CCNA Cloud Technology and Services Questions

AWS Glue is a serverless ETL service that combines schema discovery, a managed data catalog, and Spark-based transformation jobs in one offering. A Glue Crawler automatically scans S3 or databases, infers schemas, and writes table metadata to the Glue Data Catalog, which makes the data immediately queryable by services like Athena and Redshift Spectrum. Glue ETL Jobs run on a managed, auto-scaling Spark environment without any infrastructure provisioning, and can load transformed results directly into Amazon Redshift, exactly matching the serverless and schema-discovery requirements of the scenario.

AWS Transit Gateway is a central hub that connects VPCs and on-premises networks. It supports hub-and-spoke topology, scales to hundreds of VPCs, and works with Direct Connect and VPNs. This meets the requirement for simplified, scalable connectivity with centralized routing.

Amazon Route 53 combines domain registration, authoritative DNS hosting, and health checking into a single managed service. It supports alias resource record sets that let you point a domain directly to AWS resources such as an Application Load Balancer or an S3 website endpoint without exposing an IP address. It also offers routing policies like latency-based, geolocation, weighted, and failover to control global traffic.

Amazon EFS is a fully managed, POSIX-compliant network file system built on NFSv4 that can be mounted concurrently by hundreds of EC2 instances across multiple Availability Zones. It scales storage capacity and throughput automatically as files are added or removed, eliminating capacity provisioning. With features like VPC mount targets, security groups, and IAM authorization, EFS provides a native shared file system that supports consistent, low-latency reads and writes from many instances, exactly matching the scenario.

Correct. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, providing high availability. It also handles automated backups, patching, and replication.

Step Functions Standard Workflows support long-running executions lasting up to one year and include callback patterns with wait-for-task tokens, enabling human approval steps. Express Workflows cap at five minutes, so Standard is required for this duration and approval constraint.

Amazon Polly is AWS's fully managed text-to-speech (TTS) service that converts text into lifelike speech using advanced deep-learning models. It supports dozens of languages and many standard, neural, and generative voice styles, producing natural-sounding audio that can be saved as files (e.g., MP3, OGG) for use in document narration, podcasts, or accessibility applications. This aligns exactly with the requirement to convert textual content into spoken audio, making Polly the correct service for this scenario.

Amazon CloudWatch is the native AWS monitoring service that ingests time-series metrics from more than 70 AWS services and custom applications via the PutMetricData API, then stores them for 15 months. You can build custom dashboards that visualize these metrics, configure alarm rules that trigger on thresholds (e.g., CPU > 80%), and combine with CloudWatch Logs and events to automate responses. This is precisely the dashboarding and alarm functionality required for real-time operational monitoring.

AWS Cloud9 is a fully browser-based integrated development environment that runs on an EC2 instance, providing a complete code editor, integrated terminal, debugger, file tree, and real-time collaboration features. It allows developers to write, run, and debug code directly from the browser without installing any local software, making it the correct choice for this scenario.

Amazon SNS is a fully managed pub/sub service that fans out a single message to multiple subscriber protocols at once, including HTTP/S, Lambda, SQS, SMS, mobile push, and email. For this requirement, an SNS topic can publish one operational alert and immediately deliver it to both mobile devices (SMS/push) and email, with no additional orchestration. Because SNS actively pushes messages to subscribers, it is purpose-built for event-driven, real-time notifications rather than marketer-controlled campaigns.

AWS Transit Gateway is a network transit hub that connects VPCs, VPN connections, and AWS Direct Connect connections. It supports transitive routing, allowing all attached networks to communicate through a single gateway, which simplifies network architecture.

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and Amazon EKS. With Fargate, you do not need to provision or manage EC2 instances; you specify the CPU and memory requirements, and Fargate automatically runs and scales the containers. This fully meets the requirement of a serverless container compute service with no cluster management.

AWS Application Migration Service (MGN) is the correct choice because it continuously replicates the entire source server—OS, system configuration, applications, and data—to a staging area in AWS. It uses agent-based block-level replication, lets you test cutover on non-disruptive test instances, and allows a final, near-zero-downtime cutover to production EC2 instances. This makes MGN the current AWS-recommended lift-and-shift service for physical, virtual, or cloud servers.

