CCNA Cloud Technology and Services Questions — Page 5 of 5

301

MCQmedium

A company's IT team manually provisions S3 buckets, EC2 instances, security groups, and IAM roles for each new project using the AWS Management Console. This process often results in configuration errors, such as overly permissive security rules or incorrect tagging, which the security team then has to fix manually. The company wants to define its entire infrastructure in a declarative template file, store it in version control, and have AWS automatically create or update the resources based on that template. Which AWS service should the company use to meet these requirements?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerA

AWS CloudFormation is the correct service for infrastructure as code. It allows you to define all AWS resources in a declarative template, version-control the template, and automatically create or update the resources as a stack.

Why this answer

AWS CloudFormation is the correct service because it allows you to define your entire infrastructure—including S3 buckets, EC2 instances, security groups, and IAM roles—in a declarative JSON or YAML template. You can store this template in version control, and CloudFormation automatically provisions or updates the resources to match the template, eliminating manual configuration errors like overly permissive security rules or incorrect tagging.

Exam trap

The trap here is that candidates confuse AWS Elastic Beanstalk as an infrastructure-as-code solution because it automates deployment, but it does not provide the declarative template control over all AWS resources that CloudFormation offers.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service for deploying and scaling web applications, not for declaratively defining all infrastructure resources (like S3 buckets, IAM roles) in a template. It abstracts infrastructure management rather than providing full control via a declarative template.

AWS OpsWorks is a configuration management service that uses Chef or Puppet, not a declarative template service for defining infrastructure as code. It does not store templates in version control and automatically create/update resources based on a declarative template file.

AWS CodeDeploy automates code deployments to running instances, not infrastructure provisioning. It does not define or manage infrastructure resources like S3 buckets, EC2 instances, or IAM roles from a declarative template.

Practice this question →

302

MCQmedium

A company needs to connect multiple VPCs and on-premises networks through a single hub, simplifying network management. Which AWS service acts as a cloud router to interconnect these networks?

A.VPC Peering

B.AWS Transit Gateway

C.AWS Direct Connect

D.Internet Gateway

AnswerB

AWS Transit Gateway is a fully managed cloud router that provides hub-and-spoke connectivity between VPCs and on-premises networks. A single Transit Gateway attachment per VPC enables transitive routing, so 10 VPCs need only 10 attachments rather than 45 peering connections. Route tables within the Transit Gateway control which attachments can communicate, and it also supports VPN and Direct Connect attachments for hybrid network integration.

Why this answer

AWS Transit Gateway acts as a cloud router, using a hub-and-spoke model to interconnect multiple VPCs and on-premises networks through a single gateway. It simplifies network management by centralizing routing, supporting transitive routing between all attached networks, and integrating with AWS Direct Connect and VPN connections.

Exam trap

The trap here is that candidates often confuse VPC Peering (which is free but non-transitive and requires full mesh) with Transit Gateway (which provides transitive routing and central management), leading them to choose VPC Peering for multi-VPC connectivity without considering the hub-and-spoke requirement.

How to eliminate wrong answers

Option A is wrong because VPC Peering provides only a one-to-one, non-transitive connection between two VPCs, requiring a full mesh of peering connections for multiple VPCs and cannot connect to on-premises networks directly. Option C is wrong because AWS Direct Connect is a dedicated physical network connection from on-premises to AWS, not a router that interconnects multiple VPCs; it requires a Transit Gateway or Virtual Private Gateway to enable multi-VPC connectivity. Option D is wrong because an Internet Gateway is a horizontally scaled, redundant component that allows VPC communication with the internet, not a router for interconnecting VPCs or on-premises networks.

Practice this question →

303

MCQmedium

A company runs a multi-step order fulfilment process that includes payment verification, inventory check, warehouse notification, and shipping label generation. Each step is implemented as a Lambda function. They need a service to coordinate these steps, handle retries on failure, and visualise workflow state. Which AWS service should they use?

A.Amazon SQS

B.Amazon EventBridge

C.AWS Step Functions

D.Amazon SNS

AnswerC

Step Functions orchestrates multi-step workflows using a state machine model. It manages the sequence of Lambda invocations, retries failed steps, handles errors, and provides a visual console showing the current state of each workflow execution.

Why this answer

AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services, including Lambda functions, into a visual workflow. It natively supports sequential execution, parallel branches, retries on failure, and state visualization, making it the ideal choice for a multi-step order fulfillment process.

Exam trap

The trap here is that candidates confuse message/event services (SQS, SNS, EventBridge) with orchestration services, failing to recognize that only Step Functions provides the stateful coordination, retry logic, and visual workflow required for multi-step processes.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue service for decoupling application components, not a workflow orchestrator; it cannot coordinate multi-step logic, handle retries based on business logic, or visualize workflow state. Option B is wrong because Amazon EventBridge is an event bus for routing events between services, not a stateful workflow engine; it lacks built-in support for sequential step coordination, retry policies, and state visualization. Option D is wrong because Amazon SNS is a pub/sub notification service for sending messages to subscribers, not a workflow orchestrator; it cannot manage multi-step processes, retries, or provide a visual representation of workflow state.

Practice this question →

304

MCQmedium

A retail company's order processing system receives large bursts of orders during flash sales. The order intake API gets overwhelmed because it directly calls a downstream processing service that is slower. The company wants to decouple the API from the processing service so orders are not lost during spikes. Which AWS service should they use?

A.Amazon SNS

B.Amazon SQS

C.Amazon EventBridge

D.AWS Step Functions

AnswerB

SQS is a durable message queue that stores messages until they are processed. The intake API enqueues orders, and the processing service dequeues and processes them at its own pace. Messages persist even if the processor is temporarily unavailable.

Why this answer

Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that decouples the order intake API from the downstream processing service. When the API receives a burst of orders, it can immediately push each order message into an SQS queue, and the processing service can poll and consume messages at its own pace, ensuring no orders are lost even during traffic spikes.

Exam trap

The trap here is that candidates often confuse SNS (push-based pub/sub) with SQS (pull-based queue), assuming any decoupling service works the same, but SNS cannot buffer messages or allow the consumer to control the consumption rate, making it unsuitable for handling bursts from a slower downstream service.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes notifications to subscribers; it does not provide a durable buffer or allow the consumer to control the processing rate, so it cannot decouple the API from a slower downstream service without risking message loss or overload. Option C is wrong because Amazon EventBridge is a serverless event bus for routing events between AWS services and custom applications; it is not designed for point-to-point decoupling with a queue-like buffer and does not offer the same message retention and polling mechanics as SQS. Option D is wrong because AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows; it does not inherently provide a message queue for buffering bursts of requests and would not prevent the API from being overwhelmed by direct calls.

Practice this question →

305

MCQmedium

A retail company expects 10x normal traffic during Black Friday. They want to ensure their application can handle this peak load automatically. Which AWS services should they configure to handle this requirement?

