CCNA Cloud Technology and Services Questions

AWS Global Accelerator uses the AWS global network to improve the performance of TCP/UDP applications. It directs user traffic to the nearest edge location and then routes it over the AWS global backbone to the optimal regional endpoint, reducing latency and packet loss. This matches the requirement for UDP-based gaming application without application changes.

Correct. Amazon EFS provides a fully managed NFS file system that can be mounted on multiple EC2 instances across multiple Availability Zones simultaneously. It scales automatically and is designed for high availability and durability, making it ideal for shared file access.

AWS WAF is the correct choice because it operates at the application layer (Layer 7) and offers full visibility into HTTP(S) requests. Administrators can create rate-based rules that automatically count requests from a given IP and trigger a block when the count exceeds a configurable threshold per 5‑minute window. WAF also provides managed rule groups such as OWASP Top 10 and Bot Control, making it easy to protect against HTTP floods, SQL injection, and web scraping without building custom rules from scratch.

AWS X-Ray is purpose-built for distributed application tracing: it uses trace headers propagated through instrumented services to assemble a complete view of every request, from API gateway to downstream functions. It produces service maps that show each node's health and average response times, and individual traces reveal subsegments that expose slow dependencies like database queries or external HTTP calls. This is exactly what is needed to diagnose bottlenecks across a microservice architecture.

S3 Versioning is the definitive feature for retaining every version of an object within the same bucket. When you upload a new version, the previous one is kept; when you delete an object, S3 inserts a delete marker instead of permanently removing the data, so any prior version can be restored at any time. This gives you a built-in mechanism to recover from accidental overwrites, malicious actions, or application errors, making it the correct answer for maintaining version history.

Amazon EFS is a fully managed, elastic NFS file system designed to be mounted on multiple EC2 instances simultaneously, whether they reside in the same or different Availability Zones. It supports NFSv4.1 and NFSv4.0, providing a standard file system interface with automatic scaling from gigabytes to petabytes as you add or remove files. With EFS, applications get consistent performance and a shared, POSIX-compliant file system that enables concurrent access from hundreds of Linux instances, making it the ideal choice for shared workloads. Because EFS automatically replicates data within and across AZs, it also provides high availability and durability.

AWS Fargate is the serverless compute engine for ECS, letting you run containers without managing any EC2 instances. You simply define the task and specify vCPU and memory requirements, and Fargate provisions the underlying hosts, applies security patches, and isolates each task automatically. This removes the server management burden entirely, making it the correct launch type for the team's goal.

Amazon API Gateway is a fully managed service for creating, publishing, securing and monitoring APIs at scale. It acts as the front door routing clients to backend services, satisfying the stem's requirement for developers to manage APIs easily.

Amazon CloudFront is a global content delivery network (CDN) that caches website content—including media files, images, and scripts—at edge locations strategically positioned near viewers. By serving cached copies from the edge, CloudFront dramatically reduces latency and offloads traffic from the originating EC2 instances, lowering origin load and operational cost. It also provides persistent TCP connections, TLS termination, and built-in DDoS mitigation through AWS Shield, making it the ideal choice for global media delivery.

Amazon Timestream is a purpose-built time-series database that can efficiently ingest, store, and analyze trillions of time-stamped data points per day. It is serverless and auto-scaling, with built-in time-series analytics functions such as interpolation, smoothing, and approximation. This makes it the ideal choice for the company's IoT sensor data requirements.

Amazon FSx for Lustre is a fully managed, high-performance parallel file system inspired by Lustre, built to deliver sub-millisecond latencies, millions of IOPS, and hundreds of GB/s of throughput. When linked to Amazon S3, it presents S3 objects as files with POSIX semantics, so standard bioinformatics tools can read/write data without code changes while benefiting from a shared, multi-instance namespace. This combination directly matches the requirements of genomics HPC workloads.

Amazon CloudFront is a global content delivery network that caches static assets from the originating S3 bucket at hundreds of edge locations worldwide. When a user requests a file, CloudFront routes them to the nearest edge node, dramatically reducing latency and network hops. This requires no application changes and offloads repeated requests from S3, directly solving the global latency problem without rearchitecting the application.