Amazon CloudFront is a global content delivery network (CDN) that caches static assets such as images, CSS, and JavaScript at edge locations close to users, dramatically reducing latency for a worldwide customer base. For dynamic content, it terminates user connections at the edge and forwards requests to the origin over AWS's private backbone network, improving response times for personalized e-commerce pages and API calls. By combining edge caching with optimized routing, CloudFront directly addresses the requirement to reduce latency for a global audience.

Amazon SQS is a fully managed message queue service that decouples application components. Front-end servers can send job requests to an SQS queue, and back-end servers process them asynchronously. Messages are stored durably across multiple Availability Zones, and the front end can continue sending requests without waiting for the back end to be ready. This correctly meets the requirement for a durable, fully managed decoupling solution.

RDS Storage Auto Scaling is the built-in mechanism that continuously monitors the free space on your DB instance's underlying storage. When free space drops below a threshold (or when you set a maximum allocation), Amazon RDS automatically increases the storage size without requiring manual intervention, downtime, or a snapshot restore. This directly matches the requirement: it detects high utilization and expands storage on demand, making it the correct solution for avoiding out-of-space failures.

AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from your on-premises data center directly to AWS, bypassing the public internet entirely. This results in consistent, low-latency performance with a service-level agreement (SLA) on availability, making it ideal for latency-sensitive applications. Traffic traverses the AWS global network, avoiding internet congestion and reducing packet loss, jitter, and variable delay.

SNS supports the fan-out pattern where a single message published to a topic is delivered to all subscribers simultaneously. The three services can each subscribe to the SNS topic and receive every product update message at the same time.

Amazon EFS provides a fully managed, elastic NFS file system that can be mounted on multiple EC2 instances across multiple Availability Zones. It scales automatically to petabytes, offers high durability, and is designed for concurrent access from thousands of instances. This matches all requirements.

AWS WAF is the correct choice because it is a web application firewall that operates at Layer 7 of the OSI model, inspecting HTTP(S) request content, headers, and body for malicious payloads. It natively integrates with Application Load Balancers and CloudFront, and you can deploy managed rule groups or custom rules to block SQL injection and cross-site scripting (XSS) before the request reaches your application.

AWS Direct Connect is a dedicated, private physical network connection that runs from your on-premises or colocation facility to a Direct Connect location, providing consistent low latency and reliable bandwidth at speeds from 1 Gbps to 100 Gbps (or lower via partner-hosted connections). It bypasses the public internet entirely, allowing you to access your VPCs (via private virtual interfaces), AWS public services, or transit gateways. This makes it the correct service for a private, dedicated link into AWS.

CloudFront caches static content at edge locations around the world. When a user requests a file, CloudFront serves it from the nearest edge location, reducing latency and improving load times without any changes to the origin application.

Amazon Aurora is a MySQL-compatible relational database engine that offers up to five times the throughput of standard MySQL while maintaining full compatibility with existing MySQL applications. It automatically replicates data across multiple Availability Zones with a minimum of six copies, provides continuous backup to S3, and can scale storage up to 128 TB without downtime. These features make it the best choice for a workload seeking high performance, high availability, and MySQL compatibility.

Amazon EBS provides durable, block-level storage volumes designed specifically for use with EC2 instances. Volumes are network-attached to a single instance, can be formatted with a filesystem, and persist independently of the instance lifecycle: stopping or terminating the instance does not delete the volume unless you explicitly set the DeleteOnTermination flag. EBS also supports features like snapshots to S3, encryption, and performance tiers such as gp3 and io2, making it the intended persistent block storage for a database.

Amazon API Gateway is a fully managed service designed to handle all aspects of API management, including authentication (API keys, IAM, Cognito), request throttling, rate limiting, request validation, and direct integration with AWS Lambda. It is the correct choice for exposing Lambda-based serverless applications as RESTful APIs.