A.Launch the maximum number of instances before Black Friday and keep them running year-round

B.EC2 Auto Scaling + Application Load Balancer with CloudWatch scaling policies

C.Increase the EC2 instance size to the largest available type

D.Use AWS Snowball to temporarily add compute capacity

AnswerB

The right solution is EC2 Auto Scaling, an Application Load Balancer, and CloudWatch alarms. Auto Scaling dynamically launches and terminates EC2 instances based on demand, while the ALB distributes incoming traffic evenly across healthy instances. CloudWatch monitors metrics like CPU utilization or request count and triggers scaling policies, giving you elasticity, high availability, and cost control—this is the canonical architecture for variable web workloads.

Why this answer

EC2 Auto Scaling automatically adjusts the number of EC2 instances based on demand, and an Application Load Balancer distributes incoming traffic across those instances. CloudWatch scaling policies monitor metrics like CPU utilization or request count to trigger scaling actions, ensuring the application can handle the 10x traffic spike without manual intervention.

Exam trap

AWS often tests the misconception that vertical scaling (increasing instance size) is sufficient for handling traffic spikes, but the exam emphasizes horizontal scaling with Auto Scaling and load balancers as the correct approach for elasticity and high availability.

How to eliminate wrong answers

Option A is wrong because launching the maximum number of instances year-round leads to unnecessary cost and resource waste, as the company only needs the extra capacity during the Black Friday peak, not constantly. Option C is wrong because simply increasing the instance size to the largest available type does not provide horizontal scaling; a single large instance can still be overwhelmed by a 10x traffic spike and creates a single point of failure. Option D is wrong because AWS Snowball is a petabyte-scale data transfer service for moving large amounts of data into or out of AWS, not a compute capacity solution; it cannot handle real-time traffic spikes.

Practice this question →

306

MCQmedium

A company has 50 TB of on-premises file server data that must be transferred to Amazon S3. The company's internet connection is limited to 100 Mbps, and the data transfer must not impact daily business operations. The company needs a physical device to securely copy the data and then ship it to AWS for ingestion. Which AWS service should the company use?

A.AWS Snowball

B.AWS DataSync

C.Amazon S3 Transfer Acceleration

D.AWS Direct Connect

AnswerA

Correct. AWS Snowball is a physical device service for offline data transfer. It is ideal for moving large datasets (terabytes to petabytes) when network bandwidth is limited, costly, or unavailable. The device is shipped to the customer, data is copied locally, and the device is returned to AWS for ingestion into Amazon S3.

Why this answer

AWS Snowball is a physical data transport solution designed for large-scale data transfers when network bandwidth is limited or unreliable. With 50 TB of data and a 100 Mbps connection, transferring over the network would take approximately 46 days and saturate the link, impacting business operations. Snowball provides a rugged, secure device that you copy data to locally and ship to AWS, bypassing the network entirely.

Exam trap

The trap here is that candidates may choose DataSync or S3 Transfer Acceleration because they are familiar AWS data transfer services, but they overlook the explicit requirement for a physical device and the need to avoid impacting business operations on a low-bandwidth link.

Why the other options are wrong

AWS DataSync is a software-based data transfer service that moves data over the network, not via a physical device. The question explicitly requires a physical device to copy data and ship it to AWS, which DataSync cannot provide.

AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but it does not involve a physical device for shipping data. The question explicitly requires a physical device to copy and ship data, which Direct Connect cannot provide.

Practice this question →

307

MCQmedium

A company runs a containerized application that uses multiple Docker containers. The development team wants to run these containers on AWS without provisioning or managing any EC2 instances. They also do not want to manage the container orchestration control plane. The application requires consistent access to persistent storage volumes that can be attached to containers. Which AWS service should the team use to run the containers with the least operational overhead?

A.Amazon EC2 with a container-optimized AMI

B.AWS Lambda

C.AWS Fargate

D.Amazon ECR (Amazon Elastic Container Registry)

AnswerC

AWS Fargate is a serverless compute engine for containers. It eliminates the need to provision and manage EC2 instances or the container orchestration control plane. You define your containerized application (task definition) and Fargate launches and runs the containers. Fargate also supports persistent storage through Amazon EFS or Docker volumes, meeting the storage requirement with minimal operational overhead.

Why this answer

AWS Fargate is a serverless compute engine for containers that allows you to run containers without provisioning or managing EC2 instances or the underlying container orchestration control plane (Amazon EKS or Amazon ECS). It directly meets the requirement of zero infrastructure management while supporting persistent storage through Amazon EFS filesystems or Docker volumes that can be attached to Fargate tasks, providing consistent access to storage volumes.

Exam trap

The trap here is that candidates often confuse AWS Fargate with Amazon ECS or EKS, thinking they must choose a managed orchestration service that still requires EC2 management, but Fargate eliminates both instance and control plane management.

Why the other options are wrong

Amazon EC2 with a container-optimized AMI requires provisioning and managing EC2 instances, which contradicts the requirement to not manage any EC2 instances or the container orchestration control plane.

AWS Lambda is designed for short-running, event-driven functions, not for running multiple Docker containers with persistent storage volumes attached. It does not support long-running containerized applications or consistent access to persistent storage.

Amazon ECR is a container image registry for storing and managing Docker images, not a compute service for running containers. It does not provide the ability to run containers or attach persistent storage volumes.

Practice this question →

308

MCQmedium

A company has a mobile application that allows users to upload profile photos. When a new photo is uploaded to an Amazon S3 bucket, the application must automatically create a thumbnail version and store it in another S3 bucket. The company wants a solution that runs only when needed, scales automatically, and requires no management of underlying servers. Which AWS service should the company use to meet these requirements?

A.AWS Lambda

B.AWS Batch

C.Amazon EC2

D.Amazon ECS with EC2 launch type

AnswerA

AWS Lambda is the correct choice because it is a serverless compute service that can be triggered directly by Amazon S3 object-created events. When a user uploads a profile photo, Lambda executes the thumbnail-generation code automatically, scales horizontally to handle concurrent uploads without any infrastructure provisioning, and incurs cost only for the compute time actually consumed during the invocation.

Why this answer

AWS Lambda is the correct choice because it is a serverless compute service that runs code in response to events, such as an S3 PUT object event. It automatically scales from zero to thousands of concurrent executions based on the number of incoming uploads, and requires no server management, perfectly meeting the requirement for an on-demand, auto-scaling thumbnail generation solution.

Exam trap

The trap here is that candidates may confuse AWS Batch with event-driven processing, but Batch is optimized for scheduled or queued batch jobs, not for real-time, per-object triggers like S3 uploads.

Why the other options are wrong

AWS Batch is designed for batch computing jobs that require orchestration of compute resources, not for event-driven, short-lived tasks like image processing triggered by S3 uploads. It does not natively integrate with S3 events to trigger jobs automatically without additional setup.

Amazon EC2 requires manual management of underlying servers and does not automatically scale based on S3 events. It would need constant running instances or complex auto-scaling setups, violating the 'runs only when needed' and 'no management' requirements.

Amazon ECS with EC2 launch type requires managing EC2 instances, which does not meet the requirement of no server management. It also does not automatically trigger on S3 uploads without additional setup like EventBridge.

Practice this question →

309

MCQmedium

A company runs an application with variable workloads. During business hours, they need 10 EC2 instances; overnight they only need 2. Which combination minimizes cost while meeting this requirement?

