CCNA Cloud Technology and Services Questions — Page 2 of 5

MCQmedium

A company needs to run scheduled jobs that execute SQL queries on their Amazon RDS database every night. Which AWS service provides fully managed job scheduling without maintaining dedicated compute resources?

A.Amazon EC2 with cron jobs

B.AWS Lambda triggered by Amazon EventBridge Scheduler

C.Amazon ECS with scheduled tasks

D.AWS OpsWorks

AnswerB

AWS Lambda integrates natively with Amazon EventBridge Scheduler, which can invoke the function on a fixed schedule (e.g., once daily) without any persistent compute running. Lambda spins up the execution environment only when the event fires, runs the database query, and then shuts down, so you pay only for the milliseconds of compute during the actual invocation. This serverless model perfectly matches the sporadic, short-running nature of a daily batch query and eliminates idle cost. Additionally, Lambda connections to a database can use RDS Proxy or a private VPC setting to manage short-lived connections efficiently.

Why this answer

AWS Lambda triggered by Amazon EventBridge Scheduler is the correct choice because EventBridge Scheduler provides fully managed, serverless job scheduling that can invoke Lambda functions to execute SQL queries on Amazon RDS. This eliminates the need to provision or maintain any dedicated compute resources, as the scheduling and execution are handled entirely by AWS.

Exam trap

The trap here is that candidates may confuse 'fully managed job scheduling' with services like EC2 cron jobs or ECS scheduled tasks, overlooking that EventBridge Scheduler is the only option that requires zero compute resource management for this specific use case.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 with cron jobs requires you to provision, patch, and manage a dedicated EC2 instance, which contradicts the requirement of 'without maintaining dedicated compute resources'. Option C is wrong because Amazon ECS with scheduled tasks still requires you to manage a cluster of EC2 instances (or use Fargate, which is serverless but not the simplest fully managed scheduling service for this use case) and involves container orchestration overhead. Option D is wrong because AWS OpsWorks is a configuration management service (based on Chef/Puppet) that manages EC2 instances and applications, not a simple scheduled job execution service, and it still requires maintaining compute resources.

Practice this question →

MCQmedium

A development team accidentally deletes important files from an Amazon S3 bucket. The company wants to protect against accidental deletions and overwrites in the future, allowing recovery of previous versions of objects. Which S3 feature should they enable?

A.S3 Object Lock

B.S3 Cross-Region Replication

C.S3 Versioning

D.S3 Intelligent-Tiering

AnswerC

S3 Versioning preserves every version of every object, so when a team member issues a DELETE, S3 inserts a delete marker instead of purging the data and the prior versions remain intact. Overwriting an object writes a new version while retaining the previous one. To recover an accidentally deleted object, you remove the delete marker or promote an earlier version, which makes the object fully accessible again without deep backup infrastructure.

Why this answer

S3 Versioning is the correct feature because it preserves every version of an object, including overwrites and deletions. When versioning is enabled, deleting an object only adds a delete marker, and previous versions remain recoverable. This directly addresses the requirement to protect against accidental deletions and overwrites by allowing restoration of earlier object versions.

Exam trap

The trap here is that candidates often confuse S3 Object Lock with versioning, thinking that locking objects prevents deletion entirely, but Object Lock only enforces retention periods and does not provide the ability to recover from accidental deletions or overwrites after they occur.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock prevents objects from being deleted or overwritten for a fixed retention period, but it does not inherently preserve multiple versions; it works with versioning to enforce write-once-read-many (WORM) compliance, not to recover from accidental deletions after the fact. Option B is wrong because S3 Cross-Region Replication asynchronously copies objects to a different AWS region for redundancy or compliance, but it does not protect against accidental deletions or overwrites in the source bucket; deletions and overwrites are replicated, so they cannot be recovered from the source alone. Option D is wrong because S3 Intelligent-Tiering automatically moves objects between access tiers to optimize storage costs based on changing access patterns; it has no capability to preserve or recover previous object versions.

Practice this question →

MCQmedium

A company manages a web application that consists of Amazon EC2 instances, an Amazon RDS database, and an Amazon S3 bucket. The team deploys the application to separate development, test, and production environments. Currently, the team manually configures each environment, which has led to configuration drift and deployment errors. The company wants to define the entire infrastructure as code, store the definition in a version control system, and deploy it consistently across all environments with a single template. Which AWS service should the company use to meet these requirements?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerA

AWS CloudFormation is the correct answer because it is the native Infrastructure as Code (IaC) service on AWS. It lets you define your entire stack — EC2 instances, VPCs, RDS databases, S3 buckets, IAM roles, and anything else — in a declarative JSON or YAML template. CloudFormation then provisions and updates these resources in a controlled, repeatable manner, tracking them as a single stack and rolling back changes on failure. This makes it the dedicated tool for treating infrastructure as code, ensuring consistent environments across dev, test, and production, and enabling version control of your infrastructure definitions.

Why this answer

AWS CloudFormation is the correct choice because it enables you to define your entire infrastructure—including EC2 instances, RDS databases, and S3 buckets—as code in a JSON or YAML template. This template can be stored in a version control system and deployed consistently across development, test, and production environments using a single template, eliminating configuration drift and manual errors.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk's automated deployment and scaling capabilities with infrastructure-as-code provisioning, overlooking that CloudFormation provides the explicit, version-controlled template required for consistent multi-environment infrastructure management.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service that automates application deployment and scaling but does not provide a single template to define all infrastructure as code for multiple environments; it abstracts infrastructure details rather than allowing full control via a template.

AWS OpsWorks is a configuration management service that uses Chef or Puppet, not a tool for defining entire infrastructure as code with a single template for consistent deployment across environments. It focuses on managing server configurations rather than provisioning all resources.

AWS CodeDeploy automates code deployments to existing compute instances, but does not define or provision infrastructure resources like EC2, RDS, or S3. The question requires infrastructure as code and consistent environment provisioning, which CodeDeploy alone cannot achieve.

Practice this question →

MCQmedium

Which AWS service provides a continuous integration/continuous deployment (CI/CD) pipeline that automates the build, test, and deploy phases of application release?

A.AWS CodeBuild

B.AWS CodeDeploy

C.AWS CodePipeline

D.AWS CodeCommit

AnswerC

AWS CodePipeline is a fully managed continuous delivery service that models, visualizes, and automates the entire release process from source to production. It orchestrates stages by connecting actions from CodeCommit, CodeBuild, CodeDeploy, and third-party tools, managing transitions, parallel execution, and manual approvals. As the central control plane, it governs the workflow's order and dependencies, making it the correct answer.

Why this answer

AWS CodePipeline is a fully managed CI/CD service that orchestrates the build, test, and deploy phases of a release process. It integrates with services like AWS CodeBuild for building and testing, and AWS CodeDeploy for deployment, providing a single pipeline to automate the entire workflow.

Exam trap

The trap here is that candidates often confuse the individual CI/CD component services (CodeBuild, CodeDeploy, CodeCommit) with the orchestration service (CodePipeline) that ties them together, leading them to select a service that only handles one phase of the pipeline.

How to eliminate wrong answers

Option A is wrong because AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages, but it does not orchestrate the entire CI/CD pipeline or manage deployment phases. Option B is wrong because AWS CodeDeploy automates code deployments to any instance, including Amazon EC2 and on-premises, but it is only the deploy phase and does not handle build or test automation. Option D is wrong because AWS CodeCommit is a fully managed source control service that hosts Git-based repositories, but it does not provide build, test, or deployment automation.

Practice this question →

MCQmedium

Which AWS service enables event-driven architectures by acting as a central event bus that routes events from AWS services, SaaS applications, and custom applications to configured targets?

A.Amazon SNS

B.Amazon SQS

C.Amazon EventBridge

D.AWS Step Functions

AnswerC

Amazon EventBridge is the serverless event bus that powers event-driven architectures by receiving events from AWS services, SaaS applications, and custom apps, then applying declarative rules to route them to targets like Lambda, Step Functions, or SQS. It supports content-based filtering with event patterns, schema discovery, archival, and replay, enabling sophisticated routing that goes beyond simple fan-out. This makes EventBridge the correct choice for enterprise integration across AWS and third-party SaaS sources.

Why this answer

Amazon EventBridge is a serverless event bus that ingests events from AWS services, SaaS partners, and custom applications, then routes them to targets like Lambda, Step Functions, or SQS based on configurable rules. It decouples event producers from consumers, enabling event-driven architectures without polling or custom middleware. This matches the question's description of a central event bus for cross-domain event routing.

Exam trap

The trap here is that candidates confuse Amazon SNS (pub/sub) with an event bus, but SNS lacks rule-based filtering and multi-source event ingestion from SaaS and custom apps, which is the defining feature of EventBridge.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes notifications to subscribers (e.g., email, SMS, HTTP endpoints), but it does not act as a central event bus with rule-based routing from multiple sources like SaaS or custom apps. Option B is wrong because Amazon SQS is a fully managed message queue for decoupling microservices, not an event bus; it stores messages for polling consumers and lacks built-in event routing rules. Option D is wrong because AWS Step Functions is a serverless orchestration service for coordinating workflows (state machines), not an event bus for routing events from diverse sources to targets.

Practice this question →

MCQeasy

A company wants to monitor the CPU utilisation of their EC2 instances and automatically send an email alert when utilisation exceeds 80% for more than 5 consecutive minutes. Which AWS service provides this monitoring and alerting capability?

A.AWS CloudTrail

B.AWS Config

C.Amazon CloudWatch

D.AWS X-Ray

AnswerC

Amazon CloudWatch is AWS’s native monitoring service that collects and stores EC2 CPU utilization metrics as data points, either at the default 5-minute basic monitoring interval or at 1-minute intervals with detailed monitoring. You can configure an alarm specifying a threshold, such as CPUUtilization above 80%, along with a number of consecutive evaluation periods to determine when the alarm fires. When an alarm enters the ALARM state, it can trigger an action like publishing to an Amazon SNS topic to send email or SMS notifications. This direct metric collection, threshold evaluation, and notification pipeline is exactly what is needed to monitor CPU utilization.

Why this answer

Amazon CloudWatch is the correct service because it provides both monitoring of EC2 CPU utilization metrics and the ability to create CloudWatch Alarms that trigger actions, such as sending an email via Amazon SNS, when a metric like CPUUtilization exceeds a threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 5 minutes). This directly fulfills the requirement for monitoring and alerting on CPU utilization.

Exam trap

The trap here is that candidates often confuse CloudTrail (audit logging) with CloudWatch (monitoring), or assume AWS Config can handle performance alerts, when in fact only CloudWatch provides metric-based monitoring and alarm actions.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not system-level metrics like CPU utilization; it cannot monitor performance or trigger threshold-based alerts. Option B is wrong because AWS Config evaluates resource configurations against desired policies and tracks configuration changes, but it does not monitor real-time performance metrics or CPU utilization. Option D is wrong because AWS X-Ray is a distributed tracing service for analyzing and debugging application requests and latency, not for monitoring infrastructure metrics like CPU utilization.

Practice this question →

MCQeasy

A company wants to create interactive dashboards and charts from data stored in Amazon S3, Amazon RDS, and Amazon Redshift, sharing them with business users across the organisation without managing BI server infrastructure. Which AWS service provides cloud-native business intelligence?

A.Amazon Athena

B.Amazon Redshift

C.Amazon QuickSight

D.Amazon CloudWatch

AnswerC

QuickSight is AWS's managed BI service for creating interactive dashboards and ML-powered insights. It connects to S3, RDS, Redshift, and other sources and shares dashboards with business users at a per-user cost with no server management.

Why this answer

Amazon QuickSight is a cloud-native, serverless business intelligence (BI) service that enables users to create interactive dashboards and visualizations from data sources such as Amazon S3, Amazon RDS, and Amazon Redshift. It requires no BI server infrastructure management, supports SPICE (Super-fast, Parallel, In-memory Calculation Engine) for high-performance data caching, and allows sharing dashboards with business users across an organization via a web browser or mobile app.

Exam trap

The trap here is that candidates confuse query engines (Athena) or data warehouses (Redshift) with full BI services, overlooking that QuickSight is the only AWS service purpose-built for serverless interactive dashboards and sharing with business users.

How to eliminate wrong answers

Option A is wrong because Amazon Athena is an interactive query service that uses standard SQL to analyze data directly in Amazon S3, but it does not provide BI dashboarding, charting, or sharing capabilities—it is a query engine, not a BI tool. Option B is wrong because Amazon Redshift is a cloud data warehouse optimized for large-scale analytics and SQL-based querying, but it does not natively create interactive dashboards or charts; it requires a separate BI tool like QuickSight for visualization. Option D is wrong because Amazon CloudWatch is a monitoring and observability service for AWS resources and applications, designed for metrics, logs, and alarms, not for business intelligence dashboards or ad-hoc analysis of business data from S3, RDS, or Redshift.

Practice this question →

MCQmedium

Which AWS service provides a private connection from an on-premises network to AWS that bypasses the public internet and provides consistent network performance?

A.AWS Site-to-Site VPN

B.Amazon CloudFront

C.AWS Direct Connect

D.AWS Transit Gateway

AnswerC

AWS Direct Connect delivers a dedicated, physical network connection from your on-premises location to AWS data centers through a fiber-optic link, bypassing the public internet entirely. This private connection provides predictable network performance, lower latency, higher bandwidth, and reduced data transfer costs compared to internet-based connectivity, and it supports both VPC and public service endpoints through virtual interfaces.

Why this answer

AWS Direct Connect is the correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, completely bypassing the public internet. This ensures consistent network performance, lower latency, and higher bandwidth, as the connection is established through a standard 1 Gbps or 10 Gbps Ethernet fiber-optic cable linked to an AWS Direct Connect location.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN (which also connects on-premises to AWS) with a private connection, but VPN still traverses the public internet and cannot guarantee consistent performance, whereas Direct Connect is the only option that physically bypasses the internet.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN uses the public internet to create an encrypted tunnel (IPsec), which introduces variable latency and potential bandwidth fluctuations due to internet congestion, so it does not bypass the public internet nor guarantee consistent performance. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations to accelerate delivery over the internet; it does not provide a private connection from an on-premises network to AWS. Option D is wrong because AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks, but it requires an underlying connection method (such as VPN or Direct Connect) to actually reach the on-premises network; it does not itself provide a private, internet-bypassing link.

Practice this question →

MCQmedium

A company is refactoring its legacy application into a microservices architecture using Docker containers. The operations team wants to deploy and manage these containers on AWS without the need to provision, patch, or manage the underlying servers. The solution must automatically scale containers based on demand and integrate with services like Application Load Balancer and Amazon RDS. Which AWS compute service should the company use?

A.Amazon ECS with Amazon EC2 launch type

B.Amazon ECS with AWS Fargate launch type

C.AWS Lambda

D.Amazon EC2 instances with Docker installed

AnswerB

AWS Fargate is a serverless compute engine for containers. It automatically provisions and scales the underlying infrastructure, so the team does not have to manage servers. It integrates with ECS, ALB, RDS, and other AWS services.

Why this answer

Amazon ECS with AWS Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, patch, or manage underlying servers. Fargate automatically scales containers based on demand and integrates natively with services like Application Load Balancer and Amazon RDS, meeting all the stated requirements.

Exam trap

The trap here is that candidates often confuse the EC2 launch type (which still requires server management) with Fargate (which is serverless), or mistakenly think AWS Lambda can run Docker containers as a full microservice platform, ignoring its execution time and invocation model limitations.

Why the other options are wrong

Amazon ECS with EC2 launch type requires provisioning, patching, and managing the underlying EC2 instances, which contradicts the requirement to avoid server management.

AWS Lambda is designed for short-running, event-driven functions, not for managing Docker containers as a primary compute service. It does not natively support running Docker containers or integrate with Application Load Balancer for container orchestration.

Amazon EC2 instances with Docker installed require the operations team to provision, patch, and manage the underlying servers, which contradicts the requirement to avoid server management.

Practice this question →

MCQmedium

Which AWS service provides a fully managed virtual desktop infrastructure (VDI) that allows users to access Windows or Linux desktops from any device?

A.Amazon AppStream 2.0

B.AWS Client VPN

C.Amazon WorkSpaces

D.Amazon EC2 with Remote Desktop Protocol

AnswerC

Amazon WorkSpaces is a fully managed Desktop-as-a-Service solution that provisions persistent Windows or Linux virtual desktops for users, accessible from any device. AWS handles the underlying infrastructure, including patching and resiliency, so customers do not manage instances or operating systems. It is purpose-built for VDI use cases.