An Internet Gateway enables instances in public subnets to communicate bidirectionally with the internet. The subnet's route table must direct 0.0.0.0/0 traffic to the IGW for instances with public IPs to be reachable from the internet.

Correct. AWS Wavelength brings AWS compute and storage to the edge of 5G networks, providing ultra-low latency for mobile applications such as real-time gaming, AR/VR, and live video processing. This service is purpose-built for scenarios where latency to mobile subscribers is critical and the application must run within the telecom network edge.

Amazon CloudFront is a content delivery network (CDN) that caches S3 objects at edge locations in 100+ cities worldwide, so static website files are served from a PoP close to each viewer. It terminates HTTP/HTTPS at the edge, reduces origin load by serving cached responses, and lowers latency and data transfer costs for globally distributed users. With security features such as Origin Access Control (OAC), it can keep the S3 bucket private while still serving content publicly through the distribution.

AWS Lambda is a serverless compute service that can be triggered directly by S3 events. It runs code only when invoked, scales automatically, and bills only for the compute time used, meeting all the stated requirements.

DynamoDB is a serverless NoSQL key-value and document database engineered for predictable single-digit millisecond latency at any scale. Its automatic partitioning and multi-AZ replication allow it to scale horizontally and absorb millions of requests per second without provisioning servers or managing capacity. This combination of serverless operation, flexible schema, and consistently low latency makes it the default AWS service for high-throughput transactional workloads such as gaming, IoT, and session state.

Amazon MSK is the correct choice because it is a fully managed service that operates Apache Kafka and Kafka-compatible APIs, including MSK Serverless. It supports Kafka's partition model, consumer groups, and ordering semantics, so existing Kafka producers and consumers can connect without rewriting application code. This makes it the only option that directly meets a workload requiring Apache Kafka compatibility.

Amazon SageMaker is a fully managed ML platform that spans the entire workflow: Ground Truth for data labeling, managed Jupyter notebook environments, built-in training algorithms and framework containers, automatic distributed training, and one-click deployment to auto-scaling HTTPS endpoints. It eliminates the undifferentiated heavy lifting of infrastructure provisioning and maintenance, making it the only option that satisfies the need for a fully managed service for building, training, and deploying custom models.

Amazon Translate is a neural machine translation service that uses deep learning models to automatically convert text from a source language to a target language while preserving meaning and context. It offers both real-time and batch translation across dozens of language pairs through a simple API, making it the correct choice for cross-language content localization. Unlike speech or analysis services, its core purpose is to output text in a different language than the input.

VPC Peering creates a one-to-one networking relationship between two VPCs, using AWS's private global network, that allows instances in either VPC to communicate with each other as if they were on the same network, using private IPv4 or IPv6 addresses. The peering connection is not a gateway or VPN; it is a simple, layer-3 connection that requires no additional hardware, and there is no single point of failure or bandwidth bottleneck. It can be established between VPCs in the same account, across accounts, or across regions, but note that transitive peering is not supported — if VPC A peers with B and B peers with C, A cannot communicate with C via B. This is the correct solution for directly connecting two VPCs in a private, non-internet-routed fashion.

Amazon Redshift is AWS's fully managed, petabyte-scale cloud data warehouse, explicitly built for online analytical processing (OLAP). It uses columnar storage, massively parallel processing (MPP) across clusters, and query optimization for fast execution of complex SQL aggregations and joins over structured data. Redshift integrates with BI tools and can query data directly in S3 via Redshift Spectrum, making it the unequivocal correct choice for this scenario.

Amazon Redshift is a fully managed, petabyte-scale data warehouse service designed for running complex analytical queries. It uses columnar storage and massively parallel processing to deliver fast query performance. Redshift integrates with standard SQL-based business intelligence tools and can automatically scale with Redshift Spectrum and concurrency scaling, making it the appropriate choice for this scenario.

AWS IAM Identity Center is the required AWS service for workforce single sign-on. It lets you integrate with your on-premises Active Directory through a directory source such as AWS Managed Microsoft AD or AD Connector, and then define permission sets that assign users and groups to roles across multiple AWS accounts. After authenticating once with their corporate credentials, users gain access to all AWS accounts and business applications they are permitted to use, without needing separate IAM sign-ins.