A.10 On-Demand Instances running 24/7

B.10 Reserved Instances

C.2 Reserved Instances + Auto Scaling with On-Demand for variable demand

D.10 Spot Instances with Auto Scaling

AnswerC

This option is correct because Reserved Instances cover the predictable 2-instance baseline at the lowest possible price, while an Auto Scaling group uses On-Demand instances to handle the daytime spike. The scaling policy increases capacity during business hours and terminates those extra instances overnight, so you never pay for resources you aren't using. The design keeps the critical baseline always available via RIs, and uses On-Demand flexibility to match variable load.

Why this answer

It uses 2 Reserved Instances to cover the baseline workload (overnight) at a lower cost, and Auto Scaling with On-Demand Instances to dynamically add capacity during business hours. Reserved Instances provide a significant discount over On-Demand for steady-state usage, while On-Demand instances handle variable demand without upfront commitment, minimizing total cost.

Exam trap

The trap here is that candidates may choose Spot Instances (Option D) for cost savings without recognizing their lack of reliability for a workload requiring consistent availability during business hours, or they may over-purchase Reserved Instances (Option B) assuming all capacity must be reserved, ignoring the variable nature of the workload.

How to eliminate wrong answers

Option A is wrong because running 10 On-Demand Instances 24/7 incurs the highest cost, as On-Demand pricing is premium and does not leverage any discount for steady-state usage. Option B is wrong because 10 Reserved Instances lock in capacity for a 1- or 3-year term, but only 2 are needed overnight; the additional 8 Reserved Instances would be underutilized during off-peak hours, wasting money. Option D is wrong because Spot Instances can be terminated by AWS with little notice (2-minute warning) when capacity is reclaimed, making them unsuitable for a workload that must be available during business hours; they lack the reliability needed for consistent daytime operation.

Practice this question →

310

MCQmedium

A company needs to process and analyze streaming log data from thousands of servers in near real-time, loading the results into Amazon Redshift for dashboards. Which AWS service is designed for this streaming ETL delivery use case?

A.Amazon Kinesis Data Streams

B.Amazon Kinesis Data Firehose

C.AWS Glue

D.Amazon MSK

AnswerB

Kinesis Data Firehose is the managed streaming delivery service that loads data into Redshift, S3, and OpenSearch automatically — including optional Lambda transformation, with no consumer code needed.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed specifically for streaming ETL (extract, transform, load) delivery. It can capture, transform (e.g., convert to Parquet/ORC, perform Lambda-based data transformation), and automatically load streaming data into Amazon Redshift, Amazon S3, or Amazon OpenSearch Service in near real-time, with no ongoing administration required.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams (raw ingestion) with Kinesis Data Firehose (managed ETL delivery), assuming both can directly load into Redshift, but only Firehose provides the built-in COPY command integration and automatic transformation capabilities.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams is a raw data ingestion service that stores streaming data in shards for custom consumers to process; it does not natively perform ETL transformations or directly load data into Redshift without additional custom code. Option C is wrong because AWS Glue is a serverless data integration service primarily for batch ETL jobs and cataloging, not designed for continuous near-real-time streaming ingestion into Redshift. Option D is wrong because Amazon MSK (Managed Streaming for Apache Kafka) provides a managed Kafka cluster for building custom streaming applications, but it lacks built-in ETL transformation and direct Redshift delivery capabilities, requiring additional infrastructure and code.

Practice this question →

311

MCQmedium

A company is deploying a new web application on AWS. The operations team needs to provision and manage AWS resources such as Amazon EC2 instances, Amazon RDS databases, and Amazon S3 buckets in a repeatable, consistent manner across development, test, and production environments. The team wants to define the entire infrastructure as code using declarative templates that can be version-controlled and reviewed. Which AWS service should the team use to meet this requirement?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerB

AWS CloudFormation is the correct service. It enables you to define and provision AWS infrastructure using declarative templates. You can version control these templates, review them, and deploy consistent environments across development, test, and production. This is the ideal solution for infrastructure as code on AWS.

Why this answer

AWS CloudFormation is the correct service because it allows you to define your entire infrastructure as code using declarative templates (JSON or YAML). These templates can be version-controlled and reviewed, enabling repeatable and consistent provisioning of resources like EC2 instances, RDS databases, and S3 buckets across multiple environments. CloudFormation manages the lifecycle of these resources as stacks, ensuring idempotent deployments.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk (a PaaS for application deployment) with infrastructure-as-code, but Elastic Beanstalk does not provide the declarative, version-controlled resource templates that CloudFormation offers for managing individual AWS resources like EC2, RDS, and S3 across environments.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service that automates application deployment and provisioning, but it does not provide declarative infrastructure-as-code templates for defining resources like EC2, RDS, and S3 in a repeatable, version-controlled manner across environments.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, not declarative templates for infrastructure as code. It focuses on managing server configurations rather than provisioning resources like EC2, RDS, and S3 in a repeatable, version-controlled manner.

AWS CodeDeploy automates code deployments to running instances, not infrastructure provisioning. The question requires defining and managing infrastructure as code with declarative templates, which is CloudFormation's purpose.

Practice this question →

312

MCQmedium

A company is deploying a multi-tier application on AWS. Which AWS service provides layer 4 (TCP/UDP) load balancing with ultra-high performance and static IP addresses?

A.Application Load Balancer (ALB)

B.Network Load Balancer (NLB)

C.Gateway Load Balancer (GWLB)

D.Classic Load Balancer

AnswerB

Network Load Balancer (NLB) functions at Layer 4 of the OSI model, handling millions of requests per second with ultra-low latency while preserving the client's source IP address, which is critical for security and audit requirements. It automatically allocates one static Elastic IP per Availability Zone, giving clients immutable endpoints that remain unchanged even as backend capacity scales. This combination of TCP/UDP support, static IPs, and massive throughput makes NLB the precise match for this high-performance, fixed-IP load-balancing need.

Why this answer

Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with ultra-low latency. It provides static IP addresses per Availability Zone, which is essential for applications requiring fixed endpoints for whitelisting or DNS stability.

Exam trap

The trap here is that candidates often confuse ALB's Layer 7 features with NLB's Layer 4 capabilities, or assume Classic Load Balancer still provides static IPs, but only NLB offers both Layer 4 operation and static IP addresses for ultra-high performance scenarios.

How to eliminate wrong answers

Option A is wrong because Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and does not provide static IP addresses; it uses a DNS name that resolves to changing IPs. Option C is wrong because Gateway Load Balancer (GWLB) operates at Layer 3 (IP) and Layer 4, but it is specifically designed for transparent network gateways (e.g., firewalls, intrusion detection) and does not provide static IP addresses for client-facing load balancing. Option D is wrong because Classic Load Balancer (CLB) is a legacy option that supports Layer 4 and Layer 7 but does not offer static IP addresses and lacks the ultra-high performance and scalability of NLB.