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that decouples the frontend from the order-processing backend. It durably stores messages across multiple Availability Zones, buffers spikes in order volume, and lets producers and consumers scale independently. With features like visibility timeouts and dead-letter queues, SQS ensures every order message is retained and processed reliably, exactly matching the requirement for a durable buffer between tiers.

Correct. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale. It scales horizontally, supports auto scaling, and offers built-in multi-AZ replication for high availability and durability.

AWS CloudFormation is an infrastructure as code service that enables you to model and provision AWS resources using templates written in JSON or YAML. These templates can be stored in version control systems, making it possible to deploy identical environments across multiple accounts and regions consistently.

Amazon QLDB is a purpose-built ledger database that maintains a complete, immutable history of every data change in an application's data, not just a simple audit log. It uses a cryptographic hash chain, where each journal block contains the hash of the previous block, making any tampering immediately discoverable. This is the correct choice because it directly provides a centrally owned, cryptographically verifiable and append-only transaction history for application data.

An Application Load Balancer is a regional service that distributes incoming traffic across targets in multiple Availability Zones. By placing EC2 instances in at least two different AZs and registering them with an ALB, the ALB continually monitors target health and automatically reroutes traffic away from an unhealthy or unreachable AZ. This design ensures that the application remains available even if one entire Availability Zone fails.

AWS Lambda is a serverless compute service that executes code in response to events. It automatically scales to handle any volume of requests, charging only for the compute time consumed during execution (per millisecond). No servers to provision or manage, making it ideal for unpredictable, short-lived workloads.

Correct. ALB supports WebSocket protocol natively and provides sticky sessions (session affinity) using cookies or source IP. It operates at Layer 7, making it ideal for real-time chat applications that require persistent connections and application-aware routing.

Amazon VPC is the isolated virtual network environment where you provision AWS resources within a defined IP address space. You control subnets, route tables, network gateways, and security settings, giving you complete architectural authority over the network. Because it creates the logical boundary that separates your resources from the rest of the AWS cloud, this service defines the isolated network environment the question asks about.

Amazon QuickSight is a fully managed, serverless business intelligence service that provides self-service BI with drag-and-drop dashboard creation, interactive visualizations, and ML-powered natural-language insights. It is built for business users, with pay-per-session pricing and SPICE in-memory caching, making it the correct choice for the scenario's need for a BI dashboarding tool.

AWS Trusted Advisor continuously inspects your AWS environment against established best practices and generates recommendations across five pillars: cost optimization, performance, security, fault tolerance, and service quotas. It evaluates resources like idle load balancers, underutilized EBS volumes, and overly permissive security group rules, with the number of available checks depending on your support tier (Basic, Business, or Enterprise). This holistic analysis of cost and security checks in a single dashboard makes it the correct answer.

AWS Fargate is a serverless compute engine for containers that removes the need to provision or manage any underlying servers. You define the container and its resource requirements in vCPU and memory, and Fargate places the workload onto infrastructure that AWS fully operates. Scaling is automatic, and you are billed only for the resources your containers actually consume, making it the correct choice for running containers without server management.

Fargate is a serverless compute engine for containers. You define your task definitions, and Fargate runs the containers on shared, AWS-managed infrastructure. No servers to manage, and you pay only for the vCPU and memory resources consumed by your running tasks.

Fargate is a serverless compute engine for containers. You define the tasks and containers, and Fargate manages the infrastructure. You pay only for the vCPU and memory used by each running container, with no idle costs.

Aurora is AWS's cloud-native relational database that is fully compatible with MySQL and PostgreSQL. It provides up to 5x the performance of standard MySQL, automated backups, and continuous replication to six copies across three AZs.

A Multi-AZ RDS deployment creates a synchronously replicated standby in a different Availability Zone; if the primary fails, Amazon RDS automatically flips to the standby with minimal downtime. Adding one or more Read Replicas gives you dedicated read-only endpoints that use asynchronous replication and can absorb analytical or reporting traffic, reducing load on the primary. Together, the configuration provides both high availability for write operations and elastic read scaling, which directly meets the requirement to reduce load while keeping the CRM available.