AWS KMS allows the creation of customer managed keys that the company controls, including key rotation and access policies. It provides separate audit trails through AWS CloudTrail, enabling the company to monitor key usage independently. Using KMS with customer managed keys meets the requirements for managing encryption keys for S3 data at rest and auditing key usage separately.

Correct. AWS Elastic Beanstalk is a PaaS that abstracts the underlying infrastructure (EC2, load balancers, scaling) and automatically manages deployment, scaling, and health monitoring. Developers can upload code and configure scaling and rollback policies without managing servers.

Multi-AZ deployments replicate data synchronously to a standby instance in a different Availability Zone. Should the primary instance fail, Amazon RDS automatically promotes the standby, typically within 60–120 seconds, and the endpoint remains unchanged. This is an availability feature only; it does not scale reads or improve performance.

Redshift is AWS's managed data warehouse service specifically designed for OLAP. It uses columnar storage and parallel query execution to efficiently run complex SQL queries across petabytes of data and integrates with standard BI tools.

Amazon EC2 Auto Scaling is the correct answer because it is the service explicitly designed to maintain desired capacity and automatically adjust the number of EC2 instances in response to scaling policies. With a target tracking policy, for example, the Auto Scaling group continuously monitors a CloudWatch metric (like average CPU utilization) and proactively adds instances when the metric exceeds the target—this is scale-out—and removes them when it drops below. Scheduled policies also allow capacity to be added before predictable peaks, making it the only option that can directly execute a scale-out action.

AWS Local Zones are specifically designed to provide single-digit millisecond latency for applications in a specific geographic area. They are fully managed by AWS and extend the AWS Region to be closer to end users. The company can run EC2 instances in a Local Zone near Atlanta to achieve the required low latency for video editing workloads.

Amazon S3 Transfer Acceleration uses AWS edge locations to accelerate uploads to S3 buckets. It works with standard S3 PUT operations and only requires using a different endpoint URL, making it the correct choice for this scenario.

AWS Lambda is a serverless compute service that runs code in response to triggers, such as an S3 upload event. It scales automatically and charges only for execution duration, making it perfect for short-lived, sporadic image processing tasks.

Amazon MSK Serverless is a deployment mode for Amazon MSK that provisions and scales Kafka brokers automatically, so you don't need to select instance types or manage capacity. It provides the full Apache Kafka API, including Kafka Connect and tiered storage, meaning existing producers and consumers work without modification. This makes it the ideal choice when a fully managed, Kafka-compatible streaming platform is required, as it removes operational overhead while preserving API compatibility.

Amazon Transcribe is a machine-learning service purpose-built for automatic speech recognition (ASR), converting audio or video files containing speech into accurate text transcripts. It supports both batch processing for pre-recorded files stored in Amazon S3 and real-time streaming, and it includes features such as speaker diarization, custom vocabularies, language identification, and timestamp generation. This makes it the correct service to transcribe call recordings, as it directly turns the audio content into searchable, analyzable text. Its batch API can process large numbers of files asynchronously, matching common post-call analytics workflows.

Amazon Personalize is the correct answer because it is a fully managed ML service purpose-built for generating real-time personalized product recommendations by ingesting user-item interaction data such as clicks and purchases. It offers pre-built recommendation recipes and a simple API, so a retail homepage can return 'recommended for you' items without requiring the caller to train or tune any model. This directly matches the use case, while the other options address forecasting, text analysis, or custom model development.

Amazon SES is a cloud-based email sending service explicitly built for high-volume transactional and marketing email, offering APIs and SMTP endpoints for programmatic sending. It provides robust deliverability features, including dedicated IP addresses, IP warming, DKIM and SPF authentication, and automatic handling of bounces and complaints. These capabilities make SES the correct answer when the requirement is direct, scalable, deliverability-managed email.

A cross-region read replica asynchronously replicates data from the primary RDS instance to a replica in another region. The replica can be promoted to a standalone primary instance in minutes, achieving an RTO under 1 hour. As replication is near real-time, the RPO is typically a few seconds to minutes, satisfying the <5 minute RPO. This is the correct solution.

