cloud computing does this leverage?

A company operates in three separate AWS accounts: one for development, one for testing, and one for production. The company wants to take advantage of volume pricing discounts across all accounts for services such as Amazon S3 and Amazon EC2. The finance team also wants to view a single, consolidated monthly bill that aggregates charges from all accounts. Which AWS feature should the company implement?

A global e-commerce company stores product images and videos in an Amazon S3 bucket located in the us-west-2 Region. Customers worldwide report slow page load times. The company also wants to protect its website against common distributed denial-of-service (DDoS) attacks without incurring additional costs for a dedicated DDoS protection service. Which AWS service should the company use to meet both requirements?

A company's application needs to process streaming data from IoT sensors in real time and store processed results in S3. Which AWS service is designed for ingesting and processing real-time streaming data?

A company operates its own data center with physical servers that are purchased outright every three years. The company is migrating its entire infrastructure to AWS. The CFO notes that the company will no longer need to make large upfront purchases of hardware and instead will pay monthly for the compute and storage resources used. Which cloud computing benefit does this scenario best illustrate?

A company is migrating a business-critical workload to AWS. The company wants to ensure it has access to a dedicated Technical Account Manager (TAM) who will provide proactive guidance, architectural reviews, and operational support. Additionally, the company requires the Infrastructure Event Management (IEM) service to assist with the migration launch, and it wants the full set of AWS Trusted Advisor best practice checks across all categories (cost optimization, performance, security, fault tolerance, service limits). Which AWS Support plan should the company select?

A company runs 200 Amazon EC2 instances for its web application. The finance team wants to identify instances that are over-provisioned or underutilized to reduce costs. The team needs automated recommendations that consider the instance's CPU, memory, and network utilization patterns over the past 14 days. Which AWS service should the team use?

A start-up is evaluating cloud providers for its new application. The company's CTO learns that the cloud provider negotiates bulk discounts with hardware vendors and data center operators, and passes these savings on to customers through lower service prices. The CTO also notes that the provider's vast infrastructure allows customers to benefit from the provider's operational expertise in running large-scale data centers. Which benefit of cloud computing does this scenario BEST represent?

A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

Which AWS support plan is the minimum level required to access the full set of AWS Trusted Advisor checks?

A data analyst needs to run SQL queries directly against log files stored in Amazon S3 without loading the data into a database and without provisioning any servers. Which AWS service enables this?

A company is evaluating whether to use AWS Compute Savings Plans or EC2 Instance Savings Plans. Which statement correctly describes when EC2 Instance Savings Plans provide the highest discount?

A retail company runs a legacy application on a single on-premises server. The application experiences unpredictable traffic surges that degrade performance. The company is considering migrating to the AWS Cloud. Which cloud computing characteristic MOST directly addresses the ability to automatically adjust resources to meet changing demand without manual intervention?

Which AWS IAM object should be used to grant permissions to an AWS service (like EC2 or Lambda) to access other AWS services on behalf of the application?

A company is designing a highly available application on AWS. The architect plans to deploy application instances across multiple Availability Zones and implement health checks to automatically route traffic away from failed instances. These design decisions primarily contribute to which pillar of the AWS Well-Architected Framework?

A company wants to centralize backup management across multiple AWS services (EC2, RDS, EFS, DynamoDB) from a single place. Which AWS service provides centralized backup management with policy-based scheduling?

A company is launching a critical production application on AWS. The operations team requires technical support with a response time of less than 1 hour for urgent system issues. They also need access to AWS Trusted Advisor best practice checks for cost optimization and security. Which AWS Support plan meets these requirements at the lowest cost?

A solutions architect needs to isolate an application in its own virtual network within AWS, with full control over IP address ranges, subnet definitions, route tables, and internet gateway configuration. Which AWS service provides this capability?

A company is assessing their on-premises environment before migrating to AWS. Which AWS service helps discover on-premises servers, profile their utilization, and create a business case for cloud migration?

A company uses AWS Organizations. They want to ensure that member accounts cannot turn off CloudTrail or AWS Config in their accounts. What is the most effective way to enforce this?

A company's development team has written a Python web application using the Flask framework. The team wants to deploy the application to the AWS Cloud without managing the underlying servers, operating system, or web server software. They want AWS to automatically handle the deployment, from provisioning EC2 instances to configuring the web server and load balancer, and to scale the application based on traffic. They also want the ability to upload new code versions directly from their Git repository. Which AWS service should the team use?

A multi-national company needs to ensure their AWS resources in Europe comply with GDPR by keeping all data within EU regions. Which approach ensures data remains in Europe?

A company is migrating its legacy Java web application to AWS. The application consists of a stateless web tier that receives HTTP traffic. The company wants to minimize operational overhead. The development team wants to simply upload a WAR file and have AWS automatically handle the deployment, capacity provisioning, load balancing, and auto-scaling based on traffic. The team does not want to manage the underlying EC2 instances or configure the load balancer manually. Which AWS service should the company use?

A company runs a diverse workload on AWS that includes Amazon EC2 instances of various families and sizes across multiple regions, Amazon RDS databases, and a serverless application using AWS Lambda and AWS Fargate. The finance team wants to reduce compute costs by making a 1-year hourly spend commitment, but they need the flexibility to change instance families, sizes, regions, or switch between EC2, Fargate, and Lambda without losing the discount. Which AWS pricing model should the finance team choose to meet these requirements?

A company manages multiple AWS accounts using AWS Organizations and maintains hundreds of Amazon S3 buckets across these accounts. The security team wants a service that automatically scans all S3 bucket policies and identifies any bucket that grants access to an external AWS account (an account outside the organization). The team needs to receive findings when such policies are detected and wants to review the findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

A company runs a globally distributed web application on Amazon EC2 instances behind Network Load Balancers in two AWS Regions: us-east-1 and eu-west-1. Users around the world access the application over the internet. The company wants to improve latency for all users by directing each user to the nearest healthy application endpoint. Additionally, the company requires two static IP addresses that clients can use for firewall whitelisting and that do not change even if the underlying infrastructure changes. Which AWS service should the company use?

A company wants to automatically detect and label objects in photos uploaded by users — such as identifying if a photo contains a person, a car, or an outdoor scene — without building their own machine learning model. Which AWS service provides this pre-built computer vision capability?

A media processing company runs multiple Amazon EC2 instances in different Availability Zones. All instances need to read and write to a shared file system simultaneously. The file system must be fully managed, automatically replicated across multiple Availability Zones for durability, and accessible by all instances using standard file access protocols. The company does not want to provision or manage any file servers. Which AWS service should the company use to meet these requirements?

A security team needs to analyze VPC network traffic to detect anomalies and investigate security incidents. Which AWS service captures and stores network flow data for VPCs?

A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

Which AWS service provides quantum computing hardware as a cloud service, enabling researchers to run algorithms on actual quantum processors?

The AWS Well-Architected Framework's Reliability pillar recommends automatically recovering from failure. Which AWS feature directly enables automated recovery when an EC2 instance status check fails?

A company is migrating its on-premises data analytics workload to AWS. Previously, the company had to purchase and maintain dedicated servers with fixed capacity to handle peak workloads, resulting in low utilization during off-peak hours. On AWS, the company can launch compute resources, run the analytics job, and terminate the resources when done. The company only pays for the compute time and storage used during the job. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

A company wants to implement a serverless web application with no server management. They need a database that scales automatically without managing cluster capacity. Which combination best supports this?

A company runs an e-commerce platform on Amazon EC2 instances in a single AWS Region. The company wants to ensure that the platform remains available even if a natural disaster disrupts the entire geographic area of that Region. Which approach should the company take to meet this requirement?

Which AWS service provides a simple way to deploy, manage, and scale containerized applications without requiring Kubernetes or deep container expertise?

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?

Which AWS service enables developers to add user sign-up, sign-in, and access control to web and mobile applications quickly?

A healthcare company needs to extract structured medical data from clinical notes and medical documents. Which AWS service provides ML-powered extraction of medical information from unstructured text?

A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?

A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?

A company runs an e-commerce website on Amazon EC2 instances. The website experiences unpredictable traffic spikes during flash sales and returns to normal traffic levels afterward. To handle this, the company configures an Auto Scaling group that adds EC2 instances when the average CPU utilization exceeds 70% and removes instances when it drops below 30%. Which essential characteristic of cloud computing does this configuration primarily demonstrate?

What is the principle of least privilege in AWS IAM?

Which statement best describes the AWS global infrastructure concept of an Availability Zone (AZ)?

A company runs a global gaming application on Amazon EC2 instances behind an Application Load Balancer in the us-east-1 Region. Players in Europe and Asia report high latency and intermittent connection drops. The company wants to improve the application's performance for global users by routing traffic over the AWS global network. The company also needs two static IP addresses that users can whitelist in their firewalls for consistent access, and the solution must provide health checks to automatically route traffic away from unhealthy endpoints. Which AWS service should the company use?

A company processes millions of customer records and needs to query data in Amazon S3 without loading it into a database. The data is stored in Parquet format. Which AWS service enables this with no infrastructure to manage?

A retail company is migrating its e-commerce platform to AWS. The company's financial controller notes that AWS can offer lower pay-as-you-go prices than what it would cost the company to build and operate its own data center at the same scale. Which cloud computing concept best explains this pricing advantage?

A company runs a web application on a fleet of Amazon EC2 instances. The application experiences unpredictable traffic patterns with sudden spikes. The company configures an Auto Scaling group with dynamic scaling policies to automatically add instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This design is an example of which key characteristic of cloud computing?

A company has migrated its customer-facing web application to AWS. The application is deployed on Amazon EC2 instances behind an Application Load Balancer. The company's customers access the application from various devices—desktop computers, laptops, tablets, and smartphones—using standard web browsers without any additional configuration or proprietary software. The ability for customers to reach the application over the internet from any device with a standard browser best demonstrates which essential characteristic of cloud computing?

A company operates 10 AWS accounts, each managed by a different department. The finance team wants to combine the usage of all accounts to qualify for lower volume-based pricing tiers for services such as Amazon S3 and Amazon EC2. Additionally, they want a single monthly bill that aggregates charges from all accounts. Which AWS feature should the company use to meet these requirements?

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Which benefit of cloud computing allows a company to experiment with new ideas and quickly spin down failed experiments without financial penalty?

A company wants to run code that automatically resizes images whenever a new image is uploaded to an Amazon S3 bucket. The code runs for less than 60 seconds per image. The company wants to pay only for the compute time used and does not want to provision or manage any servers. Which AWS service best meets these requirements?

A financial services company is undergoing an external audit. The auditor requests copies of AWS SOC 2, ISO 27001, and PCI DSS compliance reports to validate the company's cloud infrastructure controls. Where can the company's compliance team obtain these reports in a centralized manner?

A company has deployed a web application on Amazon EC2 instances. The company's security team wants to ensure that the underlying host operating system is patched against a newly discovered vulnerability. According to the AWS Shared Responsibility Model, who is responsible for applying the patch to the host operating system?

A financial services company is required by regulation to keep all customer transaction data on-premises. However, they want to use AWS to run analytics workloads on this data using Amazon EMR and Amazon S3 for temporary storage of intermediate results. They need a solution that connects their on-premises network to AWS securely and allows them to extend their on-premises environment into the AWS Cloud. Which cloud computing deployment model does this scenario BEST describe?

A company wants to identify sensitive data (such as PII and credit card numbers) stored in Amazon S3 buckets across their organization. Which AWS service automates this discovery?

Which AWS service provides a fully managed message broker supporting ActiveMQ and RabbitMQ protocols for migrating on-premises messaging systems to the cloud?

Which AWS service provides a managed Kubernetes service that removes the overhead of installing, operating, and maintaining a Kubernetes control plane?

Which AWS service provides a domain name system (DNS) that routes end-user requests to AWS infrastructure and external resources?

Which AWS feature protects S3 buckets from having their versioned objects permanently deleted without multi-factor authentication approval?

A company wants to use AWS for a short-term proof-of-concept project lasting one month. They need EC2 instances and RDS databases but don't want any long-term commitment. Which pricing model is most appropriate?

A company needs to manage multiple Kubernetes clusters across different AWS Regions and on-premises environments from a single control plane. Which AWS service provides this?

Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?

Which AWS service provides a petabyte-scale data transfer solution for moving large amounts of data into AWS when network transfer is not feasible?

A financial services company keeps sensitive customer data in an on-premises data center. Regulatory requirements prohibit this data from being stored in the cloud. However, the company needs to run compute-intensive analytics jobs that periodically require more processing power than its on-premises servers can provide. The company wants to use AWS for these burst capacity needs while keeping the sensitive data on premises. Which cloud deployment model best describes this approach?

Which cloud deployment model involves running applications on AWS infrastructure managed entirely by AWS, where the customer does not manage any physical hardware?

A company's finance team needs the most granular AWS billing data available, including cost and usage data at the hourly level, broken down by resource ID and cost allocation tags, delivered to Amazon S3 for analysis with their BI tools. Which AWS service provides this?

A company wants to test a new version of their application by sending 10% of user traffic to the new version and 90% to the existing version, gradually increasing traffic to the new version as confidence grows. Which Amazon Route 53 routing policy supports this?

A company has been running multiple workloads on AWS for several months. The finance team notices that monthly costs have increased significantly but cannot identify which services or linked accounts are driving the increase. The team needs a tool that provides interactive graphs and filters to visualize cost and usage data over time, allows filtering by service or linked account, and identifies the top cost contributors. They also need to create custom reports that can be emailed on a weekly schedule. Which AWS tool should the finance team use to meet these requirements?

A company's employees access AWS services using the AWS Management Console from their office laptops, the AWS mobile app on their smartphones, and the AWS CLI from their home computers. Which cloud computing characteristic does this illustrate?

A company runs an e-commerce website on AWS and expects a high volume of traffic during Black Friday. The security team is concerned about potential DDoS attacks overwhelming the infrastructure. The company wants a managed service that provides always-on detection and automatic inline mitigation of DDoS attacks at the network and transport layers (layer 3 and 4), as well as cost protection against scaling charges due to DDoS attacks. Which AWS service should the company use?

A company needs a relational database that automatically scales storage, replicates data across multiple AZs, and can failover automatically without manual intervention. Which AWS service provides these capabilities?

Match each AWS management tool to its purpose.

Which of the following is NOT one of the five characteristics of cloud computing as defined by NIST?

A startup is building a Node.js web application. The development team has limited DevOps experience and wants to focus on writing code. They need a managed platform that automatically deploys their application code, provisions the necessary AWS resources (such as EC2 instances, a load balancer, and Auto Scaling), and handles health monitoring and scaling. However, they want the ability to later customize the underlying EC2 instances and configure environment variables without switching to a different compute service. Which AWS service should the startup use?

A company is designing a highly available web application on AWS. The application must remain available and continue serving traffic even if an entire physical data center experiences a complete outage. Which AWS global infrastructure component should the solutions architect use to meet this requirement?

A development team wants to deploy a Python web application to AWS without managing load balancers, auto scaling groups, or the underlying EC2 instance operating systems. They want to upload their code and have AWS handle the infrastructure. Which cloud service model does this represent?

Match each AWS Well-Architected Framework pillar to its description.

A financial analytics company runs a mission-critical application in its on-premises data center. The application must replicate large volumes of market data to Amazon S3 in real time. The company requires a dedicated, private network connection with consistent low latency and high throughput. The connection must not traverse the public internet. Which AWS service should the company use to meet these requirements?

A company wants to use AWS for disaster recovery but wants to minimize costs. They only need backups of their data, with recovery taking several hours if disaster strikes. Which DR strategy requires the least investment?

A company wants to run a MySQL database on AWS. They require full control over the operating system, MySQL version selection, storage layout, and network configuration. Which cloud service model provides this level of control?

A company is planning to migrate its on-premises data center to AWS. The Chief Financial Officer wants to compare the total cost of ownership (TCO) of the current on-premises infrastructure against running equivalent workloads on AWS. The company needs a tool that allows them to input details about their existing servers, storage, and network usage to generate a detailed cost comparison report. Which AWS tool should the company use to meet this requirement?

A company has 50 IAM users in a single AWS account. The security policy requires that every IAM user must have a virtual MFA device enabled for AWS Management Console access. The company wants to automatically detect any user who disables or has an inactive MFA device and immediately revoke that user's ability to access AWS resources by disabling their access keys. The solution must be fully managed, require no custom scripts, and use native AWS services. Which AWS service should the company use to define the compliance rule and automatically trigger the remediation action?

Which AWS concept describes the practice of tracking and managing costs using software engineering principles — such as tagging, automation, and real-time visibility — to enable engineers and teams to make cost-aware decisions?

Which statement about AWS pricing is accurate?

A company needs to store database passwords and API keys used by their applications, with automatic rotation and audit logging of access. Which AWS service is purpose-built for this?

A company runs mixed workloads on AWS — some on EC2, some on Lambda, and some on Fargate — and wants to commit to a consistent hourly spend on compute to receive discounts similar to Reserved Instances, but with the flexibility to apply those discounts across different compute services and instance types. Which purchasing option provides this flexibility?

A company hosts a web application on an Application Load Balancer in the us-east-1 AWS Region. Users are distributed across North America, Europe, and Asia. The company wants to improve application performance and availability for global users by using the AWS global network. The solution must provide two static anycast IP addresses that do not change over time and automatically route incoming traffic to the nearest healthy endpoint in the region. Which AWS service should the company use?

A company has bring-your-own-license (BYOL) server software that is licensed per physical CPU socket. They need to run this software on AWS and require visibility into and control over the physical host their instances run on. Which EC2 option meets this requirement?

A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?

A company uses multiple AWS accounts managed under AWS Organizations. Which service allows them to share Reserved Instance discounts and Savings Plans across all accounts in the organization?

A company traditionally operated an on-premises data center and purchased all server hardware and software licenses with upfront capital expenditure. After migrating its workloads to AWS, the company now receives a monthly invoice that reflects only the compute hours, storage, and data transfer that it actually used. The company can also stop paying for resources when they are no longer needed. Which key characteristic of cloud computing does this scenario best illustrate?

A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?

Which AWS service provides a managed graph database for use cases like social networks, recommendation engines, and fraud detection?

A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?

A company has deployed a customer relationship management (CRM) application on AWS. Sales representatives use the application from their office laptops, company-issued tablets, and personal smartphones. They access the application securely through a web browser using HTTPS from any location, including client sites and home offices. This capability is an example of which essential characteristic of cloud computing?

A company hosts its website on a single Amazon EC2 instance in the us-east-1 Region. The website includes static assets such as images, CSS, and JavaScript files. Users in Europe and Asia report that the website loads slowly because the static assets must travel from the us-east-1 Region. The company wants to reduce latency for global users and decrease the load on the EC2 instance by serving static content from locations that are closer to the users. Which AWS service should the company use to meet these requirements?

A financial services company is preparing for an annual audit. The auditors have requested a copy of the AWS SOC 2 Type II report to verify the security controls of the AWS infrastructure that the company uses. The company's compliance officer needs to directly download this report from a trusted AWS source. Which AWS service should the compliance officer use to obtain the report?

Which AWS service provides managed Microsoft Windows file storage that supports SMB protocol, Active Directory integration, and Windows ACL permissions?

A company operates 8 separate AWS accounts for different departments. They want to receive one consolidated monthly bill and benefit from combined usage discounts across all accounts for services like S3 and data transfer. Which AWS feature provides this?

A company plans to migrate a three-tier web application to AWS. The application will run on Amazon EC2 instances, use an Amazon RDS database, and an Application Load Balancer. The CFO needs a detailed monthly cost estimate before migration. The solutions architect needs to model different instance types, storage sizes, and data transfer volumes, and then share the estimate with the finance team. Which AWS service should the solutions architect use to meet these requirements?

A company is developing a microservices application on AWS. The application includes a front-end web tier and a backend order processing service. The front-end sends order requests to the backend, which may take several seconds to process. The company wants to ensure that the front-end does not wait for the backend to complete, and that no orders are lost if the backend service is temporarily unavailable. Which AWS service should the company use to decouple the front-end and backend?

A company's cloud finance team wants to implement cloud financial management (FinOps) on AWS. Which combination of AWS services provides the most comprehensive cost visibility, budgeting, and optimization capabilities?

Which AWS feature provides personalized recommendations about your account's security and cost optimization, available at no cost for all AWS customers?

A company needs to run scheduled jobs that execute SQL queries on their Amazon RDS database every night. Which AWS service provides fully managed job scheduling without maintaining dedicated compute resources?

A company runs an e-commerce website on Amazon EC2 instances behind an Application Load Balancer. The marketing team plans to run flash sales several times a year, which cause unpredictable but massive traffic spikes. The operations team wants the infrastructure to automatically add new EC2 instances when traffic increases and remove them when traffic decreases, without any manual intervention. Which cloud computing concept does this requirement MOST directly represent?

A company stores sensitive financial data in Amazon S3. The company's security policy requires that all data be encrypted at rest using a key that the company creates and manages, with the ability to rotate the key annually. The company also needs an audit trail of when the key was used and by which AWS service. Which solution should the company use to meet these requirements?

A development team accidentally deletes important files from an Amazon S3 bucket. The company wants to protect against accidental deletions and overwrites in the future, allowing recovery of previous versions of objects. Which S3 feature should they enable?

A company manages a web application that consists of Amazon EC2 instances, an Amazon RDS database, and an Amazon S3 bucket. The team deploys the application to separate development, test, and production environments. Currently, the team manually configures each environment, which has led to configuration drift and deployment errors. The company wants to define the entire infrastructure as code, store the definition in a version control system, and deploy it consistently across all environments with a single template. Which AWS service should the company use to meet these requirements?

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

Which AWS service enables event-driven architectures by acting as a central event bus that routes events from AWS services, SaaS applications, and custom applications to configured targets?

A company's leadership team wants a structured framework for planning their AWS cloud migration that addresses organisational change management, skills development, governance, platform, security, and operations. Which AWS framework provides guidance across these perspectives?

A company has multiple AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost budget of $5,000 for the 'Project Alpha' account. They want to receive an email notification when the actual costs reach 80% of the budget and again when the forecasted costs are expected to exceed the budget. The team also needs to centrally manage these budgets from the management account. Which AWS service should the team use to meet these requirements?

A company has migrated its IT infrastructure to AWS. The company's finance team receives a monthly bill that itemizes charges based on the number of Amazon EC2 instance hours consumed, the amount of Amazon S3 storage used in gigabyte-months, and the total data transferred out to the internet. The cloud provider automatically tracks and reports this usage data for billing purposes. This scenario best demonstrates which essential characteristic of cloud computing?

A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?

A company wants to monitor the CPU utilisation of their EC2 instances and automatically send an email alert when utilisation exceeds 80% for more than 5 consecutive minutes. Which AWS service provides this monitoring and alerting capability?

A company runs its production web application on a single Amazon EC2 instance located in one Availability Zone. Recently, a power outage in that data center caused the instance to become unavailable, resulting in application downtime. The company wants to redesign the architecture so that the application automatically continues serving users even if a single data center fails, without requiring manual intervention. Which cloud computing concept does this scenario BEST illustrate?

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

Which AWS service provides a concierge-like experience for navigating AWS services and finding the right resources, primarily available to Enterprise Support customers?

Which AWS service provides a private connection from an on-premises network to AWS that bypasses the public internet and provides consistent network performance?

A company is refactoring its legacy application into a microservices architecture using Docker containers. The operations team wants to deploy and manage these containers on AWS without the need to provision, patch, or manage the underlying servers. The solution must automatically scale containers based on demand and integrate with services like Application Load Balancer and Amazon RDS. Which AWS compute service should the company use?

Which AWS networking feature prevents resources in a private subnet from directly receiving inbound connections from the internet, while still allowing them to initiate outbound connections?

A developer at a company is working on a new feature. The developer needs a test server running a specific version of Linux with certain software pre-installed. Without waiting for approval from the IT team or filling out a request form, the developer logs into the AWS Management Console, chooses an Amazon EC2 instance type, configures the security group, and launches the instance. The instance is fully operational within minutes. Which essential characteristic of cloud computing does this scenario best illustrate?