Why this answer

Amazon WorkSpaces is a fully managed, secure virtual desktop infrastructure (VDI) service that provisions either Windows or Linux desktops. Users can access their persistent desktops from any supported device (e.g., PC, Mac, iPad, Chromebook) using the WorkSpaces client application or a web browser, without needing to manage the underlying EC2 instances or operating system.

Exam trap

The trap here is confusing Amazon WorkSpaces (full managed desktop VDI) with Amazon AppStream 2.0 (application streaming), as both involve streaming but serve fundamentally different use cases—one provides a complete desktop OS, the other only streams individual applications.

How to eliminate wrong answers

Option A is wrong because Amazon AppStream 2.0 is a fully managed non-persistent application streaming service that delivers individual applications to a user's browser or device, not a full virtual desktop with a persistent operating system environment. Option B is wrong because AWS Client VPN is a managed OpenVPN-based service that provides secure remote access to AWS or on-premises networks, not a virtual desktop infrastructure. Option D is wrong because Amazon EC2 with Remote Desktop Protocol (RDP) requires manual configuration, patching, and management of the EC2 instance, OS, and RDP settings, and is not a fully managed VDI service like WorkSpaces.

Practice this question →

MCQmedium

A company plans to deploy a multi-tier web application on AWS. The architecture includes Amazon EC2 instances for the web and application tiers, an Application Load Balancer for traffic distribution, and an Amazon RDS database for the data tier. The company wants to automate the provisioning and configuration of all these AWS resources in a repeatable and predictable manner. The solution should allow the infrastructure definition to be stored in a version control system and be used to create identical environments for development, testing, and production with minimal manual effort. Which AWS service should the company use to define and manage the infrastructure as code?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerA

AWS CloudFormation is the correct choice because it provides true infrastructure as code: you write a declarative JSON or YAML template that defines every resource in your multi-tier stack—EC2 instances, an Application Load Balancer, Auto Scaling groups, RDS databases, security groups, and IAM roles—along with their dependencies and configuration. This template can be version-controlled in Git, peer-reviewed, and reused across environments, enabling repeatable, predictable provisioning and updates. CloudFormation also manages the lifecycle and rollback of the entire stack, giving you full control over the exact resource definitions.

Why this answer

AWS CloudFormation is the correct service because it enables you to define your entire multi-tier infrastructure—EC2 instances, Application Load Balancer, and RDS database—as a declarative JSON or YAML template. This template can be stored in a version control system and used to provision identical environments across development, testing, and production with a single API call, ensuring repeatability and predictability.

Exam trap

The trap here is that candidates confuse AWS Elastic Beanstalk's ease-of-use with infrastructure-as-code, but Elastic Beanstalk manages the environment as a black box and does not allow you to version-control the individual resource definitions in a reusable template like CloudFormation does.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service that automates deployment and scaling, but it abstracts the underlying infrastructure and does not allow defining resources as code in a version-controlled template. The question requires infrastructure as code (IaC) for repeatable, predictable provisioning, which CloudFormation provides.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, but it is not designed for defining and managing infrastructure as code in a declarative template format like CloudFormation. The question specifically requires a service that allows infrastructure definition to be stored in version control and create identical environments, which is the core function of CloudFormation, not OpsWorks.

AWS CodeDeploy automates code deployments to running instances, not the provisioning of infrastructure resources like EC2, ALB, or RDS. It does not define or manage the entire infrastructure as code.

Practice this question →

MCQmedium

A company is building a microservices application on AWS. The application consists of multiple independent services that need to communicate asynchronously. When an order is placed, the order service must send a notification to the inventory service, the shipping service, and the analytics service simultaneously. The company wants a fully managed, durable, and scalable messaging service that supports a fan-out pattern where a single message can be delivered to multiple subscribers. Which AWS service should the company use to meet these requirements?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Streams

D.AWS Step Functions

AnswerB

Amazon SNS is a fully managed pub/sub messaging service that supports the fan-out pattern. It can send a single message to multiple subscribers, including other AWS services like Lambda, SQS, and HTTP/S endpoints, making it the ideal choice for this requirement.

Why this answer

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that supports fan-out, where a single message published to a topic is delivered to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints) simultaneously. It is durable (persists messages across AZs) and scales automatically to handle high throughput, making it ideal for the asynchronous notification requirements of the order, inventory, shipping, and analytics services.

Exam trap

The trap here is that candidates often confuse SQS (point-to-point queuing) with SNS (pub/sub fan-out), mistakenly thinking SQS can deliver to multiple consumers by using multiple queues, but SNS is the correct service for simultaneous, multi-subscriber delivery without polling.

Why the other options are wrong

Amazon SQS is a message queue service that supports point-to-point messaging, not a fan-out pattern. It cannot deliver a single message to multiple subscribers simultaneously; each message is consumed by only one consumer from a queue.

Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for simple fan-out messaging. It requires consumers to manage their own checkpointing and does not natively push messages to multiple subscribers; instead, consumers poll the stream.

AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a messaging service for fan-out message delivery. It does not natively support broadcasting a single message to multiple subscribers asynchronously.

Practice this question →

MCQmedium

A company needs to transfer petabytes of data from an on-premises data center to Amazon S3. The network connection is too slow for online transfer and the data must arrive within two weeks. Which AWS service is most appropriate?

A.AWS DataSync

B.AWS Direct Connect

C.AWS Snowball Edge

D.Amazon S3 Transfer Acceleration

AnswerC

AWS Snowball Edge is the correct service because it ships rugged, physical storage devices to your site, where you load data locally and return them to AWS, bypassing the network entirely. Each Snowball Edge device provides large capacity, and multiple devices can be used in parallel to achieve petabyte-scale migration over a constrained connection.

Why this answer

AWS Snowball Edge is the most appropriate service because it provides physical storage devices that can be shipped to the on-premises data center, allowing petabyte-scale data to be loaded locally and shipped back to AWS, bypassing slow network connections entirely. This meets the two-week deadline since network transfer would be infeasible at that scale over a slow link.

Exam trap

The trap here is that candidates often choose AWS DataSync or S3 Transfer Acceleration because they focus on 'fast transfer' without recognizing that physical shipment is the only viable method when the network is too slow for petabyte-scale data within a strict deadline.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is an online data transfer service that relies on network connectivity, making it unsuitable when the network is too slow for petabyte-scale transfers within two weeks. Option B is wrong because AWS Direct Connect establishes a dedicated network connection but still depends on the available bandwidth, which cannot overcome a fundamentally slow or congested link for such large data volumes. Option D is wrong because Amazon S3 Transfer Acceleration uses optimized network paths and edge locations but still requires an internet-based transfer, which would be too slow for petabytes of data over a constrained connection.

Practice this question →

MCQmedium

A company uses AWS CloudFormation to define and manage its production infrastructure as code. The operations team wants to ensure that any proposed changes to the stack are reviewed and explicitly approved before being applied. Which AWS CloudFormation feature should the company use?

A.AWS CloudFormation StackSets

B.AWS CloudFormation Change Sets

C.AWS CloudFormation Drift Detection

D.AWS CloudFormation Stack Policies

AnswerB

Correct. Change Sets allow you to examine how proposed changes to a stack will impact your running resources before you decide to apply them, providing a mechanism for review and approval.

Why this answer

AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the operations team to review and explicitly approve changes, ensuring that modifications are not applied automatically without oversight.

Exam trap

The trap here is that candidates often confuse Change Sets with Stack Policies, thinking that policies can enforce approval workflows, but Stack Policies only restrict updates to specific resources, not provide a review-and-approve mechanism.

Why the other options are wrong

Drift detection identifies whether a stack's actual resources have deviated from the expected template configuration, but it does not provide a mechanism to review and approve changes before they are applied.

Stack policies protect stack resources from updates, but they do not provide a review and approval workflow for proposed changes. They prevent updates to specified resources, not enable explicit approval of changes.

Practice this question →

MCQeasy

A startup's development team wants to deploy their Node.js web application to AWS without learning about load balancers, auto scaling, or EC2 configuration. They want to simply upload their application code and have AWS handle everything else. Which AWS service is designed for this use case?

A.Amazon EC2 Auto Scaling

B.AWS CloudFormation

C.Amazon ECS

D.AWS Elastic Beanstalk

AnswerD

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) specifically created for developers who want to deploy applications without dealing with the underlying infrastructure. You upload your code (or a ZIP/war file) and choose a supported platform such as Java, Node.js, Python, or Docker, and Elastic Beanstalk automatically provisions the needed resources—EC2 instances, a load balancer, an auto scaling group, and health monitoring—behind the scenes. It also manages capacity scaling and rolling application updates with minimal configuration, while still allowing fine-grained control through configuration files when needed. This makes it the simplest and most direct fit for the stated need.

Why this answer

AWS Elastic Beanstalk is the correct service because it is a Platform as a Service (PaaS) offering that automatically handles capacity provisioning, load balancing, auto scaling, and application health monitoring. The development team can simply upload their Node.js application code, and Elastic Beanstalk deploys it on pre-configured EC2 instances without requiring any manual configuration of infrastructure components.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk with Amazon ECS or EC2 Auto Scaling, mistakenly thinking that container orchestration or raw scaling services provide the same 'upload and go' abstraction, but only Elastic Beanstalk fully automates the entire deployment pipeline from code to running application without requiring infrastructure expertise.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 Auto Scaling is a scaling service that automatically adjusts the number of EC2 instances based on demand, but it does not deploy application code or manage the underlying infrastructure; it requires manual setup of launch configurations and scaling policies. Option B is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service that provisions AWS resources using templates, but it does not automatically deploy or manage application code; it requires the team to define and manage all resources themselves. Option C is wrong because Amazon ECS is a container orchestration service that requires the team to create a cluster, define task definitions, and manage Docker containers; it does not abstract away EC2 configuration or load balancer setup for a simple code upload.

Practice this question →

MCQeasy

A company needs to verify the identity of users who call into their contact center by comparing their voice against a stored voiceprint. Which AWS service provides speaker identification from voice data?

A.Amazon Transcribe

B.Amazon Rekognition

C.Amazon Connect Voice ID

D.Amazon Lex

AnswerC

Amazon Connect Voice ID is a real-time, ML-powered service embedded in the Amazon Connect contact-center platform. It creates a unique mathematical voiceprint from a caller's voice during an initial enrollment call, then compares that caller's live speech against the stored voiceprint on subsequent interactions, authenticating the speaker in seconds. Because it verifies who is speaking, not just what is spoken, it lets contact centers securely replace or supplement traditional knowledge-based security questions.

Why this answer

Amazon Connect Voice ID is the correct AWS service for real-time speaker identification and verification using voice biometrics. It compares a caller's live voice against a stored voiceprint to authenticate their identity, specifically designed for contact center use cases within Amazon Connect.

Exam trap

The trap here is that candidates confuse Amazon Transcribe (speech-to-text) with speaker identification, or assume Amazon Rekognition can handle audio, when in fact Rekognition is strictly for visual media (images and video).

How to eliminate wrong answers

Option A is wrong because Amazon Transcribe is a speech-to-text service that converts audio to text, not a speaker identification service. Option B is wrong because Amazon Rekognition analyzes images and videos for faces, objects, and text, not voice data. Option D is wrong because Amazon Lex is a service for building conversational interfaces (chatbots and IVR) using natural language understanding, not for voice biometric verification.

Practice this question →

MCQmedium

A data engineering team processes petabytes of raw log data using Apache Spark and Hadoop frameworks. They need a managed AWS service that provisions the cluster, installs the big data frameworks, and terminates the cluster after the job completes to minimise cost. Which service should they use?

A.Amazon Redshift

B.AWS Glue

C.Amazon EMR

D.Amazon Athena

AnswerC

Amazon EMR is AWS's managed big data platform that automatically provisions and configures clusters running Hadoop, Spark, Hive, Presto, HBase, and dozens of other open-source frameworks. It supports transient clusters that launch, process data, and terminate automatically, reducing cost for batch workloads since you only pay for compute time during the job. EMR also integrates natively with S3 and can leverage spot instances, making it the intended service for users who need full control over their big data infrastructure.

Why this answer

Amazon EMR is the correct choice because it is a managed big data platform that can provision Apache Spark and Hadoop clusters, install the required frameworks, and automatically terminate the cluster upon job completion using features like transient clusters and step-based lifecycle management. This minimizes cost by only paying for compute resources during active processing.

Exam trap

The trap here is that candidates confuse AWS Glue's use of Apache Spark with the ability to run custom Hadoop/Spark jobs on petabyte-scale data, but Glue is serverless and lacks the cluster management and framework installation capabilities required for this use case.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for SQL-based analytics and structured data, not for running Apache Spark or Hadoop jobs on raw log data. Option B is wrong because AWS Glue is a serverless ETL service that uses Apache Spark under the hood but does not provision or manage Hadoop clusters; it is designed for smaller-scale, event-driven data transformation, not for petabyte-scale raw log processing with custom Hadoop frameworks. Option D is wrong because Amazon Athena is a serverless interactive query service that runs SQL directly on data in S3, not a cluster-based big data framework for running Spark or Hadoop jobs.

Practice this question →

MCQeasy

A company needs to implement DevOps practices and wants a fully managed service to store their application source code with version control. Which AWS service provides managed Git repositories?

A.AWS CodeBuild

B.AWS CodeCommit

C.AWS CodeDeploy

D.AWS CodeArtifact

AnswerB

AWS CodeCommit is a managed source control service that hosts private Git repositories, giving developers full Git functionality including push, pull, branching, merging, and commit history. It integrates with IAM for fine-grained authentication and authorization, encrypts repositories in transit and at rest using AWS KMS, and works natively with CodeBuild, CodePipeline, and other AWS developer tools. This makes CodeCommit the correct service when the requirement is a durable, versioned repository for source code.

Why this answer

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own source control system by providing managed Git repositories that integrate with other AWS services, making it the correct choice for storing application source code with version control.

Exam trap

The trap here is that candidates often confuse AWS CodeCommit with AWS CodeBuild or CodeDeploy because all three are part of the AWS Developer Tools suite, but only CodeCommit provides managed Git repositories for version control.

How to eliminate wrong answers

Option A is wrong because AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages, not a Git repository hosting service. Option C is wrong because AWS CodeDeploy is a service that automates code deployments to any instance, including Amazon EC2 and on-premises, and does not provide version-controlled source code storage. Option D is wrong because AWS CodeArtifact is a fully managed artifact repository service for storing and retrieving software packages (e.g., Maven, npm, PyPI), not Git repositories.

Practice this question →

MCQmedium

A company wants to provide a virtual contact center for their customer service operations without managing any telephony infrastructure. Which AWS service enables this?

A.Amazon Chime SDK

B.Amazon Connect

C.Amazon Pinpoint

D.Amazon SES

AnswerB

Amazon Connect is a fully managed cloud contact center that provides a phone system, interactive voice response (IVR), automatic call distribution, and skills-based routing out of the box. It includes a web-based agent application, real-time and historical analytics dashboards, and deep integrations with AWS services like Amazon Lex for chatbots, Lambda for business logic, and third-party CRMs such as Salesforce and Zendesk. This comprehensive feature set lets you deploy a complete customer service operation without managing any underlying telephony infrastructure.

Why this answer

Amazon Connect is a cloud-based contact center service that enables organizations to set up a virtual contact center without managing any underlying telephony infrastructure. It provides built-in telephony, IVR, and agent management, allowing customer service operations to scale on demand without the need for physical PBX or SIP trunking.

Exam trap

The trap here is that candidates may confuse Amazon Chime SDK (a communication API) with a full contact center service, but Amazon Connect is the only AWS service designed specifically for virtual contact centers with built-in telephony management.

How to eliminate wrong answers

Option A is wrong because Amazon Chime SDK is used for embedding real-time audio/video communication into custom applications, not for building a full contact center with telephony infrastructure management. Option C is wrong because Amazon Pinpoint is a marketing and engagement service for sending targeted push notifications, emails, and SMS campaigns, not a contact center solution. Option D is wrong because Amazon SES is a transactional email sending service, not a telephony-based contact center platform.

Practice this question →

MCQeasy

A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every day and must be highly available and durable. Which S3 storage class is most appropriate for this workload?

A.S3 One Zone-IA

B.S3 Glacier Flexible Retrieval

C.S3 Standard

D.S3 Standard-IA

AnswerC

S3 Standard is designed for frequently accessed data with high durability across three AZs and high availability. It provides immediate access with low latency — perfect for frequently read video thumbnails.