Amazon RDS is the correct choice because it is a fully managed relational database service: AWS automatically applies patches to the database engine and underlying operating system, performs automated backups, and can provision Multi-AZ failover for high availability. You retain control over schema design, parameters, and queries, but you do not need to schedule maintenance windows or manually install updates, which directly satisfies the stated requirement of avoiding patching responsibilities.

Pilot Light keeps just the critical data layer (like a replicated database) running continuously in AWS, along with pre-loaded AMIs and configuration scripts for the remaining application components. The compute resources are not active, so you pay for the small always-on footprint, but when a disaster is declared you quickly launch the pre-configured EC2 instances to scale up to production. This balances cost and RTO, typically achieving recovery in about ten minutes to a few hours, making it a middle-ground DR strategy.

Amazon EC2 Auto Scaling is the correct service. It automatically adds or removes EC2 instances based on defined policies or to maintain a desired capacity. If an instance fails, Auto Scaling detects the decrease in healthy capacity and launches a new instance to replace it, ensuring the application remains available.

AWS Fargate is the correct choice. It is a serverless compute engine for containers that runs on Amazon ECS or EKS. You define your containerized application and its resource requirements, and Fargate handles the underlying infrastructure, scaling, and billing per resource consumption.

Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations, reducing latency. It integrates with ACM for free SSL/TLS certificates, supports custom domain names, and enforces HTTPS. This meets all the requirements without any server management.

AWS Organizations is the correct service because it provides centralized governance across multiple AWS accounts. It supports consolidated billing, so usage from all three development accounts appears on a single invoice, and it allows you to attach Service Control Policies (SCPs) to accounts or organizational units. SCPs act as guardrails that can deny actions such as turning off CloudTrail or deleting CloudTrail log files, even when performed by a member account's root user.

Amazon Textract is the intended solution because it uses machine learning to automatically extract printed and handwritten text, key-value pairs, and table structures from scans, PDFs, and images. Unlike basic OCR, Textract understands the layout of the page, so it can preserve relationships between elements, such as which value belongs to which form field, and returns data in a structured JSON format. It is the only AWS service here whose core purpose is converting documents into structured digital text.

Global Accelerator uses static anycast IP addresses and the AWS global network to optimize the path for TCP and UDP traffic. It automatically routes users to the nearest healthy application endpoint, improving latency and connection stability for real-time applications.

This uses CloudFront's built-in behavior routing with path patterns. Each behavior can have its own cache policy (or TTL settings), allowing different caching durations for videos and thumbnails while using a single distribution and a single S3 bucket. This meets the requirements with minimal operational overhead.

AWS Control Tower is the correct answer because it is a fully managed orchestration service that automatically provisions a secure, well-governed multi-account environment called a landing zone. During setup, it creates the AWS Organizations structure, configures AWS IAM Identity Center for SSO, enables centralized CloudTrail and CloudWatch Logs, and deploys both preventive guardrails (SCPs) and detective guardrails (AWS Config rules) across enrolled accounts. Control Tower also offers Account Factory for account provisioning and continuous governance monitoring, making it the complete landing zone solution.

As AWS's content delivery network, CloudFront uses a global network of 400+ edge locations to cache static and dynamic content closer to viewers. When a user requests content, CloudFront serves it from the nearest edge location, reducing latency and offloading origin servers. It supports both static caching and dynamic content acceleration via the AWS backbone.

Amazon EFS is a fully managed NFS file system that automatically scales storage capacity as you add or remove files, and you pay only for the storage used. It provides high availability and durability by storing data across multiple Availability Zones within a Region, and can be accessed by multiple EC2 instances concurrently.

Amazon ECR is a fully managed private container image registry that natively implements the Docker/OCI registry API. It supports multiple repositories, image tags and digests for versioning, IAM-based authentication, lifecycle policies to prune unused images, and automated vulnerability scanning. Because ECS and EKS authenticate directly with ECR, it serves as the default storage and distribution layer for container images running on AWS, and it is the correct service for this scenario.