Which AWS service provides a fully managed virtual desktop infrastructure (VDI) that allows users to access Windows or Linux desktops from any device?

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

A company plans to deploy a multi-tier web application on AWS. The architecture includes Amazon EC2 instances for the web and application tiers, an Application Load Balancer for traffic distribution, and an Amazon RDS database for the data tier. The company wants to automate the provisioning and configuration of all these AWS resources in a repeatable and predictable manner. The solution should allow the infrastructure definition to be stored in a version control system and be used to create identical environments for development, testing, and production with minimal manual effort. Which AWS service should the company use to define and manage the infrastructure as code?

A company's AWS bill has increased significantly. The finance team wants to implement cost governance best practices. Which action represents a foundational cost governance control?

A company manages user access to AWS resources using IAM users. The security team wants to automatically detect if an IAM user's access key is being used from a geographic location that is unusual for that user, which could indicate a compromised credential. The team needs a managed threat detection service that monitors API activity and raises alerts for such anomalies. Which AWS service should the security team use?

A company is building a microservices application on AWS. The application consists of multiple independent services that need to communicate asynchronously. When an order is placed, the order service must send a notification to the inventory service, the shipping service, and the analytics service simultaneously. The company wants a fully managed, durable, and scalable messaging service that supports a fan-out pattern where a single message can be delivered to multiple subscribers. Which AWS service should the company use to meet these requirements?

A company needs to transfer petabytes of data from an on-premises data center to Amazon S3. The network connection is too slow for online transfer and the data must arrive within two weeks. Which AWS service is most appropriate?

A company uses AWS CloudFormation to define and manage its production infrastructure as code. The operations team wants to ensure that any proposed changes to the stack are reviewed and explicitly approved before being applied. Which AWS CloudFormation feature should the company use?

A startup's development team wants to deploy their Node.js web application to AWS without learning about load balancers, auto scaling, or EC2 configuration. They want to simply upload their application code and have AWS handle everything else. Which AWS service is designed for this use case?

A financial services company maintains a legacy on-premises database for sensitive customer data that must remain in a physically controlled environment due to regulatory requirements. The company runs its customer-facing web application on AWS to benefit from scalability and global reach. A dedicated encrypted VPN connection securely links the on-premises environment with the AWS cloud. Which cloud deployment model does this scenario BEST represent?

A company runs a critical application on Amazon EC2 instances in a specific Availability Zone. The operations team wants to be notified immediately if AWS experiences a service disruption that could affect their instances. They also want a personalized view of the impact of AWS service events on their specific AWS resources. Which AWS tool should they use?

A company needs to verify the identity of users who call into their contact center by comparing their voice against a stored voiceprint. Which AWS service provides speaker identification from voice data?

A data engineering team processes petabytes of raw log data using Apache Spark and Hadoop frameworks. They need a managed AWS service that provisions the cluster, installs the big data frameworks, and terminates the cluster after the job completes to minimise cost. Which service should they use?

A company has employees in field offices who need to manage AWS resources (e.g., launch EC2 instances, upload files to S3) using a web browser on their company-issued laptops. The laptops connect to the internet via public Wi-Fi or cellular hotspots. The employees do not have any VPN or direct corporate network connection. They can successfully access the AWS Management Console and perform all actions over standard HTTPS ports. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

A company needs to implement DevOps practices and wants a fully managed service to store their application source code with version control. Which AWS service provides managed Git repositories?

A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?

Which AWS support feature provides a dedicated technical contact who provides proactive guidance, acts as an advocate for the customer, and helps with architectural reviews?

A company wants to provide a virtual contact center for their customer service operations without managing any telephony infrastructure. Which AWS service enables this?

A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every day and must be highly available and durable. Which S3 storage class is most appropriate for this workload?

A company runs several applications in a single AWS account. Each application belongs to a different project (Project Alpha, Project Beta, Project Gamma). The company has already applied tags with the key "Project" and the corresponding project name to all AWS resources used by each project. The finance team wants to use AWS Cost Explorer to view and filter monthly costs by project. However, after tagging all resources, the "Project" tag does not appear as a filter option in Cost Explorer. What must the finance team do to make the "Project" tag available for cost filtering in Cost Explorer?

A company's security team manages AWS accounts for multiple business units using AWS Organizations. The security team needs a single place to view and prioritize all security alerts, including findings from Amazon GuardDuty, Amazon Inspector, and AWS IAM Access Analyzer. The team also wants to automatically run continuous compliance checks against industry standards such as the CIS AWS Foundations Benchmark. The solution must provide a consolidated dashboard with automated findings aggregation and compliance score tracking. Which AWS service should the security team choose?

Which cloud computing benefit allows a company's development team to spin up a testing environment in 5 minutes instead of waiting 6 weeks for hardware procurement and data center provisioning?

Match each AWS storage service to its description.

Which AWS service enables you to run relational database workloads with up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL at a lower price point than commercial databases?

A company architect is designing a new system on AWS. They want to implement the Well-Architected Framework principle of 'loosely coupled components.' Which architecture pattern best achieves this?

A company wants to create RESTful APIs that serve as the front door to their backend Lambda functions and EC2 services. They need features including API key management, throttling to protect backends from overload, and usage plan enforcement. Which AWS service provides this?

A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?

A company runs multiple workloads on AWS. At the end of each month, the finance team receives a detailed invoice that shows exactly how many GB-hours of Amazon EBS storage each workload used and how many hours each Amazon EC2 instance was running. This granular usage data is used to allocate costs back to the respective business units. Which essential characteristic of cloud computing does this capability best demonstrate?

Which AWS service provides a fully managed environment to run Apache Spark, Hadoop, and other big data frameworks for data processing and analytics?

A company runs a mix of Amazon EC2 instances and AWS Fargate containers. The CFO wants to reduce costs by committing to a consistent amount of compute usage (measured in $ per hour) for a 1-year term. The company expects to change instance families and regions occasionally and needs the flexibility to apply the savings to both EC2 and ECS Fargate usage. Which AWS pricing option should the company choose?

A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?

A company's finance team receives a detailed monthly report from AWS that shows the exact number of Amazon EC2 instance hours used, the amount of Amazon S3 storage consumed, and the volume of data transferred out to the internet over the month. The team uses this report to analyze usage trends, allocate costs to different departments, and plan future budgets. This capability is an example of which essential characteristic of cloud computing?

A compliance officer needs to download AWS's SOC 2 Type II report and ISO 27001 certification to provide to their company's auditors as evidence that the AWS infrastructure meets regulatory standards. Where should they access these documents?

A company discovers they have 30 EC2 instances running 24/7 that are almost never used — CPU utilisation under 1%. Terminating these idle instances would save thousands of dollars per month. Which AWS Well-Architected Framework pillar encourages this practice?

A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?

A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?

A company wants to automatically detect potential security threats such as compromised credentials, unauthorized access attempts, and communication with known malicious IP addresses across its AWS environment. The company has enabled AWS CloudTrail, VPC Flow Logs, and DNS logs. Which AWS service should the company use to continuously analyze these logs and generate actionable security findings without requiring manual setup of data sources?

A company uses AWS Organizations to manage over 50 AWS accounts. The security team has identified a high-priority requirement to prevent any security group rule in any account from allowing inbound RDP (port 3389) access from the internet (0.0.0.0/0). If a rule is created that violates this policy, the team wants it to be automatically removed. The team needs a centralized service that can enforce this policy across all current and new accounts without requiring manual setup in each account. Which AWS service should the team use?

A startup has a development AWS account and wants the minimum paid AWS Support plan that provides email-based technical support from AWS staff. They do not need 24/7 phone access. Which is the minimum support plan that provides access to AWS technical support engineers?

A company operates five separate AWS accounts for different business units. The finance team wants to aggregate the usage across all accounts to benefit from volume pricing discounts and to receive a single monthly bill. The company does not need to centrally manage permissions or apply service control policies at this time. Which AWS feature should the company use to meet these requirements?

A solutions architect is designing a new architecture on AWS that includes EC2, RDS, S3, and data transfer. Before deploying anything, they want to estimate the monthly cost of running this architecture. Which AWS tool should they use?

A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?

A company architect uses the Well-Architected Framework to review their workload. Which pillar specifically covers the concepts of selecting the right instance types and sizes, using serverless architectures, and choosing the appropriate storage solution?

A company is migrating its internal email system to a cloud-based solution. After the migration, the company's IT team no longer needs to manage the email servers, apply operating system patches, or upgrade the email software. The cloud provider handles all underlying infrastructure, the platform, and the application itself. Users access their email through a web browser or a mobile app. Which cloud service model does this scenario describe?

A healthcare company is migrating patient records to Amazon S3. The company must comply with HIPAA and needs to automatically identify any S3 buckets that contain protected health information (PHI) and generate alerts. The solution must be fully managed and require no manual effort to scan the data. Which AWS service should the company use?

A company plans to run a fleet of Amazon EC2 instances continuously for 3 years to support a steady-state application. The company wants the lowest possible cost for this predictable workload while maintaining the flexibility to change instance families if needed. Which AWS purchasing option should the company choose?

A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?

A company runs a microservices-based application on Amazon ECS. The application stores database credentials and API keys in plaintext configuration files that are baked into container images. A security audit reveals that this practice violates the company's compliance policy, which mandates that secrets must be stored separately from code, centrally managed, and automatically rotated every 90 days. Which AWS service should the company use to meet these requirements?

A company spends over $75,000 per month on AWS services and needs ongoing, proactive cost optimization guidance from a designated AWS expert. The company also requires a 15-minute response time for their most critical production incidents. Which AWS Support plan should the company choose?

A company's compliance officer needs to provide an external auditor with copies of AWS SOC 2 reports and a PCI DSS attestation of compliance. The officer needs a self-service portal to download these documents directly, without contacting AWS Support. The solution must provide the most current versions of these reports. Which AWS service should the officer use?

A company runs a web application where requests to /api/* should be routed to one group of EC2 instances and requests to /images/* should be routed to another group. Which AWS load balancer type supports this URL path-based routing?

A company manages multiple AWS accounts, each used by a separate business unit. The finance team wants to obtain a single monthly bill that aggregates charges from all accounts and to benefit from volume discount pricing tiers on services like Amazon EC2 and Amazon S3 across the entire organization. Which AWS feature or service should the company use to meet these requirements?

A company uses AWS Organizations with multiple accounts for different departments (Engineering, Marketing, Sales). The finance team needs to create detailed monthly chargeback reports showing each department's usage and costs, broken down by service (e.g., Amazon EC2, Amazon S3) and by custom tags (e.g., Project). The reports must be in a machine-readable format (CSV) so they can be ingested into the company's internal billing system. The team wants the most comprehensive, granular cost data available from AWS, including line items for individual resources. Which AWS tool should the finance team configure to meet these requirements?

A company is designing a system where a failure in one component does not cause cascading failures across the entire application. Which architectural concept does this represent?

A company wants to implement a hub-and-spoke network architecture where multiple VPCs can communicate with a shared services VPC (containing DNS, monitoring, and security tools) but not with each other. Which AWS networking feature enables this?

A company's security team wants to identify all Amazon S3 buckets that are shared with external AWS accounts or publicly accessible. The team needs a continuous evaluation that reports findings in a centralized dashboard and sends alerts when new unintended external shares are created. Which AWS service should the security team use to meet these requirements?

A company runs a production workload on Amazon EC2 and Amazon RDS. The operations team needs technical support with a guaranteed response time of less than 1 hour for critical system issues. They also require access to the full set of AWS Trusted Advisor best practice checks, including cost optimization, security, and fault tolerance recommendations. The company does not want to pay for a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

A startup wants to deploy their web application to AWS with minimal configuration. They want AWS to handle provisioning, load balancing, scaling, and health monitoring automatically. Which service is most appropriate?

A small e-commerce company currently hosts its website on a single physical server in a colocation facility. The company pays a fixed monthly fee for the server, power, and bandwidth, regardless of actual usage. The CTO is evaluating AWS and notes that AWS operates millions of servers across multiple data centers, allowing it to negotiate lower prices for hardware and pass those savings to customers. The CTO expects that migrating to AWS will reduce the company's per-unit costs. Which benefit of cloud computing does this scenario BEST describe?

An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires a mechanism to prevent any IAM user or role in any member account from modifying Amazon S3 bucket policies to grant public access. The solution must be enforced centrally and cannot be overridden by account administrators. Which AWS feature should the company use?

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The application serves users worldwide, and the company wants to optimize both performance and availability for all users. The solution should use the AWS global network to route traffic from users to the nearest edge location and then over the AWS backbone to the ALB, without caching content at edge locations. Which AWS service should the company use?

Which AWS service provides a serverless, fully managed Apache Spark processing engine for big data analytics without managing clusters?

A company has predictable workloads running 24/7. Which EC2 pricing option would provide the most significant cost savings compared to On-Demand pricing?

Which AWS service allows you to build, train, and deploy machine learning models at scale?

A company's data scientists want a managed environment for collaborative Jupyter notebooks connected to their AWS data sources and compute without managing infrastructure. Which AWS service provides this?

A startup recently signed up for AWS and is using the AWS Free Tier to run a small web application. The startup's finance lead wants to monitor the team's usage of AWS services to ensure they do not exceed the Free Tier limits and incur unexpected charges. The finance lead needs a tool that can proactively send an alert when the team approaches 80% of the Free Tier limit for a specific service, such as Amazon EC2. Which AWS service or feature should the finance lead use to set up this alert?

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple Amazon EC2 instances concurrently. The EC2 instances run Amazon Linux and are deployed across multiple Availability Zones for high availability. The file system must grow and shrink automatically as files are added or removed, and the company wants to avoid provisioning storage capacity in advance. Which AWS service should the company use to meet these requirements?

A company is currently running its IT infrastructure in an on-premises data center. The finance department wants to understand how moving to the AWS Cloud would change the company's cost structure. In particular, they want to avoid large upfront hardware purchases and instead pay only for the resources they consume on a monthly basis. Which key cloud computing concept does this shift represent?

A company uses AWS and wants to make their application fault tolerant against the failure of an entire AWS Region. Which approach achieves Region-level fault tolerance?

A web application queries a relational database for a product catalogue that changes infrequently but is requested thousands of times per second. Database query latency is becoming a bottleneck. Which AWS service can the company use to cache frequently accessed query results in memory and reduce database load?

A company runs a nightly batch processing job on AWS that takes exactly 2 hours to complete. The company uses a fixed set of Amazon EC2 instances for the job. AWS automatically tracks the number of instance-hours consumed each month and bills the company precisely for that usage. The company does not need to sign a long-term contract or pay for idle resources. Which essential characteristic of cloud computing does this scenario best illustrate?

A media company produces video content and stores all videos in Amazon S3. New videos are accessed frequently for the first 30 days after release. After that, access drops significantly, but the company must retain all videos for 5 years for archival purposes. The company wants to minimize storage costs without compromising retrieval speed for the frequently accessed period. Which S3 storage class strategy should the company implement?

A company stores customer data in Amazon S3 buckets. The compliance team needs to automatically discover which buckets contain personally identifiable information (PII) such as names, addresses, and credit card numbers. The team also wants to receive continuous monitoring and alerts when new sensitive data is uploaded. Which AWS service should the team use to meet these requirements?

A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?

A company uses multiple AWS accounts for different departments. Which AWS feature enables them to receive a single monthly bill and potentially lower rates through combined usage?

A company needs a managed service to forecast product demand using machine learning, helping them optimize inventory levels without building a custom ML model. Which AWS AI service provides ready-to-use time-series forecasting?

A social media startup plans to launch its application to users across North America, Europe, and Asia. The CTO wants a single deployment approach that minimizes latency for end users in all geographic regions, provides high availability, and allows the company to add new regions within minutes as the user base expands. The startup has no existing data centers outside its home country. Which fundamental benefit of cloud computing does this requirement best illustrate?

A company runs several Amazon EC2 instances for development and testing purposes. The finance team wants to identify any instances that have been running with very low CPU utilization (less than 10%) over the past two weeks so they can stop or resize them to reduce costs. Which AWS tool provides this specific recommendation as part of its cost optimization checks?

A company uses AWS Organizations to centrally manage multiple AWS accounts. The security team requires that no IAM users can be created in any member account. All access must use federated identities from the company's existing identity provider. The security team needs a single, centralized mechanism to enforce this restriction across all existing and future member accounts. Which AWS feature should the security team use to meet this requirement?

A company is building a data lake on AWS. Which AWS service provides a serverless interactive query service that allows analysts to query data stored in Amazon S3 using standard SQL?

A company wants to migrate their on-premises applications to AWS but is concerned about losing visibility into their infrastructure. Which AWS service provides a centralized inventory of all AWS resources and tracks configuration changes over time?

A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their web servers, and automatically redirect traffic to a healthy backup server if the primary server fails. Which AWS service provides all of these capabilities?

A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?

A company needs to ensure their containerized applications pass security scans for known vulnerabilities before being deployed to production. Which AWS service scans container images for CVEs?

A company hosts its primary web application on Amazon EC2 instances in the us-east-1 AWS Region. To meet disaster recovery requirements, the company has launched an identical set of EC2 instances in the eu-west-1 Region. The company wants to direct all user traffic to the us-east-1 endpoints under normal conditions. If us-east-1 becomes unhealthy due to a regional outage, traffic must be automatically redirected to the eu-west-1 endpoints. The company uses Amazon Route 53 as its DNS service. Which Route 53 routing policy should the company use to meet these requirements?

A company uses AWS Organizations with multiple accounts for different departments. The finance team applies tags to resources to track costs by department (e.g., Marketing, Engineering) and environment (e.g., Production, Development). However, many resources lack the required tags. The team needs a tool that can automatically allocate costs for untagged resources to specific departments and environments based on rules, and then generate reports that show cost breakdowns by these custom dimensions. The solution must not require custom scripts or manual allocation. Which AWS feature should the finance team use?

A company hosts a web application on AWS that uses Amazon CloudFront for content delivery and an Application Load Balancer (ALB) in front of Amazon EC2 instances. The security team wants to protect the application against common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that can inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches the application servers. Which AWS service should the company use to meet these requirements?

A company needs an AWS support plan that provides access to online training, use case guidance, and architectural support for non-production environments. Which is the minimum plan that provides direct technical guidance from AWS engineers (not just documentation)?

A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?

A company needs to send transactional emails such as order confirmations and password resets at scale. Which AWS service should they use?

A company wants to automatically detect anomalies in their application metrics, such as unusual spikes in error rates, without manually setting thresholds. Which AWS service provides ML-powered anomaly detection for CloudWatch metrics?

A solutions architect is reviewing a system to ensure the right instance types are selected for each workload, that resource selection is based on data rather than assumptions, and that performance is monitored and improved over time. Which pillar of the AWS Well-Architected Framework is being applied?

A company runs a fleet of Amazon EC2 instances that host a customer-facing web application. The security team wants to automatically identify software vulnerabilities, such as missing patches and common vulnerabilities and exposures (CVEs), in the operating system and applications running on these instances. The team also needs visibility into unintended network accessibility, such as instances with ports open to the internet. The solution must be natively integrated with AWS and should provide findings that can be viewed in a central dashboard. Which AWS service should the security team use?

An operations team documents all operational procedures as runbooks, deploys infrastructure using AWS CloudFormation templates stored in version control, and continuously refines their processes based on lessons learned from incidents. Which pillar of the AWS Well-Architected Framework does this represent?

A company needs to generate a pre-signed URL to allow a business partner to download a specific S3 object for 24 hours without requiring AWS credentials. Which S3 feature enables this?

A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?

A company has a global user base that uploads images to an Amazon S3 bucket in the us-east-1 Region. Users report slow upload speeds and frequent timeouts when uploading large files from distant locations. The company wants to use the AWS global network and edge locations to accelerate uploads to the S3 bucket. The solution must require minimal infrastructure changes on the client side and must be configured at the bucket level. Which AWS feature should the company enable?

A company runs a web application that allows users to upload images. After each upload, the application must perform several background processing tasks (e.g., resizing, generating thumbnails) that take up to 30 seconds each. Users should receive an immediate response and the processing should continue asynchronously. The company wants a solution that scales automatically with the number of uploads and requires no server management. Which AWS service should the company use to run these background processing tasks?

A retail company runs its e-commerce platform on AWS. The platform uses multiple Amazon EC2 instances behind an Application Load Balancer. To ensure the application remains available during an Availability Zone failure, the company distributes the instances across three Availability Zones. The load balancer automatically reroutes traffic away from an unhealthy zone. This design primarily addresses which pillar of the AWS Well-Architected Framework?

A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?

A company uses multiple AWS accounts. The security team wants to enforce two requirements for all Amazon S3 buckets: first, server-side encryption must be enabled using AWS KMS; second, no bucket can be publicly accessible. The team needs a service that continuously monitors the configuration of S3 buckets across all accounts, detects when a bucket violates either requirement, and automatically applies corrective actions (such as enabling default encryption or removing public access). Which AWS service should the security team use to meet these requirements?

Which AWS tool provides recommendations to help reduce costs, improve performance, enhance security, and increase fault tolerance?

A startup is building a prototype web application on AWS and is eligible for the AWS Free Tier. They plan to use a single t2.micro Amazon EC2 instance running continuously (24 hours per day, 7 days per week), 10 GB of Amazon S3 Standard storage, and 1 GB of Amazon RDS for MySQL storage. Which of the following statements accurately describes how these services will be billed during the first 12 months under the Free Tier, assuming they stay within the Free Tier limits for each service?

A company runs an e-commerce web application on Amazon EC2 instances. During flash sales, the backend order processing service becomes overloaded and drops requests, causing customer failures. The company needs a durable, scalable, and fully managed service to buffer incoming order requests and decouple the web tier from the backend processing tier. Orders must be stored reliably and processed in the order they were received. Which AWS service should the company use?

A company wants to ensure its cloud architecture can handle sudden spikes in traffic without manual intervention. Which cloud concept best describes this capability?

A company manages multiple AWS accounts under a single AWS Organizations structure with consolidated billing. The finance team needs to analyze historical cost and usage data across all accounts for the past six months. They want to filter the data by service (e.g., Amazon EC2, Amazon S3), AWS Region, and individual account. Additionally, they want to generate a line chart showing monthly trends and a forecast of future costs based on historical usage patterns. Which AWS tool should the finance team use to meet all of these requirements?

After GuardDuty generates a security finding about potentially compromised EC2 instances, a security analyst needs to investigate the full context of the threat — understanding which users, IPs, and resources were involved and how they relate to each other. Which AWS service helps investigators analyse and visualise these relationships?

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?

Which AWS service provides a fully managed NoSQL database with single-digit millisecond latency at any scale?

A solutions architect is reviewing an application design to ensure the system can automatically recover from failures, scale horizontally to increase availability, and prevent failures from cascading to other components. Which pillar of the AWS Well-Architected Framework is the architect applying?

A company uses AWS Support and wants to know which plan provides the fastest response time for a business-critical system outage causing complete service disruption.

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?

A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?

Which AWS pricing concept means you pay a lower per-unit price when you use more of a service, such as S3 charging less per GB as storage volume increases?

A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?

A company has migrated to AWS and uses multiple accounts under AWS Organizations with consolidated billing. The finance team needs a monthly cost breakdown by business unit. Each business unit's AWS resources are tagged with a 'BusinessUnit' tag (e.g., 'Marketing', 'Engineering'). However, some resources are not tagged. The team wants to see both the cost per business unit (based on tagged resources) and the total cost of untagged resources, all in one view. They also need the ability to filter by AWS service (e.g., EC2, S3) for each business unit. Which AWS tool or feature should the finance team use to meet these requirements?

A company wants to use Amazon S3 as their data lake but needs a way to track, search, and govern all datasets across multiple S3 buckets. Which AWS service provides centralized data catalog management?