Practice this question →

313

MCQmedium

A financial services company runs a high-frequency trading application that must process transactions with sub-millisecond latency. The application must run in the company's own data center to meet strict latency requirements, but the company wants to use the same AWS management APIs, control plane, and tools (such as AWS CloudFormation and Amazon CloudWatch) for consistency across on-premises and cloud environments. The company also needs the ability to seamlessly run Amazon EBS-backed Amazon EC2 instances locally. Which AWS service should the company use to meet these requirements?

A.AWS Outposts

B.AWS Wavelength

C.AWS Local Zones

D.AWS Direct Connect

AnswerA

Correct. AWS Outposts extends AWS infrastructure and services to on-premises facilities, allowing the company to run EC2 instances with EBS storage using the same AWS APIs and management tools, while keeping the application in the local data center for ultra-low latency.

Why this answer

AWS Outposts is correct because it extends AWS infrastructure, services, APIs, and tools to on-premises data centers, enabling the company to run Amazon EBS-backed EC2 instances locally with sub-millisecond latency while using the same AWS management APIs, CloudFormation, and CloudWatch for consistency.

Exam trap

The trap here is confusing AWS Outposts with AWS Local Zones or Wavelength, as candidates often think any edge or local compute service can run in their own data center, but only Outposts provides the fully managed, on-premises AWS infrastructure with local EBS-backed EC2 instances.

Why the other options are wrong

AWS Wavelength is designed for ultra-low latency applications at the edge of 5G networks, not for on-premises data centers. It does not run in the customer's own data center or support local EBS-backed EC2 instances.

AWS Local Zones extend AWS infrastructure to metropolitan areas for low-latency applications, but they do not run in the customer's own data center. The requirement to keep the application in the company's own data center eliminates Local Zones.

AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, but it does not run AWS services locally in the customer's data center. The requirement to run Amazon EBS-backed EC2 instances on-premises with sub-millisecond latency cannot be met by Direct Connect alone.

Practice this question →

314

MCQmedium

A company wants to provide their data analysts with a way to run SQL queries on their S3 data lake using familiar BI tools like Tableau or Power BI. Which AWS service provides an ODBC/JDBC connection to S3 data?

A.Amazon QuickSight

B.Amazon Athena with JDBC/ODBC drivers

C.Amazon EMR with Hive

D.AWS Glue Data Catalog only

AnswerB

Amazon Athena is a serverless, interactive query service that runs standard SQL directly against data stored in Amazon S3. Athena provides official JDBC and ODBC drivers (from Simba) that enable BI tools like Tableau, Power BI, and QuickSight to connect to Athena as if it were a traditional database, using a preexisting connection string and standard SQL syntax. Because it is serverless, there are no clusters to provision or manage, and you pay only for the data scanned per query—making it the ideal choice for on-demand, low-latency SQL analytics over S3 data.

Why this answer

Amazon Athena is a serverless interactive query service that allows you to run standard SQL directly against data stored in Amazon S3. It provides JDBC and ODBC drivers that enable BI tools like Tableau and Power BI to connect to Athena and query the S3 data lake without needing to move or transform the data.

Exam trap

The trap here is that candidates may confuse Amazon QuickSight (a visualization tool) with the query engine that provides the actual JDBC/ODBC connectivity, or think that AWS Glue Data Catalog alone enables SQL queries, when in fact Athena is the service that combines the Data Catalog with a serverless SQL engine and JDBC/ODBC support.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a BI visualization service, not a SQL query engine that provides JDBC/ODBC connectivity to S3 data; it can use Athena as a data source but does not itself expose an ODBC/JDBC interface. Option C is wrong because Amazon EMR with Hive can query S3 data, but it requires provisioning and managing a Hadoop cluster, and while Hive has a JDBC driver, the question specifically asks for a service that provides an ODBC/JDBC connection to S3 data in a serverless, familiar BI tool context—Athena is the simpler, direct answer. Option D is wrong because AWS Glue Data Catalog is a metadata repository that stores table definitions and schema information; it does not provide a query engine or ODBC/JDBC connectivity on its own.

Practice this question →

315

MCQmedium

A company is deploying a multi-tier web application that includes a VPC, subnets, security groups, EC2 instances, and an Application Load Balancer. The team needs to define the entire infrastructure in a version-controlled template so that it can be consistently deployed across development, test, and production environments with minimal manual effort. Which AWS service should the team use to meet this requirement?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS OpsWorks

D.AWS Systems Manager

AnswerA

AWS CloudFormation is the correct choice because it enables Infrastructure as Code (IaC) by provisioning AWS resources—including VPCs, subnets, internet gateways, and security groups—from a declarative JSON or YAML template. The template is version-controllable and reusable, so the same multi-tier architecture can be deployed consistently across dev, test, and production environments. CloudFormation stacks also support update, rollback, and drift detection, giving the team precise control over the entire resource lifecycle.

Why this answer

AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define your entire multi-tier web application infrastructure—including VPC, subnets, security groups, EC2 instances, and an Application Load Balancer—in a version-controlled template (JSON or YAML). This enables consistent, repeatable deployments across development, test, and production environments with minimal manual effort, as CloudFormation handles the provisioning and updates in an orderly, predictable manner.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk (a PaaS that simplifies deployment) with CloudFormation (an IaC service), but Elastic Beanstalk does not provide the granular, version-controlled control over network components like VPCs and subnets required by the question.

Why the other options are wrong

AWS Elastic Beanstalk is a PaaS service that abstracts infrastructure management, but it does not provide version-controlled infrastructure-as-code templates for defining VPCs, subnets, security groups, and other low-level resources. The requirement is for a template-based, version-controlled deployment of the entire infrastructure, which is exactly what CloudFormation offers.

AWS OpsWorks is a configuration management service that uses Chef or Puppet, not a declarative infrastructure-as-code template service. The requirement is for a version-controlled template to define the entire infrastructure, which is the purpose of AWS CloudFormation.

AWS Systems Manager is a management service for operational tasks like patching and automation, not for defining and deploying entire infrastructure templates in a version-controlled manner.

Practice this question →

316

MCQmedium

A company needs to provide secure, scalable file storage for thousands of concurrent users accessing the same shared file system from Linux-based EC2 instances. Which AWS service is most appropriate?

A.Amazon EBS Multi-Attach

B.Amazon EFS

C.Amazon S3

D.Amazon FSx for Windows File Server

AnswerB

Amazon EFS is a fully managed, POSIX-compliant file system designed for Linux workloads that automatically scales storage capacity and throughput as files are added or accessed. It uses the NFSv4.1 protocol and can be mounted simultaneously on thousands of EC2 instances across multiple Availability Zones, eliminating the need for manual capacity planning. This elasticity and concurrency make EFS the correct choice for scenarios requiring a shared file system with a high number of concurrent Linux users.

Why this answer

Amazon EFS (Elastic File System) is the correct choice because it provides a fully managed, scalable, and elastic NFS file system that can be concurrently accessed by thousands of Linux-based EC2 instances. It automatically scales storage capacity up and down as files are added or removed, and it supports the NFSv4.1 and NFSv4.0 protocols, making it ideal for shared file workloads on Linux.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a true shared file system, not realizing it is limited to a small number of instances in the same AZ and requires application-level coordination for writes, making it unsuitable for thousands of concurrent users.