Why this answer

S3 Standard is the most appropriate storage class because it offers high durability (99.999999999%) and high availability (99.99%) with low-latency access, making it ideal for frequently accessed, critical data like video thumbnails that are read multiple times daily. It provides automatic replication across a minimum of three Availability Zones, ensuring both high availability and durability without retrieval fees or minimum storage duration penalties.

Exam trap

The trap here is that candidates often choose S3 Standard-IA thinking it saves costs for any infrequently accessed data, but they overlook the per-GB retrieval fee and minimum storage duration that make it more expensive than S3 Standard for data read multiple times daily.

How to eliminate wrong answers

Option A is wrong because S3 One Zone-IA stores data in a single Availability Zone, which does not provide the high availability required for this workload; if that AZ fails, the thumbnails become unavailable. Option B is wrong because S3 Glacier Flexible Retrieval is designed for long-term archival data with retrieval times ranging from minutes to hours, not for frequently accessed thumbnails that require immediate, low-latency access. Option D is wrong because S3 Standard-IA, while durable and cost-effective for infrequently accessed data, incurs a per-GB retrieval fee and a minimum 30-day storage charge, making it more expensive and less suitable for data read multiple times every day.

Practice this question →

MCQeasy

Which AWS service enables you to run relational database workloads with up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL at a lower price point than commercial databases?

A.Amazon RDS for MySQL

B.Amazon Aurora

C.Amazon Redshift

D.Amazon DynamoDB

AnswerB

Amazon Aurora is the correct choice because its distributed, SSD-backed virtual storage layer is purpose-built to deliver up to 5x the throughput of standard MySQL and 3x that of PostgreSQL, while maintaining compatibility with those engines. Storage is replicated six ways across three Availability Zones, and redo logging is pushed to storage to reduce network and CPU overhead, enabling high write performance. Aurora also supports MySQL and PostgreSQL clients without modification, making it a drop-in relational database with superior performance and built-in high availability.

Why this answer

Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud, offering up to 5x the throughput of standard MySQL and 3x the throughput of standard PostgreSQL. It achieves this performance through a distributed, auto-healing storage subsystem that separates compute from storage, and it is priced lower than commercial databases like Oracle or SQL Server while providing high availability and durability.

Exam trap

The trap here is that candidates confuse Amazon RDS for MySQL with Amazon Aurora, assuming RDS offers the same performance enhancements, but Aurora is a separate engine with a fundamentally different distributed architecture that provides the stated throughput gains.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a managed service for standard MySQL, which does not provide the 5x throughput improvement over itself; Aurora is the enhanced version that delivers that performance boost. Option C is wrong because Amazon Redshift is a petabyte-scale data warehouse for analytical workloads, not a relational database for transactional workloads, and it does not offer MySQL or PostgreSQL compatibility or the stated throughput ratios. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational database, and it does not support MySQL or PostgreSQL compatibility or the specific throughput claims.

Practice this question →

MCQmedium

A company wants to create RESTful APIs that serve as the front door to their backend Lambda functions and EC2 services. They need features including API key management, throttling to protect backends from overload, and usage plan enforcement. Which AWS service provides this?

A.Amazon CloudFront

B.AWS Direct Connect

C.Amazon API Gateway

D.Amazon Route 53

AnswerC

Amazon API Gateway is a fully managed service that enables you to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at scale. It natively supports API key management, usage plans, throttling, quota limits, and request/response transformation, and it integrates directly with AWS Lambda, EC2, and other backends to act as the front door for your applications. These capabilities make it the correct choice for managing backend APIs.

Why this answer

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly provides built-in API key management, throttling (rate limiting and burst limits), and usage plan enforcement to protect backend services like Lambda functions and EC2 instances from overload. These features are core to API Gateway's functionality, making it the correct choice for acting as the front door to the described backend resources.

Exam trap

The trap here is that candidates often confuse Amazon CloudFront's edge caching and origin shielding capabilities with API management features, mistakenly thinking CloudFront can handle API key validation and throttling, when in fact CloudFront lacks native API key management and usage plan enforcement.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and delivers static and dynamic content at the edge; it does not natively provide API key management, throttling, or usage plan enforcement for RESTful APIs. Option B is wrong because AWS Direct Connect is a dedicated network connection from an on-premises data center to AWS, used for private, low-latency connectivity, not for managing API access, throttling, or usage plans. Option D is wrong because Amazon Route 53 is a DNS (Domain Name System) web service that translates domain names to IP addresses; it does not offer API key management, throttling, or usage plan capabilities.

Practice this question →

MCQmedium

Which AWS service provides a fully managed environment to run Apache Spark, Hadoop, and other big data frameworks for data processing and analytics?

A.Amazon Redshift

B.Amazon Athena

C.Amazon EMR

D.AWS Glue

AnswerC

Amazon EMR (Elastic MapReduce) is the correct service because it provides managed clusters of EC2 instances pre-configured with Apache Spark, Hadoop, Presto, HBase, and other big data frameworks. EMR handles cluster provisioning, configuration, auto-scaling, and monitoring, letting you focus on writing data processing logic rather than managing infrastructure. It supports both transient clusters for occasional jobs and long-running clusters for continuous workloads, and integrates tightly with S3, DynamoDB, and other AWS services. This makes it ideal for running open-source big data frameworks at scale.

Why this answer

Amazon EMR (Elastic MapReduce) is the correct answer because it is a fully managed big data platform that natively supports Apache Spark, Hadoop, Hive, Presto, and other distributed processing frameworks. It automatically provisions EC2 instances, configures the cluster, and handles scaling, patching, and monitoring, allowing you to run large-scale data processing and analytics workloads without manual infrastructure management.

Exam trap

The trap here is that candidates often confuse AWS Glue (which uses Spark for ETL) with a general-purpose Spark/Hadoop platform, but Glue is a serverless ETL service with limited customization, whereas EMR provides full control over cluster configuration, libraries, and frameworks.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a fully managed petabyte-scale data warehouse optimized for SQL-based analytics using columnar storage, not a platform for running Apache Spark or Hadoop frameworks. Option B is wrong because Amazon Athena is a serverless interactive query service that uses Presto and standard SQL to analyze data directly in S3, not a managed environment for running Spark or Hadoop jobs. Option D is wrong because AWS Glue is a serverless data integration and ETL service that uses Apache Spark under the hood for job execution, but it is not designed as a general-purpose managed cluster for running arbitrary Hadoop or Spark applications; it focuses on schema discovery, cataloging, and ETL workflows.

Practice this question →

MCQmedium

A company runs a web application where requests to /api/* should be routed to one group of EC2 instances and requests to /images/* should be routed to another group. Which AWS load balancer type supports this URL path-based routing?

A.Network Load Balancer (NLB)

B.Classic Load Balancer (CLB)

C.Gateway Load Balancer (GWLB)

D.Application Load Balancer (ALB)

AnswerD

ALB operates at Layer 7 and supports rule-based routing based on URL path, host header, HTTP headers, and query strings. Routing /api/* to one target group and /images/* to another is a standard ALB path-based routing configuration.

Why this answer

The Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports content-based routing, including path-based routing rules that direct requests to different target groups based on URL paths such as /api/* and /images/*. This makes ALB the correct choice for the described use case.

Exam trap

The trap here is that candidates may confuse the Layer 4 capabilities of NLB with Layer 7 routing features, mistakenly thinking NLB can handle URL-based routing because it supports TLS termination, but NLB cannot inspect HTTP path patterns.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP/TLS) and cannot inspect HTTP URL paths for routing decisions. Option B is wrong because the Classic Load Balancer (CLB) is a legacy option that only supports simple round-robin or sticky session routing and does not support path-based routing rules. Option C is wrong because a Gateway Load Balancer (GWLB) is designed for transparent network gateway appliances (e.g., firewalls, intrusion detection) at Layer 3/4 and does not provide HTTP path-based routing.

Practice this question →

100

MCQmedium

A company wants to implement a hub-and-spoke network architecture where multiple VPCs can communicate with a shared services VPC (containing DNS, monitoring, and security tools) but not with each other. Which AWS networking feature enables this?

A.VPC Peering with route table customization

B.AWS Transit Gateway with route tables

C.Internet Gateway with security groups

D.VPC Endpoints

AnswerB

AWS Transit Gateway provides a single managed hub that attaches to many VPCs and supports multiple route tables to control traffic flow. By associating each spoke VPC with a route table that contains only a route to the shared-services VPC attachment, you isolate spokes from each other while still granting them access to shared resources. This scales to hundreds of VPCs without the complexity of peering full meshes.

Why this answer

AWS Transit Gateway with route tables is the correct choice because it acts as a central hub that connects multiple VPCs (spokes) to a shared services VPC, while using separate route tables to prevent inter-spoke communication. This allows the shared services VPC to be reachable from all other VPCs, but the route tables can be configured to not propagate routes between the spoke VPCs, enforcing the desired isolation.

Exam trap

The trap here is that candidates often confuse VPC Peering with Transit Gateway, assuming that route table customization in peering can achieve transitive routing, but VPC Peering does not support transitive routing (e.g., if VPC A is peered with VPC B and VPC B is peered with VPC C, VPC A cannot reach VPC C through VPC B).

How to eliminate wrong answers

Option A is wrong because VPC Peering with route table customization does not support transitive routing; each peering connection is a one-to-one relationship, so to connect multiple VPCs to a shared services VPC without them communicating with each other, you would need a full mesh of peering connections and complex route table entries, which is not scalable and does not natively prevent inter-spoke traffic without additional network appliances. Option C is wrong because an Internet Gateway is used for internet connectivity, not for private VPC-to-VPC communication; it cannot route traffic between VPCs. Option D is wrong because VPC Endpoints (Gateway or Interface endpoints) are used to privately connect VPCs to AWS services (like S3 or DynamoDB) or to services powered by AWS PrivateLink, not to route traffic between multiple VPCs.

Practice this question →

101

MCQmedium

A startup wants to deploy their web application to AWS with minimal configuration. They want AWS to handle provisioning, load balancing, scaling, and health monitoring automatically. Which service is most appropriate?

A.Amazon EC2 with Auto Scaling

B.AWS Elastic Beanstalk

C.Amazon EKS

D.AWS CloudFormation

AnswerB

AWS Elastic Beanstalk is a PaaS service that abstracts away the underlying infrastructure. You simply upload your application code and Elastic Beanstalk automatically provisions and manages the environment, including the EC2 instances, load balancer, auto scaling group, and health monitoring. It also handles capacity provisioning and rolling deployments, so developers can focus on code rather than infrastructure operations. This squarely meets the requirement of minimal configuration.

Why this answer

AWS Elastic Beanstalk is the correct choice because it is a Platform-as-a-Service (PaaS) offering that automatically handles provisioning, load balancing, auto scaling, and health monitoring with minimal configuration. The startup simply uploads their web application code, and Elastic Beanstalk manages the underlying infrastructure, including the EC2 instances, Elastic Load Balancer, and CloudWatch health checks, without requiring manual setup.

Exam trap

AWS often tests the distinction between managed services (PaaS) and infrastructure services (IaaS), and the trap here is that candidates confuse Amazon EC2 with Auto Scaling as a 'fully managed' solution when it actually requires significant manual configuration for load balancing and health monitoring.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 with Auto Scaling requires manual configuration of the Auto Scaling group, launch templates, load balancer, and health checks, which contradicts the 'minimal configuration' requirement. Option C is wrong because Amazon EKS is a managed Kubernetes service that demands significant setup and expertise to configure clusters, node groups, and networking, making it overkill for a simple web application deployment. Option D is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service that requires writing and maintaining templates to define resources, which is not a fully managed platform and does not automatically handle provisioning or scaling without explicit configuration.

Practice this question →

102

MCQmedium

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The application serves users worldwide, and the company wants to optimize both performance and availability for all users. The solution should use the AWS global network to route traffic from users to the nearest edge location and then over the AWS backbone to the ALB, without caching content at edge locations. Which AWS service should the company use?

A.AWS Global Accelerator

B.Amazon CloudFront

C.AWS Shield

D.Amazon Route 53 latency-based routing

AnswerA

AWS Global Accelerator uses Anycast IP addresses at AWS edge locations to receive user traffic and then routes it over the AWS global network to the application endpoint. This improves performance by reducing internet latency and provides fast failover between regions or endpoints. It does not cache content, making it suitable for dynamic applications.

Why this answer

AWS Global Accelerator uses the AWS global network to route user traffic to the nearest edge location via Anycast IP addresses, then forwards it over the AWS backbone directly to the Application Load Balancer (ALB) in us-east-1. This optimizes performance by reducing latency and jitter, and improves availability by providing static IP addresses and health-check-based traffic shifting, without caching any content at edge locations.

Exam trap

The trap here is that candidates often confuse Global Accelerator with CloudFront because both use edge locations, but the key differentiator is that CloudFront caches content at the edge, while Global Accelerator does not cache and instead optimizes network path routing for dynamic content or non-HTTP traffic.

Why the other options are wrong

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations. The question explicitly states 'without caching content at edge locations,' so CloudFront is not suitable.

AWS Shield is a managed DDoS protection service, not a global traffic optimization service. It does not route traffic over the AWS backbone or improve performance and availability for global users via edge locations.

Route 53 latency-based routing directs traffic to the region with the lowest latency, but it does not use the AWS global network to route traffic from users to the nearest edge location and then over the AWS backbone to the ALB. It relies on DNS resolution, which can be cached and does not provide the performance optimization of a fixed entry point close to the user.

Practice this question →

103

MCQeasy

Which AWS service provides a serverless, fully managed Apache Spark processing engine for big data analytics without managing clusters?

A.Amazon EMR on EC2

B.Amazon Redshift

C.AWS Glue (serverless Apache Spark ETL)

D.Amazon Kinesis Data Analytics

AnswerC

AWS Glue provides a serverless Apache Spark environment purpose-built for ETL, meaning you do not provision, configure, or scale any cluster—AWS handles the underlying resources automatically. Glue scales compute based on the job's DPU (data processing unit) requirements and charges per DPU-second only while your job runs, which directly matches the need for a serverless Spark ETL service. This makes it the correct choice for running Spark ETL workloads without operational overhead.

Why this answer

AWS Glue provides a fully managed, serverless Apache Spark environment for ETL (extract, transform, load) workloads. It automatically provisions, configures, and scales the Spark cluster behind the scenes, so you don't need to manage any infrastructure. This makes it the correct choice for a serverless Apache Spark processing engine for big data analytics.

Exam trap

The trap here is that candidates often confuse Amazon EMR (which can run Spark but requires cluster management) with a fully serverless Spark offering, or they mistakenly think Amazon Kinesis Data Analytics supports Apache Spark when it actually supports Apache Flink and SQL for stream processing.

How to eliminate wrong answers

Option A is wrong because Amazon EMR on EC2 requires you to manage EC2 instances and clusters, even though it can run Apache Spark; it is not serverless. Option B is wrong because Amazon Redshift is a fully managed data warehouse that uses its own SQL-based engine, not Apache Spark, and it is not designed as a serverless Spark processing engine. Option D is wrong because Amazon Kinesis Data Analytics is a serverless service for real-time stream processing using Apache Flink or SQL, not Apache Spark.

Practice this question →

104

MCQeasy

Which AWS service allows you to build, train, and deploy machine learning models at scale?

A.Amazon Rekognition

B.Amazon Comprehend

C.Amazon SageMaker

D.AWS DeepLens

AnswerC

Amazon SageMaker is AWS's flagship machine learning platform, offering an integrated suite that covers the entire ML lifecycle: labeling with Ground Truth, building via Jupyter notebooks, training on managed clusters, automatic tuning with Autopilot, and deployment to scalable endpoints. It supports popular frameworks like TensorFlow, PyTorch, and XGBoost, and includes MLOps features such as pipelines, model registry, and monitoring. This makes it the correct choice as a general, end-to-end ML development platform on AWS.

Why this answer

Amazon SageMaker is the correct answer because it is a fully managed service that provides every component needed for the machine learning lifecycle, including building, training, and deploying models at scale. It offers integrated Jupyter notebooks for development, built-in algorithms, automatic model tuning, and one-click deployment to a production endpoint with auto-scaling. This makes it the single AWS service designed specifically for end-to-end ML workflows, unlike the other options which serve narrower AI/ML functions.

Exam trap

The trap here is that candidates confuse purpose-built AI services (like Rekognition or Comprehend) with the full ML platform (SageMaker), assuming any service with 'AI' in its name can handle custom model training and deployment.