A company has a compliance requirement that all Amazon S3 buckets must have server-side encryption (SSE) enabled and must block all public access. The company has hundreds of existing S3 buckets and creates new ones regularly. The security team needs a centralized AWS service that can continuously evaluate all buckets against these two rules, automatically detect noncompliant buckets, and then automatically remediate them by enabling SSE and blocking public access. Additionally, the team wants to receive notifications when compliance changes occur. Which AWS service should the security team use?

A company is calculating the Total Cost of Ownership (TCO) for migrating to AWS vs. staying on-premises. Which costs are typically REDUCED when migrating to AWS?

A company is developing a mobile application that requires a database to store user session data and preferences. The data is accessed very frequently with low-latency requirements, and the access patterns are unpredictable – the application experiences sudden spikes in read and write traffic. The company wants a fully managed database service that automatically scales to handle the workload, requires no patching or server administration, and charges based on the throughput consumed rather than on provisioned capacity. Which AWS service meets these requirements?

A company has multiple AWS accounts used by different departments (Finance, Marketing, Engineering). The finance team wants to see a single monthly bill that aggregates charges from all accounts. Additionally, they want to track costs by department using custom cost allocation tags that each department applies to its resources. Which AWS feature should the company use to meet both requirements?

A security team needs to continuously assess their AWS resources for security vulnerabilities and deviations from security best practices. Which service provides automated security assessments?

A startup is evaluating a migration from its on-premises infrastructure to AWS. The CTO notes that AWS can offer significantly lower per-unit costs for compute and storage compared to the startup's own data center. The CTO explains that AWS achieves this by pooling the demand of millions of customers, which allows AWS to negotiate better hardware prices and spread the fixed costs of data centers, power, cooling, and operational staff across a massive customer base. This specific cost advantage of cloud computing is best described by which fundamental concept?

A company stores sensitive customer data in multiple Amazon S3 buckets. The security team wants to proactively identify any buckets that have been configured to allow unintended access from external AWS accounts or from the public internet. The team needs a service that continuously analyzes the resource-based policies attached to these buckets and generates findings when such unintended access is detected. Which AWS service should the security team use to meet this requirement?

A company uses multiple AWS accounts managed through AWS Organizations. The finance team wants to see a consolidated view of all costs across accounts, and also wants to filter costs by specific projects using custom tags that are applied to resources. The team has already created tag keys and applied them to resources in all accounts. What additional step must the team take in the Management Account to ensure these tags appear as cost allocation dimensions in AWS Cost Explorer?

A company wants to provision and manage SSL/TLS certificates for their AWS resources without paying for certificates or manually handling renewals. Which AWS service provides this?

A retail company uses Amazon EC2 Auto Scaling to automatically launch hundreds of EC2 instances when CPU utilization exceeds 70% during a flash sale. When traffic subsides, the Auto Scaling group terminates the excess instances. This ability to dynamically provision and release compute resources in response to changes in demand best demonstrates which fundamental characteristic of cloud computing?

A company runs a critical e-commerce application in a single AWS Region. The architecture team wants to ensure the application remains available even if an entire data center fails. They plan to deploy the application across multiple physically separate and independent locations within that Region. Which component of the AWS global infrastructure should the team use to achieve this goal?

A company deploys their web application across multiple isolated locations within the same AWS Region, each with independent power, cooling, and networking. This design ensures that a failure in one location does not affect the others. What are these isolated locations called?

A company is migrating its on-premises infrastructure to AWS. The operations team needs a managed service that allows them to define their entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—as a reusable template stored in version control. The service must automatically handle resource dependencies, such as creating the database before launching the application servers, and ensure that the infrastructure is provisioned consistently across multiple environments (e.g., development, staging, production). Which AWS service should the company use to meet these requirements?

Which AWS service provides a fully managed NoSQL database designed for single-digit millisecond performance at any scale?

A healthcare company is migrating its application and patient data to AWS. To meet HIPAA requirements, the compliance officer must review and accept the AWS Business Associate Addendum (BAA). Additionally, the auditor requires the company to provide the latest AWS SOC 2 Type II report. The compliance officer needs a single self-service portal to access both documents directly from AWS. Which AWS service should the company use?

A company wants to improve the resilience of their Amazon RDS database by ensuring that read traffic is distributed across multiple copies of the database and that a replica can be promoted if the primary fails. Which RDS feature enables this?

A multinational company hosts its customer relationship management (CRM) application on AWS. Sales team members access the CRM from various locations using desktop computers, laptops, tablets, and smartphones. They connect over the internet through standard web browsers. Which essential characteristic of cloud computing does this scenario best illustrate?

A company operates over 100 AWS accounts consolidated under AWS Organizations. The finance team needs to analyze the company's historical AWS spending across all accounts for the past 6 months. They want to understand which services and regions drive the most costs, and they also need a 3-month forecast of future spending to inform budget planning. The team needs a visual dashboard that allows interactive filtering by account, service, and region without requiring custom scripts. Which AWS tool should the finance team use to meet these requirements?

Which AWS service is used to send emails, SMS messages, and push notifications to subscribers in a publish/subscribe pattern?

A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?

A company runs an e-commerce application on a fleet of Amazon EC2 instances. The application experiences unpredictable traffic spikes during flash sales. To handle this, the company configures an Amazon EC2 Auto Scaling group to automatically add instances when CPU utilization exceeds 70% and remove instances when utilization drops below 30%. The company only pays for the instances that are running. This ability to dynamically add and remove compute capacity based on real-time demand best demonstrates which essential characteristic of cloud computing?

A company needs to store their application's database connection strings and automatically rotate them every 30 days. Which AWS service handles secret storage with automatic rotation built in?

A company runs a web application on Amazon EC2 instances that accepts user uploads. The uploads need to be processed by a backend service that performs virus scanning and thumbnail generation. The backend processing can take up to 30 seconds per upload. Users should not experience delays when submitting their files. The company wants to decouple the web tier from the processing tier so that the web application can immediately return a response to the user while the processing happens asynchronously. The solution must be fully managed, durable, and scale automatically with demand. Which AWS service should the company use?

A company runs a critical web application on Amazon EC2 instances in the us-east-1 Region, with a secondary standby deployment in us-west-2 for disaster recovery. The application requires that user traffic be directed to the nearest healthy endpoint, automatically failover to the secondary region if the primary region becomes unavailable, and the company needs two static IP addresses that remain fixed regardless of infrastructure changes. The application uses TCP and UDP protocols. Which AWS service should the company use to meet these requirements?

A startup wants to ensure its web application automatically handles traffic spikes during product launches without over-provisioning resources during quiet periods. Which AWS capability best addresses this requirement?

A company's CTO asks about the AWS Cloud Adoption Framework (AWS CAF). Which statement about AWS CAF is accurate?

A company runs a fleet of 100 EC2 instances and needs to remotely execute commands, apply patches, and collect inventory data across all instances without opening SSH ports. Which AWS service enables this?

A company's security team needs to investigate a potential security incident. They want to determine which IAM user launched a new, unauthorized Amazon EC2 instance two days ago. The team needs to see the exact timestamp, the source IP address, and the instance type that was launched. Which AWS service should the security team use to find this information?

A company wants to use machine learning to automatically identify objects, scenes, and activities in images uploaded by users. Which AWS service should they use?

Match each AWS security service to its function.

A company is preparing for a third-party security audit. The auditors require the company to provide up-to-date AWS compliance reports, such as the SOC 2 report and the ISO 27001 certificate, as part of the evidence. The company needs to access these documents from a centralized, self-service portal within their AWS account. They also need to accept the terms and conditions for the reports. Which AWS service should the company use to meet these requirements?

A company's finance team needs to analyze AWS spending in detail. They require a report that includes hourly cost data for each AWS service, each individual resource (e.g., a specific EC2 instance), and any cost allocation tags applied. The team plans to export this data to an Amazon S3 bucket and then import it into a custom business intelligence (BI) analytics dashboard. Which AWS tool should the finance team use to generate this level of detailed cost data?

A company operates 10 AWS accounts, each managed by a separate team. Each account runs its own Amazon EC2 instances and stores data in Amazon S3. The CFO wants to minimize overall costs by taking advantage of volume discount pricing tiers that AWS offers (e.g., lower per-GB storage costs as total S3 usage increases). Which AWS feature should the company use to combine usage from all accounts so they benefit from the highest possible volume discounts?

A company ingests sensor data from IoT devices into an Amazon S3 bucket. The data is accessed frequently for the first 30 days, but after that, it is rarely queried. The company’s compliance policy requires all data to be retained for 7 years. The company wants to minimize storage costs by automatically moving data to more cost-effective storage classes as it ages, without any manual intervention. Which Amazon S3 feature should the company configure to meet these requirements?

A company runs a mix of Amazon EC2 instances (different instance families) and AWS Fargate tasks across multiple AWS Regions. The cloud operations team wants to reduce costs while retaining maximum flexibility to change instance families, operating systems, and compute platforms (EC2 or Fargate) without losing the discount. They are willing to commit to a consistent amount of compute usage (measured in $/hour) for a 1-year term. Which AWS pricing model should they choose?

Which AWS service provides a managed message broker for Apache ActiveMQ and RabbitMQ to help migrate existing messaging systems to the cloud?

A security team suspects unauthorised network traffic is reaching a subnet in their VPC. They need to capture metadata about the IP traffic (source IP, destination IP, port, protocol, accept/reject status) flowing through their VPC network interfaces for analysis. Which AWS feature provides this network traffic metadata?

Which AWS concept describes the strategy of designing applications so that any individual component can fail without causing the entire system to fail?

A company currently owns and operates its own data center. They are considering moving to AWS. Which economic benefit describes the elimination of the costs associated with purchasing, maintaining, and cooling physical servers?

A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?

What does the AWS Free Tier offer to new AWS customers?

A financial services company is preparing for an annual compliance audit. The compliance team needs to continuously assess whether their AWS environment adheres to industry standards such as PCI DSS. They want to automate the collection of evidence, such as IAM policy changes and S3 bucket configurations, and generate audit-ready reports. They also need to identify gaps in their controls and receive remediation recommendations. Which AWS service should the company use?

A company uses multiple AWS accounts to store data in Amazon S3. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled. The team needs a service that can continuously monitor all S3 bucket configurations across all accounts, automatically detect any bucket that does not have encryption enabled, and automatically apply the encryption setting to bring the bucket into compliance. Which AWS service should the team use?

Which AWS service enables no-code integration between SaaS applications (like Salesforce, ServiceNow, Zendesk) and AWS services for automated data flows?

A company runs a public-facing e-commerce website on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has discovered that attackers are attempting SQL injection attacks through the website's search feature. The company wants to use a managed AWS service to inspect incoming HTTP requests and block these malicious payloads before they reach the application. Which AWS service should the company use?

A startup is using the AWS Free Tier for the first time. They have launched an Amazon EC2 t2.micro instance and are storing 10 GB of data in Amazon S3 Standard. The startup wants to ensure they do not incur any charges beyond the Free Tier limits. They need a managed AWS service that can automatically monitor their usage against the Free Tier allowances and send them a notification if they are approaching or exceeding those limits. Which AWS service should the startup use?

AWS can offer lower pay-as-you-go pricing than a single company could achieve operating its own data centre because AWS aggregates usage from hundreds of thousands of customers. Which cloud computing benefit does this describe?

A company runs a monolithic order processing application on a single Amazon EC2 instance. During peak hours, the instance receives a sudden burst of orders that exceeds its processing capacity. Orders are dropped and customers do not receive confirmations. The company needs a solution that buffers incoming orders, stores them durably, and allows the application to process them at a manageable pace. The solution must be fully managed and ensure that no orders are lost. Which AWS service should the company use to meet these requirements?

Which AWS service provides a managed way to create, control, and rotate encryption keys used to protect your data?

A company's security policy requires that all Amazon S3 buckets have default encryption enabled (SSE-S3 or SSE-KMS). A recent audit found several buckets without encryption enabled. The company wants an automated solution to continuously monitor all existing and new S3 buckets, detect any bucket that does not have default encryption enabled, and automatically remediate by enabling encryption. The solution must also maintain a compliance score and allow the security team to review non-compliant resources. Which AWS service should the company use to meet these requirements?

Match each AWS database service to its description.

A company wants to adopt AWS and is performing a readiness assessment. The AWS Cloud Adoption Framework (CAF) identifies which two areas that most cloud migrations fail to address adequately?

A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?

Which AWS service provides recommendations to help reduce costs, such as identifying idle EC2 instances, underutilized EBS volumes, and unassociated Elastic IPs?

A company runs a combination of Amazon EC2 instances and AWS Lambda functions for its applications. The finance team wants to reduce costs by making a commitment to a consistent amount of compute usage (measured in dollars per hour) for a 1-year term. The team wants the flexibility to change instance families, sizes, and AWS regions, and also wants the commitment to cover both EC2 and Lambda usage. Which AWS pricing option should the team purchase?

Which AWS pricing model allows customers to commit to a consistent amount of compute usage (measured in $/hour) for a 1 or 3-year term in exchange for significant discounts, without being locked to specific instance types?

A company wants to automate the deployment of its infrastructure across multiple AWS environments (development, staging, production). The operations team needs to define all AWS resources (such as Amazon EC2 instances, security groups, and load balancers) in a declarative JSON or YAML template. They want to version control these templates, quickly replicate the entire infrastructure in a new region, and ensure that each deployment is consistent and repeatable. Which AWS service should the company use to achieve this?

A developer needs to launch a test EC2 instance for a new prototype. The developer logs into the AWS Management Console, selects an instance type, and launches the instance without contacting AWS support or waiting for approval. Which cloud computing characteristic does this demonstrate?

A company operates three separate AWS accounts, one for production, one for development, and one for testing. The finance team wants to receive a single monthly invoice that shows the total charges from all three accounts combined. They also want to aggregate usage across accounts to benefit from volume discounts on Amazon S3 and Amazon EC2. Additionally, the team wants to apply a single payment method (credit card) to cover charges for all accounts. Which AWS feature should the finance team use to meet these requirements?

A company wants to accelerate their machine learning workflows by using pre-trained foundation models for tasks like text generation and image creation without training models from scratch. Which AWS service provides access to pre-trained foundation models via API?

Which AWS service continuously assesses your AWS resources for security vulnerabilities, unintended network exposure, and deviations from security best practices?

A company manages a fleet of hundreds of Amazon EC2 instances running across multiple AWS Regions. The company's security policy requires that all instances be patched with the latest security updates within 7 days of release. The operations team currently logs in to each instance manually to apply patches, which is time-consuming and error-prone. The team wants to automate the patching process, track compliance across all instances, and receive reports on patch status. The solution must not require any changes to the existing application code or the use of additional third-party software. Which AWS service should the operations team use to meet these requirements?

A retail company wants to implement a recommendation engine based on customer purchase history. Which AWS service is designed to provide ML-based personalized recommendations with no ML experience required?

A company has a hybrid cloud environment with both on-premises servers and AWS. They want a consistent management experience across both environments. Which AWS service extends the same AWS Systems Manager capabilities to non-AWS servers?

A company is planning to migrate a legacy application to AWS and wants to estimate the monthly cost of running the new workload. The company needs to compare costs across different Amazon EC2 instance types, regions, and pricing models (On-Demand, Reserved, and Spot). The team also wants to include estimated costs for related services such as Amazon EBS storage and data transfer. Which AWS tool should the company use to generate this cost estimate?

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?

A company uses Amazon EC2 instances to run its workloads. The company's IT team does not know the exact physical server where each instance runs, and instances from multiple customers may be hosted on the same physical hardware. The team only specifies the AWS Region and Availability Zone. Which essential characteristic of cloud computing does this scenario BEST represent?

A healthcare company runs a production application on AWS that stores protected health information (PHI). The company needs a support plan that provides a designated Technical Account Manager (TAM) who will perform quarterly business reviews, offer proactive architectural guidance, and help optimize the environment. The company also requires a 15-minute response time for critical system failures. Which AWS Support plan should the company choose?

Which AWS service is used to distribute incoming application traffic across multiple EC2 instances to improve availability and fault tolerance?

A software development team uses AWS CloudFormation to define their test environments as infrastructure as code. Each developer can launch a complete environment containing multiple Amazon EC2 instances, an Application Load Balancer, and an Amazon RDS database in under five minutes. They run their test suite for a few hours and then delete the entire CloudFormation stack, releasing all resources. Which essential characteristic of cloud computing does this workflow best illustrate?

Which AWS service or feature provides a notification when AWS is performing planned maintenance that may affect your resources?

A healthcare company needs to store patient medical records that must be retained for 10 years to comply with regulatory requirements. These records are accessed very rarely, only in the event of an audit or legal request. Which Amazon S3 storage class is the MOST cost-effective choice for this data?

A company needs to synchronize files between their on-premises file server and Amazon S3 on a recurring schedule, detecting and copying only the changed files. Which AWS service is designed for this use case?

A company runs a web application on Amazon EC2 instances. The application experiences unpredictable traffic spikes during marketing campaigns. The company configures an Amazon EC2 Auto Scaling group to automatically add instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This allows the company to handle peak loads without manual intervention and avoid paying for idle capacity during low traffic periods. Which essential characteristic of cloud computing does this configuration BEST demonstrate?

A startup is migrating its infrastructure to AWS. The CTO notices that the hourly rate for an Amazon EC2 instance is significantly lower than the cost of purchasing and maintaining a comparable physical server in their own data center. The CTO explains that AWS can offer lower prices because it aggregates demand from thousands of customers and optimizes its data center operations. Which benefit of cloud computing does this scenario primarily illustrate?

A company wants to ensure their containerized microservices can discover each other by name without hard-coding IP addresses. Which AWS service provides DNS-based service discovery for ECS and EKS?

A company's security policy requires that access keys for IAM users must be rotated every 90 days. Which AWS service can automatically detect users with non-compliant key age?

A compliance team needs to track the configuration history of AWS resources, determine when a security group was last modified, and verify that all EC2 instances comply with a rule requiring encryption on all attached EBS volumes. Which AWS service provides these capabilities?

A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?

A startup runs an e-commerce website on AWS. During flash sales, traffic can increase 10x in a few minutes. The startup uses an Auto Scaling group to automatically launch additional EC2 instances when CPU utilization exceeds 70% and terminate them when utilization drops below 30%. This approach ensures that the application always has enough capacity to handle the load without manual intervention, and they only pay for what they use. Which cloud computing concept does this scenario BEST illustrate?

A company is planning to migrate a legacy application to AWS. The solutions architect needs to estimate the monthly cost of running Amazon EC2 instances, Amazon RDS databases, and Amazon S3 storage. The architect wants to compare different instance types, storage classes, and pricing models (e.g., On-Demand vs. Reserved Instances) to find the most cost-effective configuration. The team requires a tool that provides a detailed, itemized cost estimate without incurring any actual charges, and allows saving and sharing the estimate with stakeholders. Which AWS tool should the solutions architect use?

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

A company hires 10 new developers and needs to assign them identical AWS permissions — read access to S3 and the ability to launch EC2 instances. What is the AWS best practice for assigning these permissions efficiently?

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

A company manages a fleet of hundreds of EC2 instances and needs to automate patching across all instances, run commands remotely without SSH, and store configuration parameters centrally. Which AWS service provides these operational management capabilities?

A company runs a globally distributed multiplayer game on AWS. The game uses UDP for real-time communication and requires static IP addresses that do not change for whitelisting by internet service providers. The company needs to route traffic to the nearest healthy application endpoint to minimize latency and improve performance. The solution must work with both TCP and UDP traffic and provide static IP addresses. Which AWS service should the company use?

A government agency runs all of its computing workloads on hardware located in its own secure facility. No resources are hosted with a third-party cloud provider. The agency manages all servers, networking equipment, and storage. Which cloud deployment model describes this architecture?

Before moving to AWS, a company over-provisioned their data centre servers to handle projected peak traffic, resulting in expensive idle capacity most of the time. After migrating, the company uses Auto Scaling to match capacity exactly to actual demand. Which cloud benefit does this represent?

A company wants to automate the creation and management of machine learning models without writing code. Which AWS service provides a no-code ML model building interface?

A company has multiple departments (HR, Finance, Engineering) sharing a single AWS account. Each department tags its resources with a 'Department' tag (e.g., Department:HR). The finance team wants to set monthly spending limits for each department and receive email alerts when a department's spending reaches 80% of its limit. They also want a visual dashboard to compare actual spending against the budgeted amounts. Which combination of AWS services should the finance team use?

A data team needs to extract data from S3 and RDS, transform it (clean, enrich, join), and load it into Amazon Redshift for analytics. They want a serverless service that discovers and catalogues data schemas automatically and runs the ETL jobs without provisioning servers. Which AWS service provides this?

A company migrates their self-managed MySQL database running on a virtual machine to Amazon RDS for MySQL, taking advantage of managed backups and Multi-AZ without changing the database schema or application code. Which migration strategy does this represent?

A company uses Amazon EC2 instances and Amazon S3 for its workloads. The finance team reviews the monthly AWS bill and notices it includes line items for EC2 instance hours, data transfer out from EC2, and S3 storage usage. The bill shows exactly how many hours each instance ran and how much data was transferred. The company uses this detailed usage data to allocate costs to different departments and to optimize resource utilization. This scenario best demonstrates which essential characteristic of cloud computing?

A company's external auditor requires the company to provide evidence that the AWS infrastructure used by the company meets SOC 2 and ISO 27001 standards. The company needs to download the latest AWS SOC 2 report and ISO 27001 certification to share with the auditor. Which AWS service or feature should the company use to retrieve these documents?

A company operates multiple Amazon VPCs across several AWS accounts for different business units. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the connectivity between all VPCs and the on-premises network. Currently, they manage individual VPC peering connections, which is becoming complex as more VPCs are added. They need a single network hub that can scale to connect hundreds of VPCs and the on-premises network, with centralized routing management. Which AWS service should the network team use?

Which AWS service is used to register domain names and route DNS queries for domain names like 'example.com'?

A startup is designing a new application on AWS. They have selected specific Amazon EC2 instance types, Amazon EBS volumes, and estimated data transfer. The team wants to compare the monthly cost of running the application using On-Demand instances versus 1-year All Upfront Reserved Instances before they commit to any resources. Which AWS tool should they use to generate this cost estimate?

A company runs non-production Amazon EC2 instances for development and testing. The finance team wants to automatically stop all non-production instances if the monthly spending exceeds $5,000. The team wants to set this up without writing custom scripts or using third-party tools. Which AWS feature should the finance team use to meet this requirement?

A company runs a web application on multiple EC2 instances across multiple Availability Zones. All instances need to access and share the same file system simultaneously to read and write shared configuration files. Which AWS storage service supports simultaneous access from multiple EC2 instances?

A company runs a web application on Amazon EC2 instances that connect to a relational database. The application requires high database availability so that if the primary database instance fails, a standby instance automatically takes over without manual intervention. The company wants to minimize administrative overhead for database patching, backups, and replication. Which AWS service should the company use to meet these requirements?

A company needs a managed workflow service to coordinate long-running business processes that may require human approval steps and can run for up to one year. Which AWS service handles this?

Which benefit of cloud computing allows organizations to avoid the capital expense of buying hardware and instead pay only for what they use?

A company processes credit card transactions and must comply with PCI DSS requirements. Customer payment data is stored in Amazon RDS for MySQL. The security team needs to ensure that all automated database snapshots are encrypted at rest using customer-managed encryption keys that are automatically rotated every 365 days. The team wants a fully managed AWS service to create and control these encryption keys. Which AWS service should the company use to meet these requirements?

A healthcare startup is migrating its patient records database to Amazon RDS for PostgreSQL. The company must comply with HIPAA and ensure that all protected health information (PHI) is encrypted at rest and in transit. Which task is the company responsible for under the AWS shared responsibility model?

A company runs a development environment composed of multiple Amazon EC2 instances. The finance team has set a monthly budget of $5,000 for this environment and wants to automatically stop all EC2 instances if the accumulated cost reaches $4,500 before the end of the month. The team needs a managed AWS-native solution that does not require custom scripts or third-party tools. Which AWS feature or service should the company use to meet this requirement?