How to eliminate wrong answers

Option A is wrong because Amazon EBS Multi-Attach only allows a single EBS volume to be attached to up to 16 Nitro-based EC2 instances in the same Availability Zone, and it does not support concurrent write access from multiple instances—it is designed for clustered applications that manage I/O coordination themselves, not for thousands of concurrent users. Option C is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs (REST/SOAP), not a file system; it does not provide a POSIX-compliant file system interface and cannot be mounted directly as a shared file system by EC2 instances without additional software (e.g., S3FS FUSE), which introduces performance and consistency limitations. Option D is wrong because Amazon FSx for Windows File Server provides SMB-based file storage for Windows-based workloads, not Linux; it does not natively support NFS and is not designed for Linux-based EC2 instances.

Practice this question →

317

MCQmedium

A company hosts a static website on Amazon S3. Users in different geographic locations experience high latency when accessing the website. The company wants to reduce latency for all users and also minimize the number of direct requests to the S3 bucket. Which AWS service should the company use?

A.AWS Global Accelerator

B.Amazon CloudFront

C.Amazon Route 53 latency-based routing

D.AWS Direct Connect

AnswerB

Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide. This reduces latency by serving content from a nearby edge location and reduces the number of direct requests to the S3 bucket, thereby offloading the origin.

Why this answer

Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, significantly reducing latency for users regardless of their geographic location. By serving content from the edge, CloudFront also offloads direct requests to the S3 bucket, reducing the load on the origin and potentially lowering costs.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator (which optimizes network path but does not cache) with CloudFront (which caches content at the edge), leading them to choose Global Accelerator for a static website latency problem.

Why the other options are wrong

AWS Global Accelerator improves performance for TCP/UDP traffic by routing over the AWS global network, but it does not cache static content or reduce direct requests to the S3 bucket. For a static website, CloudFront's content delivery network (CDN) is the appropriate service to cache content at edge locations and minimize S3 requests.

Amazon Route 53 latency-based routing directs traffic to the region with the lowest latency, but it does not cache content or reduce direct requests to the S3 bucket; each user request still goes directly to S3, which can cause high latency and load on the bucket.

AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, which does not reduce latency for geographically distributed users accessing a public S3 website, nor does it minimize direct S3 requests.

Practice this question →

318

MCQmedium

A company is refactoring its monolithic e-commerce application into multiple microservices. The order-processing service must send messages to the inventory service to reserve stock. The company needs a fully managed service that can durably store these messages, handle high throughput, and allow the inventory service to poll for messages at its own pace. The company wants to avoid any message loss. Which AWS service should the company use?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Streams

D.Amazon MQ

AnswerA

Correct. Amazon SQS is a fully managed message queue service designed for decoupling application components. It stores messages durably, supports high throughput, and allows consumers to poll for messages, ensuring no message loss. This fits the requirement perfectly.

Why this answer

Amazon SQS is the correct choice because it is a fully managed message queuing service that durably stores messages across multiple Availability Zones, ensuring no message loss. It supports high throughput and allows the inventory service to poll for messages at its own pace using long or short polling, decoupling the order-processing and inventory services.

Exam trap

The trap here is that candidates might choose Amazon SNS because they confuse push-based notifications with durable message queuing, overlooking that SNS does not store messages or allow polling, which is essential for decoupled, loss-free communication.

Why the other options are wrong

SNS is a pub/sub messaging service that pushes messages to subscribers; it does not support polling by consumers. The inventory service needs to poll for messages at its own pace, which SQS provides via long polling. SNS also does not durably store messages for individual consumer retrieval.

Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for decoupled message queuing with individual message polling. It requires consumers to process records in order within shards, and does not support independent polling at the consumer's own pace without managing shard iterators.

Amazon MQ is a managed message broker for ActiveMQ or RabbitMQ, not a fully managed service that durably stores messages with high throughput and polling at the consumer's pace. It requires managing brokers and is not serverless, and it does not guarantee the same level of durability and scalability as SQS for this use case.

Practice this question →

319

MCQeasy

Which AWS service helps you manage and deploy infrastructure as code using templates?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS OpsWorks

D.AWS CodeDeploy

AnswerB

CloudFormation is AWS's native infrastructure-as-code service, where you define resources in a declarative JSON or YAML template and the service provisions, updates, and deletes the stack as a single unit. It manages resource dependencies and ordered operations automatically, making it the correct answer for template-based infrastructure provisioning. Administrators can version templates and use them across accounts and regions, giving deterministic infrastructure.

Why this answer

AWS CloudFormation is the correct service because it allows you to model and provision AWS resources using declarative templates (JSON or YAML). This enables Infrastructure as Code (IaC) by treating infrastructure as version-controlled, repeatable code, which can be used to create, update, and delete entire stacks of resources in a predictable manner.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk (which also uses a 'template' concept for environment configuration) with CloudFormation, but Elastic Beanstalk is a higher-level abstraction for application deployment, not a general-purpose IaC tool for managing all AWS resources.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk is a Platform as a Service (PaaS) that automates application deployment and scaling, but it does not use templates for IaC; it uses a managed environment with limited customization. Option C is wrong because AWS OpsWorks is a configuration management service that uses Chef or Puppet recipes, not declarative templates, and is more focused on server configuration than IaC. Option D is wrong because AWS CodeDeploy is a deployment automation service that handles code deployment to compute instances, but it does not manage infrastructure provisioning or use templates for resource creation.

Practice this question →

320

MCQeasy

A company runs multiple EC2 instances across several applications and wants to centralise all application log files in one place for searching, analysis, and long-term retention. Which AWS service provides centralised log storage and querying?

A.Amazon S3

B.AWS CloudTrail

C.Amazon CloudWatch Logs

D.Amazon Kinesis Data Firehose

AnswerC

Amazon CloudWatch Logs is the purpose-built service for centralised log storage and real-time analysis: the unified CloudWatch agent collects logs from EC2 instances, Lambda execution events are ingested natively, and on-premises servers can stream logs via the agent as well. Log events are organised into log groups and streams with configurable retention, and you can define metric filters to create CloudWatch metrics from matching log patterns, triggering alarms, or run interactive queries using CloudWatch Logs Insights. This makes it the correct choice when the need is unified operational logging with search, monitoring, and alerting.

Why this answer

Amazon CloudWatch Logs is the correct service because it is designed to centralize log storage from multiple sources, including EC2 instances, via the CloudWatch agent. It provides built-in querying with Logs Insights, supports real-time monitoring, and offers configurable retention policies for long-term storage, meeting all requirements for searching, analysis, and retention.

Exam trap

The trap here is that candidates often confuse CloudWatch Logs with CloudTrail, mistakenly thinking CloudTrail handles application logs, when in fact CloudTrail only records AWS API calls, not application-generated log data.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a log querying service; while logs can be stored in S3, it lacks native querying capabilities without additional services like Athena. Option B is wrong because AWS CloudTrail records API activity for governance and auditing, not application log files; it captures control-plane events, not application-level logs. Option D is wrong because Amazon Kinesis Data Firehose is a data ingestion and delivery service that streams data to destinations like S3 or Redshift, but it does not provide native log storage or querying capabilities.