S3 Lifecycle policies with expiration rules let you define actions that transition objects to cheaper storage classes and permanently delete objects or their versions after a specified age. You can, for example, expire current versions after 180 days and remove noncurrent versions after 30 days, directly aligning storage spend with data retention requirements. This is the service-native mechanism for automated cost optimization through deletion.

Amazon API Gateway provides a fully managed HTTP API endpoint with routing, authentication, rate limiting, and request validation, then invokes AWS Lambda to execute business logic without provisioning any servers. Lambda scales automatically with each request, runs code in a stateless environment, and charges only for compute time consumed during execution. This combination is the standard serverless architecture for building HTTP-based APIs on AWS.

AWS CloudFormation is the core infrastructure-as-code service on AWS, allowing you to define entire stacks of AWS resources using declarative YAML or JSON templates. These templates are version-controlled files that can be deployed repeatedly to create identical environments, supporting updates, rollbacks, and drift detection. CloudFormation manages the lifecycle of all resources in a stack in a safe and predictable manner, making it the correct choice for defining infrastructure from code.

CloudFront is a CDN that caches static and dynamic content at 400+ edge locations globally. A user in Europe would be served cached content from a nearby edge location instead of making a round-trip to US East, dramatically reducing latency.

Amazon Connect is a cloud-native, pay-as-you-go contact center service with no upfront hardware or licensing costs. It provides IVR, visual contact flows, automatic call distribution to agent queues, skills-based routing, chat, a softphone agent desktop, and real-time and historical analytics, integrating with AWS Lambda, Amazon Lex, and CRM connectors to orchestrate complex customer journeys.

AWS Backup is a fully managed, centralized backup service that lets you define backup plans, assign resources via tags, and automate on-demand or scheduled backups across services including EC2, RDS, DynamoDB, EFS, Storage Gateway, and AWS Organizations. It enforces retention policies, creates cross-region and cross-account copies for disaster recovery, integrates with AWS KMS for encryption, and provides audit/reporting via AWS Backup Vault Lock and compliance features, all from a single console.

Amazon DynamoDB is a fully managed NoSQL database that delivers consistent single-digit millisecond latency at any scale. It supports global tables for multi-Region replication and automatic scaling to handle millions of requests per second. It also provides built-in backup and restore, meeting all stated requirements.

AWS Wavelength Zones are AWS infrastructure deployments embedded directly within the telecommunications service provider's 5G network, close to the radio access network and mobile core. This allows developers to launch EC2 instances and attach EBS volumes in these zones, bringing compute and storage to the network edge so mobile applications can achieve single-digit millisecond latency. Because the zone is logically part of a VPC, applications can split their processing between the Wavelength Zone and the parent AWS Region over the AWS backbone, making Wavelength the correct choice for latency-critical mobile workloads on 5G.

Amazon DynamoDB is the correct answer. It is a fully managed NoSQL service that delivers consistent single-digit millisecond latency at any scale. It automatically scales read/write throughput based on traffic patterns and replicates data across three Availability Zones in an AWS Region by default, meeting all requirements.

The correct approach is to use the AWS China Regions (cn-north-1 in Beijing, operated by Sinnet, and cn-northwest-1 in Ningxia, operated by NWCD), which require a separate AWS account from the standard global account. These regions are physically located in mainland China and operate under different compliance frameworks, including ICP licensing. To serve content to Chinese users efficiently and legally, you must deploy resources in these regions—there is no way to use the global CloudFront service to directly serve mainland China, because the global edge network does not extend there and Chinese law mandates local hosting for end-user content.

Multi-AZ deployments create a synchronous standby replica in a different Availability Zone. Amazon RDS automatically handles failover to the standby replica when a failure is detected, and updates the DNS record so that the same connection endpoint continues to work without any application changes. This meets all the stated requirements.

Amazon API Gateway is a fully managed service that enables developers to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale. It provides built-in features like request throttling, API key management, custom authorizers, caching, and integration with AWS Lambda for serverless backends. As the correct answer, it is the AWS service specifically designed to act as the front-end HTTP interface for API-based workloads.