AWS Global Accelerator uses the AWS global network to route user traffic to the nearest healthy endpoint, improving performance and reliability. It provides two static anycast IP addresses that remain fixed, allowing clients to add them to firewall allowlists. This meets both the latency and static IP requirements.

Correct. Elastic Beanstalk is a fully managed service that automatically provisions and manages the infrastructure for web applications, including EC2 instances, load balancers, and Auto Scaling groups. Developers simply upload their code, and Elastic Beanstalk handles the deployment, capacity provisioning, load balancing, and health monitoring.

AWS Lambda is the native serverless compute service that runs code in response to S3 event notifications without any server provisioning or patching. It scales automatically with each event, bills only for the duration your function executes (rounded to the nearest millisecond), and is ideal for short-duration processing such as image resizing or metadata extraction when an object is uploaded. With a maximum invocation timeout of 15 minutes, Lambda handles this exact use case while requiring no infrastructure to manage.

AWS Fargate is a serverless compute engine for containers that runs on top of Amazon ECS or Amazon EKS. It abstracts away all underlying EC2 instances, automatically managing host patching, capacity provisioning, and hardware failures. Fargate integrates natively with Application Load Balancers and can scale tasks or pods horizontally based on CPU/memory utilization or custom metrics. This fully meets the requirement of avoiding server management while supporting containerized microservices.

Amazon ElastiCache is a fully managed, in-memory caching service supporting the Redis and Memcached engines. It sits in front of databases or applications to reduce read latency from milliseconds to microseconds by serving hot data directly from RAM. Because it is engine-agnostic, ElastiCache can cache database query results, session state, API responses, or any key/value data, making it the correct general-purpose caching layer for this scenario.

Amazon S3 + Amazon CloudFront is the best fit for a static website with global reach. S3 stores the HTML/CSS/JS and media files, while CloudFront caches that content at 400+ edge locations, drastically reducing latency for global users. You also get built-in HTTPS through AWS Certificate Manager and can further restrict S3 bucket access to only CloudFront using an origin access control (OAC), making the solution both secure and fully managed with no servers to maintain.

Amazon CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations worldwide, dramatically reducing latency for global users. It offloads requests from the EC2 origin server, handling high concurrency and protecting against traffic spikes. CloudFront also supports custom origins and integrates with AWS Shield for DDoS protection, making it ideal for a global e-commerce website.

AWS Step Functions is the correct answer because it is a purpose-built orchestration service that models order processing as a state machine using Amazon States Language. It coordinates Lambda functions and other AWS services across sequential steps, managing retry logic, error handling, and branching automatically. Step Functions also provides execution history and visual monitoring, making it ideal for auditable serverless pipelines without requiring custom code for state management.

Amazon Managed Blockchain is a fully managed service that lets you create and operate blockchain networks using either Hyperledger Fabric or Ethereum. It automates the provisioning of peer nodes, ordering services, certificate management, and membership policies, while still preserving the decentralized, multi-party consensus model that defines a blockchain. Because it provides the infrastructure for actual blockchain networks and supports multiple organizations voting and transacting without a central administrator, it is the correct answer.

Fargate is a serverless compute engine for containers that removes all EC2 instance management, allowing developers to define only container requirements such as CPU and memory. Fargate automatically provisions, scales, and patches the underlying infrastructure invisibly, making it ideal for running containerized applications without operational overhead. You never see or manage the host instances.

AWS Storage Gateway is a hybrid cloud storage service that provides on-premises applications with low-latency access to AWS storage. Its File Gateway mode presents Amazon S3 as a file share via NFS and SMB, caching recently accessed data locally, while Volume Gateway offers iSCSI block storage backed by EBS snapshots, and Tape Gateway replaces physical tape for backups. This bridges the gap between on-premises workloads and AWS object, block, or archival storage, making it the correct answer for hybrid NFS/SMB access to S3.

S3 Glacier Deep Archive offers the lowest storage cost in Amazon S3, purpose-built for data retained for 7–10 years that is rarely or never retrieved. It meets the 7-year compliance requirement at the minimum cost.