Practice this question →

321

MCQmedium

A company wants to create a hybrid cloud architecture where their on-premises applications can access AWS services as if they were running locally. Which AWS service extends AWS infrastructure and services to on-premises locations?

A.AWS Direct Connect

B.AWS VPN

C.AWS Outposts

D.AWS Local Zones

AnswerC

AWS Outposts is a fully managed service that physically installs AWS-designed racks of compute and storage hardware in your own data center or co-location facility. These racks run the same AWS APIs, tools, and management console as an AWS Region, effectively extending AWS infrastructure to your on-premises site for ultra-low latency and local data residency needs. Since Outposts brings AWS services directly to your location with local operation, it is the only option here that genuinely extends AWS infrastructure to your premises.

Why this answer

AWS Outposts is the correct answer because it is a fully managed service that extends AWS infrastructure, services, APIs, and tools to virtually any on-premises or edge location. This allows customers to run AWS services locally, enabling a true hybrid cloud experience where on-premises applications can access AWS services with low latency and local data processing, as if they were running in an AWS Region.

Exam trap

The trap here is that candidates often confuse AWS Direct Connect or VPN as the solution for extending AWS services on-premises, but those only provide network connectivity, not the actual deployment of AWS infrastructure locally.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, but it does not extend AWS infrastructure or services locally; it only provides a private, high-bandwidth link to AWS Regions. Option B is wrong because AWS VPN creates an encrypted tunnel over the public internet to connect on-premises networks to AWS, but it does not bring AWS services or infrastructure on-premises. Option D is wrong because AWS Local Zones are extensions of AWS Regions that place compute, storage, and database services closer to end users for low-latency applications, but they are still within the AWS network and not deployed on customer premises.

Practice this question →

322

MCQmedium

A media company processes user-uploaded images to generate thumbnails and metadata. The current solution runs a script on a single Amazon EC2 instance, which becomes overloaded during peak hours, causing delays. The company wants a solution that automatically scales to handle spikes in upload volume, requires no server management, and charges only for the processing time consumed. Which AWS service should the company use?

A.AWS Lambda

B.Amazon EC2 Auto Scaling

C.AWS Batch

D.Amazon Lightsail

AnswerA

Correct. AWS Lambda is a serverless compute service that executes code in response to triggers (e.g., S3 uploads) and automatically scales based on incoming traffic. It requires no server management and charges only for the compute time used, meeting all stated requirements.

Why this answer

AWS Lambda is the correct choice because it provides a serverless compute service that automatically scales with incoming upload volume, requires no server management, and charges only for the actual processing time (in 1ms increments). The media company's need for automatic scaling, zero server management, and pay-per-use billing aligns perfectly with Lambda's event-driven architecture, where each image upload can trigger a Lambda function to generate thumbnails and metadata without provisioning or managing any underlying infrastructure.

Exam trap

The trap here is that candidates often confuse 'auto scaling' with 'serverless' and choose Amazon EC2 Auto Scaling (Option B) because it scales, but they overlook the requirement for 'no server management' and 'pay only for processing time,' which EC2 Auto Scaling does not satisfy.

Why the other options are wrong

AWS Batch is designed for batch computing jobs that require orchestration of compute resources, but it still involves managing compute environments (e.g., EC2 instances) and does not provide the serverless, automatic scaling with per-execution billing that the question requires.

Amazon Lightsail requires manual scaling and server management, which does not meet the requirement for automatic scaling and no server management.

Practice this question →

323

MCQmedium

A company is developing a microservices application on AWS. The application has multiple independent services that must communicate asynchronously. The company needs a fully managed service to reliably store and deliver messages between these services, ensuring that each message is processed at least once and allowing the services to scale independently. Which AWS service should the company use?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon MQ

D.Amazon Kinesis Data Streams

AnswerA

Amazon SQS is the correct choice because it is a fully managed message queue service specifically built for decoupling microservices. It durably stores messages in a queue and allows each consumer to poll for its own messages at its own pace, which means producers and consumers can scale independently without blocking each other. With standard queues you get at-least-once delivery and high throughput, while FIFO queues give exactly-once processing and message ordering, making SQS a flexible, serverless backbone for point-to-point asynchronous communication.

Why this answer

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables asynchronous communication between microservices. It reliably stores messages in queues and ensures each message is delivered at least once, allowing services to poll and process messages independently, which supports decoupling and independent scaling.

Exam trap

The trap here is that candidates confuse SNS (push-based pub/sub) with SQS (pull-based queue), overlooking that the requirement for at-least-once processing and independent scaling points to a queue-based service, not a notification fan-out service.

Why the other options are wrong

Amazon SNS is a pub/sub messaging service that pushes messages to multiple subscribers, but it does not guarantee at-least-once processing or allow services to pull messages at their own pace; messages are pushed and may be lost if a subscriber is unavailable.

Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ, which is not fully serverless and requires provisioning of broker instances. The question specifies a fully managed service for asynchronous communication with at-least-once processing and independent scaling, which SQS provides without managing infrastructure.

Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for reliable message queuing with at-least-once processing. It does not guarantee exactly-once or at-least-once delivery per message in the same way SQS does, and it requires consumers to manage their own checkpointing.

Practice this question →

324

MCQeasy

A developer wants to send real-time notifications to mobile app users when new content is available. Which AWS service enables push notifications to iOS and Android devices?

A.Amazon SES

B.Amazon Pinpoint

C.Amazon SNS

D.AWS AppSync

AnswerC

Amazon SNS is a fully managed pub/sub messaging service that natively integrates with Apple APNs, Google FCM, and Amazon ADM to deliver mobile push notifications. You create a platform application endpoint for each device, then publish messages that SNS pushes to the respective platform, with built-in retry logic and dead-letter queues. SNS is the classic, foundational AWS service for sending simple, real-time push notifications to mobile devices at scale, making it the correct answer.

Why this answer

Amazon SNS (Simple Notification Service) is the correct choice because it provides a fully managed pub/sub messaging service that supports push notifications to mobile endpoints via platform application endpoints for iOS (APNs) and Android (FCM). It enables real-time delivery of messages directly to mobile apps without requiring polling or additional infrastructure.

Exam trap

The trap here is that candidates may confuse Amazon Pinpoint as the only service for push notifications due to its marketing focus, but Amazon SNS is the core service for direct programmatic push notification delivery to mobile devices.

How to eliminate wrong answers

Option A is wrong because Amazon SES (Simple Email Service) is designed for sending transactional and marketing emails, not push notifications to mobile devices; it lacks the ability to send to mobile push endpoints. Option B is wrong because Amazon Pinpoint is a customer engagement service that can send push notifications, but it is primarily a multi-channel marketing and analytics tool, not the simplest or most direct service for a developer to send real-time push notifications programmatically; SNS is the more appropriate service for this specific use case. Option D is wrong because AWS AppSync is a managed GraphQL service for building real-time and offline-capable applications, but it does not directly send push notifications to mobile devices; it can trigger notifications via other services like SNS but is not the push notification delivery mechanism itself.