A company moves its infrastructure to AWS. The company's IT team notices that they have no control over which specific physical server their virtual machines run on, and they are unaware of the exact hardware location except at the regional level. The underlying physical resources are shared across multiple AWS customers. Which essential characteristic of cloud computing does this scenario BEST describe?

A company uses an Amazon RDS for PostgreSQL database for its production application. The security policy requires that database passwords be rotated automatically every 90 days. The database credentials are currently stored in a configuration file on an Amazon EC2 instance. The company wants a fully managed AWS service that can securely store the credentials, automatically rotate them on a schedule, and update the RDS instance without requiring code changes to the application. Which AWS service should the company use to meet these requirements?

A company is migrating a steady-state web server to AWS. The server is expected to run continuously (24 hours a day, 7 days a week) for the next three years. The workload has predictable CPU and memory usage and does not experience significant spikes. The company wants to minimize the total cost of running this server over the three-year period. Which AWS EC2 pricing model should the company choose?

A company wants its employees to access cloud applications and manage cloud resources from anywhere using a variety of devices, including laptops, smartphones, and tablets. Which essential characteristic of cloud computing does this requirement directly represent?

Which of the following best describes an AWS Region?

Which AWS IAM feature allows you to set the maximum permissions that IAM entities in an account can have, regardless of what their identity-based policies allow?

A company hosts a multi-tier web application on AWS. The web tier runs on Amazon EC2 instances in a public subnet, and the database tier runs on Amazon EC2 instances in a private subnet. The security team needs to configure security groups to allow only the web tier instances to communicate with the database tier on port 3306 (MySQL). The web tier must be accessible from the internet on port 443. Which security group configuration meets these requirements?

A company is concerned about unexpected AWS charges from development instances that developers forget to stop. Which AWS service provides a simple dashboard showing AWS service health events and can also be used to stay informed about account-level events?

A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?

A startup uses AWS Lambda for its backend processing. The company is billed only for the number of function invocations and the compute time consumed, rounded up to the nearest millisecond. There are no minimum fees or upfront commitments. This billing model is a direct example of which essential characteristic of cloud computing?

A company needs to convert text documents into natural-sounding speech in multiple languages for an audiobook application. Which AWS service provides this capability?

A development team needs to spin up a new Amazon RDS database instance for a proof-of-concept application. The team can log into the AWS Management Console, select the database engine, configure settings, and launch the instance within minutes, without needing to submit a ticket or wait for IT operations to provision hardware. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

A company wants to purchase EC2 capacity that provides a discount over On-Demand pricing and is available only when AWS has excess capacity, with the option of interruption with a 2-minute warning. Which option is this?

A company uses several AWS services and wants to create a unified monitoring dashboard to track metrics and set alarms. Which AWS service provides this capability?

Which AWS service provides a desktop development environment in the cloud with a browser-based code editor and computing resources, requiring no local installation?

A company runs a microservices application on AWS. It needs to send real-time alerts to mobile devices via push notifications and to administrators via email whenever a critical event occurs. The solution must be a fully managed service that supports both delivery channels without requiring separate infrastructure for each. Which AWS service should the company use?

A company runs a multi-region application on AWS with separate VPCs in us-east-1 and eu-west-1. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the routing topology so that traffic between all VPCs and the on-premises network flows through a central hub. They need a service that can manage many VPC attachments and provide transitive routing across all connected networks. Which AWS service should the network team use?

A company has 20 AWS accounts managed under AWS Organizations. The finance team wants to centralize billing so that the company receives volume discounts for the aggregated usage across all accounts. Additionally, the team needs to set monthly budgets for each department and automatically receive email notifications when a department's spending reaches 80% of its budget threshold. Which combination of AWS features or services should the company use to meet these requirements?

A company has been using Amazon EC2 instances for a production application for the past 12 months. The finance team wants to understand historical spending patterns and identify opportunities to reduce costs. Specifically, they need to see which EC2 instance families and sizes are being underutilized and get recommendations for purchasing Reserved Instances to save money compared to current On-Demand pricing. The team wants to use a native AWS tool that provides a visual dashboard of costs, usage trends, and actionable recommendations. Which AWS tool should the finance team use?

A company is developing a microservices application using Docker containers. The development team wants to deploy and run these containers on AWS without having to provision or manage any underlying EC2 instances. Additionally, the team does not want to manage the container orchestration control plane. They need a fully serverless compute engine for containers that automatically scales based on demand. Which AWS compute option should the team use?

A company wants to migrate their on-premises VMware virtual machines to Amazon EC2. Which AWS service simplifies this lift-and-shift migration?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application connects to an Amazon RDS for MySQL database. The database password is currently hardcoded in the application configuration file, and the security team is concerned about the risk of exposure. The company wants to remove the hardcoded credential and instead have the application retrieve the database password securely at runtime. Additionally, the security team requires that the password be automatically rotated every 90 days without any manual intervention or custom scripting. Which AWS service should the company use to meet these requirements?

A company has a development environment running on Amazon EC2 instances. To control costs, the team wants to set a monthly budget of $5,000 for this environment. If the forecasted cost for the month exceeds $6,000 (20% over budget), they want AWS to automatically stop all non-critical EC2 instances to prevent further spending. Which AWS feature should the team use to implement this automated cost control?

A company's sales team uses a cloud-based CRM application hosted on AWS. Sales representatives access the application from various devices—office desktops, company-issued laptops, and personal smartphones—using only standard web browsers and internet connections. No special client software or dedicated network connections are required. Which essential characteristic of cloud computing does this scenario best illustrate?

A company runs an e-commerce application on Amazon EC2 instances in the us-east-1 Region. The application serves static assets (images, CSS files) and dynamic API responses. Users in Europe and Asia report that the website loads slowly, especially for images. The company needs a solution that reduces latency for both static and dynamic content by caching static assets at edge locations and accelerating dynamic API calls using optimized network paths. Which AWS service should the company use?

A company has a two-tier web application. The front-end web servers run on Amazon EC2 instances in a public subnet. The back-end application servers process jobs that are submitted by the front end. The company wants to decouple the front-end and back-end tiers so that the back-end servers can process jobs as they are submitted, even if the front-end servers experience a spike in traffic. The solution must be durable and fully managed, and must allow the front-end servers to send job requests without waiting for the back-end servers to be available. Which AWS service should the company use to send the job requests from the front end to the back end?

A company operates a global e-commerce website behind Amazon CloudFront. Security analysts have noticed a pattern of SQL injection attempts and cross-site scripting attacks targeting the web application. The company needs a fully managed service that can inspect incoming HTTP(S) requests and block these common web exploits before they reach the application origin. The solution must integrate with CloudFront and allow the security team to author custom rules. Which AWS service should the company use?

A company is reviewing their AWS bill and notices charges for Amazon CloudWatch. Which specific CloudWatch usage would NOT incur additional charges beyond the CloudWatch free tier?

What is the purpose of AWS Shield Standard?

A company wants to migrate 50 virtual machines from their on-premises data centre to AWS as quickly as possible to reduce data centre costs. They plan to move the VMs without making any changes to the applications. Which cloud migration strategy does this represent?

A startup company is evaluating the benefits of migrating to AWS. The CEO wants to experiment with a new application idea by quickly launching a small server, testing the application for a few days, and then decommissioning it. The company does not want to go through a lengthy procurement process to purchase hardware. Which cloud computing concept does this scenario best demonstrate?

A company wants to understand the AWS Well-Architected Framework's sixth pillar added in 2021. Which pillar focuses on minimizing the environmental impact of cloud workloads?

A company uses AWS for multiple projects. Each project's resources have been tagged with 'Project' and 'Team' tags. The finance team wants to view a cost breakdown in AWS Cost Explorer using these tags. The tags are already applied to existing resources. However, when the finance team opens Cost Explorer, the tags are not available for filtering. What must the finance team do to see costs by these tags?

Which Amazon RDS feature enables automatic scaling of database storage capacity without any downtime when storage is running low?

Under the AWS Shared Responsibility Model, what is AWS responsible for when a customer uses AWS Lambda?

A company runs a latency-sensitive application on AWS that must communicate with an on-premises data center. The company requires a dedicated, private network connection that provides consistent, low-latency performance and bypasses the public internet. Which AWS service should the company use to meet these requirements?

A company publishes a message each time a new product is added to its catalogue. Three services need to receive this message simultaneously: an email notification service, an inventory update service, and an analytics service. Which AWS service should the company use to deliver the message to all three services at the same time?

A company runs a web application on multiple Amazon EC2 instances across two Availability Zones. The application processes user-uploaded documents and must store them in a shared file system that all instances can access simultaneously. The file system must be scalable to petabytes, durable, and fully managed. Which AWS service should the company use to meet these requirements?

A company uses separate AWS accounts for development, testing, and production. The finance team wants to receive a single monthly invoice that covers all accounts and to benefit from volume pricing discounts across the entire organization. Which AWS feature should the company use to achieve this?

Which AWS service provides hardware-based key management and cryptographic operations using FIPS 140-2 Level 3 validated hardware security modules (HSMs)?

A company runs a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS). They need a managed service that allows them to create custom rules to filter malicious HTTP traffic and integrates directly with the ALB and Amazon CloudFront. Which AWS service should the security team configure?

A financial institution needs a private, dedicated, high-bandwidth network connection from their on-premises data centre to AWS that does not traverse the public internet, provides consistent low latency, and supports up to 100 Gbps bandwidth. Which AWS service provides this?

A company hosts an e-commerce website on Amazon EC2 instances in the us-east-1 Region. The website serves static assets (images, CSS, and JavaScript) to a global user base. Users in Europe and Asia report slow page load times. The company needs to improve the performance of delivering these static assets to all users without modifying the application code or provisioning additional origin servers. Which AWS service should the company use?

A company manages 15 AWS accounts and wants to centrally deploy and enforce consistent AWS WAF rules, security groups, and Shield Advanced protections across all accounts and regions from a single administrator account. Which AWS service provides this centralised security policy management?

A company uses AWS for multiple workloads across several linked accounts under AWS Organizations. The finance team needs to analyze historical cost and usage data to identify monthly spending trends by service (e.g., Amazon EC2, Amazon S3) and by linked account. They also need to filter the data by date range and view the top cost drivers. The team prefers a built-in AWS tool that provides an interactive interface with graphs and tables, without requiring them to download or process raw data. Which AWS service or tool should the finance team use?

A company is designing a resilient multi-tier web application on AWS. The architect wants to implement the Well-Architected Framework Reliability pillar design principle of 'automatically recover from failure.' Which combination of services implements this most completely?

A company architect is reviewing their architecture for the Operational Excellence pillar of the Well-Architected Framework. Which practice is a core recommendation of this pillar?

A company wants to use AWS to run a relational database that is compatible with MySQL but with improved performance and availability. Which service should they use?

A company has multiple AWS accounts that are consolidated under AWS Organizations. The finance team receives a single monthly bill for all accounts. The team needs to allocate costs to individual departments based on which department owns each resource. They want to see a breakdown of costs by department in the monthly cost report without manually combining data from each account. Which action should the finance team take to meet these requirements?

A company runs a database on an Amazon EC2 instance. They need block storage that persists independently from the EC2 instance — if the instance is stopped or terminated, the data must remain available. Which AWS storage service provides this?

A company is building a serverless web application using AWS Lambda for compute. The application needs to expose RESTful API endpoints that allow users to perform CRUD operations on a database. The API must support authentication using API keys, throttle requests to prevent abuse, and validate incoming request payloads before they reach the Lambda functions. The company wants a fully managed service that handles these API management tasks and integrates directly with AWS Lambda. Which AWS service should the company use?

A company runs a critical production application on AWS. The internal team is unable to resolve intermittent errors that are impacting the application. The company currently has the AWS Basic Support plan and requires access to AWS technical support with a faster response time for production issues. Due to budget constraints, the company wants the most cost-effective support plan that provides a response time of 1 hour for production system impaired cases. Which AWS Support plan should the company choose?

A company is considering AWS for their new application. Which tool allows them to compare the cost of running their workloads on AWS versus on-premises, and estimate the potential savings?

A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?

A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?

A company launches EC2 instances in a public subnet of their VPC. For these instances to communicate directly with the internet — both to receive inbound requests and to make outbound requests — which VPC component must be attached to the VPC and referenced in the subnet's route table?

A company wants to improve their application's reliability by ensuring it can handle the failure of a single Availability Zone. According to AWS Well-Architected Framework, what architectural pattern achieves this?

A mobile gaming company is developing a real-time multiplayer game that requires ultra-low latency (under 10 milliseconds) for player interactions. The company expects most of its users to be on 5G mobile networks. To meet the latency requirement, the company needs to deploy compute and storage resources as close as possible to the mobile subscribers, directly at the edge of the telecommunications network. Which AWS service should the company use?

A company operates hundreds of AWS accounts under AWS Organizations. The security team wants a single dashboard that aggregates security findings from Amazon GuardDuty, Amazon Inspector, and AWS Macie across all accounts. Additionally, they want to continuously assess the accounts against the CIS AWS Foundations Benchmark and receive a consolidated compliance score. Which AWS service should the security team use?

According to the AWS Well-Architected Framework, what does the Performance Efficiency pillar primarily focus on?

A company hosts a static website on Amazon S3. The website serves product images and documents to customers around the world. Users in distant regions report slow load times. The company wants to reduce latency for all users without changing the existing S3 bucket configuration. Which AWS service should the company use?

A development team is building a serverless application that processes image uploads to Amazon S3. The application needs to automatically generate a thumbnail version of each uploaded image and store it in a separate S3 bucket. The team wants to minimize operational overhead and only pay for the compute time used during thumbnail generation. Which AWS service should the team use to execute the thumbnail generation code in response to S3 upload events?

A company is preparing for a SOC 2 Type II audit and needs to provide its auditor with evidence of AWS's operational security controls. The security team has been asked to download the latest SOC 2 Type II report published by AWS. The team must access the report through a self-service portal without needing to contact AWS Support. Which AWS service should the security team use to meet this requirement?

Match each AWS support plan to its key feature.

A development team needs to provision a new Amazon EC2 instance for a proof-of-concept project. The team has an AWS account with appropriate IAM permissions. One developer logs into the AWS Management Console, selects an Amazon Machine Image (AMI), chooses an instance type, configures security groups, and launches the instance. The entire process takes less than 10 minutes and does not require any interaction with AWS support or IT administrators. Which essential characteristic of cloud computing does this scenario best illustrate?

A gaming company needs a database that can handle millions of requests per second with consistent single-digit millisecond latency and automatically scales without any capacity planning. Which AWS database service meets these requirements?

Which AWS service provides a serverless, fully managed Apache Kafka-compatible data streaming service?

A company has multiple AWS accounts managed under AWS Organizations with consolidated billing enabled. The company purchases a 3-year Compute Savings Plan to reduce costs on Amazon EC2, AWS Fargate, and AWS Lambda usage. The finance team wants the discount from the Savings Plan to apply to eligible usage across all accounts in the organization. What configuration is required to achieve this?

A data science team wants to build, train, and deploy machine learning models without managing the underlying server infrastructure for training and inference. Which AWS service provides a fully managed environment for the machine learning workflow?

Which AWS service enables real-time translation of text between languages for applications serving a global audience?

A company has a monthly budget of $10,000 for its development AWS account. The project manager wants to receive an automated email alert when the actual costs for the current month reach 80% of the budget. The project manager does not want to build any custom code or manage any infrastructure for this alert. Which approach should the project manager take to meet these requirements?

A company has two separate VPCs — one for development workloads and one for a shared services environment — and wants EC2 instances in both VPCs to communicate with each other using private IP addresses without traffic traversing the public internet. Which AWS feature enables this?

A company manages over 100 AWS accounts using AWS Organizations. The security team wants a centralized service that continuously monitors for malicious or unauthorized behavior across all accounts. The service must analyze AWS CloudTrail management event logs, VPC Flow Logs, and DNS query logs to automatically detect threats such as anomalous API calls, crypto-mining activity, and compromised credentials. The security team wants to receive actionable alerts without having to write custom detection rules or manage underlying infrastructure. Which AWS service should the security team use?

Which AWS service is a fully managed data warehousing service optimized for online analytical processing (OLAP) of large datasets?

A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?

A company plans to migrate its on-premises workload to AWS. The finance team wants to compare the total cost of ownership between running the workload on-premises and running it on AWS. They need to estimate monthly costs for different Amazon EC2 instance types, pricing models (On-Demand, Reserved, Spot), and storage options before making any commitment. Which AWS tool should the finance team use to create this detailed cost estimate?

Which AWS support plan provides access to AWS Infrastructure Event Management (IEM) for product launches and migrations at no additional charge?

A company runs a web application that connects to an Amazon RDS for MySQL database. The security policy requires that the database password be rotated every 30 days. The development team wants a fully managed solution that automatically rotates the password, handles the update in RDS, and provides the application with the latest credentials without any code changes. The application should also continue to work during the rotation process. Which AWS service should the company use to meet these requirements?

A company needs to integrate their on-premises Active Directory with AWS to enable SSO for employees accessing AWS services. Which AWS service provides this federation capability?

A development team needs to deploy a web application on AWS. They want to avoid managing the underlying infrastructure, such as EC2 instances and load balancers, but still need the ability to control scaling, update the application code, and perform rollbacks. The application must scale automatically based on demand and remain highly available. Which AWS service should the team use?

A company runs a production MySQL database on Amazon RDS. The workload has a steady baseline usage that requires a db.r5.large instance most of the time, but during end-of-month processing, the database needs to scale up to a db.r5.xlarge for a few days. The company wants to maximize cost savings while retaining the ability to temporarily scale up the instance during those peaks and still receive a discounted rate. Which purchasing option should the company choose?

Match each AWS service to its primary category.

A company runs multiple applications across hundreds of Amazon EC2 instances in several AWS accounts. The finance team needs to perform daily cost analysis by combining detailed usage data (including instance type, operating system, and custom cost allocation tags) with their own business data stored in an on-premises data warehouse. They want to export cost and usage data from AWS at the most granular level possible (down to each individual resource and hour) into their on-premises system for custom reporting. Which AWS tool should they use to achieve this?

A company runs an e-commerce application using Amazon RDS for MySQL. The database stores order and customer information. To achieve high availability, the company configures a Multi-AZ deployment. Which of the following describes a benefit of this configuration?

A company operates a healthcare application on AWS that must comply with HIPAA regulations. The application stores sensitive patient data in Amazon S3. The compliance team requires that all data at rest in S3 be encrypted with a key that the company manages. The company also needs the ability to automatically rotate the encryption key every 365 days and to audit all key usage through AWS CloudTrail. Which AWS service should the company use to meet these requirements?

Which AWS service helps detect unusual API activity and potential security threats by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs?

A company is migrating its on-premises data center to AWS. The Chief Financial Officer (CFO) wants to understand how this migration will change the company's financial structure. Historically, the company purchased servers, networking equipment, and software licenses upfront, with costs depreciating over several years. The CFO notes that the move to AWS will replace these large upfront capital expenditures with smaller, recurring operational expenses based on actual usage. Which essential characteristic of cloud computing enables this shift from capital expenditure (CAPEX) to operational expenditure (OPEX)?

A company's application has components that tightly depend on each other, making it difficult to scale individual components or update one without affecting others. The architects want to refactor to a more resilient architecture. What AWS design principle addresses this?

A company uses Amazon WorkMail for corporate email. Employees access email through a web browser or mobile app. The company does not manage any servers, email software, or storage infrastructure. Which cloud service model does this represent?

A company stores sensitive financial data in an Amazon S3 bucket. The security policy requires that all data must be encrypted in transit. The security administrator discovers that some automated scripts are using HTTP instead of HTTPS to upload files. The administrator must enforce that any request that does not use HTTPS is denied by the S3 bucket policy. Which condition key should the administrator include in the bucket policy to enforce this requirement?

A company wants to analyse petabytes of historical sales data using standard SQL queries and connect their existing business intelligence (BI) tools to the data store. The workload is analytical (OLAP), not transactional (OLTP). Which AWS service is designed for this use case?

A company's application experiences traffic spikes every weekday morning when employees arrive at work. During off-hours, very few users are active. Which AWS feature automatically adjusts the number of EC2 instances based on demand, adding instances during peak hours and removing them during quiet periods?

A company's development team regularly creates temporary test environments. Each time, they log into the AWS Management Console, select the required Amazon EC2 instance types and storage, and launch the resources without needing to contact AWS support or their IT department. The team also terminates the resources when testing is complete. Which essential characteristic of cloud computing does this scenario best demonstrate?

A media production company has a physical studio in Atlanta, Georgia. The company runs video editing workloads on Amazon EC2 instances that require single-digit millisecond latency to the studio's on-premises storage and workstations. The company wants to use AWS infrastructure that is physically located in or very near Atlanta to achieve this latency, while still having full access to AWS services like EC2, EBS, and VPC. The company does not want to manage the underlying hardware. Which AWS infrastructure option should the company use?

A company migrates its on-premises applications to AWS. The finance team wants to allocate costs to different departments based on the exact amount of compute, storage, and network resources each department consumes. They also want to set automatic alerts when a department's usage exceeds a predefined budget. Which essential characteristic of cloud computing enables this level of visibility and control over resource consumption?

A gaming company wants to deploy its multiplayer game to players in North America, Europe, and Asia. The company needs to ensure that players in all three regions experience low latency when connecting to game servers, and the game servers must be located as close as possible to the players. The company chooses AWS to host the game servers. Which benefit of cloud computing does this scenario best illustrate?

A company runs a production workload on AWS and needs technical support that includes phone and email access with a response time of less than 1 hour for critical system failures. The company also wants architectural guidance for cost optimization and performance improvement. The company currently has an AWS account with the Basic Support plan. Which AWS Support plan should the company choose to meet these requirements at the most cost-effective price?

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that no Amazon S3 bucket in any account within the organization can be made publicly accessible. The team wants a centrally managed, preventive control that applies to all existing and future accounts and cannot be overridden by individual account administrators. Which AWS feature should the security team use to meet these requirements?

A company hosts a file-sharing platform on Amazon S3. The application bucket is in the us-west-2 (Oregon) Region. Users in Europe and Asia experience slow upload speeds when transferring large files. The company wants to improve upload performance by using AWS edge locations to accelerate data transfers to the bucket. The solution must work with standard S3 PUT operations and require minimal application changes. Which AWS feature should the company enable?

A company has a web application that processes user-uploaded images. When a user uploads an image, the application needs to resize the image into multiple formats (thumbnail, medium, large). The company wants to avoid managing servers and wants the image processing to execute only when a new image is uploaded. The solution must automatically scale to handle thousands of concurrent uploads. Which AWS service should the company use to perform the image processing?

A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The application must comply with a security standard that requires encryption in transit for all web traffic. The company needs a service to centrally manage SSL/TLS certificates, automatically renew them, and deploy them to the ALB without manual intervention. Which AWS service should the company use to meet these requirements?

Which AWS service provides a managed Apache Kafka streaming service without requiring customers to provision, configure, or manage Kafka clusters?

A company is evaluating the AWS Sustainability pillar in the Well-Architected Framework. Which action aligns with AWS cloud sustainability best practices?

Which AWS service enables automatic speech recognition (ASR) to convert audio from customer service calls into text for further analysis?

A retail company wants to provide personalized product recommendations on their homepage using machine learning. Which AWS service delivers this without requiring any ML expertise or model training?

A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?

A company uses multiple AWS accounts and wants to perform detailed custom cost analysis using a third-party business intelligence (BI) tool. The company needs the most granular cost and usage data available, including resource-level details such as instance type, region, and tags. The BI tool can read CSV files from an Amazon S3 bucket. The company wants a managed AWS service that automatically exports this detailed data to an S3 bucket on a daily basis with no additional coding. Which AWS service should the company use?

A company archives historical transaction records in Amazon S3. The records are accessed frequently for the first 30 days after creation. After 30 days, access drops sharply to only a few times per year, but the company must be able to retrieve any record within 5 minutes if needed. The company wants to minimize storage costs while meeting the retrieval time requirement. Which combination of S3 storage classes should the company use?