How to eliminate wrong answers

Option A is wrong because Amazon Rekognition is a pre-trained AI service for image and video analysis (e.g., object detection, facial recognition) and does not allow you to build, train, or deploy custom machine learning models. Option B is wrong because Amazon Comprehend is a natural language processing (NLP) service that uses pre-trained models to extract insights from text (e.g., sentiment, entities) and cannot be used to train or deploy your own ML models. Option D is wrong because AWS DeepLens is a hardware device (a deep learning-enabled video camera) that runs pre-trained models locally for edge inference, not a service for building, training, or deploying models at scale in the cloud.

Practice this question →

105

MCQmedium

A company's data scientists want a managed environment for collaborative Jupyter notebooks connected to their AWS data sources and compute without managing infrastructure. Which AWS service provides this?

A.AWS Cloud9

B.Amazon SageMaker Studio

C.Amazon EMR Studio

D.AWS Lambda with Jupyter

AnswerB

Amazon SageMaker Studio is the purpose-built, unified integrated development environment for the entire machine learning lifecycle. It provides managed Jupyter notebooks with automatic scaling of compute resources, direct integration with SageMaker components like Experiments, Pipelines, and Model Registry, and supports collaboration through shared spaces and role-based access. Unlike generic IDEs or single-purpose tools, SageMaker Studio is designed specifically for data scientists to prepare data, build, train, tune, deploy, and monitor models all in one place.

Why this answer

Amazon SageMaker Studio is a fully managed, web-based visual interface for data scientists to build, train, debug, deploy, and monitor machine learning models. It provides collaborative Jupyter notebooks that can connect directly to AWS data sources (e.g., S3, Athena, Redshift) and compute resources (e.g., SageMaker training instances, endpoints) without requiring any infrastructure management by the user.

Exam trap

The trap here is that candidates may confuse Amazon SageMaker Studio with AWS Cloud9 or Amazon EMR Studio, because all three offer web-based development environments, but only SageMaker Studio is specifically designed for collaborative Jupyter notebooks with integrated ML compute and data source connectivity without infrastructure management.

How to eliminate wrong answers

Option A is wrong because AWS Cloud9 is a cloud-based integrated development environment (IDE) for writing, running, and debugging code, but it is not purpose-built for collaborative Jupyter notebooks with integrated ML workflows and does not natively connect to SageMaker compute or data sources. Option C is wrong because Amazon EMR Studio is a web-based IDE for big data analytics using Apache Spark, Hive, and other open-source frameworks, but it is not designed for Jupyter notebooks in a managed ML environment and focuses on EMR clusters rather than SageMaker. Option D is wrong because AWS Lambda with Jupyter is not a managed service; Lambda is a serverless compute service for running code in response to events, and it does not provide a collaborative notebook interface or persistent compute for interactive data science work.

Practice this question →

106

MCQmedium

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple Amazon EC2 instances concurrently. The EC2 instances run Amazon Linux and are deployed across multiple Availability Zones for high availability. The file system must grow and shrink automatically as files are added or removed, and the company wants to avoid provisioning storage capacity in advance. Which AWS service should the company use to meet these requirements?

A.Amazon S3

B.Amazon EBS

C.Amazon EFS

D.Amazon FSx for Windows File Server

AnswerC

Amazon EFS provides a fully managed, scalable NFS file system that can be mounted by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity on demand and charges only for the storage used, meeting all the stated requirements.

Why this answer

Amazon EFS (Elastic File System) is a fully managed NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It automatically scales storage capacity up and down as files are added or removed, eliminating the need to provision storage in advance. EFS supports the NFSv4.1 and NFSv4.0 protocols, making it ideal for shared file workloads on Amazon Linux.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared file system, overlooking that EBS volumes are single-instance attachments (except for the limited multi-attach feature) and require upfront capacity provisioning, whereas EFS is designed specifically for shared, elastic file storage across multiple instances and AZs.

Why the other options are wrong

Amazon S3 is an object storage service, not a shared file system that can be mounted by multiple EC2 instances concurrently via a standard file system interface (POSIX). It does not support automatic file system mounting or concurrent read/write locking required for a shared file system.

Amazon EBS volumes cannot be mounted by multiple EC2 instances concurrently; they are block-level storage attached to a single instance. The requirement for concurrent access across multiple instances and automatic scaling rules out EBS.

Amazon FSx for Windows File Server requires provisioning storage capacity in advance and does not automatically grow and shrink as files are added or removed. It also does not support Amazon Linux EC2 instances natively, as it is designed for Windows-based environments.

Practice this question →

107

MCQmedium

A company uses AWS and wants to make their application fault tolerant against the failure of an entire AWS Region. Which approach achieves Region-level fault tolerance?

A.Deploy resources across multiple Availability Zones within a single Region

B.Deploy the application in multiple AWS Regions with Route 53 failover routing

C.Use Reserved Instances in a single Region for guaranteed capacity

D.Enable S3 versioning in a single Region

AnswerB

Deploying the application in multiple AWS Regions and attaching Amazon Route 53 failover routing creates a primary/secondary architecture where Route 53 health checks continuously monitor the primary endpoint. When the health check fails, Route 53 automatically responds to DNS queries with the secondary Region's endpoint, instantly shifting traffic away from the impacted Region. Because each AWS Region is completely independent—with its own data centers, power grid, and network—this design offers true disaster recovery, allowing the application to remain reachable even if an entire Region becomes unavailable.

Why this answer

Deploying the application in multiple AWS Regions and using Route 53 failover routing ensures that if an entire Region becomes unavailable, traffic is automatically redirected to a healthy Region. This is the only approach that provides fault tolerance against a complete Region failure, as Availability Zones within a single Region cannot protect against a Region-wide outage.

Exam trap

The trap here is that candidates often confuse high availability within a Region (using multiple Availability Zones) with disaster recovery across Regions, and incorrectly assume that deploying across Availability Zones alone provides Region-level fault tolerance.

How to eliminate wrong answers

Option A is wrong because deploying across multiple Availability Zones within a single Region protects against the failure of a single data center, but not against the failure of an entire Region, as all Availability Zones in a Region share the same physical infrastructure and can be impacted by a Region-wide event. Option C is wrong because Reserved Instances provide a billing discount and capacity reservation in a single Region, but do not offer any fault tolerance or redundancy against Region failure. Option D is wrong because enabling S3 versioning in a single Region protects against accidental deletion or overwrite of objects, but does not provide any protection against a Region-wide outage, as all data remains in that single Region.

Practice this question →

108

MCQmedium

A web application queries a relational database for a product catalogue that changes infrequently but is requested thousands of times per second. Database query latency is becoming a bottleneck. Which AWS service can the company use to cache frequently accessed query results in memory and reduce database load?

A.Amazon RDS Read Replica

B.Amazon S3

C.Amazon ElastiCache

D.Amazon DynamoDB

AnswerC

ElastiCache provides fully managed in-memory caching with Redis or Memcached. Caching the product catalogue in ElastiCache means most requests never reach the database, dramatically reducing latency and database load.

Why this answer

Amazon ElastiCache is the correct choice because it provides an in-memory caching layer (using Redis or Memcached) that can store frequently accessed query results, reducing the need to repeatedly query the relational database. This dramatically lowers latency for high-throughput read workloads (thousands of requests per second) and offloads database pressure, directly addressing the bottleneck described.

Exam trap

The trap here is that candidates often confuse a read replica (Option A) with a caching solution, not realizing that a read replica still executes SQL queries against a relational engine and does not provide the in-memory speed needed for thousands of requests per second.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Read Replica is a read-only copy of the database that still requires querying a relational engine, which does not eliminate the latency of disk-based I/O and cannot match the sub-millisecond response times of an in-memory cache. Option B is wrong because Amazon S3 is an object store designed for blob data (images, backups, logs) and does not support low-latency, high-QPS query caching for relational database results; its request rates are limited and latency is higher than in-memory solutions. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database that, while fast, is a separate database service and not a caching layer for an existing relational database; using it would require redesigning the data model and does not cache existing query results.

Practice this question →

109

MCQmedium

A media company produces video content and stores all videos in Amazon S3. New videos are accessed frequently for the first 30 days after release. After that, access drops significantly, but the company must retain all videos for 5 years for archival purposes. The company wants to minimize storage costs without compromising retrieval speed for the frequently accessed period. Which S3 storage class strategy should the company implement?

A.Store all videos in S3 Standard for the entire 5-year retention period.

B.Store all videos in S3 Glacier Deep Archive immediately upon upload.

C.Store newly uploaded videos in S3 Standard, then use an S3 Lifecycle policy to transition them to S3 Glacier Deep Archive after 30 days.

D.Store newly uploaded videos in S3 One Zone-IA, then transition to S3 Glacier Flexible Retrieval after 30 days.

AnswerC

S3 Standard provides low-latency access for the first 30 days. An S3 Lifecycle policy automatically moves data to S3 Glacier Deep Archive after that period, minimizing long-term storage costs while meeting the archival retention requirement.

Why this answer

It uses S3 Standard for the first 30 days to ensure low-latency retrieval for frequently accessed content, then an S3 Lifecycle policy automatically transitions objects to S3 Glacier Deep Archive, which offers the lowest storage cost for long-term archival data. This balances cost and performance by matching the storage class to the access pattern, and the lifecycle transition is seamless with no manual intervention required.

Exam trap

The trap here is that candidates may confuse S3 Glacier Flexible Retrieval with S3 Glacier Deep Archive, or assume that S3 One Zone-IA is suitable for archival data, but the question explicitly requires 5-year retention and minimal cost, making Deep Archive the correct archival tier.

Why the other options are wrong

Storing all videos in S3 Standard for 5 years is cost-inefficient because after 30 days, access drops significantly, and S3 Standard has higher storage costs than archival classes like Glacier Deep Archive. The company wants to minimize costs, so keeping all data in Standard for the full period fails to achieve that.

S3 Glacier Deep Archive is designed for long-term archival with retrieval times of 12 hours or more, which would not meet the requirement for frequent access during the first 30 days after release.

S3 One Zone-IA does not provide the required durability across multiple Availability Zones, and S3 Glacier Flexible Retrieval has retrieval times that may not be suitable for the frequently accessed period. The company needs high durability and immediate retrieval for the first 30 days, which S3 Standard provides.

Practice this question →

110

MCQmedium

A company needs a managed service to forecast product demand using machine learning, helping them optimize inventory levels without building a custom ML model. Which AWS AI service provides ready-to-use time-series forecasting?

A.Amazon SageMaker

B.Amazon Forecast

C.Amazon Comprehend

D.Amazon Rekognition

AnswerB

Amazon Forecast is a fully managed time-series forecasting service that ingests historical data and uses machine learning algorithms, including the same approach used at Amazon.com, to generate demand predictions. It automatically handles data preprocessing, model selection, and training, allowing customers to upload historical data and obtain forecasts without deep ML knowledge.

Why this answer

Amazon Forecast is a fully managed service that uses machine learning to deliver highly accurate time-series forecasts based on historical data, without requiring any custom model building. It is specifically designed for use cases like product demand forecasting, inventory planning, and resource allocation, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates may confuse Amazon SageMaker as a general-purpose ML service that can do forecasting, overlooking that Amazon Forecast is the purpose-built, fully managed service for time-series forecasting without custom model development.

How to eliminate wrong answers

Option A is wrong because Amazon SageMaker is a platform for building, training, and deploying custom machine learning models, not a ready-to-use forecasting service; it requires significant ML expertise and custom development. Option C is wrong because Amazon Comprehend is a natural language processing (NLP) service for extracting insights from text, such as sentiment or entities, and has no capability for time-series forecasting. Option D is wrong because Amazon Rekognition is a computer vision service for analyzing images and videos, such as facial recognition or object detection, and cannot perform time-series forecasting.

Practice this question →

111

MCQmedium

A company is building a data lake on AWS. Which AWS service provides a serverless interactive query service that allows analysts to query data stored in Amazon S3 using standard SQL?

A.Amazon Redshift

B.Amazon Athena

C.Amazon EMR

D.AWS Glue

AnswerB

Amazon Athena is a serverless interactive query service that runs standard SQL directly against data stored in Amazon S3, using a Presto/Trino engine under the hood, so there are no servers or clusters to manage. You are billed per query based on the amount of data scanned, and results are available in seconds to minutes, which makes it ideal for ad-hoc analysis of S3 objects. In this scenario, Athena directly matches the requirement for serverless S3 querying with no infrastructure management.

Why this answer

Amazon Athena is a serverless interactive query service that enables analysts to query data stored in Amazon S3 using standard SQL. It requires no infrastructure management, as Athena automatically scales and executes queries directly against data in S3, making it the ideal choice for ad-hoc analysis on a data lake.

Exam trap

The trap here is that candidates confuse AWS Glue (an ETL service) with Athena (a query service), or assume Amazon Redshift is serverless because of its recent serverless option, but the question explicitly requires a serverless interactive query service for S3 data using standard SQL, which only Athena fulfills.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a fully managed data warehouse that requires provisioning and managing clusters, not a serverless query service; it is designed for structured data and complex analytics, not for directly querying raw data in S3 without loading. Option C is wrong because Amazon EMR is a managed big data platform that uses frameworks like Apache Spark, Hive, or Presto, requiring cluster provisioning and management, and is not serverless nor purely SQL-based without additional configuration. Option D is wrong because AWS Glue is a serverless data integration and ETL service that prepares and transforms data, but it does not provide an interactive SQL query engine; its Glue Data Catalog can be used by Athena, but Glue itself is not the query service.

Practice this question →

112

MCQeasy

A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their web servers, and automatically redirect traffic to a healthy backup server if the primary server fails. Which AWS service provides all of these capabilities?

A.Amazon VPC

B.Amazon CloudFront

C.Amazon Route 53

D.AWS Direct Connect

AnswerC

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service that translates domain names into IP addresses and offers robust health-checking and traffic-routing capabilities. It continuously checks the health of configured endpoints by sending HTTP, HTTPS, or TCP requests from multiple global locations, and when the primary resource becomes unhealthy, the failover routing policy automatically redirects traffic to a healthy secondary resource. Route 53 uniquely combines authoritative DNS resolution, endpoint monitoring, and policy-based failover in a single service, making it the correct and complete answer for this scenario.

Why this answer

Amazon Route 53 is a DNS web service that translates domain names to IP addresses. It also offers health checks that monitor the availability of web servers and can automatically route traffic away from unhealthy endpoints to healthy ones using DNS failover routing policies.

Exam trap

The trap here is that candidates may confuse CloudFront's edge caching and origin failover (which only works for specific HTTP errors) with Route 53's DNS-level health checks and failover, which operate at the network layer and can redirect traffic before it even reaches the web server.

How to eliminate wrong answers

Option A is wrong because Amazon VPC is a virtual private cloud service for launching AWS resources in a logically isolated network; it does not provide DNS resolution, health checks, or traffic failover. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches and delivers content at edge locations; while it can use DNS, it does not natively perform health checks or automatic failover routing between origin servers. Option D is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS; it does not offer DNS resolution, health monitoring, or traffic rerouting capabilities.

Practice this question →

113

MCQmedium

A company needs to ensure their containerized applications pass security scans for known vulnerabilities before being deployed to production. Which AWS service scans container images for CVEs?

A.Amazon GuardDuty

B.Amazon Inspector

C.AWS Security Hub

D.Amazon Macie

AnswerB

Amazon Inspector is the correct service because it continuously scans container images in Amazon ECR for software vulnerabilities, including known CVEs, using a constantly updated list of rules from the Common Vulnerabilities and Exposures database. When a vulnerability is found, Inspector assigns a risk score and provides detailed remediation guidance, making it the purpose-built service for finding security vulnerabilities in container images. Note that Inspector also scans Amazon EC2 instances and Lambda functions for vulnerabilities and network exposure.

Why this answer

Amazon Inspector is the correct service because it is designed to automatically scan container images stored in Amazon Elastic Container Registry (ECR) for software vulnerabilities, including Common Vulnerabilities and Exposures (CVEs). It continuously monitors the images at rest and during deployment, providing a detailed findings report that helps you remediate security issues before the container reaches production.

Exam trap

The trap here is that candidates often confuse Amazon Inspector (which scans for CVEs in container images and EC2 instances) with Amazon GuardDuty (which detects threats but does not perform vulnerability scanning), leading them to select GuardDuty because of its security monitoring name.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior using VPC Flow Logs, DNS logs, and CloudTrail events, not for scanning container images for CVEs. Option C is wrong because AWS Security Hub is a centralized security posture management service that aggregates findings from multiple AWS services (including Inspector) and performs compliance checks, but it does not itself scan container images for vulnerabilities. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data (like PII) in S3 buckets, not for scanning container images for CVEs.