Practice this question →

325

MCQmedium

A company stores historical sales data in Amazon S3. The data is accessed only once a month for generating quarterly reports. When accessed, the data must be available for retrieval within seconds. The company wants to minimize storage costs while meeting the retrieval latency requirement. Which S3 storage class should the company use?

A.S3 Standard

B.S3 Intelligent-Tiering

C.S3 Standard-IA (Infrequent Access)

D.S3 Glacier Deep Archive

AnswerC

S3 Standard-IA is optimized for infrequently accessed data that requires millisecond retrieval. It offers lower storage costs than S3 Standard, with a retrieval fee. This matches the scenario: monthly access with seconds retrieval latency and lowest cost.

Why this answer

S3 Standard-IA (Infrequent Access) is the correct choice because it offers the same low-latency retrieval (milliseconds) as S3 Standard but at a lower storage cost, making it ideal for data accessed infrequently (e.g., once a month) yet requiring immediate availability. The company's requirement of 'within seconds' is fully met by S3 Standard-IA, which provides the same first-byte latency as S3 Standard, while minimizing storage costs for data that is not accessed frequently.

Exam trap

The trap here is that candidates often confuse 'infrequent access' with 'archival access' and incorrectly choose S3 Glacier Deep Archive, overlooking the critical retrieval latency requirement of 'within seconds' that only S3 Standard-IA (or S3 Standard) can meet.

Why the other options are wrong

S3 Standard is designed for frequently accessed data with millisecond latency, but it has higher storage costs than S3 Standard-IA. Since the data is accessed only once a month, Standard-IA provides the same retrieval latency at lower cost, making Standard suboptimal for minimizing storage costs.

S3 Intelligent-Tiering is designed for data with unknown or changing access patterns, but here the access pattern is known (monthly) and predictable, making Standard-IA more cost-effective without the monitoring fee.

S3 Glacier Deep Archive has a retrieval time of 12-48 hours, which does not meet the requirement of 'available for retrieval within seconds' for monthly data access.

Practice this question →

326

MCQmedium

A company wants to use Amazon S3 to store objects that must not be deleted or overwritten for a specified period for regulatory compliance. Which S3 feature enforces this?

A.S3 Versioning

B.S3 Lifecycle policies

C.S3 Object Lock

D.S3 Block Public Access

AnswerC

S3 Object Lock delivers WORM protection by allowing you to set a retention period on objects, during which they cannot be overwritten or deleted. In Governance mode, a principal with s3:BypassGovernanceRetention can remove the lock, but in Compliance mode the object is immutable even for the root user until the retention expires. This mandatory retention directly satisfies regulatory requirements such as SEC 17a-4(f), making Object Lock the only option here that guarantees data cannot be tampered with.

Why this answer

Amazon S3 Object Lock is designed specifically to prevent objects from being deleted or overwritten for a fixed period or indefinitely. It enforces a write-once-read-many (WORM) model by applying retention modes (Governance or Compliance) or legal holds, which block both DELETE and PUT operations on locked objects until the retention period expires. This directly meets the regulatory compliance requirement described in the question.

Exam trap

The trap here is that candidates often confuse S3 Versioning with immutability, assuming that keeping multiple versions prevents deletion, but versioning alone does not block the ability to delete the latest version or permanently delete all versions.

How to eliminate wrong answers

Option A is wrong because S3 Versioning creates multiple versions of an object but does not prevent deletion or overwriting; a user can still delete the current version or overwrite it, and versioning alone offers no WORM protection. Option B is wrong because S3 Lifecycle policies automate transitions or expirations of objects based on age or rules, but they do not enforce a retention lock that blocks user-initiated deletions or overwrites. Option D is wrong because S3 Block Public Access only restricts public access to buckets and objects via ACLs or bucket policies; it has no mechanism to prevent deletion or overwriting of objects.

Practice this question →

327

MCQeasy

Which AWS database service is best suited for storing and querying data with complex relationships using structured query language?

A.Amazon DynamoDB

B.Amazon RDS

C.Amazon ElastiCache

D.Amazon Neptune

AnswerB

Amazon RDS is a fully managed service that supports multiple relational database engines, including MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. It provides traditional SQL capabilities such as schemas, joins, and transactions, ideal for structured data, plus automated backups, patching, and multi-AZ replication. For any workload requiring a relational database with standard SQL queries, RDS is the correct choice.

Why this answer

Amazon RDS is the correct choice because it provides managed relational database services (e.g., MySQL, PostgreSQL, Oracle, SQL Server) that use structured query language (SQL) and are designed to handle complex relationships through foreign keys, joins, and normalized schemas. This makes it ideal for applications requiring ACID transactions and complex queries across multiple tables.

Exam trap

The trap here is that candidates often confuse Amazon DynamoDB's ability to store JSON documents with relational capabilities, but DynamoDB lacks SQL support and cannot efficiently handle complex multi-table joins or referential integrity constraints.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support complex relational queries or SQL; it is optimized for high-scale, low-latency access with simple query patterns. Option C is wrong because Amazon ElastiCache is an in-memory caching service (supporting Redis and Memcached) that is not designed for persistent relational data storage or complex SQL queries. Option D is wrong because Amazon Neptune is a graph database that uses query languages like Gremlin and SPARQL, not SQL, and is specialized for highly connected data (e.g., social networks, recommendation engines) rather than general relational data.

Practice this question →

328

MCQmedium

A company's microservices application consists of 10 services. When a user request is slow, the development team cannot determine which service in the chain is the bottleneck. Which AWS service provides distributed tracing so they can see the full path of a request and identify the slow component?

A.Amazon CloudWatch Metrics

B.AWS CloudTrail

C.AWS X-Ray

D.Amazon Inspector

AnswerC

X-Ray instruments applications with the X-Ray SDK to capture trace data for each request. It builds a service map showing latency at each service hop, making it straightforward to identify the bottleneck in a multi-service chain.

Why this answer

AWS X-Ray is the correct service because it provides end-to-end distributed tracing, allowing developers to trace a request as it travels through multiple microservices. It generates a service map that shows the full path of a request, including latency breakdowns for each service, enabling identification of the slow component. This directly addresses the need to pinpoint bottlenecks in a chain of 10 services.

Exam trap

The trap here is that candidates confuse Amazon CloudWatch Metrics (which shows aggregate performance data) with distributed tracing, not realizing that only X-Ray can trace a single request's full path across multiple services to identify the specific slow component.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Metrics aggregates and monitors performance metrics (e.g., CPU, memory) but does not trace individual requests across services or show the request path through a microservices chain. Option B is wrong because AWS CloudTrail records API calls for auditing and governance, not application-level request tracing or latency analysis. Option D is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a distributed tracing tool.

Practice this question →

329

MCQmedium

A company needs to replicate their Amazon S3 data to a different AWS Region automatically to meet disaster recovery requirements. Which S3 feature enables this?