Amazon SQS is a fully managed message queuing service that stores messages until a consumer processes them. It decouples the order submission from order processing, allowing the backend to process at its own pace. SQS automatically scales to handle any volume of messages and provides high availability and durability by replicating messages across Availability Zones.

Correct. AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. It uses the SSM Agent, which is preinstalled on many EC2 AMIs, to run patch scans and installations according to a schedule you define. Compliance reports are available directly in the AWS Systems Manager console.

Auto Scaling's self-healing mechanism continuously monitors the health of each instance in the Auto Scaling group using EC2 status checks and Elastic Load Balancing (ELB) health checks. When an instance fails these checks, the group automatically terminates it and launches a new replacement instance with a fresh instance ID. This process is oriented entirely around preserving the group's desired or minimum capacity, not around time or demand forecasting. It directly answers the goal of maintaining a minimum healthy fleet, making it the correct mechanism.

AWS Snowball Edge is the correct choice because it transfers data by physical shipment rather than over the network. Each 80 TB model can hold the 50 TB dataset in encrypted, tamper-resistant storage, and once the device arrives on-premises, data is copied locally and shipped back to AWS for import into Amazon S3. This makes the 2-week timeline achievable regardless of the 10 Mbps pipe.

Using Amazon RDS for HIPAA workloads is valid when the customer has signed a Business Associate Agreement with AWS and configures the service according to AWS's HIPAA implementation guidance. The BAA extends AWS's business associate commitments to the customer, and RDS is listed in the AWS HIPAA Eligible Services Reference, so it can store protected health information. After signing, the customer must still implement encryption via KMS, least-privilege IAM policies, VPC-based network controls, and database audit logging to satisfy the HIPAA Security Rule.

AWS Storage Gateway File Gateway (with the SMB protocol option) is the correct service because it deploys a virtual appliance that presents an S3 bucket as an SMB file share to on-premises Windows clients. This appliance handles the protocol translation, so users map a standard Windows drive letter (e.g., Z:) and interact with files normally, while the gateway stores the underlying data as objects in S3 and locally caches hot data for low latency. It is the only listed option that natively gives Windows clients a network-mounted file share backed by S3 without requiring them to use S3 API operations.

Amazon SQS is a fully managed message queue that enables asynchronous communication between application components. The frontend sends a message to the SQS queue, and the processing backend polls the queue for messages. SQS supports at-least-once delivery and can be configured to retain failed messages for retries, meeting the requirements perfectly.

AWS Glue is a serverless data integration service that runs Crawlers to discover source data schemas and populate the Glue Data Catalog, creating a central metadata repository. Using Glue Studio, you can visually build ETL workflows and automatically generate PySpark or Scala scripts, eliminating manual coding overhead. This exact combination of automatic schema discovery, central catalog, and ETL code generation makes Glue the correct answer.

Amazon API Gateway is a fully managed service designed specifically for creating, publishing, maintaining, monitoring, and securing APIs at scale. It supports REST and HTTP APIs and includes native features like caching with configurable TTLs, throttling and quotas via usage plans, authentication through IAM, Cognito, or Lambda authorizers, and request/response mapping. Its native CloudFront integration allows global edge distribution while retaining API management controls, making it the correct answer for a general-purpose API solution.

Correct. Amazon DynamoDB is a fully managed NoSQL database that offers single-digit millisecond latency at any scale. It supports on-demand capacity mode and auto scaling to automatically handle unpredictable traffic spikes without manual intervention. It is serverless, so developers do not manage servers or clusters.

AWS Lambda is a serverless compute service that can be triggered directly by Amazon S3 events. It runs code only when an image is uploaded, scales automatically, and bills per millisecond of execution. This matches the requirements for minimal overhead and pay-per-use.

AWS Elastic Beanstalk is a Platform as a Service (PaaS) that abstracts away the underlying infrastructure: you supply your application code (e.g., Java, Python, Node.js) and choose a platform version, and Beanstalk automatically provisions EC2 instances, a load balancer, auto scaling, and health monitoring. You get the benefits of a managed environment while retaining the ability to access and customize the underlying resources if needed. It is the most direct way to deploy an existing web application without re-architecting.