Practice this question →

114

MCQmedium

A company hosts its primary web application on Amazon EC2 instances in the us-east-1 AWS Region. To meet disaster recovery requirements, the company has launched an identical set of EC2 instances in the eu-west-1 Region. The company wants to direct all user traffic to the us-east-1 endpoints under normal conditions. If us-east-1 becomes unhealthy due to a regional outage, traffic must be automatically redirected to the eu-west-1 endpoints. The company uses Amazon Route 53 as its DNS service. Which Route 53 routing policy should the company use to meet these requirements?

A.Geolocation routing

B.Latency routing

C.Failover routing

D.Weighted routing

AnswerC

Failover routing is specifically designed for active-passive failover. You configure a primary and a secondary record. Route 53 uses health checks to monitor the primary endpoint; if it fails, traffic is automatically directed to the secondary endpoint. This exactly meets the company's requirement for normal traffic to us-east-1 with automatic redirection to eu-west-1 during a failure.

Why this answer

Failover routing is the correct choice because it allows you to configure an active-passive setup where Route 53 health checks monitor the primary endpoint (us-east-1). If the health check fails, Route 53 automatically routes traffic to the secondary (eu-west-1) endpoint, meeting the disaster recovery requirement.

Exam trap

The trap here is that candidates confuse failover routing with latency routing, assuming latency-based routing will automatically redirect traffic during an outage, but latency routing does not consider endpoint health and will not fail over.

Why the other options are wrong

Geolocation routing directs traffic based on the geographic location of the user, not the health of endpoints. It cannot automatically redirect traffic from a failed region to another; it only routes based on predefined location rules.

Latency routing directs traffic based on the lowest latency for each user, not based on health checks or regional failover. It does not automatically redirect traffic from an unhealthy primary region to a secondary region.

Weighted routing distributes traffic across multiple endpoints based on assigned weights, but it does not automatically redirect all traffic to a secondary region when the primary becomes unhealthy. It lacks health-check-based failover capability.

Practice this question →

115

MCQmedium

A company needs to send transactional emails such as order confirmations and password resets at scale. Which AWS service should they use?

A.Amazon SNS

B.Amazon SQS

C.Amazon SES

D.Amazon Pinpoint

AnswerC

Amazon Simple Email Service (SES) is the appropriate choice for a solution that must reliably send transactional emails such as order confirmations and password resets at high volume. It supports both sending and receiving email, provides built-in bounce and complaint tracking, suppression lists, and deliverability monitoring, and exposes APIs that allow templated, personalized messages to be sent at scale. SES also integrates with AWS Lambda and CloudWatch for event-based notifications, making it the native AWS email delivery service rather than a general-purpose messaging or queuing system.

Why this answer

Amazon SES (Simple Email Service) is specifically designed for sending high-volume transactional and marketing emails, such as order confirmations and password resets. It provides reliable delivery with built-in feedback loops, bounce handling, and dedicated IP management, making it the correct choice for this use case.

Exam trap

The trap here is that candidates confuse Amazon SNS's email notification capability with a full transactional email service, overlooking that SNS lacks the dedicated sending infrastructure, bounce handling, and reputation management that SES provides for high-volume email delivery.

How to eliminate wrong answers

Option A is wrong because Amazon SNS (Simple Notification Service) is a pub/sub messaging service for sending notifications via SMS, email, or HTTP endpoints, but it is not optimized for high-volume transactional email delivery with dedicated sending infrastructure and bounce/complaint handling. Option B is wrong because Amazon SQS (Simple Queue Service) is a message queuing service for decoupling application components, not for sending emails. Option D is wrong because Amazon Pinpoint is a customer engagement service focused on targeted marketing campaigns, analytics, and multi-channel messaging (SMS, push, email), but it is overkill and not the primary service for straightforward transactional email sending at scale.

Practice this question →

116

MCQmedium

A company wants to automatically detect anomalies in their application metrics, such as unusual spikes in error rates, without manually setting thresholds. Which AWS service provides ML-powered anomaly detection for CloudWatch metrics?

A.Amazon GuardDuty

B.Amazon DevOps Guru

C.Amazon CloudWatch Anomaly Detection

D.AWS X-Ray

AnswerC

Amazon CloudWatch Anomaly Detection applies statistical and machine learning models to historical metric data to establish a baseline of expected behavior, then computes a dynamic band of normal values based on trends, seasonality, and variability. It automatically flags points outside this band as anomalies without requiring you to manually set static thresholds or predict how workloads will behave over time. This directly matches the scenario of detecting deviations in application metrics using ML, making it the correct answer.

Why this answer

Amazon CloudWatch Anomaly Detection applies machine learning algorithms to analyze historical CloudWatch metric data and establish a baseline of expected values. It then continuously evaluates new data points against this baseline to automatically detect anomalies, such as unusual spikes in error rates, without requiring manual threshold configuration. This makes it the correct choice for the described use case.

Exam trap

The trap here is that candidates may confuse Amazon DevOps Guru's ML-powered anomaly detection for operational issues with CloudWatch Anomaly Detection, but DevOps Guru works at a higher level across multiple AWS services and does not directly provide anomaly detection on individual CloudWatch metrics.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior in AWS accounts and workloads using VPC Flow Logs, DNS logs, and CloudTrail events, not application metrics. Option B is wrong because Amazon DevOps Guru is an ML-powered service for detecting operational issues and anomalies in application performance and resource utilization, but it analyzes operational data from multiple AWS services (e.g., Amazon RDS, Amazon DynamoDB) and provides insights via a separate console, not directly on CloudWatch metrics. Option D is wrong because AWS X-Ray is a distributed tracing service that helps analyze and debug application requests as they travel through microservices, focusing on request latency and errors, not on anomaly detection in CloudWatch metrics.

Practice this question →

117

MCQmedium

A company needs to generate a pre-signed URL to allow a business partner to download a specific S3 object for 24 hours without requiring AWS credentials. Which S3 feature enables this?

A.S3 Bucket Policy with IP-based restrictions

B.S3 Access Points

C.S3 Pre-signed URLs

D.S3 Bucket public-read ACL

AnswerC

A pre-signed URL works because an authorized IAM principal uses its Signature Version 4 credentials to sign a request for a specific S3 object and includes an expiration timestamp in the URL. Anyone with the URL can download that exact object before the expiry time, without possessing or providing AWS credentials. This is ideal for granting a temporary, single-object download to an external partner because access is automatically revoked when the expiration time passes.

Why this answer

Pre-signed URLs grant temporary access to a specific S3 object by embedding credentials in a URL signed with the bucket owner's AWS signature. The URL is valid for a specified duration (up to 7 days, here 24 hours) and allows the partner to download the object without having AWS credentials. This is the only S3 feature that provides time-limited, object-specific access without requiring the partner to authenticate with AWS.

Exam trap

The trap here is that candidates confuse pre-signed URLs with bucket policies or ACLs, thinking those can also grant temporary access, but they lack the time-limited, credential-free delegation that pre-signed URLs uniquely provide.

How to eliminate wrong answers

Option A is wrong because a bucket policy with IP-based restrictions controls access based on source IP addresses, not time-limited access, and still requires the request to be authenticated (e.g., via IAM credentials) unless combined with other settings. Option B is wrong because S3 Access Points simplify managing data access for large datasets but do not generate temporary URLs; they enforce policies at the access point level but still require AWS credentials or a pre-signed URL for anonymous access. Option D is wrong because a bucket public-read ACL makes the object publicly readable for everyone, indefinitely, without any time restriction or the ability to limit access to a specific partner.

Practice this question →

118

MCQmedium

A company has a global user base that uploads images to an Amazon S3 bucket in the us-east-1 Region. Users report slow upload speeds and frequent timeouts when uploading large files from distant locations. The company wants to use the AWS global network and edge locations to accelerate uploads to the S3 bucket. The solution must require minimal infrastructure changes on the client side and must be configured at the bucket level. Which AWS feature should the company enable?

A.Amazon S3 Transfer Acceleration

B.Amazon CloudFront with an origin access identity

C.AWS Global Accelerator using a custom routing accelerator

D.Amazon S3 cross-region replication

AnswerA

Amazon S3 Transfer Acceleration (TA) is a bucket-level feature that leverages AWS edge locations to accelerate uploads to an S3 bucket. When enabled, clients upload to a unique accelerate endpoint (e.g., `bucket.s3-accelerate.amazonaws.com`), and the data travels over the public internet only to the nearest edge; from there it is forwarded over AWS's high-bandwidth backbone to the bucket's region. This reduces latency and variability for large objects over long distances. Note that TA requires no application changes—only a switch to the accelerate endpoint URL—and is configured per bucket, not per object.

Why this answer

Amazon S3 Transfer Acceleration (A) uses AWS edge locations to route uploads over the AWS global network, reducing latency and timeouts for large files from distant locations. It is enabled at the bucket level and requires only a simple client-side change (using the accelerated endpoint instead of the standard S3 endpoint), meeting the requirement for minimal client-side modifications.

Exam trap

The trap here is confusing CloudFront's edge caching for downloads with S3 Transfer Acceleration's edge-based upload optimization, leading candidates to select CloudFront even though it does not accelerate client-to-S3 uploads.

Why the other options are wrong

CloudFront accelerates content delivery (downloads) to end users, not uploads to S3. The question specifically requires accelerating uploads, which is not a CloudFront capability.

AWS Global Accelerator improves availability and performance for TCP/UDP traffic over the AWS global network, but it does not integrate directly with S3 bucket-level configurations to accelerate uploads. The question requires a bucket-level feature, and Global Accelerator is a networking service that operates at the application endpoint level, not at the S3 bucket level.

S3 Cross-Region Replication (CRR) does not accelerate uploads; it asynchronously replicates objects after they are already uploaded. It requires a destination bucket in another region and does not use edge locations to speed up client uploads.

Practice this question →

119

MCQmedium

A company runs a web application that allows users to upload images. After each upload, the application must perform several background processing tasks (e.g., resizing, generating thumbnails) that take up to 30 seconds each. Users should receive an immediate response and the processing should continue asynchronously. The company wants a solution that scales automatically with the number of uploads and requires no server management. Which AWS service should the company use to run these background processing tasks?

A.AWS Lambda

B.Amazon EC2 with Auto Scaling

C.Amazon ECS with AWS Fargate

D.AWS Batch

AnswerA

Correct. AWS Lambda is a serverless compute service that runs code in response to events like an S3 upload. It scales automatically, requires no server management, and supports execution times up to 15 minutes, easily covering the 30-second tasks.

Why this answer

AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to events, such as an image upload to Amazon S3. It scales automatically with the number of uploads, requires no server management, and can run background tasks like resizing and thumbnail generation within its 15-minute maximum execution time, easily accommodating the 30-second processing requirement. Users receive an immediate response because the upload triggers Lambda asynchronously, decoupling the frontend from the processing.

Exam trap

The trap here is that candidates may choose Amazon ECS with AWS Fargate because they think containerization is required for complex processing, but Lambda is simpler, cheaper, and more appropriate for short-lived, event-driven tasks that fit within its execution limits.

Why the other options are wrong

Amazon EC2 with Auto Scaling requires managing server instances, patching, and scaling policies, which violates the 'no server management' requirement. It also does not provide the immediate, asynchronous response needed for the background tasks.

AWS Fargate requires managing containers and tasks, which adds complexity and overhead compared to Lambda's simpler event-driven model. For short-lived, asynchronous tasks triggered by uploads, Lambda's stateless execution and automatic scaling are more appropriate.

AWS Batch is designed for batch computing jobs that can run for hours or days, not for short-lived, event-driven tasks triggered by user uploads. It requires job queues and scheduling, adding unnecessary complexity for sub-minute processing.

Practice this question →

120

MCQmedium

A company runs an e-commerce web application on Amazon EC2 instances. During flash sales, the backend order processing service becomes overloaded and drops requests, causing customer failures. The company needs a durable, scalable, and fully managed service to buffer incoming order requests and decouple the web tier from the backend processing tier. Orders must be stored reliably and processed in the order they were received. Which AWS service should the company use?

A.Amazon Simple Notification Service (SNS)

B.Amazon Simple Queue Service (SQS)

C.Amazon Kinesis Data Streams

D.Amazon MQ

AnswerB

Amazon SQS is a fully managed message queuing service that decouples application components. It can durably store messages until they are processed, and FIFO queues guarantee exactly-once processing and strict message ordering. This matches all stated requirements.

Why this answer

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples application components. It provides durable, scalable storage for incoming order requests and supports FIFO (First-In-First-Out) queues to guarantee that messages are processed exactly once and in the order they were sent, meeting the requirement for ordered processing.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams with a message queue, but Kinesis is optimized for real-time analytics and stream processing, not for durable, ordered, exactly-once message buffering required for decoupling web and backend tiers.

Why the other options are wrong

Amazon Kinesis Data Streams is designed for real-time streaming of large-scale data, not for decoupling web and backend tiers with reliable, ordered message processing. It does not guarantee exactly-once processing or strict FIFO ordering within a shard without custom logic, and it is not a fully managed buffer for decoupling in this context.

Amazon MQ is a managed message broker service for ActiveMQ and RabbitMQ, but it is not fully managed in the sense of serverless scaling and durability; it requires provisioning and managing broker instances. It also does not guarantee strict FIFO ordering without additional configuration, and it is not the best fit for a fully managed, durable, scalable buffer that decouples tiers in a serverless manner.

Practice this question →

121

MCQeasy

Which AWS service provides a fully managed NoSQL database with single-digit millisecond latency at any scale?

A.Amazon RDS

B.Amazon ElastiCache

C.Amazon Redshift

D.Amazon DynamoDB

AnswerD

Amazon DynamoDB is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale. It uses a serverless architecture with automatic partitioning, built-in encryption, and on-demand or provisioned capacity, making it the correct choice for a NoSQL workload. Unlike relational stores, DynamoDB does not require a fixed schema, so items in the same table can have different attributes, which supports flexible, high-velocity application development.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers consistent single-digit millisecond latency at any scale. It achieves this through its distributed architecture, automatic partitioning, and SSD-backed storage, making it ideal for high-traffic applications like gaming, ad tech, and IoT.

Exam trap

The trap here is that candidates confuse Amazon ElastiCache's low-latency caching with a fully managed NoSQL database, but ElastiCache lacks persistent storage and native query capabilities, making DynamoDB the correct choice for a durable, scalable NoSQL database.

How to eliminate wrong answers

Option A is wrong because Amazon RDS is a relational database service (SQL-based) that does not provide a NoSQL data model and can experience higher latency under heavy load due to its traditional ACID constraints. Option B is wrong because Amazon ElastiCache is an in-memory caching service (Redis/Memcached) that is not a fully managed NoSQL database; it is used for caching to reduce latency but does not offer persistent, durable storage with query capabilities. Option C is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for analytical SQL queries on structured data, not a NoSQL database, and its latency is measured in seconds for complex aggregations, not single-digit milliseconds for point lookups.

Practice this question →

122

MCQmedium

A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?

A.Amazon S3

B.AWS Systems Manager Parameter Store

C.Amazon DynamoDB

D.AWS CloudFormation

AnswerB

AWS Systems Manager Parameter Store is a purpose-built, centralized store for configuration data and secrets, supporting String, StringList, and SecureString parameter types. It provides automatic versioning with rollback capability, integrates natively with AWS Identity and Access Management for fine-grained permissions, and uses AWS KMS to encrypt SecureString values with customer-managed keys. Standard parameters are free, while advanced parameters support hierarchical namespaces and parameter policies such as expiration, making this the ideal service for this use case.

Why this answer

AWS Systems Manager Parameter Store is the correct choice because it provides a secure, centralized service for storing configuration data and feature flags, with built-in version history for each parameter. It allows applications to read configuration values at runtime via the AWS SDK or CLI without hard-coding, and supports encryption using AWS KMS for sensitive data.

Exam trap

The trap here is that candidates often confuse Amazon S3's object versioning with configuration version history, but S3 lacks the centralized parameter management, secure runtime access patterns, and integration with AWS KMS that Parameter Store provides for frequently changing configuration data.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service for files and static assets, not designed for storing frequently changing configuration data with version history in a parameter-style access pattern; while S3 has versioning, it lacks the hierarchical parameter structure and secure runtime retrieval features of Parameter Store. Option C is wrong because Amazon DynamoDB is a NoSQL database for high-performance, scalable application data, not a configuration store; it requires custom code for versioning and lacks native parameter management features like tiers, policies, and secure parameter references. Option D is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning AWS resources, not a runtime configuration store; it does not provide a mechanism for applications to read configuration values at runtime without redeploying stacks.