A.S3 Intelligent-Tiering

B.S3 Cross-Region Replication (CRR)

C.S3 Lifecycle policies

D.S3 Transfer Acceleration

AnswerB

S3 Cross-Region Replication (CRR) automatically and asynchronously replicates newly uploaded objects and subsequent updates to a destination bucket in a different AWS Region. It requires versioning to be enabled on both source and destination buckets, and is commonly used for disaster recovery, compliance mandates that require data residency, and reducing latency for geographically distributed users. The configuration is defined by replication rules at the bucket level, and you can choose to replicate all objects or a subset by prefix or tag.

Why this answer

Amazon S3 Cross-Region Replication (CRR) is the correct feature because it automatically and asynchronously replicates objects across S3 buckets in different AWS Regions, meeting disaster recovery requirements by ensuring data is available in a secondary geographic location. CRR requires versioning to be enabled on both source and destination buckets, and it replicates new objects and object metadata by default, with optional configuration for replicating delete markers or objects from specific prefixes.

Exam trap

The trap here is that candidates often confuse S3 Lifecycle policies (which manage storage tiers) with replication features, or mistakenly think S3 Transfer Acceleration provides replication because it improves transfer speed, but neither performs automatic cross-region copying.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering is a storage class that optimizes costs by moving data between access tiers based on usage patterns, not a replication feature; it does not copy data to another Region. Option C is wrong because S3 Lifecycle policies automate transitioning objects between storage classes or expiring them, but they do not replicate data across Regions. Option D is wrong because S3 Transfer Acceleration speeds up uploads over long distances using AWS edge locations and optimized network paths, but it does not provide automatic replication or disaster recovery.

Practice this question →

330

MCQmedium

A company uses Amazon S3 to store raw data files for a data analytics platform. The company requires that files remain immediately accessible for the first 30 days after upload. After 30 days, files must be automatically moved to a lower-cost storage class for archival access. After 7 years, files must be automatically deleted. The company wants to implement this data management strategy with minimal ongoing effort. Which AWS S3 feature should the company use?

A.S3 Lifecycle policies

B.S3 Intelligent-Tiering

C.S3 Object Lock

D.S3 Versioning

AnswerA

This is correct. S3 Lifecycle policies allow you to define rules for transitioning objects to other storage classes after a specified number of days and for expiring (deleting) objects after a set period. This automates the company's data management requirements.

Why this answer

S3 Lifecycle policies allow you to define rules that automatically transition objects between storage classes (e.g., from S3 Standard to S3 Glacier Deep Archive) and expire (delete) objects based on object age. This directly meets the requirement to keep files immediately accessible for 30 days, move them to a lower-cost archival class after 30 days, and delete them after 7 years, all with minimal ongoing effort.

Exam trap

The trap here is that candidates often confuse S3 Intelligent-Tiering (which automates cost optimization based on access patterns) with S3 Lifecycle policies (which enforce a fixed, time-based data management schedule), leading them to choose Intelligent-Tiering even though it cannot enforce a mandatory deletion date.

Why the other options are wrong

S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, but it does not support time-based transitions to a specific lower-cost storage class after a fixed period (e.g., 30 days) or automatic deletion after a fixed retention period (e.g., 7 years).

S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed retention period, not to automate transitions between storage classes or schedule deletions based on age.

S3 Versioning is used to preserve, retrieve, and restore every version of an object, not to automate transitions between storage classes or schedule deletions. It does not provide lifecycle management for moving or deleting files based on time.

Practice this question →

331

MCQmedium

A development team needs to deploy a web application on AWS quickly. The team wants a fully managed service that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring. The team does not want to manage the underlying Amazon EC2 instances or the application stack manually. Which AWS service should the team use?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS OpsWorks

D.Amazon EC2 Auto Scaling

AnswerA

Correct. AWS Elastic Beanstalk is a PaaS service that automatically manages capacity provisioning, load balancing, auto-scaling, and application health monitoring for deployed web applications. You simply upload your code and the service handles the underlying infrastructure.

Why this answer

AWS Elastic Beanstalk is the correct choice because it is a fully managed Platform as a Service (PaaS) that automatically handles capacity provisioning, load balancing, auto-scaling, and application health monitoring without requiring the team to manage the underlying EC2 instances or application stack. It abstracts away infrastructure management, allowing developers to simply upload their code and have the service handle deployment, scaling, and monitoring out of the box.

Exam trap

The trap here is that candidates often confuse AWS Elastic Beanstalk with AWS CloudFormation, mistakenly thinking that CloudFormation provides the same level of automated management, when in fact CloudFormation only provisions resources based on templates and does not include built-in application health monitoring or auto-scaling logic without additional configuration.

Why the other options are wrong

AWS CloudFormation is an Infrastructure as Code (IaC) service that provisions and manages AWS resources, but it does not automatically handle capacity provisioning, load balancing, auto-scaling, or health monitoring out of the box. The team would need to manually define and configure these components in templates, which contradicts the requirement for a fully managed service that abstracts EC2 management.

AWS OpsWorks is a configuration management service that uses Chef and Puppet, requiring manual management of EC2 instances and application stacks, which contradicts the requirement for a fully managed service without underlying infrastructure management.

Amazon EC2 Auto Scaling only handles scaling EC2 instances based on demand, but it does not provide a fully managed platform for deploying web applications, nor does it handle capacity provisioning, load balancing, or application health monitoring automatically without additional configuration.

Practice this question →

332

MCQmedium

A company runs a data-intensive workload in a colocation facility and wants to establish a dedicated, private network connection to its Amazon VPC. The connection must bypass the public internet to provide consistent high throughput and low latency. The company also wants to avoid data transfer costs associated with internet-based connections. Which AWS service should the company use?

A.AWS Site-to-Site VPN

B.AWS Direct Connect

C.AWS VPN CloudHub

D.AWS Transit Gateway

AnswerB

Correct. AWS Direct Connect establishes a dedicated private connection between an on-premises data center and AWS. This connection bypasses the public internet, resulting in more consistent network performance, lower latency, and potentially lower data transfer costs. It is the appropriate service for the described requirements.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private network connection from an on-premises or colocation facility directly to an Amazon VPC, bypassing the public internet entirely. This ensures consistent high throughput, low latency, and eliminates data transfer costs associated with internet-based connections, as traffic flows over a private physical link.

Exam trap

The trap here is that candidates often confuse AWS Site-to-Site VPN with a private connection, but VPNs still traverse the public internet and cannot guarantee the consistent performance or cost savings of a dedicated physical link like Direct Connect.

Why the other options are wrong

AWS Site-to-Site VPN uses the public internet to establish encrypted tunnels, so it does not bypass the public internet and cannot guarantee consistent high throughput and low latency like a dedicated private connection.

AWS VPN CloudHub is a hub-and-spoke VPN topology that connects multiple remote sites via the internet, not a dedicated private connection. It does not bypass the public internet or provide consistent high throughput and low latency like Direct Connect.

AWS Transit Gateway is a network transit hub to interconnect VPCs and on-premises networks, but it does not provide a dedicated private connection itself; it requires an underlying connection like AWS Direct Connect or VPN. The question specifically asks for a dedicated private network connection that bypasses the public internet, which Transit Gateway alone cannot fulfill.

Practice this question →