This service is designed exactly for this use case: it provides a local VM that caches frequently accessed files on premises, presents SMB/NFS shares to applications, and stores the primary data in Amazon S3. It offers low-latency access through the cache and is managed from the AWS Management Console.

Correct. AWS Lambda is a serverless compute service that runs code in response to events, such as S3 object creation. It automatically scales, requires no server management, and executes the function only when new files are uploaded, making it the best fit for this use case.

AWS CloudFormation is the correct choice because it provides infrastructure as code (IaC) with declarative JSON or YAML templates. It automatically manages resource dependencies, provisioning order, and rollback on failures, enabling a multi-tier application (VPC, subnets, EC2, RDS, ELB, security groups) to be deployed as a single, versionable stack. CloudFormation also supports change sets to preview updates and drift detection to ensure the live infrastructure matches the stack template, giving the team full declarative control over every resource.

Correct. AWS Step Functions is a fully managed service that lets you coordinate multiple AWS services into stateful, scalable workflows. It supports sequencing, parallel execution, error handling, and retries, making it ideal for orchestrating a series of Lambda functions in a defined order.

EC2 Inf and Trn instances are built on AWS Inferentia and Trainium, which are custom-designed ASICs (application-specific integrated circuits) created by AWS exclusively for machine learning. Inferentia instances provide high-throughput, low-latency inference at a lower cost than GPUs, while Trainium instances are optimized for training large models with high efficiency. These chips integrate natively with major frameworks like TensorFlow and PyTorch, and they are the correct choice when the question emphasizes custom ML hardware, cost-effective scaling, and high performance for ML inference or training workloads.

Correct. Amazon CloudFront is a global content delivery network (CDN) that can cache static content at edge locations closer to users. It also supports dynamic content by forwarding requests to the origin, which can be an Application Load Balancer. This meets both the caching and origin integration requirements.

Amazon Lex is the correct builder because it natively combines automatic speech recognition and natural-language understanding to create conversational interfaces. Developers define intents, sample utterances, and slot types in the Lex API, and Lex uses the same ASR/NLU technology powering Amazon Alexa. Lex manages dialog management across turns, which is essential for chatbots and voice assistants. It can also invoke Lambda functions for business logic and integrate with channels like Facebook and Slack.

Correct. Amazon SQS is a fully managed message queuing service that decouples application components. It is highly available and durable, automatically replicating messages across multiple Availability Zones. It supports polling mechanisms, allowing the order processing service to consume messages at its own pace.

RDS Read Replicas are asynchronous read-only copies of the primary database that can serve SELECT queries, effectively offloading read traffic from the primary instance. This horizontal read scaling is ideal for read-heavy workloads, allowing the primary to focus on write operations. However, remember that replication lag may cause slightly stale reads, which is acceptable for many reporting and dashboard use cases.

An Amazon S3 gateway VPC endpoint provides a private connection between a VPC and Amazon S3, allowing instances in private subnets to access S3 without traversing the public internet. By adding the endpoint to the route table of the private subnet, traffic to S3 is routed through the endpoint. This meets the security requirement and is cost-effective.

Amazon WorkSpaces is a fully managed DaaS offering that provisions persistent Windows or Linux desktops in the AWS cloud. AWS manages the underlying infrastructure, including security patches and availability, while users access their personalized desktop from almost any device using the WorkSpaces client. Enterprises can integrate with Active Directory and use existing Microsoft 365 licenses, making it the correct purpose-built choice for virtual desktops.

Correct. File Gateway provides an on-premises file share that caches active data locally and stores all data durably in Amazon S3. It supports SMB protocol, enabling existing applications to access the cloud storage seamlessly while maintaining low latency for frequently used files.

Amazon Lightsail is AWS's simplified VPS offering, providing pre-configured virtual machines with predictable fixed monthly pricing that bundles compute, SSD storage, data transfer, and DNS management. It is designed for users who need a lightweight, always-on server for simple websites or small applications without deep AWS expertise. Unlike EC2, it hides networking and scaling details behind an intuitive console, and unlike Lambda, it maintains a persistent server environment suitable for WordPress or other self-managed software.