Practice this question →

123

MCQmedium

A company wants to use Amazon S3 as their data lake but needs a way to track, search, and govern all datasets across multiple S3 buckets. Which AWS service provides centralized data catalog management?

A.Amazon Macie

B.AWS Glue Data Catalog

C.Amazon S3 Inventory

D.AWS Lake Formation

AnswerB

The AWS Glue Data Catalog is a fully managed, centralized metadata repository that stores table definitions, schema information, partition details, and the S3 locations of datasets across AWS analytics services. Glue crawlers automatically infer table schemas by scanning data in S3, and the catalog is natively integrated with Amazon Athena, Amazon Redshift Spectrum, Amazon EMR, and AWS Glue ETL jobs for querying and processing data. This makes it the correct answer for a data lake metadata catalog that enables tracking and searching datasets.

Why this answer

AWS Glue Data Catalog is a fully managed, centralized metadata repository that stores table definitions, schema information, and partition details for datasets across multiple S3 buckets. It integrates with AWS Glue ETL, Amazon Athena, and Amazon Redshift Spectrum to provide a unified view for tracking, searching, and governing data lake assets, making it the correct choice for centralized data catalog management.

Exam trap

The trap here is that candidates confuse AWS Lake Formation with the Glue Data Catalog because Lake Formation provides a visual interface for managing data lakes and uses the catalog under the hood, but the question specifically asks for the service that provides centralized data catalog management, which is the Glue Data Catalog itself.

How to eliminate wrong answers

Option A (Amazon Macie) is wrong because it is a data security and privacy service that uses machine learning to discover and protect sensitive data (e.g., PII) in S3, not a metadata catalog for tracking and governing datasets. Option C (Amazon S3 Inventory) is wrong because it generates flat-file reports of object metadata (e.g., size, last modified date) for a single bucket, not a searchable, centralized catalog across multiple buckets. Option D (AWS Lake Formation) is wrong because it is a service for building, securing, and managing data lakes, and while it uses the Glue Data Catalog internally for metadata, it is not itself the centralized catalog; its primary function is data lake setup and fine-grained access control, not standalone catalog management.

Practice this question →

124

MCQmedium

A company is developing a mobile application that requires a database to store user session data and preferences. The data is accessed very frequently with low-latency requirements, and the access patterns are unpredictable – the application experiences sudden spikes in read and write traffic. The company wants a fully managed database service that automatically scales to handle the workload, requires no patching or server administration, and charges based on the throughput consumed rather than on provisioned capacity. Which AWS service meets these requirements?

A.Amazon RDS for MySQL

B.Amazon DynamoDB

C.Amazon Redshift

D.Amazon EBS

AnswerB

Amazon DynamoDB is a fully managed NoSQL database that provides single-digit millisecond performance at any scale. It supports on-demand capacity mode, which automatically scales to accommodate traffic spikes and charges per request, eliminating the need for provisioning. It is ideal for session storage, gaming, and real-time applications.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports on-demand capacity mode, which automatically scales to handle unpredictable traffic spikes and charges based on the actual reads and writes consumed, not on pre-provisioned throughput. This eliminates the need for patching, server administration, or capacity planning, matching all the stated requirements exactly.

Exam trap

The trap here is that candidates often confuse 'fully managed' with 'serverless' and pick Amazon RDS for MySQL because it is also fully managed, but they overlook the specific requirement for throughput-based pricing and automatic scaling for unpredictable spikes, which only DynamoDB's on-demand mode provides.

Why the other options are wrong

Amazon RDS for MySQL requires provisioning capacity and does not automatically scale for unpredictable spikes; it also involves patching and server administration, and charges based on provisioned capacity, not throughput consumed.

Amazon Redshift is a data warehousing service optimized for analytical queries on large datasets, not for low-latency, high-frequency read/write operations on user session data. It requires provisioning capacity and does not charge based on throughput consumed.

Amazon EBS is a block-level storage volume for EC2 instances, not a fully managed database service. It does not automatically scale, requires server administration, and charges based on provisioned capacity, not throughput.

Practice this question →

125

MCQmedium

A company wants to provision and manage SSL/TLS certificates for their AWS resources without paying for certificates or manually handling renewals. Which AWS service provides this?

A.AWS KMS

B.AWS Certificate Manager (ACM)

C.AWS CloudHSM

D.AWS IAM

AnswerB

AWS Certificate Manager (ACM) is the correct choice because it is a fully managed service that provisions and renews SSL/TLS certificates for AWS resources such as Application Load Balancers, CloudFront distributions, and API Gateway. ACM handles the entire certificate lifecycle, including domain validation, certificate issuance, and automatic renewal before expiration. There is no need to purchase certificates, submit CSRs, or manually track renewal dates, as ACM automates these steps at no additional cost.

Why this answer

AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancing, CloudFront, API Gateway) at no additional cost. ACM automatically handles certificate renewals, eliminating the need for manual intervention.

Exam trap

The trap here is that candidates may confuse AWS KMS or CloudHSM as certificate management services because they deal with encryption, but they do not provision or renew SSL/TLS certificates.

How to eliminate wrong answers

Option A is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for managing SSL/TLS certificates. Option C is wrong because AWS CloudHSM provides dedicated hardware security modules for cryptographic key storage and operations, but it does not provision or manage SSL/TLS certificates. Option D is wrong because AWS IAM manages users, groups, roles, and permissions, and while it can store server certificates for use with Elastic Load Balancing, it does not automate certificate provisioning or renewal.

Practice this question →

126

MCQmedium

A company is migrating its on-premises infrastructure to AWS. The operations team needs a managed service that allows them to define their entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—as a reusable template stored in version control. The service must automatically handle resource dependencies, such as creating the database before launching the application servers, and ensure that the infrastructure is provisioned consistently across multiple environments (e.g., development, staging, production). Which AWS service should the company use to meet these requirements?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerA

AWS CloudFormation allows you to define your entire infrastructure as code in a template. It automatically manages resource dependencies, handles creation and updates in the correct order, and provides consistent provisioning across environments. This matches the requirement for a managed infrastructure-as-code service.

Why this answer

AWS CloudFormation is the correct choice because it provides Infrastructure as Code (IaC) capabilities, allowing you to define your entire cloud environment—including VPCs, subnets, EC2 instances, and RDS databases—in a reusable JSON or YAML template stored in version control. It automatically manages resource dependencies using the DependsOn attribute and intrinsic functions like Ref and Fn::GetAtt, ensuring resources are created in the correct order (e.g., database before application servers). CloudFormation also supports consistent provisioning across multiple environments by using parameters, mappings, and stacksets, making it ideal for the operations team's requirements.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk with Infrastructure as Code because it automates resource provisioning, but Elastic Beanstalk is a managed PaaS that does not give you full control over defining every resource (like VPCs and subnets) in a reusable template, whereas CloudFormation provides that granular, declarative control.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service that abstracts infrastructure management, not a tool for defining reusable templates in version control. It does not allow granular control over resources like VPCs and subnets, nor does it manage dependencies between resources as templates.

AWS OpsWorks is a configuration management service that uses Chef or Puppet, not a declarative template language like CloudFormation. It does not natively define entire cloud environments as reusable templates stored in version control with automatic dependency resolution across resources like VPCs, subnets, EC2, and RDS.

AWS CodeDeploy automates code deployments to running instances, not infrastructure provisioning. It does not define or manage cloud resources like VPCs, subnets, or RDS databases as reusable templates.

Practice this question →

127

MCQeasy

Which AWS service provides a fully managed NoSQL database designed for single-digit millisecond performance at any scale?

A.Amazon RDS

B.Amazon Redshift

C.Amazon DynamoDB

D.Amazon ElastiCache

AnswerC

Amazon DynamoDB is the correct answer because it is a fully managed, serverless NoSQL database that provides consistent single-digit millisecond latency at any scale. It supports both key-value and document data models, with flexible attributes and no schema constraints. DynamoDB automatically scales throughput and storage, replicates across multiple Availability Zones, and integrates natively with AWS Lambda for serverless application patterns.

Why this answer

Exam trap

The trap here is that candidates often confuse Amazon ElastiCache (an in-memory cache) with a NoSQL database, but ElastiCache is not a persistent database and lacks the durability and querying capabilities of DynamoDB.

How to eliminate wrong answers

Option A is wrong because Amazon RDS is a relational database service that supports SQL-based engines like MySQL and PostgreSQL, not a NoSQL database, and it does not guarantee single-digit millisecond performance at any scale. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for analytical queries using SQL, not a NoSQL database designed for low-latency transactional workloads. Option D is wrong because Amazon ElastiCache is an in-memory caching service (supporting Redis and Memcached) that provides microsecond latency, but it is not a fully managed NoSQL database; it is primarily used for caching and session storage, not as a persistent database.

Practice this question →

128

MCQmedium

A company wants to improve the resilience of their Amazon RDS database by ensuring that read traffic is distributed across multiple copies of the database and that a replica can be promoted if the primary fails. Which RDS feature enables this?

A.RDS Multi-AZ deployment

B.RDS Read Replicas

C.RDS Automated Backups

D.RDS Performance Insights

AnswerB

Read Replicas are asynchronous, write-ahead log (WAL) based copies of the primary database that can accept SELECT traffic, effectively distributing read workload and improving overall application throughput. You can create multiple replicas, in the same or different Regions, to scale reads globally and reduce latency for distributed users. If the primary fails, you can manually promote a replica to a standalone production instance, though promotion is not automatic. This combination of read scaling and a manual failover path directly matches the stated requirement, making it the correct choice.

Why this answer

Amazon RDS Read Replicas allow you to create one or more copies of your database instance that serve read traffic, offloading read queries from the primary DB instance. In the event of a primary failure, a Read Replica can be manually promoted to a standalone primary instance, providing resilience and continuity for read-heavy workloads. This directly matches the requirement to distribute read traffic and enable replica promotion.

Exam trap

The trap here is that candidates confuse Multi-AZ with Read Replicas, assuming Multi-AZ also distributes read traffic, but Multi-AZ's standby is passive and only used for automatic failover, not for serving reads or manual promotion.

How to eliminate wrong answers

Option A is wrong because RDS Multi-AZ deployment provides high availability by automatically failing over to a standby replica in a different Availability Zone, but that standby does not serve read traffic and cannot be promoted manually—it is only used for automatic failover. Option C is wrong because RDS Automated Backups are point-in-time recovery snapshots and transaction logs, not live copies that can serve read traffic or be promoted. Option D is wrong because RDS Performance Insights is a monitoring and diagnostic feature for database performance, not a replication or failover mechanism.

Practice this question →

129

MCQeasy

Which AWS service is used to send emails, SMS messages, and push notifications to subscribers in a publish/subscribe pattern?

A.Amazon SES

B.Amazon Pinpoint

C.Amazon SNS

D.Amazon SQS

AnswerC

Amazon SNS is the AWS-native publish/subscribe notification service: publishers send messages to a topic, and SNS immediately fans each message out to every subscriber, which can include email, SMS, mobile push, HTTP/S endpoints, SQS queues, and Lambda functions. It supports delivery policies, message filtering, and dead-letter queues, making it the correct choice for broadcasting application events to multiple consumers without coupling publishers to subscribers. SNS is also an AWS managed service with no infrastructure to provision.

Why this answer

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers via multiple protocols, including email (JSON/plain text), SMS (text messages), and push notifications to mobile devices. It decouples message producers from consumers by using topics, where each topic can have multiple subscriber endpoints that receive messages asynchronously.

Exam trap

The trap here is that candidates confuse Amazon Pinpoint's ability to send SMS and push notifications with the pub/sub pattern, but Pinpoint is a campaign and analytics tool, not a general-purpose pub/sub messaging service like SNS.

How to eliminate wrong answers

Option A is wrong because Amazon SES (Simple Email Service) is designed specifically for sending transactional and marketing emails, not for SMS or push notifications, and it does not implement a publish/subscribe pattern—it uses a sender-recipient model. Option B is wrong because Amazon Pinpoint is a customer engagement service focused on targeted marketing campaigns, analytics, and audience segmentation, not a general-purpose pub/sub messaging service; while it can send SMS and push notifications, its primary architecture is campaign-driven rather than topic-based pub/sub. Option D is wrong because Amazon SQS (Simple Queue Service) is a message queue service that uses a pull-based polling model for decoupling components, not a push-based publish/subscribe pattern, and it does not natively support sending to email or SMS endpoints.

Practice this question →

130

MCQmedium

A company runs database servers in private subnets with no direct internet access for security. However, these servers need to download OS updates from the internet. Which VPC component allows the private instances to make outbound internet connections while remaining unreachable from the internet?

A.Internet Gateway

B.NAT Gateway

C.VPN Gateway

D.VPC Endpoint

AnswerB

A NAT Gateway placed in a public subnet translates private instance IP addresses for outbound internet traffic. Return traffic is allowed back through the NAT, but no inbound connections initiated from the internet can reach the private instances.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for OS updates) while preventing the internet from initiating inbound connections to those instances. It resides in a public subnet with an Elastic IP and uses Source Network Address Translation (SNAT) to replace the private source IP with the gateway's public IP, making the response traffic routable back without exposing the private instances.

Exam trap

The trap here is that candidates confuse a NAT Gateway with an Internet Gateway, assuming both provide internet access, but the key differentiator is that a NAT Gateway only allows outbound-initiated traffic and blocks unsolicited inbound connections, which is exactly what the question requires.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway allows bidirectional traffic; attaching it to a private subnet would make instances directly reachable from the internet, violating the security requirement. Option C is wrong because a VPN Gateway establishes encrypted tunnels to on-premises networks, not to the public internet; it does not provide outbound internet access for OS updates. Option D is wrong because a VPC Endpoint provides private connectivity to AWS services (e.g., S3, DynamoDB) via the AWS network, not to general internet destinations like OS update servers.

Practice this question →

131

MCQmedium

A company runs a web application on Amazon EC2 instances that accepts user uploads. The uploads need to be processed by a backend service that performs virus scanning and thumbnail generation. The backend processing can take up to 30 seconds per upload. Users should not experience delays when submitting their files. The company wants to decouple the web tier from the processing tier so that the web application can immediately return a response to the user while the processing happens asynchronously. The solution must be fully managed, durable, and scale automatically with demand. Which AWS service should the company use?

A.Amazon Simple Notification Service (Amazon SNS)

B.Amazon Simple Queue Service (Amazon SQS)

C.Amazon Kinesis Data Streams

D.Amazon MQ

AnswerB

Amazon SQS is a fully managed message queuing service that allows you to decouple application components. The web application can send a message to a queue immediately after user upload, and the backend service can poll and process messages asynchronously. SQS stores messages durably and scales automatically, making it ideal for this use case.

Why this answer

Amazon SQS is the correct choice because it provides a fully managed, durable, and scalable message queue that decouples the web tier from the processing tier. When a user uploads a file, the web application can immediately return a response after sending a message to an SQS queue, while the backend service polls the queue and processes the upload asynchronously, handling the up-to-30-second processing time without blocking the user.

Exam trap

The trap here is that candidates often confuse SNS with SQS because both are messaging services, but SNS is push-based and not designed for decoupled asynchronous processing where the consumer needs to pull messages at its own pace.

Why the other options are wrong

Amazon SNS is a pub/sub messaging service for fan-out notifications, not for decoupling asynchronous processing with durable message queues. It does not provide the message retention, polling, or processing guarantees needed for backend tasks like virus scanning.

Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for decoupling a web tier from a processing tier with individual messages that need to be processed asynchronously. It lacks the built-in message visibility timeout and individual message lifecycle management that SQS provides for this use case.

Amazon MQ is a managed message broker service for ActiveMQ and RabbitMQ, which is not fully managed in the sense of serverless scaling and requires provisioning and managing broker instances. It does not provide the same level of automatic scaling and durability as Amazon SQS, and is overkill for simple decoupling of web and processing tiers.

Practice this question →

132

MCQmedium

A company runs a critical web application on Amazon EC2 instances in the us-east-1 Region, with a secondary standby deployment in us-west-2 for disaster recovery. The application requires that user traffic be directed to the nearest healthy endpoint, automatically failover to the secondary region if the primary region becomes unavailable, and the company needs two static IP addresses that remain fixed regardless of infrastructure changes. The application uses TCP and UDP protocols. Which AWS service should the company use to meet these requirements?