A company operates multiple AWS accounts for separate departments. The finance team wants to simplify monthly billing by receiving a single consolidated invoice that covers all accounts. Additionally, the company wants to aggregate usage across accounts to qualify for lower volume-based pricing tiers. Which AWS feature should the company enable to meet these requirements?

A company wants to ensure that their AWS account root user is protected with the highest level of security. Which two actions should they take? (Choose the answer that covers both.)

A company has been using AWS for several months. The finance team wants to view a graphical dashboard of their monthly spending trends for the past 6 months and also obtain a forecast of their expected costs for the next month. The team needs an AWS managed service that provides this visualization and forecasting without requiring any additional data export or third-party tools. Which AWS service should the team use?

Which AWS service provides a managed workflow for human review tasks, allowing machine learning models to request human oversight for low-confidence predictions?

Which AWS service enables sending promotional and transactional email at scale, such as marketing newsletters and order confirmations?

A company runs a nightly batch processing job on a single on-premises server. The job takes 4 hours to complete, and if the server fails during processing, the job must start over from the beginning. The company is migrating this workload to AWS. The solutions architect proposes running the job across multiple Amazon EC2 instances that process different chunks of data simultaneously. The architect also plans to configure the system so that if any single instance fails, its chunk is automatically reprocessed by another instance, ensuring the overall job still completes. Which benefit of cloud computing does this architecture primarily demonstrate?

A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?

A company runs its primary database on an Amazon RDS for MySQL DB instance in the us-east-1 Region. The company's disaster recovery policy requires that the database be recoverable in a different AWS Region within 1 hour of a region-wide failure, with a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour. Which AWS feature should the company use to meet these requirements?

A company wants to run a MySQL database in AWS without managing database software installation, applying patches, setting up backups, or configuring replication for high availability. Which AWS service meets these requirements?

A company needs to implement a disaster recovery strategy where data is continuously replicated to AWS but AWS compute resources are only started during a declared disaster. Which DR strategy does this describe?

A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?

A company's compliance team is preparing documentation for a third-party audit. The auditor requires a copy of the AWS SOC 3 report, which provides an overview of AWS's security controls and is intended for public distribution. The team needs to securely download the most recent version of this report directly from AWS. Which AWS service should the team use?

What does the principle of least privilege mean in the context of AWS IAM?

A company operates three separate AWS accounts: development, testing, and production. Each account independently incurs Amazon S3 data transfer charges. The company signs up for AWS Organizations and enables consolidated billing. How does consolidated billing affect the S3 data transfer pricing for the company?

A company runs a web application on multiple Amazon EC2 instances that are behind an Application Load Balancer. The operations team wants to ensure that if any EC2 instance fails, a new instance is automatically launched to replace it and maintain a minimum number of running instances. Which AWS service should the company use to meet this requirement?

A company runs a batch processing workload on Amazon EC2 instances. The finance team has set a monthly budget of $10,000 for this workload. They want to automatically stop the batch processing instances if the accumulated costs for the month exceed $8,000, to prevent overspending. The company needs a native AWS solution that can monitor the costs and take corrective action automatically. Which AWS feature should the company use to meet these requirements?

A company manages multiple AWS accounts under AWS Organizations. The finance team needs to set a monthly spending limit for each account, receive automatic email alerts when spending reaches 80% of that limit, and also view a graphical dashboard showing historical cost trends across all accounts. Which combination of AWS services should the company use to meet these requirements?

A company runs a batch processing application in Docker containers. The application runs for several hours at a time and requires significant CPU and memory resources. The company wants to run these containers on AWS without provisioning or managing any underlying EC2 instances or cluster capacity. They need a service that automatically scales based on demand and charges only for the resources consumed by the containers. Which AWS service should the company use?

A company develops a mobile application that allows employees to upload sales reports to an Amazon S3 bucket. The application must work reliably from any location, including from corporate offices, remote home offices, and international travel locations. The solution uses standard HTTPS requests over the internet. Which essential characteristic of cloud computing does this scenario best illustrate?

What is the primary purpose of an AWS Virtual Private Cloud (VPC)?

A company has unused Reserved Instances that don't match their current infrastructure. What option allows them to recoup some cost from unused RIs?

A finance team works with architects to eliminate unused EC2 instances, right-size over-provisioned resources, replace On-Demand instances with Reserved Instances for stable workloads, and adopt managed services to reduce operational overhead. Which AWS Well-Architected Framework pillar guides these activities?

A company hosts its corporate website entirely as static content (HTML, CSS, JavaScript, images) in an Amazon S3 bucket. The website currently has no authentication requirements and is accessible to the public. The company wants to serve this content to users around the world with low latency. Additionally, the company wants to enforce HTTPS for all traffic using a custom domain name (www.example.com). The company does not want to manage SSL/TLS certificates on any servers. Which AWS service should the company use to meet these requirements?

A company uses AWS Organizations with consolidated billing across multiple member accounts. The finance team requires that only the management account (payer account) can view and modify payment methods and receive invoices. Member accounts must be prevented from accessing billing and payment information in the AWS Billing and Cost Management console. Which AWS feature should be configured to enforce this restriction?

A company uses three separate AWS accounts for development, testing, and production workloads. The security team needs to enforce a policy that prevents users in any account from disabling AWS CloudTrail or deleting CloudTrail log files. The team also wants to consolidate billing and have a single payment method for all accounts. Which AWS service should the security team use to meet these requirements?

A company's application receives images from users and needs to detect and blur any credit card numbers visible in the images for compliance. Which AWS AI service provides document text extraction from images?

A company runs a multiplayer gaming application on AWS. The application uses UDP for real-time communication between players. Players in different geographic regions report high latency and connection instability. The company wants to improve performance by directing user traffic to the nearest healthy application endpoint and using a static IP address for the application. Which AWS service should the company use to meet these requirements?

A media company runs a video-on-demand platform on AWS. Video files (.mp4) and thumbnail images (.jpg) are stored in the same Amazon S3 bucket. The company uses Amazon CloudFront to deliver content to users globally. The video files are large and do not change frequently, so the company wants them to be cached at CloudFront edge locations for 30 days. Thumbnails change more often when new uploads are processed, so the company wants them to be cached for only 1 day. The company wants a single CloudFront distribution to serve both types of content from the same S3 bucket. Which configuration should the company use to meet these requirements with minimal operational overhead?

Which AWS service provides managed, automated workflows for coordinating migration tasks such as tracking migration status, grouping servers into migration waves, and coordinating cutover?

A company is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances and use an Amazon RDS for MySQL database. The security team needs to understand which security controls remain the company's responsibility after the migration. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

Drag and drop the steps to configure an Application Load Balancer (ALB) in the correct order.

A company runs a mix of production and non-production Amazon EC2 instances. The finance team uses AWS Budgets to monitor monthly spending. For the development accounts, the team wants to automatically stop all running EC2 instances when the account's monthly spending reaches 90% of the budgeted amount. The team wants a solution that does not require custom scripting or additional infrastructure. Which AWS Budgets feature should the team configure to meet this requirement?

Which statement correctly describes the difference between horizontal scaling and vertical scaling in cloud computing?

A company runs a multi-tier web application on Amazon EC2 instances. The security team wants to continuously monitor the configuration of the EC2 security groups to ensure that no security group allows inbound SSH (port 22) access from the entire internet (0.0.0.0/0). If a security group is modified to allow such access, the company must be automatically notified and provided with a detailed record of the change, including the user who made the change. Which combination of AWS services should the company use to meet these requirements?

Which AWS service provides a landing zone and automated multi-account setup with pre-configured security baselines and guardrails for AWS Organizations?

A company stores sensitive customer data in Amazon S3. The security policy requires that all objects be encrypted at rest using an encryption key that is automatically rotated every 12 months. The company must retain full control over the key, including the ability to immediately revoke access to the key if a security incident occurs. The security team also needs to audit every use of the key through AWS CloudTrail. Which key management solution should the company choose to meet these requirements?

A company hosts a critical e-commerce web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team is concerned about Layer 7 attacks, such as SQL injection and cross-site scripting (XSS). They also want to automatically block traffic from known malicious IP addresses. The company needs a managed web application firewall that integrates directly with the ALB. Which AWS service should the company use?

A company is planning to migrate its on-premises infrastructure to AWS. The operations team wants to compare the total cost of ownership (TCO) between running workloads on-premises and running them on AWS. They need a tool that can accept details about their current on-premises servers (number of servers, CPU, memory, storage) and produce a detailed report comparing costs over a specified period, including savings from avoided hardware purchases, IT labor, and data center costs. Which AWS tool should the operations team use?

A company has migrated all of its workloads to AWS and has decommissioned all of its on-premises data centres. All compute, storage, databases, and networking are now managed in AWS. Which cloud deployment model describes this architecture?

Which AWS service provides a fully managed content delivery network (CDN) that caches content at global edge locations to reduce latency for end users?

A company runs a data analytics workload on a cluster of Amazon EC2 instances. The application requires a shared file system that can be mounted by multiple EC2 instances simultaneously. The workload is bursty: during data processing jobs, the instances write and read large datasets, but between jobs the file system is mostly idle. The company wants a fully managed, highly available, and durable file storage solution that automatically scales capacity up and down and charges only for the storage used. The solution must be accessible from EC2 instances across multiple Availability Zones in the same AWS Region. Which AWS service should the company use?

A financial services company uses AWS CloudTrail to log all API calls in its AWS account. The company must demonstrate to auditors that the CloudTrail log files have not been tampered with after they were delivered to the Amazon S3 bucket. The company wants to use a feature that automatically creates digest files containing a hash of each log file, allowing the auditor to mathematically verify the integrity of the logs. Which AWS feature should the company enable to meet this requirement?

A company deploys their web application across two Availability Zones using an Application Load Balancer. If one AZ experiences an outage, traffic is automatically routed to the other AZ and the application continues to function. Which cloud benefit does this demonstrate?

A company runs a production web application on a fleet of Amazon EC2 instances. The operations team has observed that most instances have an average CPU utilization below 10% over the past month. They want to receive automated, ML-based recommendations for downsizing these instances to smaller instance types to reduce costs without compromising performance. The team also wants to see the estimated monthly savings for each recommendation. Which AWS service should the operations team use?

A company based in Germany needs to store and process customer data that, by law, must remain within the European Union (EU). The company plans to use AWS services. Which AWS Global Infrastructure element is the MOST important for the company to evaluate when choosing where to deploy its resources?

A company used to spend $2 million upfront purchasing servers and building a data centre before launching a new product. With AWS, they provision resources as needed and pay monthly based on actual usage. Which cloud benefit does this represent?

A startup is building a photo-sharing application on AWS. The startup expects to store billions of photos over time. The CEO is surprised that the per-GB price for Amazon S3 storage is the same for the startup as it is for a multinational corporation with petabytes of data. Which characteristic of cloud computing does this pricing model best demonstrate?

A development team builds Docker container images as part of their CI/CD pipeline and needs a managed, private registry to store and version these images, integrated with Amazon ECS and EKS for deployment. Which AWS service provides this container image registry?

A company wants to identify all resources in their AWS account that are accessible from outside the account — such as S3 buckets with public access or IAM roles with external trust. Which AWS service provides this analysis?

Which Amazon S3 feature allows you to automatically delete objects after a specified number of days to reduce storage costs?

A healthcare company is subject to HIPAA regulations and must record all AWS API calls made in its account for auditing. The logs must be retained for 7 years and must be protected from any modification or deletion, including by the account root user. Which combination of AWS services should the company use to meet these requirements?

A developer wants to build a serverless application that responds to HTTP requests. Which combination of AWS services would be most appropriate?

What is the purpose of an AWS Region when designing a global cloud architecture?

A company wants to define their entire AWS infrastructure — VPCs, EC2 instances, RDS databases, and load balancers — as code in a text template so they can version-control the infrastructure, deploy it consistently across multiple environments, and recreate it reliably after deletion. Which AWS service enables this?

A company hosts a website in the US East (N. Virginia) AWS region. Users in Europe and Asia Pacific report slow page load times because content must travel long distances from the origin server. Which AWS service should the company deploy to reduce latency for global users?

A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?

A company runs a production web application on Amazon EC2 and Amazon RDS. The internal IT team needs a support plan that provides a guaranteed response time of less than one hour for a production system outage. Additionally, the company wants access to AWS Infrastructure Event Management, which includes guidance from AWS experts during planned events such as product launches or migrations. The company does not require a dedicated Technical Account Manager (TAM). Which AWS Support plan should the company choose?

A company uses a continuous integration and continuous deployment (CI/CD) pipeline to deploy applications on AWS. The development teams frequently create feature branches in the code repository. The company wants to automatically provision a complete, isolated environment (including compute, storage, and networking) for each new feature branch, with no manual intervention. The environment must be ready within minutes of the branch creation. Which characteristic of cloud computing does this requirement primarily demonstrate?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences unpredictable traffic patterns, with sudden spikes during promotional events and low traffic at other times. The company configures an Auto Scaling group to automatically add EC2 instances when CPU utilization exceeds 70% and remove instances when utilization drops below 30%. The system handles the spike without any manual intervention and reduces capacity when demand decreases. Which fundamental characteristic of cloud computing does this scenario best illustrate?

A company wants to set up a cloud-based customer service contact centre with an interactive voice response (IVR) system, agent call routing, and the ability to scale to thousands of agents without purchasing phone hardware or PBX equipment. Which AWS service provides this?

A development team needs to create a temporary Amazon RDS database for testing a new feature. The team uses the AWS Management Console to launch a db.t3.micro MySQL instance, configures the security group, and connects the application within minutes. When the testing is complete, they terminate the instance without any interaction with AWS support or IT administrators. This ability to provision and manage resources entirely through self-service interfaces best describes which essential characteristic of cloud computing?

A company wants to proactively monitor its AWS spending and receive email notifications when actual or forecasted costs exceed a defined threshold. The company has a monthly budget of $10,000 and wants to be alerted when costs reach 80% of the budget. Which AWS service should the company use to meet these requirements?

A company wants to centralise backup management for all their AWS resources — EC2, EBS, RDS, DynamoDB, and EFS — under a single policy, automate backup schedules, and ensure cross-region backup copies for disaster recovery. Which AWS service provides this?

Match each AWS compute service to its typical use case.

Which AWS offering provides free, self-paced online training courses, videos, and labs to help customers learn AWS services and pass certification exams?

A company runs non-critical batch analytics jobs that can be paused and restarted if interrupted. The jobs are flexible regarding when they run. Which EC2 purchasing option offers the lowest possible cost for this workload?

A financial services company has a core banking application that runs on-premises and stores sensitive customer data. Due to strict regulatory requirements, this application cannot be migrated to the cloud. However, the company wants to use AWS for its development and test environments to benefit from rapid provisioning and pay-per-use pricing. The company also wants to establish a dedicated private network connection between its on-premises data center and AWS to securely transfer data between the environments. Which cloud deployment model does this scenario describe?

A company is building a global e-commerce application that requires a database with single-digit millisecond latency, seamless scaling to handle millions of requests per second, and the ability to replicate data across multiple AWS Regions for disaster recovery and low-latency reads. The database must be fully managed with automatic backup and restores. Which AWS service should the company choose?

A company's architecture team is evaluating their multi-tier application against the AWS Well-Architected Framework. They discover that their database has no backup and recovery procedure. Which pillar does this finding fall under?

Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?

A company runs a batch processing job on a single Amazon EC2 instance. The job takes 10 hours to complete. The company needs to reduce the processing time to under 1 hour to meet a new business requirement. The data can be split into independent chunks that can be processed in parallel. Which cloud computing concept would most directly enable the company to achieve this goal?

Amazon CloudFront serves cached content to users from the closest possible network point, with over 400 such points globally. What are these network points called?

A marketing company is launching a new campaign that will require a temporary increase in web server capacity. The operations team provisions an additional 10 Amazon EC2 instances through the AWS Management Console within five minutes, without needing to submit a purchase order or wait for hardware delivery. Which advantage of cloud computing does this scenario best demonstrate?

A company runs multiple workloads on AWS, each in separate AWS accounts managed through AWS Organizations. The finance team wants to set a monthly cost threshold of $5,000 for the 'development' account. If the actual or forecasted costs exceed 80% of this threshold, the team wants to receive an email alert so they can review usage and take corrective action if needed. They also want to track costs against this threshold over time using a dashboard. Which AWS service should the finance team use to set up this threshold and receive the alerts?

A gaming company needs ultra-low latency access to AWS compute for their mobile game players at 5G network edges. Which AWS infrastructure extension enables this?

A fast-growing mobile game company uses a NoSQL database to store player profiles, leaderboards, and game state. The database must deliver consistent single-digit millisecond response times regardless of the number of concurrent players. The company wants a fully managed service that automatically scales throughput capacity up and down based on traffic and replicates data across multiple Availability Zones for high availability. Which AWS service should the company use?

A company runs a production application on a mix of Amazon EC2 instance families (e.g., M5, C5, R5) across two AWS Regions. The application runs 24/7 and is expected to continue for the next three years. The company wants to minimize compute costs while retaining the flexibility to change instance families, sizes, or Regions if needed. The company also prefers to avoid any upfront payment to preserve cash flow. Which AWS pricing option should the company choose?

A company received an unexpected AWS bill that was much higher than expected. Which AWS service would help them understand which resource or service caused the cost spike?

A company wants to ensure they never spend more than $500 per month on AWS services. Which AWS feature can automatically stop or terminate resources when cost projections reach a threshold?

A company uses Amazon CloudFront to serve their website globally. They want to ensure that users in China can also access the website with low latency. What infrastructure consideration is required?

A company has deployed multiple EC2 instances with different security groups. The compliance team wants to ensure that no security group allows unrestricted SSH access (0.0.0.0/0) and receive alerts if any such rule is created. Which AWS service can they use to continuously monitor and evaluate the security group configurations against this policy?

A company runs a critical e-commerce application that uses an Amazon RDS for MySQL database deployed in a single Availability Zone. The company needs to ensure that the database remains available if the underlying hardware or the entire Availability Zone fails. The solution must provide automatic failover with minimal downtime and must not require any changes to the application's database connection string. Which Amazon RDS feature should the company use to meet these requirements?

A company is designing a microservices architecture on AWS. According to the AWS Well-Architected Framework's Operational Excellence pillar, which practice best supports the ability to safely make frequent, small changes to production?

Which AWS service provides a fully managed environment for creating, maintaining, and documenting APIs using REST, HTTP, and WebSocket protocols?

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?

A company is expanding its AWS environment from a single account to multiple accounts using AWS Organizations. The security team wants to enforce a baseline set of permissions across all accounts, ensuring that users in any account cannot disable AWS CloudTrail or modify Amazon S3 bucket policies that prevent public access. Which feature of AWS Organizations should the security team use to achieve this control?

A company runs a multiplayer gaming application on Amazon EC2 instances in the us-east-1 Region. The application uses the UDP protocol for real-time communication between players and game servers. Players in Asia and Europe report high latency and packet loss. The company wants to improve performance by directing player traffic from the nearest edge location to the application over the AWS global network, without modifying the application code. Which AWS service should the company use?

An e-commerce company runs its website on Amazon EC2. During normal operation, 10 instances are sufficient. During a major sale event, traffic increases 20x and the Auto Scaling group automatically adds 190 additional instances within minutes. After the sale, the instances are terminated. Which cloud computing characteristic does this behaviour demonstrate?

A company's marketing team needs a temporary compute environment to run a one-week data analysis for a campaign. The developer uses the AWS CLI to automatically provision an Amazon EC2 instance and an Amazon RDS database without any manual approval or interaction from the AWS support team. This ability to provision resources automatically without requiring human interaction from the cloud provider best demonstrates which essential characteristic of cloud computing?

A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?

A company runs a customer-facing web application with an Amazon RDS database. Initially, the database is deployed as a single instance in one Availability Zone (AZ). A power outage occurs in that AZ, causing the database to become unavailable for several hours. After the incident, the company modifies the database to use a Multi-AZ configuration. Shortly after the change, another power outage affects the same primary AZ. This time, the database automatically fails over to the standby instance in the other AZ without any manual intervention, and the application remains available. Which cloud computing concept does this scenario best demonstrate?

A company runs a web application across multiple Amazon EC2 instances that are distributed across several Availability Zones. The application needs to share a common set of configuration files and static assets that must be accessible concurrently and consistently from all instances. The company wants a fully managed, scalable file storage solution that does not require provisioning or managing underlying storage hardware. Which AWS service should the company use?

A company is deploying a web application on AWS. The application will run on multiple Amazon EC2 instances distributed across two Availability Zones. An Application Load Balancer will distribute incoming traffic across the instances. The company's primary goal is to ensure the application remains available to users even if one Availability Zone experiences a service disruption. Which cloud computing concept does this architecture primarily demonstrate?

A company wants to protect their web application from common Layer 7 attacks and also implement rate limiting to prevent API abuse. Which AWS service provides both capabilities?

A company has 10 EC2 On-Demand instances running. They purchase a 1-year Compute Savings Plan for a commitment equivalent to 6 instances. What happens to the remaining 4 instances' cost?

A company runs a critical web application on a single Amazon EC2 instance in a single Availability Zone. The company wants to design the architecture so that the application continues to operate even if the physical server hosting the instance fails. Which AWS Cloud concept does this design objective primarily address?

A company needs to monitor their application's performance and identify bottlenecks by tracing requests as they travel through multiple AWS services and microservices. Which AWS service provides distributed tracing?

A company has been running multiple workloads on AWS for the past six months. The finance team needs to analyze historical spending to identify month-over-month trends by AWS service and by individual linked accounts. The team requires a graphical, interactive tool that allows them to apply custom date ranges and filters, and view the results as customizable charts and graphs. Which AWS service should the finance team use to meet this requirement?

Which Amazon S3 feature protects against accidental deletion by maintaining multiple versions of every object in a bucket?

According to the AWS Well-Architected Framework, which pillar focuses on the ability to run workloads effectively, gain insight into operations, and continuously improve processes?

A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?

A consulting firm has a global team of consultants who frequently travel to client sites. The firm hosts its critical business applications on AWS. The consultants need to access these applications from various locations (hotels, airports, client offices) using a variety of devices, including company laptops, personal smartphones, and tablets. They connect using standard web browsers and internet connections. This ability to access the same cloud resources from anywhere using different devices is an example of which essential characteristic of cloud computing?

Which AWS storage service is designed for shared file storage accessible simultaneously by multiple EC2 instances using the NFS protocol?

A company runs containerised microservices using Amazon ECS. The operations team wants to stop managing EC2 instances, including patching and capacity planning for the container hosts. Which option allows them to run containers on ECS without managing servers?

A company currently pays $50,000/month for on-premises infrastructure. They project that running the equivalent workload on AWS will cost $35,000/month including all data transfer. What is the annual AWS cost savings?

Which AWS service makes it easy for developers to create, publish, and manage APIs that act as the front door for applications to access backend services?

A media company hosts its website on Amazon EC2 instances in the us-east-1 Region. Static assets such as images, CSS, and JavaScript files are stored in an Amazon S3 bucket. Users across the globe report slow page load times due to high latency when fetching these assets. The company wants to deliver the static content with low latency and high transfer speeds to users worldwide, reduce the load on the EC2 instances, and add protection against common DDoS attacks. Which AWS service should the company use?

A company uses AWS Organizations. The management account receives the consolidated bill. Which statement about Reserved Instance discount sharing in AWS Organizations is correct?

A startup is planning a new web application on AWS. The architecture will use Amazon EC2 for compute, Amazon RDS for the database, and Amazon S3 for static assets. The team needs to estimate the monthly cost of running this application before building it. They want to compare costs across different instance types, regions, and pricing models (On-Demand vs. Reserved Instances), and they also need to account for data transfer costs. Which AWS tool should the team use to create this estimate?

A company needs to ensure that all data transmitted between their on-premises servers and AWS is encrypted during transfer. Which AWS services provide encryption in transit? (Choose the most complete answer.)