Amazon OpenSearch Service is a fully managed service that provisions, operates, and scales OpenSearch/Elasticsearch clusters, giving you a dedicated distributed search engine built on Apache Lucene. It supports full-text search using inverted indexes, relevance scoring, fuzzy matching, autocomplete suggestions, aggregations, and dashboards, as well as log analytics and application monitoring. The service handles operational tasks such as cluster health, version upgrades, patches, and storage scaling, and integrates with Amazon S3, CloudWatch Logs, and Kinesis Data Firehose. This makes OpenSearch Service the correct choice for a managed search backend for a website or application, because it is purpose-built for interactive, high-concurrency search workloads.

S3 Lifecycle policies are the native rule-based engine for automating storage-class transitions and expirations. You define rules such as 'move objects to S3 Standard-IA after 30 days, then to S3 Glacier Flexible Retrieval after 120 days,' and S3 enforces them continuously without manual effort. Lifecycle also handles expiring old object versions and incomplete multipart uploads, making it both a cost-optimization and a governance tool. For any exam scenario that says 'move to cheaper storage after X days,' this is the correct answer.

VPC endpoints allow you to privately connect your VPC to supported AWS services and VPC endpoint services using private IP addresses, without requiring an Internet Gateway, NAT device, VPN, or AWS Direct Connect connection. Traffic between your VPC and the AWS service stays entirely within the AWS network, never crossing the public internet, which reduces exposure and improves performance. For S3 and DynamoDB, you use either gateway endpoints or interface endpoints depending on the service, but the core benefit remains private, secure, and simplified access. This is the correct choice because it directly addresses the need for private connectivity.

Correct. AWS Lambda is a serverless compute service that runs your code only when triggered (e.g., via Amazon API Gateway). It automatically scales to handle any number of requests and you pay only for the compute time consumed during execution (per millisecond). There are no servers or containers to manage, aligning perfectly with the team's focus on writing code and minimizing operational overhead.

Step Functions defines the workflow as a visual state machine, chaining resize, thumbnail and DynamoDB steps sequentially with built-in retries and error handling. This removes the need for custom orchestration code, exactly matching the team's stated requirements.

Horizontal scaling involves adding more instances (e.g., EC2 instances) to distribute the load. If one instance or even an entire Availability Zone fails, the remaining healthy instances continue serving traffic. Combined with automated health checks and Auto Scaling, this design principle ensures automatic recovery from component failures, directly meeting the requirement.

AWS Lambda executes function code in response to HTTP requests via API Gateway or function URLs, with no server provisioning or management. Its event-driven, function-based programming model directly satisfies the stem's requirement for running code without managing servers.

The Application Load Balancer is the correct choice because it operates at Layer 7 of the OSI model, enabling content-based routing. It can inspect the HTTP request and route traffic to different target groups based on URL path patterns (e.g., /api or /images), host headers, or query strings. Additionally, it handles SSL/TLS termination, providing centralized certificate management and reducing backend encryption burdens. For a multi-tier web application that requires fine-grained request distribution and health checks, ALB is the recommended modern service.

Amazon QLDB is a purpose-built ledger database with an append-only journal that cryptographically chains every revision to the previous one, creating an immutable and mathematically verifiable history. Each stored document revision is hashed, and any alteration, insertion, or deletion in the journal can be detected by recomputing hashes and comparing against the digests. QLDB also supports SQL-like PartiQL queries and provides an audit trail that is verifiable by external parties, making it ideal for financial applications that must prove data integrity to regulators.

Amazon Kinesis Data Streams is purpose-built for real-time streaming ingestion of high-volume data, such as clickstreams, IoT telemetry, and application logs. It uses shards to scale throughput and supports multiple consumers reading the same stream concurrently via the Kinesis Client Library (KCL), enabling sub-second analytics, pattern detection, and live dashboards. Data is durably stored for up to 365 days, allowing replay and processing by multiple applications independently. Its design directly matches the requirement for real-time streaming data ingestion and consumption.