A.Amazon Route 53

B.AWS Global Accelerator

C.Amazon CloudFront

D.Elastic Load Balancing

AnswerB

AWS Global Accelerator uses the AWS global network to direct traffic to the optimal regional endpoint based on health, latency, and geography. It provides two static anycast IP addresses that remain fixed, and supports TCP and UDP. It automatically performs health checks and failover between endpoints across Regions, meeting all stated requirements.

Why this answer

AWS Global Accelerator is the correct choice because it provides two static anycast IP addresses that remain fixed regardless of infrastructure changes, directs traffic to the nearest healthy endpoint using the AWS global network, and supports automatic failover between regions for both TCP and UDP traffic. It also integrates with Network Load Balancers, Application Load Balancers, or EC2 instances to route traffic to the closest healthy endpoint, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) with anycast IP-based routing (Global Accelerator), assuming that DNS can provide static IPs and instant failover, but DNS caching and TTL delays make it unsuitable for the requirement of fixed IPs and rapid failover for both TCP and UDP traffic.

Why the other options are wrong

Amazon Route 53 provides DNS resolution and routing policies like latency-based or geolocation routing, but it does not provide static IP addresses. Route 53 can direct traffic to endpoints but relies on DNS caching, which can cause delays during failover and does not offer fixed IP addresses.

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and does not provide static IP addresses. It also does not support UDP traffic, which is required by the application.

Elastic Load Balancing distributes traffic within a single region and does not provide global traffic management, static IP addresses, or cross-region failover for disaster recovery.

Practice this question →

133

MCQmedium

A company runs a fleet of 100 EC2 instances and needs to remotely execute commands, apply patches, and collect inventory data across all instances without opening SSH ports. Which AWS service enables this?

A.AWS CloudShell

B.AWS Systems Manager

C.Amazon EC2 Instance Connect

D.AWS Config

AnswerB

Systems Manager enables fleet management including Run Command (remote script execution), Patch Manager, Inventory collection, and Session Manager (SSH-free interactive access) without requiring open inbound ports.

Why this answer

AWS Systems Manager is the correct service because it provides a unified interface to remotely execute commands, apply patches, and collect inventory data across EC2 instances without requiring SSH access. It uses the Systems Manager Agent (SSM Agent) installed on the instances and communicates over HTTPS (port 443), eliminating the need to open inbound SSH ports (port 22). This aligns directly with the requirement to manage a fleet of 100 instances securely and at scale.

Exam trap

The trap here is that candidates often confuse Amazon EC2 Instance Connect (which still requires SSH port 22 to be open) with a solution that avoids opening ports entirely, or they mistakenly think AWS CloudShell can directly manage EC2 instances, when it is only a shell for the AWS CLI.

How to eliminate wrong answers

Option A is wrong because AWS CloudShell is a browser-based shell environment for running AWS CLI commands, not a service for remotely executing commands or managing patches on EC2 instances. Option C is wrong because Amazon EC2 Instance Connect allows SSH access to instances via a one-time key push but still requires the SSH port (22) to be open in the security group, which violates the 'without opening SSH ports' constraint. Option D is wrong because AWS Config is a service for evaluating and auditing resource configurations against rules, not for executing commands, applying patches, or collecting inventory data on running instances.

Practice this question →

134

MCQeasy

A company wants to use machine learning to automatically identify objects, scenes, and activities in images uploaded by users. Which AWS service should they use?

A.Amazon Textract

B.Amazon SageMaker

C.Amazon Rekognition

D.Amazon Comprehend

AnswerC

Amazon Rekognition is the correct choice because it is a fully managed AI service that provides pre-trained models for image and video analysis via simple API calls. It can detect objects, scenes, faces, celebrities, and inappropriate content, and it also supports facial comparison and text-in-image recognition. Because the models are already trained, you do not need any ML expertise—you simply send an image and receive JSON metadata describing what the image contains.

Why this answer

Amazon Rekognition is the correct service because it is specifically designed to analyze images and videos to identify objects, scenes, activities, faces, and text. It provides pre-trained machine learning models that can automatically detect these elements without requiring custom model training, making it ideal for the use case described.

Exam trap

The trap here is that candidates often confuse Amazon Rekognition with Amazon Textract or Amazon Comprehend, mistakenly thinking text extraction or NLP can handle visual analysis, when in fact Rekognition is the only service purpose-built for image and video content recognition.

How to eliminate wrong answers

Option A is wrong because Amazon Textract is a service for extracting text, handwriting, and data from scanned documents, not for identifying objects, scenes, or activities in images. Option B is wrong because Amazon SageMaker is a fully managed machine learning platform for building, training, and deploying custom models, which is overkill and not the pre-built solution needed for this specific task. Option D is wrong because Amazon Comprehend is a natural language processing (NLP) service used to extract insights from text, such as sentiment or entities, not for analyzing visual content.

Practice this question →

135

MCQmedium

A company ingests sensor data from IoT devices into an Amazon S3 bucket. The data is accessed frequently for the first 30 days, but after that, it is rarely queried. The company’s compliance policy requires all data to be retained for 7 years. The company wants to minimize storage costs by automatically moving data to more cost-effective storage classes as it ages, without any manual intervention. Which Amazon S3 feature should the company configure to meet these requirements?

A.S3 Lifecycle policy

B.S3 Object Lock

C.S3 Replication

D.S3 Transfer Acceleration

AnswerA

Correct. An S3 Lifecycle policy can automatically transition objects to cheaper storage classes (e.g., from S3 Standard to S3 Glacier Deep Archive) based on the object's age, meeting the cost-optimization and compliance requirements without manual intervention.

Why this answer

An S3 Lifecycle policy automates the transition of objects between storage classes based on age. By configuring a lifecycle rule to move objects to S3 Standard-IA or S3 One Zone-IA after 30 days, and then to S3 Glacier Deep Archive after a longer period, the company can meet the 7-year retention requirement while minimizing costs without manual intervention.

Exam trap

The trap here is that candidates may confuse S3 Object Lock (which only enforces retention, not cost-efficient transitions) with lifecycle policies, or think S3 Replication can change storage classes, but replication only copies objects and does not alter the source's storage class over time.

Why the other options are wrong

S3 Object Lock is used to prevent objects from being deleted or overwritten for a fixed retention period, not to automatically transition objects between storage classes based on age.

S3 Replication is used to copy objects across buckets or regions for redundancy, compliance, or latency reduction, not to transition objects between storage classes based on age. It does not automate lifecycle transitions to cost-effective storage.

S3 Transfer Acceleration is designed to speed up uploads over long distances by using edge locations, not for automatically transitioning data between storage classes based on age.

Practice this question →

136

MCQmedium

Which AWS service provides a managed message broker for Apache ActiveMQ and RabbitMQ to help migrate existing messaging systems to the cloud?

A.Amazon SQS

B.Amazon SNS

C.Amazon MQ

D.Amazon Kinesis

AnswerC

Amazon MQ is the correct answer because it is the AWS managed broker service specifically built for compatibility with Apache ActiveMQ and RabbitMQ. It supports standard protocols including AMQP, MQTT, OpenWire, STOMP, and WebSocket, so existing producers and consumers can connect with little or no code changes. This eliminates the operational burden of running brokers yourself while preserving the protocol behavior that legacy applications depend on.

Why this answer

Amazon MQ is a managed message broker service that natively supports Apache ActiveMQ and RabbitMQ, making it the ideal choice for migrating existing messaging systems that rely on these protocols to the cloud without rewriting application code. It handles the provisioning, patching, and high availability of the broker infrastructure, allowing you to use standard JMS, AMQP, MQTT, and STOMP protocols.

Exam trap

The trap here is that candidates often confuse Amazon MQ with Amazon SQS or SNS because all three handle messaging, but only Amazon MQ provides managed brokers for ActiveMQ and RabbitMQ, which is specifically tested in migration scenarios.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a fully managed, pull-based queue service that uses a proprietary API and does not support ActiveMQ or RabbitMQ protocols, so it would require application code changes to migrate. Option B is wrong because Amazon SNS is a pub/sub notification service that uses HTTP/S, email, SMS, and Lambda triggers, not a message broker for ActiveMQ or RabbitMQ. Option D is wrong because Amazon Kinesis is a real-time data streaming service for ingesting and processing large data streams, not a message broker compatible with ActiveMQ or RabbitMQ.

Practice this question →

137

MCQmedium

Which AWS service enables no-code integration between SaaS applications (like Salesforce, ServiceNow, Zendesk) and AWS services for automated data flows?

A.AWS DataSync

B.Amazon AppFlow

C.AWS Glue

D.Amazon EventBridge

AnswerB

Amazon AppFlow is a fully managed integration service that lets you securely exchange data between SaaS applications and AWS services, such as S3, Redshift, and Salesforce. It provides pre-built connectors for dozens of SaaS providers, along with capabilities for data transformation, filtering, validation, and scheduling, all without writing custom code. AppFlow supports both pull (SaaS to AWS) and push (AWS to SaaS) flows, including event-triggered and on-demand transfers. This is exactly the no-code, purpose-built SaaS integration approach the scenario describes.

Why this answer

Amazon AppFlow is the correct service because it is specifically designed for no-code integration between SaaS applications (such as Salesforce, ServiceNow, and Zendesk) and AWS services, enabling automated data flows without writing any code. It supports bi-directional data transfer, transformation, and filtering, making it ideal for syncing customer records or support tickets directly into Amazon S3 or Redshift.

Exam trap

The trap here is that candidates often confuse Amazon EventBridge's event routing capability with the actual data integration and transformation features of AppFlow, assuming EventBridge can directly pull data from SaaS apps without custom code.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is a data transfer service for moving large datasets between on-premises storage and AWS (e.g., NFS/SMB to S3/EFS), not for integrating SaaS applications. Option C is wrong because AWS Glue is a serverless ETL service that requires writing or generating code (e.g., PySpark or Scala) for data preparation and cataloging, not a no-code SaaS integration tool. Option D is wrong because Amazon EventBridge is an event bus service for routing events between AWS services and custom applications, but it does not provide built-in connectors for SaaS applications like Salesforce or ServiceNow for automated data flows without custom code.

Practice this question →

138

MCQmedium

A company runs a monolithic order processing application on a single Amazon EC2 instance. During peak hours, the instance receives a sudden burst of orders that exceeds its processing capacity. Orders are dropped and customers do not receive confirmations. The company needs a solution that buffers incoming orders, stores them durably, and allows the application to process them at a manageable pace. The solution must be fully managed and ensure that no orders are lost. Which AWS service should the company use to meet these requirements?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Firehose

D.Amazon ElastiCache

AnswerA

Amazon Simple Queue Service (SQS) is a fully managed message queue that provides durable, reliable storage of messages until they are retrieved by consumers. It decouples the order submission frontend from the backend processing application, allowing orders to be enqueued and asynchronously processed, which absorbs traffic bursts and prevents message loss even if the consumer is temporarily unavailable.

Why this answer

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples application components. It durably stores incoming orders in a queue, allowing the EC2 instance to poll and process them at its own pace, preventing order loss during traffic bursts. SQS guarantees at-least-once delivery and provides a buffer that absorbs spikes in demand.

Exam trap

The trap here is that candidates confuse SNS (push-based) with SQS (pull-based), assuming any notification or messaging service can buffer orders, but only SQS provides the durable, decoupled queue needed for the application to process at its own pace.

Why the other options are wrong

Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, but it does not buffer or store messages durably. If the application cannot keep up, messages are dropped, and SNS does not allow the application to process orders at a manageable pace.

Amazon Kinesis Data Firehose is designed for streaming data ingestion into data stores and analytics services, not for buffering and decoupling application processing. It does not provide the message-level buffering and decoupling needed to allow the monolithic application to process orders at a manageable pace without loss.

Amazon ElastiCache is an in-memory caching service, not a durable buffer. It does not guarantee persistence of messages; data can be lost on node failure or restart, so it cannot ensure no orders are lost.

Practice this question →

139

MCQmedium

A company wants to automate the deployment of its infrastructure across multiple AWS environments (development, staging, production). The operations team needs to define all AWS resources (such as Amazon EC2 instances, security groups, and load balancers) in a declarative JSON or YAML template. They want to version control these templates, quickly replicate the entire infrastructure in a new region, and ensure that each deployment is consistent and repeatable. Which AWS service should the company use to achieve this?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS CodePipeline

AnswerA

CloudFormation is the correct service because it provides Infrastructure as Code using declarative JSON or YAML templates to define and provision AWS resources consistently across environments. Templates can be version-controlled, and stacks can be replicated in different regions.

Why this answer

AWS CloudFormation is the correct choice because it allows you to define all AWS resources (EC2 instances, security groups, load balancers) in a declarative JSON or YAML template. These templates can be version-controlled, enabling you to replicate the entire infrastructure in a new region by simply reusing the same template, ensuring consistent and repeatable deployments across environments.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk (which also uses templates but is application-focused) with CloudFormation, or they think AWS CodePipeline can define infrastructure directly, but CodePipeline only orchestrates pipelines and relies on other services like CloudFormation for provisioning.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service for deploying applications, not for declaratively defining infrastructure resources like EC2 instances, security groups, and load balancers in JSON/YAML templates. It abstracts infrastructure management, whereas the question requires explicit resource definition and version control.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, not declarative JSON/YAML templates for defining infrastructure. It focuses on managing server configurations and application stacks, not on provisioning all AWS resources in a declarative, version-controlled template.

AWS CodePipeline is a continuous delivery service for automating build, test, and deploy phases, not for defining infrastructure resources in declarative templates. It does not directly manage or provision AWS resources like EC2 instances or security groups.

Practice this question →

140

MCQmedium

A company wants to accelerate their machine learning workflows by using pre-trained foundation models for tasks like text generation and image creation without training models from scratch. Which AWS service provides access to pre-trained foundation models via API?

A.Amazon SageMaker

B.Amazon Rekognition

C.Amazon Bedrock

D.AWS DeepComposer

AnswerC

Amazon Bedrock is a fully managed service that provides serverless API access to a broad selection of foundation models from Amazon, Anthropic, Meta, Stability AI, Cohere, and AI21 Labs. Using APIs like InvokeModel, you can build generative AI applications—including text generation, image generation, and question answering—without provisioning or managing any model training or inference infrastructure. Because the scenario requires a platform for accessing pre-trained foundation models via API, Bedrock is the correct choice.

Why this answer

Amazon Bedrock is a fully managed service that provides access to pre-trained foundation models (FMs) from leading AI providers like AI21 Labs, Anthropic, Cohere, Meta, Stability AI, and Amazon via a single API. It enables you to build generative AI applications for tasks such as text generation and image creation without managing underlying infrastructure or training models from scratch.

Exam trap

The trap here is that candidates often confuse Amazon SageMaker (a full ML lifecycle service) with Bedrock (a managed FM API service), or mistakenly think Amazon Rekognition or AWS DeepComposer provide general-purpose generative AI capabilities, when in fact they are specialized for narrow use cases.

How to eliminate wrong answers

Option A is wrong because Amazon SageMaker is a machine learning platform for building, training, and deploying custom models, not a service that provides direct API access to pre-trained foundation models. Option B is wrong because Amazon Rekognition is a specialized service for image and video analysis (e.g., object detection, facial recognition) and does not offer generative foundation models for text generation or image creation. Option D is wrong because AWS DeepComposer is a service for creating music using generative AI, specifically for composing melodies, and is not a general-purpose API for accessing pre-trained foundation models for text or image generation.

Practice this question →

141

MCQmedium

A company manages a fleet of hundreds of Amazon EC2 instances running across multiple AWS Regions. The company's security policy requires that all instances be patched with the latest security updates within 7 days of release. The operations team currently logs in to each instance manually to apply patches, which is time-consuming and error-prone. The team wants to automate the patching process, track compliance across all instances, and receive reports on patch status. The solution must not require any changes to the existing application code or the use of additional third-party software. Which AWS service should the operations team use to meet these requirements?

A.AWS Config

B.AWS Systems Manager

C.Amazon Inspector

D.AWS Trusted Advisor

AnswerB

AWS Systems Manager is the correct choice because its Patch Manager capability automates the entire patching workflow for EC2 instances, including scanning for missing security updates, deploying patches on a schedule, and generating compliance reports. This directly addresses both the need to apply patches across hundreds of instances and to track which ones are compliant. Systems Manager also integrates with IAM, CloudTrail, and SSM Agent, making it the AWS-native solution for fleet-wide patch management.