Drag and drop the steps to set up a VPC with a public subnet and an internet gateway in the correct order.

A company operates a critical e-commerce platform on AWS that generates significant revenue. The management team requires a dedicated Technical Account Manager (TAM) to provide proactive guidance and operational best practices. Additionally, they need the fastest possible response time for critical system failures, targeting a response within 15 minutes. Which AWS Support plan should the company choose?

Which AWS Well-Architected Framework pillar includes recommendations for using a mix of purchase options and rightsizing instances to optimize costs?

A company migrates its workloads to AWS. After the migration, the company receives a monthly invoice that shows precise charges for each service used, such as the exact number of Amazon EC2 instance hours consumed and the amount of data stored in Amazon S3. The company uses this detailed usage data to allocate costs to different departments. Which essential characteristic of cloud computing does this scenario best demonstrate?

A manufacturing company collects sensor data from thousands of IoT devices every second. The data includes temperature, pressure, and vibration readings. The company needs to store this time-series data and perform real-time queries to detect anomalies, as well as run historical analysis. The data volume is extremely high and will grow continuously. The company wants a fully managed, serverless solution that can automatically scale to handle the data volume and provide built-in analytics functions for time-series. Which AWS service should the company use?

A company stores sensitive audit reports in an Amazon S3 bucket. An external auditor needs to download a specific report for a compliance review. The auditor does not have an AWS account and will only need access for 48 hours. The company wants to provide a secure, time-limited link that allows the auditor to download the file directly from S3 without making the bucket public or requiring the auditor to authenticate with AWS. Which AWS feature should the company use to meet these requirements?

A retail company runs a web application on Amazon EC2 instances behind an Application Load Balancer. During a promotional event, traffic spikes to 10 times the normal level. The company configured an Amazon EC2 Auto Scaling group with a scaling policy that adds instances when CPU utilization exceeds 70% and removes instances when it drops below 30%. The application handles the spike without any manual intervention, and after the event ends, the number of instances automatically decreases to the original count, saving costs. This scenario best demonstrates which cloud computing concept?

A company stores genomics data (several petabytes) on Amazon S3. They need to run complex analytics on this data using standard bioinformatics tools that require a POSIX file system interface. Which AWS solution provides this?

A company uses multiple AWS accounts and needs to perform granular cost and usage analysis using standard SQL queries. The cloud operations team requires the most detailed data possible, including resource-level attributes such as instance type, usage quantity, and cost allocation tags. This data must be automatically delivered to an Amazon S3 bucket on a daily basis for long-term retention and querying. Which AWS service should the company use to generate this dataset?

A startup company is developing a new mobile application. The development team needs to quickly provision and tear down test environments to experiment with different backend configurations. They want to try new features, run performance tests for a few hours, and then delete all resources without any upfront commitment. They only pay for the compute and storage resources consumed during each test. Which benefit of cloud computing does this scenario BEST represent?

A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?

A company is migrating its customer-facing web application to AWS. The Chief Information Security Officer (CISO) is reviewing the division of security responsibilities. The CISO understands that AWS is responsible for the security of the physical data centers, hardware, and network infrastructure. The company, as the customer, is responsible for securing the application code, customer data, and operating system patches on Amazon EC2 instances. This division of security responsibilities is an example of which fundamental cloud computing concept?

A company uses AWS Organizations to manage multiple accounts. The security team wants a preventive control to ensure that nobody in any account, including account root users, can disable AWS CloudTrail or delete Amazon S3 bucket policies. Which AWS feature should the security team use?

A company operates a global e-commerce website with static assets (product images, CSS, JavaScript) stored in an Amazon S3 bucket. Users in different geographic regions report slow page load times. The company wants to reduce latency without rearchitecting the application or moving the S3 bucket. Which AWS service should the company use to distribute the static assets closer to users?

A global gaming company needs to deploy its application in multiple geographic locations to reduce latency for players worldwide. The application must also remain available even if an entire data center fails. The company plans to run the application on Amazon EC2 instances behind an Application Load Balancer. Which combination of AWS global infrastructure components should the company use to meet these requirements?

A company has a strict data residency policy that requires all customer data to remain stored on-premises at all times. However, the company experiences unpredictable spikes in compute demand and wants to use an AWS cloud environment to handle this additional workload during peak periods. The company needs a solution that allows them to seamlessly run applications across their on-premises infrastructure and AWS, using consistent management tools and APIs. The company also needs a dedicated, private network connection between the two environments for low latency and security. Which cloud deployment model best describes this architecture?

A company has a web application that processes customer orders. The frontend web servers run on Amazon EC2 instances and receive order requests from users. The backend order processing system runs on a separate fleet of EC2 instances. The company wants to decouple these two tiers so that order requests are stored reliably until the backend is ready to process them. The solution must handle occasional traffic spikes without losing any messages and must allow the backend to scale independently. Which AWS service should the company use to meet these requirements?

Which AWS service provides automated security assessments of EC2 instances against a library of security best practices and common vulnerabilities?

A company's IT director wants to present a business case for migrating from on-premises infrastructure to AWS. They need to compare the full cost of running on-premises (hardware, facilities, power, labour) against the cost of running equivalent workloads on AWS. Which AWS tool helps create this comparison?

A gaming company operates a mobile game with millions of active users. The game stores player profiles and session state in a key-value database. The database must provide single-digit millisecond latency for read and write operations at any scale. The company expects traffic to grow unpredictably, and the database must scale horizontally without downtime. The company wants a fully managed, highly available solution with built-in replication across multiple Availability Zones. Which AWS service should the company use?

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce a policy that prevents any user, including the root user, in any member account from disabling the 'Block Public Access' setting on Amazon S3 buckets. The policy must be centrally managed and automatically applied to all existing and future member accounts. Which AWS feature should the security team use?

A company is planning to deploy a multi-tier web application on AWS. The architecture includes Amazon EC2 instances, an Application Load Balancer, an Amazon RDS database, and security groups. The company wants to define and provision these resources as reusable, version-controlled infrastructure so they can consistently deploy the same environment to development, testing, and production accounts. The solution should allow the team to use JSON or YAML templates to describe the resources and their dependencies. Which AWS service should the company use?

A company is evaluating a migration of its on-premises virtualized workloads to AWS. The CFO wants to understand the potential cost savings over a three-year period by shifting from capital expenditure (hardware purchases) to operational expenditure (pay-as-you-go). The team needs a tool that can provide a detailed comparison of the total cost of ownership (TCO) for the current on-premises environment versus running the same workloads on AWS, including hardware, software, labor, and facilities costs. Which AWS tool should the team use?

A social media company hosts a web application on AWS that serves millions of users worldwide. The application delivers static content such as images, videos, and CSS files. To improve load times for users in different geographic regions, the company wants to cache this content at AWS locations that are as close to end users as possible. Which component of the AWS global infrastructure should the company use?

A company uses AWS Organizations with multiple accounts. The finance team needs to generate custom cost and usage reports that include every line item, all user-defined cost allocation tags, and resource-level details. The team also needs the ability to query the data using standard SQL tools for in-depth analysis. Which AWS feature should the team use to meet these requirements?

A company wants to minimise the environmental impact of their AWS workloads by choosing the right instance sizes, maximising utilisation, using graviton processors for better performance per watt, and designing architectures that reduce total compute needed. Which AWS Well-Architected Framework pillar guides these decisions?

Which AWS service provides an immutable, cryptographically verifiable transaction log for tracking the complete history of changes to application data?

A company is running their application on EC2 instances behind an Application Load Balancer. They want to ensure the application remains available during an AZ outage. What is the minimum architecture configuration required?

A company is developing a REST API that processes customer orders. The API receives JSON payloads via HTTPS and performs short-lived operations, such as data validation, transformation, and writing to a database. The workload is very unpredictable: sometimes there are long periods of inactivity, but during flash sales the API may receive thousands of requests per second for a few minutes. The company wants a fully managed compute service that automatically scales to handle any request volume, charges only for the compute time used during execution, and requires no server provisioning or ongoing infrastructure management. Which AWS service should the company use?

According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?

A company stores sensitive documents in Amazon S3. The security team wants a preventive control that ensures no S3 bucket in the AWS account can ever be configured with a bucket policy that grants public read or write access. This control must apply automatically to all newly created buckets and to existing buckets, without requiring changes to individual bucket policies. Which AWS feature should the security team use?

A company is building a real-time chat application that relies on long-lived WebSocket connections between clients and backend servers. The application runs on Amazon EC2 instances across multiple Availability Zones. The company needs a load balancer that can distribute incoming WebSocket traffic while preserving the connection and supporting sticky sessions. Which AWS load balancing solution should the company use?

Which AWS service enables you to create a private, isolated network within the AWS Cloud where you can define your own IP address range, subnets, and routing?

Which AWS Cost Management tool provides daily forecasts and allows customers to track Reserved Instance and Savings Plans utilization and coverage?

A company needs to provide business users with self-service business intelligence dashboards and visualizations of data from multiple AWS data sources. Which AWS service enables this?

An enterprise is planning their cloud adoption strategy. They want to understand how cloud adoption typically progresses. Which framework provides a structured approach to cloud adoption organized around business, people, governance, platform, security, and operations perspectives?

A healthcare company stores patient records in Amazon S3 buckets across multiple accounts and needs to automatically discover and classify any objects containing personally identifiable information (PII) or protected health information (PHI). Which AWS service provides this capability?

A financial institution has regulatory requirements to store sensitive customer data on-premises in its own data center. However, it wants to use AWS for compute-intensive analytics that need to access this data. The company plans to establish a dedicated, encrypted network connection between its data center and AWS. Which cloud deployment model does this scenario describe?

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

A company's security policy requires that all IAM user access keys be rotated every 90 days. The security team wants to automatically identify any IAM user in the company's AWS account whose access keys are older than 90 days and trigger a notification to the security team. They need a managed AWS service that continuously evaluates the access key age against this requirement and generates findings. Which AWS service should the security team use?

A company wants an automated tool that analyses their AWS account and provides recommendations across five categories: cost optimisation, performance, security, fault tolerance, and service limits. Which AWS service provides this analysis?

Which AWS service enables you to run containerized applications without managing the underlying servers?

A startup is planning to build and launch a new mobile application on AWS. The team expects very low initial traffic but hopes to scale rapidly. They have a limited budget and want to avoid any upfront costs. They are unsure which AWS services they will need and want to estimate their monthly AWS charges before committing to an architecture. Additionally, they need access to technical support to help troubleshoot issues that arise during development and production, with a guaranteed response time of less than 12 hours for production-impacting issues. Which combination of AWS tool and support plan should the startup choose to meet these requirements?

A company runs a production e-commerce application on AWS. The CIO requires that the company have access to AWS technical support with a response time of under 1 hour for critical production system failures. Additionally, the operations team wants to use AWS Trusted Advisor to get recommendations on cost optimization, performance, and security for all AWS resources. The company already pays for AWS Business Support for its development account but wants the minimum-cost support plan that meets these requirements for its production account. Which AWS Support plan should the company choose for the production account?

Match each AWS pricing concept to its definition.

A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?

A company manages 20 AWS accounts under AWS Organizations. The security team wants to ensure that no security group in any account allows unrestricted inbound RDP access (0.0.0.0/0). They need to automatically detect any security group that violates this rule and receive a notification. They also want to track the configuration history of security group changes for forensic analysis. Which AWS service should they use to achieve these requirements?

A company currently uses the AWS Basic Support plan. The CTO wants to access the complete set of AWS Trusted Advisor checks, including those related to cost optimization and performance. Additionally, the CTO requires a guaranteed response time of less than 15 minutes for critical business-impairing issues. Which AWS Support plan should the company choose to meet all of these requirements?

Which AWS service provides a central place to manage security alerts and automate compliance checks across an AWS Organization?

A development team wants to deploy a containerized microservices application on AWS. The team wants to minimize operational overhead by not managing any servers or container orchestration control plane. They also want to pay only for the compute and memory resources their containers consume, without needing to provision or scale underlying infrastructure. Which AWS compute service should the team use?

A development team is migrating a monolithic application to a microservices architecture. Each microservice will run in a separate container. The team wants to deploy and scale these containers without managing any underlying servers or clusters. The team also wants to pay only for the vCPU and memory resources consumed by each container, not for any idle capacity. Which AWS compute service should the team use?

A company runs a MySQL database and wants to migrate to a cloud-native relational database that is fully managed, provides up to 5x the performance of standard MySQL, offers automated backups with point-in-time recovery, and is compatible with MySQL drivers and tools without application changes. Which AWS service meets these requirements?

A company has an AWS Basic Support plan. The operations team wants to use AWS Trusted Advisor to receive recommendations for cost optimization, such as identifying idle load balancers and underutilized Amazon EC2 instances. They log into the AWS Management Console and navigate to Trusted Advisor, but they only see a limited set of checks, such as S3 bucket permissions and service limits. Which action should the team take to access the complete library of Trusted Advisor checks, including the cost optimization recommendations?

A company's security policy prohibits opening SSH (port 22) or RDP (port 3389) to the internet for any Amazon EC2 instance. The operations team needs a way to establish secure shell sessions to manage instances directly from the AWS Management Console without managing bastion hosts or SSH keys. Which AWS service provides this capability?

A company runs a customer relationship management (CRM) application on a single Amazon RDS for PostgreSQL instance. The application experiences heavy read traffic during business hours, often causing the primary database to become overloaded with SELECT queries. The company needs a solution that offloads read queries to a separate database endpoint and provides automatic failover to a standby database in a different Availability Zone if the primary fails. Which combination of Amazon RDS features should the company use to meet these requirements?

A company has committed to a 1-year Compute Savings Plan at $100/hour. During a given hour, their actual compute usage is only worth $80 at On-Demand rates. How does the Savings Plan apply?

A startup is planning to migrate its web application to AWS. The CTO wants to estimate the monthly cost of running the application on Amazon EC2 and Amazon RDS, including data transfer costs. The team has not yet created any AWS accounts or resources. They need a tool that allows them to input assumptions about instance types, storage, and data transfer to generate a detailed cost estimate. Which AWS tool should they use?

A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?

A media company streams live video to a global audience. The application runs on Application Load Balancers in two AWS Regions (us-east-1 and eu-west-1). The company's clients require the use of a fixed set of static IP addresses for firewall allowlisting. The company needs to route user traffic to the nearest healthy endpoint to minimize latency. Which AWS service should the company use?

A company needs 24/7 phone and chat access to AWS support engineers, full access to all AWS Trusted Advisor checks, and a response time of less than 1 hour for production system outages. Which is the minimum AWS Support plan that meets all these requirements?

A company uses AWS for its development environment. The finance team wants to set a monthly budget of $10,000. They want to receive an email notification when the actual costs reach 80% of the budget ($8,000) and again when costs exceed the budget. The team needs a managed AWS service that can automatically send these alerts without requiring custom code or third-party tools. Which AWS service should the team use?

A company runs a payment processing application on AWS that must comply with the Payment Card Industry Data Security Standard (PCI DSS). An external auditor requests a copy of the AWS SOC 2 report and the PCI DSS Attestation of Compliance (AOC) to verify the security controls of the underlying AWS infrastructure. The company needs to obtain these documents directly from AWS. Which AWS service should the company use?

A retail company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to obtain an official document from AWS that details the security controls AWS has implemented to support PCI DSS compliance for services such as Amazon RDS and Amazon EC2. The document must be downloadable as a PDF for review and audit purposes. Which AWS service should the compliance officer use to retrieve this document?

A financial institution runs its core banking application on-premises due to regulatory requirements. It has connected its data centre to AWS using AWS Direct Connect and runs analytics workloads on AWS that access data from the on-premises systems. Which cloud deployment model does this describe?

A company's security team wants to automatically remediate non-compliant AWS Config rules, such as automatically enabling S3 server-side encryption on any bucket found without it. Which AWS Config feature enables this?

A company runs a containerized application on Amazon ECS using a mix of Amazon EC2 On-Demand instances from different instance families (e.g., M5, C5, R5). The workload is consistent, and the company is willing to commit to a 1-year term to reduce costs. However, the team expects to change instance families within the next 12 months due to new hardware requirements and wants the flexibility to switch instance families without incurring a financial penalty. Which pricing option best meets these requirements?

A company is developing a web application that uses Node.js, Express, and a MySQL database. The development team wants to deploy the application to AWS without manually configuring Amazon EC2 instances, load balancers, or Auto Scaling groups. They want AWS to automatically manage the underlying infrastructure, monitor application health, and allow them to deploy new versions by simply uploading a zip file. Which AWS service should the team use to meet these requirements?

A company wants to review its AWS spending for the past six months to identify which services and business units are driving costs. The finance team needs to interactively examine cost trends, filter by service and account, and visualize the data without setting up complex reports. Which AWS service or tool should the company use to meet these requirements?

A startup is deploying a web application on Amazon EC2 instances across multiple Availability Zones (AZs). The architecture must ensure that the application remains fully operational and available to users even if one entire AZ fails. Which cloud computing concept does this requirement MOST directly represent?

According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?

A company wants to allow its developers to provision virtual servers in AWS without needing to submit a ticket to an IT administrator or wait for manual approval. The developers need to be able to spin up instances directly from the AWS Management Console, CLI, or SDKs, and the resources should be available immediately after the request is submitted. Which essential characteristic of cloud computing does this scenario best describe?

A development team is building a web application and wants to minimize operational overhead. The team wants to focus solely on writing and deploying code without managing the underlying operating system, runtime, or middleware. The team needs the ability to simply upload their application code and have it run, with the cloud provider automatically handling capacity provisioning, load balancing, and patching of the platform. Which cloud computing service model best describes this approach?

A company manages multiple AWS accounts using AWS Organizations. The company wants employees to sign in using their existing corporate credentials from an on-premises Microsoft Active Directory. The company also needs a single sign-on (SSO) experience so that each employee can access the AWS Management Console for any authorized account without needing separate passwords. Additionally, the company wants to centrally manage permissions across all accounts. Which AWS service should the company use to meet these requirements?

A company is deploying a mission-critical application on AWS. The application requires the highest level of support available, including a designated Technical Account Manager (TAM) and a response time of 15 minutes or less for production system down cases. Which AWS Support plan should the company choose?

A company uses AWS Organizations to manage multiple AWS accounts. The security team must ensure that all API activity across all accounts, including any new accounts added in the future, is recorded and delivered to a centralized S3 bucket for auditing. The solution should require minimal ongoing manual effort. Which AWS feature should the security team use?

A company wants all IAM users to verify their identity with both a password and a one-time code from an authenticator app before accessing the AWS Management Console. Which security control should the company enable?

Which AWS service provides a Web Application Firewall that protects web applications from common exploits like SQL injection and cross-site scripting?

A company's security team needs to receive near-real-time notifications whenever an IAM user in their AWS account performs an action that violates a defined baseline of expected behavior. Examples include launching an Amazon EC2 instance in an unauthorized AWS Region or modifying a security group to allow public SSH access from the internet. The solution must analyze continuous streams of AWS API activity to identify suspicious patterns and known malicious IP addresses. Which AWS service should the security team use?

A startup can now test a new application idea by provisioning cloud resources in minutes, run the experiment for a week, and tear down the resources if the idea fails — spending only a few dollars. Previously, the same experiment would have required months of procurement and significant capital expenditure. Which cloud benefit does this illustrate?

A company operates a social media analytics platform that runs on AWS. The platform experiences unpredictable traffic spikes during major events. The company wants to ensure that compute capacity automatically increases during these spikes without any manual intervention, and decreases when traffic subsides to avoid paying for idle resources. Which characteristic of cloud computing does this business requirement directly rely on?

A finance team wants to view and analyse their AWS spending patterns over the past 12 months, filter costs by service and linked account, and identify which teams are spending the most. Which AWS tool provides this historical cost analysis?

A company running large-scale scientific simulations needs EC2 instances with exclusive access to a physical host for software licensing reasons (per-socket licensing). Which EC2 option provides this?

A developer wants to run code in response to an S3 object upload without managing any servers. The code runs for less than 5 minutes. Which AWS service is most appropriate?

A company runs a customer-facing web application on Amazon EC2 instances. The company wants to have access to technical support with a guaranteed response time of 1 hour for critical production system failures. The company also needs access to AWS Trusted Advisor to get cost optimization recommendations. Which AWS Support plan meets these requirements?

A company is deploying a three-tier web application on AWS. The security team requires a network-level firewall that operates at the subnet level and can evaluate both inbound and outbound traffic using stateless rules. Which AWS feature should the company use to meet this requirement?

A company uses AWS Organizations to manage multiple accounts. The finance team needs to perform a detailed cost analysis by joining AWS usage data with their internal accounting system. They require hourly-level billing data that includes resource IDs, operation types, and cost allocation tags. The data must be available in a CSV file that can be imported into their financial software. Which AWS tool or service should the finance team use to meet this requirement?

A company is migrating its on-premises application to AWS. The application currently runs on a single server and experiences occasional traffic spikes that cause performance degradation. The company wants to take advantage of cloud computing benefits to handle these spikes automatically without manual intervention. Which AWS Cloud concept would directly address this requirement?

A company wants to deploy their application to users in North America, Europe, and Asia Pacific to reduce latency. Using AWS, they can provision infrastructure in new geographic regions within minutes using the same tools and templates. Which cloud benefit does this illustrate?

A company is developing a microservices-based application using Docker containers. The development team wants to run these containers on AWS without having to provision or manage any servers. The solution must automatically scale the containers based on demand and integrate with an Application Load Balancer for traffic distribution. Which AWS service should the team use to meet these requirements?

A company's security team is concerned about the risk of compromised Amazon EC2 instances being used for crypto-mining activities. They want a managed AWS service that can automatically detect unusual outbound network traffic patterns that are characteristic of crypto-mining, without requiring the installation of any agents on the instances. The team needs continuous monitoring and the ability to receive findings that include details about the suspicious activity. Which AWS service should the security team use?

Which AWS service provides a managed in-memory caching layer to reduce database load and improve application response times?

A startup company is using the AWS Free Tier to run a small web application. They want to ensure they receive a notification if their usage is about to exceed the Free Tier limits for any service, to avoid unexpected charges. Which AWS service or feature should they use to set up this alert?

A company wants to deploy a static website with global low-latency delivery and automatic SSL/TLS certificates. Which combination of AWS services best satisfies both requirements?

A company is evaluating a move to the AWS Cloud. The finance team learns that AWS can offer lower per-unit prices for compute and storage because AWS purchases hardware in very large volumes and operates at a massive scale. This cost advantage, which is then passed on to customers, is a direct benefit of which fundamental cloud computing concept?

A company runs a global e-commerce website hosted on Amazon EC2 instances in the us-west-2 Region. The website includes static assets (product images, CSS, JavaScript) and dynamic content generated by the application. The company wants to improve page load times for users in Europe and Asia by caching static content at edge locations, while also reducing the direct load on the EC2 instances. Which AWS service should the company use?

A company runs multiple containerized applications on a single Amazon ECS cluster using AWS Fargate. The company's compliance team asks whether sharing the same underlying physical hardware with other AWS customers introduces security risks. The company explains that AWS isolates each customer's compute environment, even though resources are drawn from a shared pool. Which essential characteristic of cloud computing does this arrangement best illustrate?

A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?

Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?

A security team wants to automatically scan their Amazon EC2 instances for known software vulnerabilities (CVEs) and assess whether any instances have unintended network access paths open. Which AWS service performs these automated security assessments?

A customer is evaluating moving to AWS and asks about the total cost of ownership (TCO) benefits. Which of the following is NOT a factor that reduces TCO when migrating to AWS?

A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Drag and drop the steps to set up a cross-region read replica for Amazon RDS in the correct order.

A company wants to receive a notification whenever a new AWS root account sign-in occurs. Which combination of services achieves this?

A company is migrating a critical database to Amazon RDS. The database must run continuously for the next 3 years to support the company's operations. The finance team wants to minimize compute costs for this database. However, they have a limited budget and cannot make large upfront payments. They want to commit to a 3-year term to receive the highest possible discount without paying anything upfront. Which pricing option should the finance team select for the DB instance?

A company runs multiple workloads on AWS and must ensure that all Amazon S3 buckets have server-side encryption enabled. The compliance team wants to automatically detect any S3 bucket that is created without encryption and receive an alert. They also want to continuously monitor existing buckets for compliance. Which AWS service should they use?

A solutions architect implements IAM least-privilege policies, enables encryption for all data at rest and in transit, configures VPC security groups and NACLs to limit network access, and sets up automated security incident detection. Which Well-Architected Framework pillar covers these activities?

A company's development team frequently needs temporary test environments. A developer can log into the AWS Management Console, select an Amazon EC2 instance type, configure storage, and launch the instance within minutes without any interaction with the IT infrastructure team. This capability is an example of which essential characteristic of cloud computing?

A company has a serverless architecture on AWS for its order processing system. The system uses AWS Lambda functions to validate payment, check inventory, update the database, and send email notifications. The company needs a managed service to coordinate these functions into a workflow, implement retry logic in case of failures, and manage the execution of each step sequentially. Which AWS service should the company use?

Which AWS service provides a managed blockchain network using open-source frameworks like Hyperledger Fabric and Ethereum?

A small startup wants to launch a new application on AWS without any upfront investment in servers. Which cloud computing deployment model allows them to use AWS infrastructure without owning any physical hardware?

Which statement about AWS data transfer pricing is correct?

A company is planning to migrate its on-premises data center to AWS. The finance team needs to compare the current on-premises infrastructure costs (including servers, storage, networking, and personnel) against the projected costs of running identical workloads on AWS over a three-year period. The team wants to input detailed specifications of their existing hardware and get a comprehensive report that highlights potential savings and provides a total cost of ownership (TCO) comparison. Which AWS tool should the finance team use?

Which cloud computing characteristic allows a company to pay only for the compute resources they actually use, without upfront commitments?

A security team wants to automatically detect unusual activity in their AWS account, such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicating credential compromise, or cryptocurrency mining activity. Which AWS service uses machine learning to detect these threats?

A company has been using AWS for six months and wants to predict their expected spending for the next quarter. They have historical cost data and need to use an AWS tool that can analyze past usage patterns and generate a monthly cost forecast. Which AWS tool should they use?

A company wants to run containerized applications without managing the underlying EC2 instances or clusters. Which AWS service enables this?

Which AWS service provides a hybrid cloud storage solution that allows on-premises applications to seamlessly access data stored in AWS cloud storage using standard file protocols?

A company stores sensitive financial data in Amazon S3 and must encrypt it at rest. The compliance team mandates that the encryption key must be rotated at least once per year, and the key material must be generated and managed by the company within AWS. The company wants a fully automated solution that requires no manual intervention for key rotation. Which AWS service or feature should the company use?

A company stores compliance logs in Amazon S3. After 90 days, logs are never accessed again but must be retained for 7 years to meet regulatory requirements. Which S3 storage class provides the lowest storage cost for this long-term archival requirement?

A company runs a web application that processes customer orders. During flash sales, the application's backend servers become overwhelmed because orders are submitted faster than they can be processed. The company needs a fully managed, highly available service that can buffer incoming orders so that the backend can process them at its own pace without losing any data. The service must automatically scale to handle any volume of orders without requiring manual provisioning. Which AWS service meets these requirements?

A company runs a critical e-commerce application on a single Amazon EC2 instance in one Availability Zone. The company wants to ensure that if the entire Availability Zone becomes unavailable, the application continues to run without manual intervention. Which AWS cloud concept best describes this requirement?

A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

A company runs an e-commerce application on AWS that experiences unpredictable traffic spikes during flash sales. The application currently runs on a fixed number of Amazon EC2 instances, which leads to performance degradation during spikes and wasted capacity during low traffic. The company wants to automatically adjust the number of instances based on real-time demand, only paying for the resources it uses. This need best represents which cloud computing concept?

A company is using Amazon EC2 and wants to understand the difference between Compute Savings Plans and EC2 Instance Savings Plans. Which statement is accurate?

A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?

A company is evaluating a migration of its on-premises data center to AWS. The CIO wants a detailed report that compares the total cost of ownership (TCO) of the current on-premises infrastructure versus running the equivalent workloads on AWS. The report should include costs for hardware, software, labor, power, cooling, and facilities. Which AWS tool should the company use to generate this comparison?

A company runs workloads for multiple teams in a single AWS account and wants to track and report costs per team in their monthly AWS bill. Which feature allows them to categorise and report AWS costs by team?

A company runs a web application on Amazon CloudFront and an Application Load Balancer (ALB). The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS). Additionally, the company needs to block requests from specific countries due to compliance requirements. The security team prefers a managed service that provides pre-configured rule sets and integrates directly with CloudFront and ALB without requiring additional infrastructure. Which AWS service should the security team use?

Which AWS service provides DDoS protection for all AWS customers at no additional charge and automatically protects resources at Layers 3 and 4?

Which Amazon EC2 Auto Scaling feature ensures a minimum number of healthy instances are always running, replacing terminated instances automatically?

A company stores financial reports in Amazon S3. The security team needs to automatically detect whether any of these reports contain sensitive data, such as personally identifiable information (PII) like credit card numbers or social security numbers. The team wants a fully managed service that continuously scans the S3 buckets and reports findings in a centralized dashboard. Which AWS service should the security team use to meet these requirements?

A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to record every GetObject and PutObject API call made against the bucket, including the identity of the caller, the source IP address, and the time of the request. They need to store these records in a separate centralized S3 bucket and analyze them using Amazon Athena for security audits. Which AWS feature should the security team enable?

A small company operates a single AWS account and currently uses the Basic Support plan. The company's administrator needs to be able to contact AWS Support by phone for urgent billing and account issues. Additionally, the administrator wants to request service limit increases through the AWS Support console. The company wants to minimize costs while meeting these requirements. Which AWS Support plan should the company choose?

A company is designing a critical web application that must remain available even if an entire data center goes offline due to a power outage. The application will run on Amazon EC2 instances in the us-east-1 Region. Which AWS infrastructure strategy should the company use to meet this high-availability requirement?

A company's sales team uses a cloud-based CRM application. Sales representatives access the CRM from their laptops in the office, from tablets at customer sites, and from their smartphones while traveling, all over the internet. The application works consistently across all devices without requiring any custom client software on each device. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Which statement correctly describes how Amazon S3 pricing works?

A company has 50 TB of historical data stored on on-premises network-attached storage (NAS). The company wants to transfer this data to Amazon S3. The internet connection provides only 10 Mbps upload speed, and the company wants to complete the transfer within 2 weeks. The data is not sensitive and does not require encryption during transfer. Which AWS service should the company use to meet these requirements?

A company operates a seasonal e-commerce website. During holiday sales, traffic can increase by 500% within minutes. The company uses AWS Auto Scaling to automatically add Amazon EC2 instances when CPU utilization exceeds a threshold and remove instances during off-peak hours. The company pays only for the compute capacity it actually consumes, with no upfront commitment. This scenario best demonstrates which essential characteristics of cloud computing?

A company manages multiple AWS accounts through AWS Organizations. The finance team wants to receive a consolidated view of costs across all accounts and track costs against a monthly budget of $50,000 for the entire organization. They want to be alerted when actual costs reach 90% of the budget and again when they exceed 100%. Which combination of AWS services should the finance team use?

A company stores customer health records in an application database and needs a HIPAA-eligible AWS service for the database tier. Which relational database option on AWS is eligible for HIPAA workloads?

A company uses AWS to host its web application. The company's IT manager learns that multiple AWS customers may have virtual machines running on the same physical server within an AWS data center. However, the manager is confident that each customer's data is securely isolated from others and that customers have no visibility into or control over the underlying physical infrastructure. Which essential characteristic of cloud computing does this scenario best demonstrate?

A startup is considering moving its infrastructure to AWS. The CTO explains that AWS can offer lower pay-as-you-go prices than what the startup would pay for equivalent on-premises hardware because AWS aggregates usage from millions of customers. Which benefit of the AWS Cloud does this scenario describe?

A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?

A new AWS customer wants to explore AWS services for the first time. They launch a t2.micro EC2 instance and use up to 5 GB of Amazon S3 storage. They want to understand if these will incur charges. Which AWS programme provides limited free usage of many services for new accounts during the first 12 months?

A company runs a retail website on AWS. During a promotional event, the website's traffic spikes from 1,000 concurrent users to 100,000 concurrent users in under 5 minutes. The AWS infrastructure automatically provisions additional Amazon EC2 instances to handle the increased load and terminates them when the event ends. Which essential characteristic of cloud computing does this scenario best demonstrate?

A gaming company is preparing to launch a new online multiplayer game. The company expects the player traffic to be extremely high on the first few days after launch, but then stabilize at a much lower level. The IT team wants to provision sufficient server capacity to handle the launch spike without over-provisioning and wasting money during the quieter periods. Which benefit of cloud computing most directly addresses this requirement?

A company runs a production web application on Amazon EC2 and Amazon RDS instances. The company's IT team needs technical support from AWS engineers with a guaranteed response time of less than one hour for issues where production systems are impaired. Additionally, the team wants to receive cost optimization recommendations through AWS Trusted Advisor. Which AWS Support plan should the company choose?

A company runs a production web application that uses Amazon EC2 instances, AWS Lambda functions, and Amazon ECS tasks. The application runs 24/7 and the company expects steady usage for the next three years. The company wants to commit to a flexible pricing model that provides significant discounts compared to On-Demand and automatically applies to usage across all three compute services. The company also wants the flexibility to change instance families, regions, or even migrate between compute services (e.g., from EC2 to Lambda) without needing to modify the commitment. Which AWS pricing model should the company choose?

A company wants to allow their on-premises employees to access S3 objects using Windows file system operations (drive mapping) without migrating their workflows. Which AWS service provides this capability?

A company runs a monolithic web application on Amazon EC2 that processes user-uploaded files synchronously. During peak hours, the application experiences slow response times because the file processing blocks the web server. The company wants to decouple the upload process from the file processing to improve responsiveness and allow each component to scale independently. The file processing backend must poll for new work and handle failures gracefully by retrying failed messages. Which AWS service should the company use to implement this decoupling?

Which AWS service provides a fully managed extract, transform, and load (ETL) service that automatically discovers data schemas and generates ETL code?

A company operates 10 AWS accounts under AWS Organizations. Each account runs multiple projects, and the company tags all resources with a 'Project' tag (e.g., 'Project-A', 'Project-B'). The finance team wants to view the consolidated monthly bill broken down by the value of the 'Project' tag across all accounts. Which AWS feature should the team use to achieve this?

Drag and drop the steps to set up an S3 bucket with versioning and public access blocked in the correct order.

A company wants to improve the performance of their global application by caching API responses closer to end users. Which AWS service provides an API proxy with built-in caching and CloudFront integration?

A company is building a web application that requires a fully managed NoSQL database with single-digit millisecond latency at any scale. The application will experience unpredictable traffic spikes, and the database must automatically scale throughput capacity up and down without manual intervention. The developers want to focus on application code rather than database management tasks. Which AWS database service should the company choose?

A company wants to build a serverless application that processes images uploaded to an Amazon S3 bucket. When a user uploads a new image, the application must automatically resize the image to multiple dimensions and store the resized versions in the same bucket under a different prefix. The company wants to minimize operational overhead and pay only for the compute time used. Which AWS service should be used to run the image processing code?

A company is planning to migrate to AWS. Their CTO wants to understand how AWS's massive scale benefits smaller customers. Which AWS cloud economic concept explains this benefit?

A company is designing a highly available application that must remain operational even if a single physical data center fails. The application will be deployed in the us-east-1 Region. The company wants to distribute the application across multiple physical locations within the Region, where each location has independent power, cooling, and networking. Which AWS Global Infrastructure component should the company use to meet this requirement?

A company wants to deploy a web application and have AWS handle the infrastructure, OS, and runtime — they only want to manage the application code and configuration. Which AWS service provides this experience?

A company recently signed up for AWS and is using the 12-month Free Tier offer. In the first month, they launched a single Amazon EC2 t2.micro instance and used it for exactly 750 hours. In the second month, they launched a second t2.micro instance and ran both instances simultaneously for 500 hours each (a total of 1,000 instance-hours for the month). Which statement accurately describes the charges for the second month under the Free Tier?

A security team needs to demonstrate to auditors that no AWS infrastructure has been modified between two audit periods. Which AWS service provides a continuous record of configuration changes with before-and-after state for all resources?

A company is migrating a legacy monolithic e-commerce application to AWS. The application has three tightly integrated modules: user authentication, payment processing, and inventory management. In the current design, a failure in the payment processing module often causes the entire application to crash. The company wants to redesign the application so that each module runs independently, and a failure in one module does not cascade to other modules. Which cloud computing concept should the company apply to achieve this goal?

A company runs a legacy on-premises file server that stores 10 TB of shared documents used by a team of 50 employees. The company wants to migrate this data to Amazon S3 to benefit from durable, scalable storage. However, the team requires low-latency access to frequently used files (less than 5 milliseconds latency) because the application reads and writes files multiple times per second. The company also wants to maintain a local cache of recently accessed files on premises to reduce latency and minimize egress costs. The entire solution should be managed through the AWS Management Console and support standard file-sharing protocols like SMB. Which AWS service should the company use to meet these requirements?

A company has multiple AWS accounts that are consolidated under AWS Organizations. The company uses cost allocation tags to track costs by project. The finance team now wants an interactive tool that can visualize the company's AWS spending over the past 6 months, break down costs by the 'Project' tag, and allow filtering by service, region, and linked account. The team also wants to forecast future spending based on historical trends. Which AWS service or feature should the finance team use?

A company's data analytics team needs to process log files immediately after they are uploaded to an Amazon S3 bucket. The processing logic is implemented as a custom Python script that runs for about 10 seconds per file. The team wants a fully managed solution that does not require provisioning or managing servers, automatically scales with the number of incoming log files, and executes the script only when new files are uploaded. Which AWS service should the team use to meet these requirements?

A company's finance team wants to forecast their AWS spending for the next 12 months to set accurate budget targets. Which AWS service provides cost forecasting based on historical usage patterns?

A company runs a fleet of production Amazon EC2 instances that operate 24/7 throughout the year. The CFO wants to reduce compute costs by committing to a consistent usage level. The finance team needs a tool that analyzes the company's historical EC2 usage and provides recommendations for the most cost-effective purchase options, including recommendations for both Reserved Instances and Savings Plans, with support for instance size flexibility. Which AWS tool should the finance team use?

A company runs a critical database on a single Amazon EC2 instance in a single Availability Zone. To increase fault tolerance and minimize downtime, the architecture team decides to deploy the database across multiple Availability Zones using a primary/standby configuration. This design pattern of distributing resources across isolated locations to ensure continuous operation even if an entire data center fails best demonstrates which fundamental concept of cloud computing?

A financial services company is preparing for an annual third-party audit. The auditor has requested a copy of the AWS SOC 2 Type II report to evaluate the security controls of the AWS infrastructure. The company needs to retrieve the report as quickly as possible without raising a support ticket. Which AWS service should they use?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses a custom domain name and requires HTTPS for all traffic. The security team provisions an SSL/TLS certificate using AWS Certificate Manager (ACM) and associates it with the ALB. Which of the following is an advantage of using ACM over manually managing certificates?

A company's security team needs to run automated vulnerability scans on all Amazon EC2 instances in their production environment. They require a managed service that checks for common vulnerabilities and exposures (CVEs) and identifies insecure network configurations. The scans must be scheduled to run weekly and the results must be viewable in the AWS Management Console. Which AWS service should the team use?

A company runs a production workload on Amazon EC2 instances that must be available continuously. The workload has predictable usage patterns. The company wants to minimize compute costs while maintaining high availability. Which pricing model should they choose?

A company traditionally purchases physical servers every three years to host its internal applications. The company is migrating these applications to AWS and will pay a monthly fee based on the actual compute capacity consumed. The company no longer needs to make large upfront hardware purchases and can instead budget for smaller monthly payments. Which benefit of cloud computing does this scenario BEST describe?

A DevOps team needs to deploy a multi-tier web application on AWS. The application consists of Amazon EC2 instances, an Application Load Balancer, an Amazon RDS database, and security groups. The team wants to define all these resources in a single declarative template, automatically manage the creation order and dependencies, and version control the template for repeatable deployments. Which AWS service should the team use to meet these requirements?

A company has a serverless application built with AWS Lambda. The application requires a series of functions to run in a specific order: after a user uploads a file, a validation function must run, then a processing function, and finally a metadata storage function. The company needs a service to coordinate these steps, manage state, handle errors, and automatically retry failed functions based on defined conditions. Which AWS service should the company use to meet these requirements?

A company wants to accelerate their machine learning workloads using purpose-built ML chips instead of general-purpose GPUs. Which AWS compute option provides custom ML accelerator chips?

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?

A company wants to receive alerts when their AWS spend exceeds a specific threshold. Which AWS service should they use to configure these alerts?

Which AWS service provides detailed billing reports that can be delivered hourly to Amazon S3 for custom analysis with tools like Amazon Athena or Redshift?

A company hosts an e-commerce website on Amazon EC2 instances behind an Application Load Balancer in the us-east-1 Region. The website includes both static assets (product images, CSS files) and dynamic content (user-specific cart data). The company has customers all over the world who complain about slow page load times. The company wants to reduce latency by caching static content closer to users while still allowing dynamic requests to reach the origin. Which AWS service should the company use to meet these requirements?

A company wants to deliver its web application content to users across North America, Europe, and Asia with minimal latency. The application runs on Amazon EC2 instances and serves static and dynamic content. Which AWS Cloud concept is most directly supported by using AWS Regions and edge locations to meet this requirement?

Match each AWS networking service to its description.

A company expects a steady baseline usage of AWS compute services (Amazon EC2, AWS Lambda, and AWS Fargate) over the next three years. They want to reduce costs compared to On-Demand pricing while maintaining the flexibility to change instance families, regions, or even switch between compute services (e.g., from EC2 to Lambda) without losing their discount. Which AWS pricing option should the company choose?

A company runs a variety of workloads on AWS and wants to be notified when their monthly spending behaves unusually compared to past patterns. They want a managed service that uses machine learning to detect cost anomalies and provides root cause analysis. Which AWS service or feature should they use?

A company requires all IAM users to have multi-factor authentication (MFA) enabled for AWS Management Console access. The security team needs an automated way to continuously detect any IAM user without an MFA device and generate a compliance report. The solution must not require custom code. Which AWS service should the team use?

A company suspects that an IAM role used by an EC2 instance has been granted excessive permissions. Which AWS service can generate a policy that includes only the permissions actually used over the last 90 days?

Which AWS service provides a fully managed API for building conversational interfaces (chatbots) using natural language understanding powered by the same technology as Amazon Alexa?

A company tags all Amazon EC2 instances with a 'Project' tag to track costs. The finance team reviews cost data in AWS Cost Explorer but cannot filter or group by the 'Project' tag. The tags are visible in the EC2 console. What is the most likely reason the tags are not appearing in Cost Explorer?

A company runs a microservices-based e-commerce application on AWS. During peak hours, the order processing service often gets overwhelmed because the web frontend sends requests directly to it. This causes delays and occasional failures. The architecture team needs to decouple the frontend from the order processing service by introducing a fully managed, highly available, and durable message queue. The queue must automatically replicate messages across multiple Availability Zones and allow the order processing service to pull messages at its own pace. Which AWS service should the company use?

A company runs a high-traffic e-commerce application. During peak holiday season, database read performance degrades. They want to offload read traffic from their RDS primary database. What should they implement?

Which AWS service provides a finding-based security recommendations service that uses AI to identify security threats and anomalies, going beyond simple rule-based Config checks?

Which statement about Amazon EC2 On-Demand pricing is accurate?

A company's website serves static content—such as images, videos, and CSS files—to a global audience. The company wants to reduce load times for users located far from the primary AWS Region where the application is hosted. Which component of the AWS global infrastructure is specifically designed to cache and deliver this content with low latency from locations close to end users?

A company runs a business-critical workload on AWS. The workload must have a 15-minute response time from AWS Support if it becomes unavailable. Additionally, the company wants a dedicated technical account manager (TAM) who will proactively review the architecture and provide best practice recommendations. Which AWS Support plan should the company choose?

A company wants to provide employees with secure, managed virtual Windows or Linux desktops accessible from any device, without purchasing physical computers or managing on-premises VDI infrastructure. Which AWS service provides cloud-based virtual desktops?

Which AWS Well-Architected Framework pillar focuses on protecting information, systems, and assets while delivering business value through risk assessments and mitigation strategies?

A company has an on-premises file server that stores large datasets. The company wants to reduce its on-premises storage footprint by moving cold data to AWS. However, users need low-latency access to frequently used files, and the applications must be able to access the data using the standard SMB protocol. The company wants to cache frequently accessed data locally on-premises for low latency, while securely storing all data in Amazon S3. Which AWS service should the company use?

A small business owner wants to host a simple WordPress website on AWS with a predictable flat monthly price, without learning about VPCs, security groups, instance types, or other AWS complexity. Which AWS service is designed for this simplified use case?

Which AWS service provides a fully managed, scalable search service that allows you to set up, manage, and scale a search solution for your website or application?

A company stores log files in Amazon S3 Standard. After 30 days, the logs are rarely accessed. After 365 days, they should be archived and almost never retrieved. The company wants to automatically move objects between storage classes to minimise cost. Which S3 feature enables this automated transition?

A company processes large amounts of data with Amazon EC2 and exports the results to customers globally via the internet. Which AWS cost component will be their largest variable cost?

A company runs a web application on Amazon EC2 instances. The company wants to ensure that they are billed only for the exact compute capacity they consume, down to the second, for each running instance. They also want to receive a detailed breakdown of their usage, including CPU time, storage, and data transfer, so they can analyze costs per department. Which essential characteristic of cloud computing enables this granular tracking and billing?

Which AWS service provides private connectivity between VPCs and supported AWS services without requiring internet gateway, NAT device, VPN, or Direct Connect?

A developer needs to read objects from a specific Amazon S3 bucket. Following AWS security best practices, which approach should be used when creating the IAM policy for this developer?

Which statement best describes 'high availability' in the context of AWS cloud architecture?

A company runs a critical web application on AWS behind an Application Load Balancer. The security team is concerned about the risk of Distributed Denial of Service (DDoS) attacks that could deplete application resources and incur high costs due to auto scaling. The company wants a managed service that provides enhanced DDoS detection, access to the AWS DDoS Response Team (DRT), and financial protection against scaling costs associated with DDoS attacks. Which AWS service should the company use?

A financial services company must keep customer financial records on-premises to comply with data residency regulations. The company wants to use AWS services such as Amazon SageMaker and Amazon Athena to run analytics on anonymized subsets of the data. The company establishes a dedicated AWS Direct Connect connection between its on-premises data center and its VPC, and uses AWS Storage Gateway to cache frequently accessed data locally while storing all data in Amazon S3. Which cloud deployment model does this architecture represent?

A company is developing a mobile application backend. The backend needs to process REST API requests that are triggered by user actions in the app. Usage is expected to start low but may spike unpredictably. The development team wants to focus solely on writing code and does not want to manage any servers or containers. The team also wants to only pay for compute time when requests are being processed. Which AWS service should the team use to meet these requirements?

A company hosts a web application behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting (XSS), using a managed service that requires no underlying infrastructure management. Which AWS service should they use?

A company runs separate AWS accounts for development, testing, and production workloads. The finance team wants a single view that shows the total spending across all accounts. Additionally, the team wants to benefit from volume discount pricing by aggregating usage across all accounts. The team also needs to allocate costs to individual projects based on custom tags applied to resources. Which AWS feature should the finance team use to meet all these requirements?

A company uses AWS to run its web application. A developer needs to add additional storage capacity to an Amazon EC2 instance that hosts the application's database. The developer logs in to the AWS Management Console, navigates to the Amazon EC2 dashboard, creates a new Amazon EBS volume, attaches it to the instance, and mounts it within the operating system. The entire process takes less than 10 minutes and does not require any interaction with AWS support or approval from the IT department. Which essential characteristic of cloud computing does this scenario best demonstrate?