Why this answer

AWS Systems Manager is the correct choice because it provides Patch Manager, a native capability that automates the patching of EC2 instances across multiple Regions without requiring any changes to application code or third-party software. It also integrates with Systems Manager Compliance to track patch status and generate reports, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration changes) with Systems Manager (which can both track and remediate), leading them to choose Config for compliance reporting while overlooking the patching automation requirement.

Why the other options are wrong

AWS Config tracks resource configuration changes and evaluates compliance against rules, but it cannot automate patching or apply updates to EC2 instances. It lacks the capability to execute patching workflows.

Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, but it does not automate patching or track patch compliance across instances.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not automate patching of EC2 instances or track patch compliance across multiple Regions.

Practice this question →

142

MCQmedium

A retail company wants to implement a recommendation engine based on customer purchase history. Which AWS service is designed to provide ML-based personalized recommendations with no ML experience required?

A.Amazon SageMaker

B.Amazon Personalize

C.Amazon Comprehend

D.Amazon Rekognition

AnswerB

Amazon Personalize is a fully managed machine learning service that provides real-time personalized product recommendations and user segmentation, using the same recommendation technology that powers Amazon.com. You only need to supply interaction data, create a campaign, and the service automatically trains, tunes, and deploys an appropriate model. It requires no ML expertise, making it the correct choice for developers who want to add recommendation functionality directly to their applications.

Why this answer

Amazon Personalize is a fully managed AWS service that enables developers to build applications with real-time personalized recommendations without requiring any prior machine learning experience. It uses the same technology that powers Amazon.com's recommendation engine, processing customer purchase history to deliver tailored product suggestions.

Exam trap

The trap here is that candidates often confuse Amazon SageMaker as the go-to ML service for any ML task, overlooking that Amazon Personalize is specifically designed for recommendation use cases with minimal ML expertise required.

How to eliminate wrong answers

Option A is wrong because Amazon SageMaker is a comprehensive ML service that requires users to build, train, and deploy their own models, demanding significant ML expertise and coding, not a no-experience-required solution. Option C is wrong because Amazon Comprehend is a natural language processing (NLP) service for extracting insights from text (e.g., sentiment, entities), not for generating personalized recommendations from purchase history. Option D is wrong because Amazon Rekognition is a computer vision service for analyzing images and videos (e.g., object detection, facial recognition), not for building recommendation engines.

Practice this question →

143

MCQeasy

Which AWS service is used to distribute incoming application traffic across multiple EC2 instances to improve availability and fault tolerance?

A.Amazon Route 53

B.Amazon CloudFront

C.Elastic Load Balancing

D.AWS Auto Scaling

AnswerC

Elastic Load Balancing (ELB) is the AWS service specifically designed to automatically distribute incoming application or network traffic across multiple targets, such as EC2 instances, in one or more Availability Zones. ELB performs health checks on registered instances and routes traffic only to healthy instances, thereby improving fault tolerance and availability. It also integrates with Auto Scaling to dynamically add and remove instances while continuously balancing traffic, making it the correct answer for distributing traffic across EC2 instances.

Why this answer

Elastic Load Balancing (ELB) automatically distributes incoming application traffic across multiple Amazon EC2 instances in one or more Availability Zones. By doing so, it increases the fault tolerance of your application because if one instance fails, the load balancer routes traffic to the remaining healthy instances, ensuring high availability. ELB supports multiple types (Application, Network, and Gateway Load Balancers) to handle different traffic patterns and protocols.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's DNS routing policies (like weighted or latency-based routing) with actual load balancing, but Route 53 only resolves DNS queries and does not manage traffic distribution to EC2 instances at the application or network layer.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 is a DNS web service that translates domain names to IP addresses and routes end users to internet applications, but it does not distribute traffic across EC2 instances for load balancing. Option B is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations to accelerate delivery of static and dynamic web content, not a load balancer for distributing traffic across EC2 instances. Option D is wrong because AWS Auto Scaling automatically adjusts the number of EC2 instances based on demand, but it does not distribute incoming traffic; it works in conjunction with a load balancer to scale the fleet.

Practice this question →

144

MCQmedium

A healthcare company needs to store patient medical records that must be retained for 10 years to comply with regulatory requirements. These records are accessed very rarely, only in the event of an audit or legal request. Which Amazon S3 storage class is the MOST cost-effective choice for this data?

A.S3 Standard

B.S3 Intelligent-Tiering

C.S3 One Zone-IA

D.S3 Glacier Deep Archive

AnswerD

S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of data that is accessed extremely rarely (e.g., once or twice per year). It provides secure and durable storage with retrieval times of 12-48 hours, making it the most cost-effective choice for regulatory archives with a 10-year retention requirement.

Why this answer

S3 Glacier Deep Archive is the most cost-effective choice because it is designed for long-term retention of rarely accessed data with a retrieval time of 12–48 hours. The 10-year retention requirement and infrequent access pattern (only during audits or legal requests) align perfectly with this storage class, offering the lowest storage cost among S3 classes while still meeting compliance needs.

Exam trap

The trap here is that candidates often choose S3 Glacier (Flexible Retrieval) instead of S3 Glacier Deep Archive, confusing the two, but the question specifically asks for the 'most cost-effective' option for data accessed 'very rarely' over a 10-year period, making Deep Archive the correct choice due to its lower storage cost and longer retrieval time.

Why the other options are wrong

S3 Standard is designed for frequently accessed data with low latency and high throughput, making it cost-ineffective for rarely accessed data that must be retained for 10 years. The storage cost is significantly higher than archival classes like S3 Glacier Deep Archive.

S3 Intelligent-Tiering is designed for data with unknown or changing access patterns, but this question specifies that records are accessed very rarely (only for audits/legal requests). Intelligent-Tiering incurs monitoring and automation fees that make it less cost-effective than S3 Glacier Deep Archive for data with predictable, infrequent access.

S3 One Zone-IA stores data in a single Availability Zone, which does not meet the durability and availability requirements for critical patient medical records that must be retained for 10 years. Regulatory compliance typically mandates multi-AZ redundancy to prevent data loss from zone failures.

Practice this question →

145

MCQmedium

A company needs to synchronize files between their on-premises file server and Amazon S3 on a recurring schedule, detecting and copying only the changed files. Which AWS service is designed for this use case?

A.AWS Snowball

B.Amazon S3 Transfer Acceleration

C.AWS DataSync

D.AWS Storage Gateway

AnswerC

AWS DataSync is a fully managed data movement service that automates copying data between on-premises storage (NFS/SMB) and AWS storage (S3, EFS, FSx) using a lightweight agent deployed in the on-premises environment. It performs incremental transfers by scanning the source for changed files, supports scheduled recurring tasks, validates data integrity with checksums, and encrypts data in transit with TLS. This combination of automatic change detection, scheduling, and validation makes it the correct answer for ongoing synchronization between on-premises servers and AWS.

Why this answer

AWS DataSync is purpose-built for automating and accelerating the transfer of data between on-premises storage systems and AWS storage services, including Amazon S3. It supports incremental, scheduled transfers that detect and copy only changed files, making it the ideal choice for recurring file synchronization with S3.

Exam trap

The trap here is that candidates confuse AWS Storage Gateway's file gateway with DataSync, but file gateway provides a live file server interface to S3 rather than a scheduled, agent-based sync tool for changed files.

How to eliminate wrong answers

Option A is wrong because AWS Snowball is a physical data transport device used for large-scale, one-time data migrations, not for recurring scheduled synchronization of changed files. Option B is wrong because Amazon S3 Transfer Acceleration only speeds up uploads to S3 over the internet by using AWS edge locations; it does not provide scheduling, change detection, or on-premises agent capabilities. Option D is wrong because AWS Storage Gateway offers file gateway, volume gateway, and tape gateway modes for hybrid cloud storage, but its file gateway does not natively support recurring scheduled synchronization of changed files to S3; it provides a cached or stored volume interface rather than a dedicated sync service.

Practice this question →

146

MCQmedium

A company wants to ensure their containerized microservices can discover each other by name without hard-coding IP addresses. Which AWS service provides DNS-based service discovery for ECS and EKS?

A.Amazon Route 53

B.AWS Cloud Map

C.Elastic Load Balancing

D.Amazon VPC

AnswerB

AWS Cloud Map is a fully managed service discovery service that maintains a registry of application resources such as containers, EC2 instances, and serverless functions, and automatically registers instances when they become healthy and de-registers them when they terminate. It supports both DNS-based discovery (using automatically updated A/SRV records) and API-based discovery via the DiscoverInstances endpoint, letting clients query live, healthy endpoints. This dynamic behavior directly addresses the need to track services that scale up and down, which is why Cloud Map is the correct answer here.

Why this answer

AWS Cloud Map is a cloud resource discovery service that enables microservices to dynamically discover each other by name using DNS queries or API calls. It integrates directly with Amazon ECS and EKS, allowing containers to register and resolve service endpoints without hard-coded IP addresses, making it the correct choice for DNS-based service discovery.

Exam trap

The trap here is that candidates often confuse Route 53's general DNS capabilities with Cloud Map's specialized service discovery, overlooking that Route 53 lacks the dynamic registration and health-check-aware instance management required for containerized microservices.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 is a DNS web service primarily for domain registration and routing traffic to AWS resources, but it does not provide native service discovery for dynamic containerized microservices with health checks and instance registration. Option C is wrong because Elastic Load Balancing distributes incoming traffic across targets but does not offer DNS-based service discovery for containers to find each other by name. Option D is wrong because Amazon VPC provides networking isolation and IP address management, but it lacks built-in service discovery mechanisms for resolving service names to dynamic IP addresses.

Practice this question →

147

MCQmedium

A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?

A.Amazon VPC with security groups

B.AWS App Mesh

C.Amazon API Gateway

D.AWS Transit Gateway

AnswerB

AWS App Mesh is a managed service mesh that uses Envoy sidecar proxies to control and observe microservice-to-microservice traffic. It provides mutual TLS encryption between services, fine-grained traffic routing with retries and timeouts, and integrates with AWS X-Ray and Amazon CloudWatch for metrics and traces. This makes App Mesh the correct choice when the requirement is application-level traffic management, identity-based security, and observability across services, rather than simple network connectivity.

Why this answer

AWS App Mesh is a service mesh that provides application-level networking, enabling microservices to communicate securely with mutual TLS (mTLS) and offering observability through metrics, logs, and traces. It integrates with AWS services like AWS X-Ray and Amazon CloudWatch to track network traffic between services, making it the correct choice for this requirement.

Exam trap

The trap here is that candidates often confuse network-level services like VPC security groups or Transit Gateway with application-level service mesh capabilities, overlooking that mTLS and observability require a dedicated service mesh like AWS App Mesh.

How to eliminate wrong answers

Option A is wrong because Amazon VPC with security groups provides network-level traffic filtering and segmentation, not service mesh capabilities like mTLS or observability at the application layer. Option C is wrong because Amazon API Gateway is a managed API proxy for creating, publishing, and securing APIs, not a service mesh for inter-service communication within a microservices architecture. Option D is wrong because AWS Transit Gateway is a network transit hub for connecting VPCs and on-premises networks, lacking service mesh features such as mTLS and observability for service-to-service traffic.

Practice this question →

148

MCQeasy

Which AWS service provides managed Elasticsearch (OpenSearch) clusters for log analytics and full-text search?

A.Amazon CloudSearch

B.Amazon OpenSearch Service

C.Amazon Athena

D.Amazon Redshift

AnswerB

Amazon OpenSearch Service provides managed OpenSearch and Elasticsearch clusters for near-real-time log analytics and search, exposing the standard RESTful search APIs and Kibana dashboards without requiring you to run a control plane. It automatically handles cluster provisioning, scaling, patching, and data replication, while supporting index-based data structures that enable fast full-text and aggregated queries across large log datasets.

Why this answer

Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) is the correct choice because it provides managed clusters for Elasticsearch and OpenSearch, enabling log analytics, full-text search, and real-time application monitoring. It integrates with Logstash and Kibana (the ELK stack) and supports the OpenSearch API, making it the direct AWS offering for this use case.

Exam trap

The trap here is that candidates often confuse Amazon CloudSearch (a simpler, proprietary search service) with Amazon OpenSearch Service, not realizing that CloudSearch does not support the Elasticsearch/OpenSearch ecosystem required for log analytics and Kibana integration.

How to eliminate wrong answers

Option A is wrong because Amazon CloudSearch is a managed search service that uses its own proprietary search engine and API, not Elasticsearch or OpenSearch, and is designed for simpler full-text search use cases like website search, not log analytics. Option C is wrong because Amazon Athena is a serverless interactive query service for analyzing data in Amazon S3 using standard SQL, not a managed search or analytics engine for Elasticsearch/OpenSearch clusters. Option D is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for SQL-based analytics on structured data, not for real-time log analytics or full-text search with Elasticsearch/OpenSearch.

Practice this question →

149

MCQmedium

A company manages a fleet of hundreds of EC2 instances and needs to automate patching across all instances, run commands remotely without SSH, and store configuration parameters centrally. Which AWS service provides these operational management capabilities?

A.Amazon CloudWatch

B.AWS Config

C.AWS Systems Manager

D.AWS CloudFormation

AnswerC

AWS Systems Manager is the native operations hub that delivers exactly the capabilities described in the question: Patch Manager automates both scanning and installation of missing OS patches across EC2 and hybrid fleets; Run Command provides agent-based remote command execution without requiring SSH/RDP; Session Manager offers short-lived, browser-based interactive shells; and Parameter Store securely centralizes configuration data and secrets for applications. Its SSM Agent, running on managed instances, is what makes in-guest operations and patching possible, tying the entire set of features together. In the CLF-C02 context, when a question asks for one service that covers patching, remote execution, and parameter storage, Systems Manager is the only answer.

Why this answer

AWS Systems Manager is the correct choice because it provides a unified interface for operational management tasks, including automated patching via Patch Manager, remote command execution without SSH using Run Command, and centralized parameter storage with Parameter Store. These capabilities directly address the need to manage fleets of EC2 instances at scale without requiring direct network access to each instance.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager with AWS Config because both deal with 'management' and 'configuration,' but Config is only for compliance auditing and drift detection, not for patching or remote command execution.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch is a monitoring and observability service for metrics, logs, and alarms, not a tool for patching, remote command execution, or parameter storage. Option B is wrong because AWS Config is a service for evaluating and auditing resource compliance against desired configurations, not for automating patching or running commands remotely. Option D is wrong because AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning and managing AWS resources via templates, not for ongoing operational tasks like patching or remote command execution.

Practice this question →

150

MCQmedium

A company runs a globally distributed multiplayer game on AWS. The game uses UDP for real-time communication and requires static IP addresses that do not change for whitelisting by internet service providers. The company needs to route traffic to the nearest healthy application endpoint to minimize latency and improve performance. The solution must work with both TCP and UDP traffic and provide static IP addresses. Which AWS service should the company use?

A.AWS Global Accelerator

B.Amazon CloudFront

C.Amazon Route 53

D.AWS Direct Connect

AnswerA

AWS Global Accelerator is correct because it provides static Anycast IP addresses at AWS edge locations, which route incoming TCP/UDP traffic over the AWS global network to the nearest healthy application endpoint. Unlike DNS-based services, it optimizes the network path at the packet level for latency-sensitive multiplayer game connections, and it offers fast failover without client-side DNS caching issues. This makes it ideal for globally distributed real-time games that need predictable performance and connection resilience.

Why this answer

AWS Global Accelerator provides static IP addresses that serve as fixed entry points to your application, and it uses the AWS global network to route traffic to the nearest healthy endpoint via Anycast. It supports both TCP and UDP traffic, making it ideal for real-time UDP-based gaming workloads that require low latency and static IPs for ISP whitelisting.

Exam trap

The trap here is that candidates often confuse CloudFront's edge caching with Global Accelerator's network-layer optimization, but CloudFront does not support UDP or provide static IPs, making it unsuitable for real-time gaming traffic.

Why the other options are wrong

Amazon CloudFront is a content delivery network (CDN) that primarily handles HTTP/HTTPS traffic and does not support UDP traffic, which is required for the real-time game communication. It also does not provide static IP addresses for whitelisting.

Amazon Route 53 does not provide static IP addresses for whitelisting; it uses DNS-based routing, which can change IP addresses. It also does not natively handle UDP traffic for real-time communication with static IPs.

AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but it does not provide global traffic routing to the nearest healthy endpoint, nor does it offer static IP addresses for whitelisting by ISPs. It is not designed for global traffic distribution or UDP optimization.

Practice this question →