A company runs a mix of Amazon EC2 instances, AWS Fargate containers, and AWS Lambda functions across multiple AWS Regions. The company wants to reduce costs by making a 1-year commitment for compute usage. The company needs a flexible purchasing option that automatically applies the discounted rate to any EC2 instance, Fargate, or Lambda usage, regardless of region, instance family, or size. Which AWS purchasing option should the company use?

A development team is building a serverless image processing application. When a user uploads an image to Amazon S3, the application must perform three sequential steps: first, resize the image; second, generate a thumbnail; third, store metadata in Amazon DynamoDB. The team wants to define this workflow as a visual state machine, handle errors with retries, and manage the execution flow without writing custom orchestration code. Which AWS service should the team use?

A company is designing a cloud architecture for a critical customer-facing application. The CTO requires that the architecture automatically recover from infrastructure failures without manual intervention. The solution must be able to withstand the failure of individual components, such as an Amazon EC2 instance or an entire Availability Zone. Which design principle from the AWS Well-Architected Framework's Reliability pillar should the company implement to meet this requirement?

Which AWS compute service allows developers to run code in response to HTTP requests without managing servers, using a simple programming model based on functions?

A company runs a multi-tier web application on Amazon EC2 instances across multiple Availability Zones. The application has separate backend services for serving images and handling API requests, each running on different sets of EC2 instances. The company needs a load balancer that can inspect incoming HTTP/HTTPS requests and route them to the correct target group based on the URL path (e.g., /images to one group, /api to another). The solution must also offload SSL/TLS termination and perform health checks on the instances. Which AWS service should the company use?

Which AWS support plan provides access to a Technical Account Manager (TAM) and proactive guidance for workload optimization?

A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?

A company has been running multiple workloads on AWS for over six months. The finance team needs to gain visibility into historical cost and usage data, identify which services are driving the most spend, forecast future monthly costs, and receive recommendations for purchasing Reserved Instances to achieve the highest savings. The team wants to use a native AWS tool that provides this functionality without requiring any third-party software. Which AWS tool should the finance team use?

A company runs a customer-facing web application on Amazon EC2 instances. The application experiences unpredictable traffic patterns, with occasional spikes during marketing campaigns and lulls at other times. The company configures an Auto Scaling group to automatically add EC2 instances when CPU utilization exceeds 70% and remove instances when it drops below 30%. This ability to scale computing resources up and down in response to demand best represents which essential characteristic of cloud computing?

A company's security team wants to continuously monitor their AWS environment for potential security threats such as unusual API calls, traffic from known malicious IP addresses, and anomalous behavior that might indicate a compromised resource. They need a managed threat detection service that uses machine learning to identify suspicious activity and generates detailed findings. The service should integrate with AWS Organizations to monitor multiple accounts and with Amazon CloudWatch Events to trigger automated responses. Which AWS service should the security team use?

A financial services company needs to maintain a tamper-proof audit log of all financial transactions for regulatory compliance. Which AWS service is most appropriate?

A company collects clickstream data from millions of users in real time and needs to process and analyse this data as it arrives — not after storing it — to detect patterns within seconds. Which AWS service is designed for real-time data streaming and processing?

A company runs a real-time bidding platform for online advertising. The platform requires a database that can handle millions of requests per second with single-digit millisecond latency for both reads and writes. The data model is simple key-value pairs, and the database must be fully managed so that the company does not have to provision or maintain servers. Which AWS database service should the company use to meet these requirements?

A company's compliance framework requires that all AWS API calls must be logged and that log integrity must be validated. Which AWS service with which feature satisfies this requirement?

A company runs compute-intensive batch processing jobs that require high CPU performance. The workload is not memory-intensive and does not require GPU acceleration. Which Amazon EC2 instance family is the most appropriate choice?

A company's IT team manually provisions S3 buckets, EC2 instances, security groups, and IAM roles for each new project using the AWS Management Console. This process often results in configuration errors, such as overly permissive security rules or incorrect tagging, which the security team then has to fix manually. The company wants to define its entire infrastructure in a declarative template file, store it in version control, and have AWS automatically create or update the resources based on that template. Which AWS service should the company use to meet these requirements?

A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any user or role in any member account from disabling AWS CloudTrail or deleting CloudTrail log files from Amazon S3. The team needs a solution that is centrally managed from the management account and applies to all current and future member accounts automatically. Which AWS feature should the security team use to meet these requirements?

A company needs to connect multiple VPCs and on-premises networks through a single hub, simplifying network management. Which AWS service acts as a cloud router to interconnect these networks?

A company runs a customer-facing web application on AWS. To ensure the application remains available if a fire or flood destroys one of the company's data centers, the IT team deploys the application across multiple physically separate facilities within the same AWS Region. Each facility has independent power, cooling, and physical security. Which component of the AWS global infrastructure does this deployment strategy primarily use?

A company runs a multi-step order fulfilment process that includes payment verification, inventory check, warehouse notification, and shipping label generation. Each step is implemented as a Lambda function. They need a service to coordinate these steps, handle retries on failure, and visualise workflow state. Which AWS service should they use?

A company hosts a public-facing web application behind an Application Load Balancer (ALB). The development team has recently identified that the application is vulnerable to common web attacks such as SQL injection and cross-site scripting (XSS). The security team wants to deploy a managed solution that can inspect incoming HTTP requests and block malicious traffic before it reaches the application. The solution must integrate directly with the existing ALB and provide pre-configured rule sets that can be customized. Which AWS service should the company use?

A retail company's order processing system receives large bursts of orders during flash sales. The order intake API gets overwhelmed because it directly calls a downstream processing service that is slower. The company wants to decouple the API from the processing service so orders are not lost during spikes. Which AWS service should they use?

Which AWS service provides a marketplace where customers can find, buy, and deploy software from third-party vendors that runs on AWS infrastructure?

A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?

A retail company expects 10x normal traffic during Black Friday. They want to ensure their application can handle this peak load automatically. Which AWS services should they configure to handle this requirement?

A company has 50 TB of on-premises file server data that must be transferred to Amazon S3. The company's internet connection is limited to 100 Mbps, and the data transfer must not impact daily business operations. The company needs a physical device to securely copy the data and then ship it to AWS for ingestion. Which AWS service should the company use?

A company runs a containerized application that uses multiple Docker containers. The development team wants to run these containers on AWS without provisioning or managing any EC2 instances. They also do not want to manage the container orchestration control plane. The application requires consistent access to persistent storage volumes that can be attached to containers. Which AWS service should the team use to run the containers with the least operational overhead?

A company has a mobile application that allows users to upload profile photos. When a new photo is uploaded to an Amazon S3 bucket, the application must automatically create a thumbnail version and store it in another S3 bucket. The company wants a solution that runs only when needed, scales automatically, and requires no management of underlying servers. Which AWS service should the company use to meet these requirements?

A company runs an application with variable workloads. During business hours, they need 10 EC2 instances; overnight they only need 2. Which combination minimizes cost while meeting this requirement?

A company has multiple IAM users. The security policy requires that every user must have an MFA device assigned and must use it for console sign-in. The security team wants to automatically detect any IAM user that does not have MFA enabled and receive an email alert. Which combination of AWS services should the team use to meet these requirements?

A company needs to process and analyze streaming log data from thousands of servers in near real-time, loading the results into Amazon Redshift for dashboards. Which AWS service is designed for this streaming ETL delivery use case?

A company is deploying a new web application on AWS. The operations team needs to provision and manage AWS resources such as Amazon EC2 instances, Amazon RDS databases, and Amazon S3 buckets in a repeatable, consistent manner across development, test, and production environments. The team wants to define the entire infrastructure as code using declarative templates that can be version-controlled and reviewed. Which AWS service should the team use to meet this requirement?

A company has unpredictable, short-lived batch processing workloads that can be interrupted. Which EC2 purchasing option would provide the lowest cost for these workloads?

A company manages multiple AWS accounts using AWS Organizations. The company has an on-premises Microsoft Active Directory (AD) that contains employee credentials and group memberships. The company wants to grant employees access to the AWS Management Console and command-line interface (CLI) using their existing AD credentials, without creating IAM users for each employee. Additionally, the company wants to centrally manage permissions across all accounts by assigning policies to AD groups. Which AWS service should the company use to meet these requirements?

A company runs an e-commerce platform on AWS. The platform experiences unpredictable traffic, with occasional large spikes. The company wants to automatically adjust compute capacity to match demand exactly, ensuring consistent performance while only paying for the resources consumed. Which benefit of the AWS Cloud does this scenario primarily describe?

Which cloud concept describes the ability of cloud services to remain operational even when individual components fail, through techniques like redundancy, replication, and automatic failover?

A company runs a steady, predictable workload on a diverse mix of Amazon EC2 instances spanning multiple instance families (e.g., M5, C5, R5) and AWS Regions. The company wants to maximize cost savings while retaining the ability to freely change instance families and Regions during the commitment term without losing the discount. Which AWS pricing model should the company use?

A company is deploying a multi-tier application on AWS. Which AWS service provides layer 4 (TCP/UDP) load balancing with ultra-high performance and static IP addresses?

A solutions architect is planning a new web application on AWS. The workload will include 3 Amazon EC2 instances (t3.medium) running 24/7, an Application Load Balancer, and an Amazon RDS for MySQL db.t3.small database. The architect needs to estimate the monthly cost for the first year, considering different purchasing options (On-Demand, 1-year All Upfront Reserved Instance, and Compute Savings Plan). Which AWS tool should the architect use to create this estimate?

A company needs to deploy their application in multiple geographic locations to ensure data sovereignty compliance and reduce latency for users in different continents. What is the AWS infrastructure concept that represents a distinct geographic area with multiple isolated locations?

A company is migrating to AWS and wants to understand the different types of cloud service models. Which model describes a service where the provider manages everything including the application, and the customer only manages their data and user access?

A financial services company runs a high-frequency trading application that must process transactions with sub-millisecond latency. The application must run in the company's own data center to meet strict latency requirements, but the company wants to use the same AWS management APIs, control plane, and tools (such as AWS CloudFormation and Amazon CloudWatch) for consistency across on-premises and cloud environments. The company also needs the ability to seamlessly run Amazon EBS-backed Amazon EC2 instances locally. Which AWS service should the company use to meet these requirements?

A company runs a web application on a single Amazon EC2 instance. As the application gains popularity, the instance frequently reaches 100% CPU utilization during peak hours, causing slow response times. The operations team is evaluating two approaches: (1) migrate the application to a larger EC2 instance type with more CPU and memory, or (2) add multiple smaller EC2 instances behind a load balancer and distribute the traffic. Which cloud computing concept does approach (1) represent?

A startup is evaluating cloud vs. on-premises for their new product. Which cloud characteristic means they can experiment with 10 servers for a week, then scale to 1,000 servers for a product launch, and back to 10 afterward — paying only for what they use?

A company's internal audit team needs to download the latest AWS SOC 2 Type II report and ISO 27001 certificate to include in their compliance documentation for an upcoming external audit. The team requires a centralized, self-service portal where they can access these reports and any other relevant AWS compliance artifacts. They do not want to contact AWS Support or manage any infrastructure to obtain these documents. Which AWS service should the audit team use?

A company runs a customer-facing web application on a single Amazon EC2 instance. To improve resilience, the solutions architect decides to deploy a second EC2 instance in a different Availability Zone and configure an Application Load Balancer to distribute traffic. The goal is to ensure that the application remains accessible even if one instance or one Availability Zone becomes unavailable. Which cloud computing benefit does this architecture primarily aim to achieve?

A company wants to provide their data analysts with a way to run SQL queries on their S3 data lake using familiar BI tools like Tableau or Power BI. Which AWS service provides an ODBC/JDBC connection to S3 data?

A company is deploying a multi-tier web application that includes a VPC, subnets, security groups, EC2 instances, and an Application Load Balancer. The team needs to define the entire infrastructure in a version-controlled template so that it can be consistently deployed across development, test, and production environments with minimal manual effort. Which AWS service should the team use to meet this requirement?

A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?

A company needs to provide secure, scalable file storage for thousands of concurrent users accessing the same shared file system from Linux-based EC2 instances. Which AWS service is most appropriate?

A company runs a mix of Amazon EC2 instances across multiple AWS Regions to support its e-commerce platform. The finance team wants to reduce compute costs by right-sizing resources. They need a managed tool that analyzes historical CPU and memory utilization over 30 days, uses machine learning to identify over-provisioned and under-provisioned instances, and provides actionable recommendations to adjust instance sizes. Which AWS tool should the finance team use?

A company runs a web application on a single Amazon EC2 instance. To improve the application's ability to remain operational even if an entire data center becomes unavailable, the company deploys identical application instances across three AWS Availability Zones and places them behind an Application Load Balancer. Which characteristic of cloud computing does this architecture best demonstrate?

A company wants to implement governance controls that prevent their developers from provisioning expensive instance types. Which approach is most effective?

A company hosts a static website on Amazon S3. Users in different geographic locations experience high latency when accessing the website. The company wants to reduce latency for all users and also minimize the number of direct requests to the S3 bucket. Which AWS service should the company use?

A company runs hundreds of Amazon EC2 instances across multiple accounts. The finance team wants to identify over-provisioned instances that are using more memory or CPU than necessary, so that they can downsize them and reduce monthly costs. The team needs automated, ongoing recommendations based on the actual utilization metrics of the instances. Which AWS service should the team use to meet these requirements?

A startup is migrating a web application to AWS. The application runs on Amazon EC2 instances that use a custom Amazon Machine Image (AMI) with the company's proprietary software. The security team needs to understand which security tasks the company must perform. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a consistent set of security group rules across all accounts. For example, they want to ensure that no security group in any account allows inbound SSH (port 22) from the internet (0.0.0.0/0). If a non-compliant security group is created, the service should automatically remediate by removing the offending rule or by applying a corrective policy. The company wants a managed AWS service that centrally applies these rules and requires no custom scripting. Which AWS service should the security team use?

A company operates multiple AWS accounts under AWS Organizations. The security team needs to record all management events (for example, creating Amazon EC2 instances, modifying security groups, and deleting Amazon S3 buckets) across all accounts. The logs must be delivered to a single Amazon S3 bucket that is encrypted with an AWS KMS key and protected from modification. Which AWS feature should the team enable to achieve this centralized logging requirement?

A company wants to use AWS free tier for testing new services. Which statement about the AWS Free Tier is accurate?

A company is refactoring its monolithic e-commerce application into multiple microservices. The order-processing service must send messages to the inventory service to reserve stock. The company needs a fully managed service that can durably store these messages, handle high throughput, and allow the inventory service to poll for messages at its own pace. The company wants to avoid any message loss. Which AWS service should the company use?

Which AWS service helps you manage and deploy infrastructure as code using templates?

A company has a security policy that requires all Amazon EBS volumes attached to production Amazon EC2 instances to be encrypted at rest using customer-managed encryption keys. The policy also mandates that the encryption keys must be automatically rotated every 365 days. The company wants to minimize operational overhead by using a managed AWS service for key management and automatic rotation. Which AWS service should the company use to meet these requirements?

A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?

A company wants to create a hybrid cloud architecture where their on-premises applications can access AWS services as if they were running locally. Which AWS service extends AWS infrastructure and services to on-premises locations?

A developer needs to launch a test server for a new application prototype. The developer logs into the AWS Management Console, selects an Amazon EC2 instance type, configures the security group, and starts the instance. The instance is running within two minutes, and the developer did not need to submit a formal request to the company's IT procurement team or wait for approval from a cloud administrator. Which essential characteristic of cloud computing does this scenario best demonstrate?

A company uses AWS Organizations and manages hundreds of AWS accounts. The security policy requires that all Amazon S3 buckets be encrypted using a specific AWS KMS customer-managed key (CMK). The security team wants to automatically detect any S3 bucket that is not encrypted with the required CMK and automatically apply the correct encryption configuration without manual intervention. Which AWS service should the security team use to implement this automated compliance enforcement?

A company operates separate AWS accounts for its engineering, marketing, and finance departments. The CFO wants to consolidate billing to receive a single monthly invoice and to benefit from volume pricing discounts. The security team also requires a centralized mechanism to prevent users in any department from launching Amazon EC2 instances outside of the us-east-1 and eu-west-1 Regions to meet data residency compliance. Which AWS service or feature should the company use to meet both requirements?

A company wants to implement zero-trust network security for their AWS environment. Which AWS service enables access to EC2 instances without requiring open inbound network ports or bastion hosts?

A media company processes user-uploaded images to generate thumbnails and metadata. The current solution runs a script on a single Amazon EC2 instance, which becomes overloaded during peak hours, causing delays. The company wants a solution that automatically scales to handle spikes in upload volume, requires no server management, and charges only for the processing time consumed. Which AWS service should the company use?

A gaming company runs a multiplayer game backend on Amazon EC2 instances. The game experiences variable traffic patterns: low usage during weekday mornings and high usage during evenings and weekends. The company uses an Auto Scaling group to automatically add instances during peak hours and remove them during low traffic. The company is billed only for the compute capacity actually consumed during each hour. Which characteristic of cloud computing does this usage-based billing model best illustrate?

A startup runs an application on AWS and receives a monthly bill that charges exactly for the number of compute hours used, the gigabytes of data stored, and the gigabytes of data transferred. The company pays nothing for resources they did not use. Which cloud computing characteristic does this represent?

A company uses AWS Organizations with separate accounts for development, testing, and production. The finance team wants to track monthly spending by internal project, but a single project may use resources across multiple accounts. The team has applied a 'Project' tag to all resources. They need a detailed billing report that shows costs grouped by this Project tag, combining data from all accounts. Which AWS feature should they enable to meet this requirement?

A company is developing a microservices application on AWS. The application has multiple independent services that must communicate asynchronously. The company needs a fully managed service to reliably store and deliver messages between these services, ensuring that each message is processed at least once and allowing the services to scale independently. Which AWS service should the company use?

A developer wants to send real-time notifications to mobile app users when new content is available. Which AWS service enables push notifications to iOS and Android devices?

Which statement best describes the concept of 'infrastructure as code' (IaC) in the context of AWS?

A company runs a web application on Amazon EC2 instances. The finance team wants to set a monthly spending limit for the application and receive email alerts when the actual cost exceeds 80% of that limit. Additionally, they want the system to automatically stop non-critical EC2 instances if the cost exceeds the limit. Which AWS service should they use to meet these requirements?

A company stores historical sales data in Amazon S3. The data is accessed only once a month for generating quarterly reports. When accessed, the data must be available for retrieval within seconds. The company wants to minimize storage costs while meeting the retrieval latency requirement. Which S3 storage class should the company use?

A company uses AWS Organizations to manage multiple accounts. The security team wants to continuously monitor the configurations of all AWS resources across the organization and receive alerts when a resource violates a compliance rule. For example, they want to ensure that all Amazon RDS databases are not publicly accessible, and that any new RDS instance created with public access enabled is automatically flagged. The team does not want to build custom scripts for monitoring. Which AWS service should the security team use to meet these requirements?

Which AWS feature allows multiple AWS accounts to be managed under one umbrella, receive a single consolidated bill, and potentially share volume discounts?

A company is using several AWS services and has noticed their bill has been increasing. They want to identify which team or project is responsible for each cost. Which AWS feature enables tracking costs by team, project, or environment?

A company runs a monthly batch data analytics job that requires 50 compute instances for exactly 2 hours. On AWS, the company launches 50 Amazon EC2 instances, runs the job, and then terminates all instances. The company's AWS bill shows a charge for only 100 instance-hours (50 instances × 2 hours). Which essential characteristic of cloud computing does this billing model best demonstrate?

A company wants to use Amazon S3 to store objects that must not be deleted or overwritten for a specified period for regulatory compliance. Which S3 feature enforces this?

A company is adopting the cloud and wants to improve operational efficiency by treating their infrastructure as code. Which AWS service allows them to define and provision AWS infrastructure using JSON or YAML templates?

A global company has employees who work from various locations and use different devices such as laptops, tablets, and smartphones to access corporate applications. The company plans to migrate its applications to AWS and wants all employees to access these applications directly from the internet using standard web browsers without requiring any dedicated hardware or software at each branch. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

Which AWS database service is best suited for storing and querying data with complex relationships using structured query language?

A startup wants to receive alerts when their AWS spending approaches a set threshold. Which AWS service should they use?

A company's microservices application consists of 10 services. When a user request is slow, the development team cannot determine which service in the chain is the bottleneck. Which AWS service provides distributed tracing so they can see the full path of a request and identify the slow component?

A company needs to replicate their Amazon S3 data to a different AWS Region automatically to meet disaster recovery requirements. Which S3 feature enables this?

A company's compliance team needs to enforce a policy that all Amazon S3 buckets must have 'Block all public access' enabled. If a bucket is created without this setting, the company wants the policy to be automatically remediated within minutes without manual intervention. The solution must check for compliance continuously and apply the fix automatically. Which AWS service should the company use to meet these requirements?

A company is designing a cloud architecture and wants to follow the Well-Architected Framework principle of 'stop guessing capacity.' Which AWS feature directly supports this principle?

A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?

A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?

A company is migrating its IT operations to AWS. Previously, when a developer needed a new server for a project, the developer had to submit a formal request to the IT department. The request would be reviewed, approved, and then a physical server would be procured, configured, and deployed—a process that often took several weeks. After migrating to AWS, the developer can log in to the AWS Management Console and launch a new Amazon EC2 instance with the exact required configuration within minutes, without any interaction with IT staff. Which essential characteristic of cloud computing does this scenario BEST demonstrate?

A company uses Amazon S3 to store raw data files for a data analytics platform. The company requires that files remain immediately accessible for the first 30 days after upload. After 30 days, files must be automatically moved to a lower-cost storage class for archival access. After 7 years, files must be automatically deleted. The company wants to implement this data management strategy with minimal ongoing effort. Which AWS S3 feature should the company use?

A company uses multiple AWS accounts within AWS Organizations. The security team needs to automatically check that no Amazon S3 bucket in any account has public read or write access. They want to define a security rule once and have it evaluated continuously across all accounts. The team also needs to view the overall compliance status from a single dashboard. Which AWS service should they use to meet these requirements?

A company is moving its workloads to AWS. The compliance team requires that all data must reside within the European Union (EU) and must not be stored on any physical server located outside the EU. The team also understands that AWS does not provide information about the specific physical server or data center where their data is stored. Which essential characteristic of cloud computing does this situation best describe?

A development team needs to deploy a web application on AWS quickly. The team wants a fully managed service that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring. The team does not want to manage the underlying Amazon EC2 instances or the application stack manually. Which AWS service should the team use?

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The security team needs to understand their responsibilities under the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility?

A company runs a batch processing workload on an on-premises data center. The servers are powerful machines that are used at maximum capacity only for a few days each month during financial reporting periods. For the rest of the month, the servers run at very low utilization. The CFO wants to migrate this workload to AWS to reduce costs. Which characteristic of AWS cloud computing is most directly aligned with the CFO's goal of paying only for the compute capacity actually used?

A company is moving its on-premises workloads to AWS. The company's chief financial officer notes that AWS can provide computing resources at a lower cost per unit because AWS spreads the cost of building and maintaining vast data centers across millions of customers. This cost advantage is best described as an example of which concept?

A company has been running workloads on AWS for over a year. The finance team needs to analyze historical spending patterns. They want a graphical dashboard that shows costs by service (e.g., EC2, S3), by AWS Region, and by custom cost allocation tags over the last 12 months. Additionally, they need to generate a 3-month cost forecast based on this historical data. Which AWS tool should the finance team use to meet these requirements?

A company runs a data-intensive workload in a colocation facility and wants to establish a dedicated, private network connection to its Amazon VPC. The connection must bypass the public internet to provide consistent high throughput and low latency. The company also wants to avoid data transfer costs associated with internet-based connections. Which AWS service should the company use?