| Contents: |
Cloud Concepts Overview
Why: Every listed option is a genuine advantage of cloud computing over on-premises infrastructure — you avoid CapEx, scale on demand, deploy globally in minutes, and move faster. Since all four are correct, "All of the above" is the best answer.
Why: AWS's core pricing philosophy is "pay-as-you-go" — you pay only for the individual services you use, for as long as you use them, with no long-term contracts required.
Why: The three recognized cloud computing models are IaaS, PaaS, and SaaS. "System administration as a service" is not a real cloud service model — it's a distractor.
Why: This is the core definition of cloud computing — AWS owns, maintains, and operates the physical hardware and infrastructure, while customers simply provision and use the resources they need without managing the underlying hardware.
Why: "Racking, stacking, and powering servers" describes the manual, physical work required in on-premises data centers — it's exactly what cloud computing eliminates, not a benefit of it. All the other options are genuine cloud benefits.
Why: High availability, temporary/disposable (elastic) resources, and fault-tolerant databases are all genuine AWS benefits. "Multiple procurement cycles" (the slow, manual hardware-buying process) and "High latency" are drawbacks of on-premises infrastructure that cloud computing specifically eliminates — so these are the two correct picks.
Why: Amazon EC2 (Elastic Compute Cloud) is AWS's core compute service, providing resizable virtual servers. VPC is networking, S3 is storage, CloudFront is a CDN, and Redshift is a data warehousing service — none of which are compute services.
Why: This statement has it backwards. In the cloud model, AWS owns and maintains the network-connected hardware, and you (the customer) provision and use what you need — not the other way around.
Why: Economies of scale happen because AWS aggregates usage from hundreds of thousands of customers, allowing costs (power, hardware, facilities, etc.) to be spread across a massive base — driving prices down for everyone. This is passed on to customers as lower pay-as-you-go rates.
Why: AWS core services can be accessed three ways: the Management Console (browser-based GUI), the CLI (command-line scripting/automation), and SDKs (programmatic access from your application code). Technical support calls and the AWS Marketplace are not access methods for the services themselves.
Auto Scaling and Monitoring
Cloud Economics and Billing
Why: Reserved Instances offer three payment options: All Upfront (AURI), Partial Upfront (PURI), and No Upfront (NURI). The bigger the upfront payment, the deeper the discount. "MURI" and "DURI" aren't real AWS payment terms.
Why: AWS Cost Explorer lets you visualize, understand, and manage your AWS costs and usage over time — including up to 12 months of historical data. CloudTrail logs API activity (who did what), not billing/cost breakdowns, so it's the wrong tool for this job.
Why: A full upfront payment gets you the best discount, but it isn't required. You can also choose Partial Upfront or No Upfront and still receive a discount compared to On-Demand pricing — just a smaller one.
Why: Storage services (like S3 and EBS) are generally billed per GB stored. By contrast, inbound data transfer is typically free, and compute is billed per hour/second of use — not a flat monthly fee.
Why: AWS Support offers four tiers: Basic (free, included for all accounts), Developer, Business, and Enterprise — each adding deeper response times and support channels.
Why: The AWS Pricing Calculator lets you model your architecture before deploying anything and get a cost estimate. Budgets, Cost and Usage Reports, and the Billing Dashboard all deal with tracking actual spend, not upfront estimation.
Why: This is the textbook definition of economies of scale — as AWS's customer base and purchasing power grow, per-unit costs drop, and AWS passes those savings on through repeated price reductions.
Why: These are all "management/orchestration" services that are free to use in themselves — but they typically provision or interact with billable resources (like EC2 instances or RDS databases), which is where actual charges come from.
Why: AWS Organizations lets you group accounts into organizational units and apply policies at the group level, and it exposes APIs to automate account creation/management at scale. SCPs work alongside IAM policies, not as a replacement; nested OUs are supported but not unlimited (AWS caps nesting depth); and SCPs specifically do not apply to the organization's management (root) account, so that last option misdescribes the actual behavior.
Why: The AWS Free Tier is not unlimited — it provides limited amounts of usage (specific GB, hours, or request thresholds) for eligible services, and usage beyond those limits is billed at standard rates. Some Free Tier offers are 12-months limited, others are "Always Free" or short-term trials.
AWS Global Infrastructure Overview
Why: CloudFront is AWS's content delivery network (CDN). It caches content at edge locations, which are distributed in many more cities worldwide than Regions or Availability Zones, placing content physically closer to end users and reducing latency.
Why: The shorter the physical/network distance between the user and the resource, the less time data takes to travel — so running workloads in a nearby Region decreases (reduces) latency, not increases it.
Why: AWS organizes its 200+ services into categories such as Compute (EC2, Lambda), Storage (S3, EBS), Databases (RDS, DynamoDB), and Networking (VPC, Route 53) — these are indeed core AWS service categories.
Why: A Region is a physical geographic location (e.g., us-east-1) that contains multiple, isolated Availability Zones. "Compute zones" and "AWS Origins" are not real AWS Global Infrastructure terms.
Why:
The blanks appear in that order in the sentence (redundancy first, then dynamic capacity adjustment), so the correctly ordered answer is "Fault tolerant, elastic and scalable." (Note: the screenshot shows a different option highlighted in blue — that appears to be a mis-selection, since it reverses the correct order of terms relative to the sentence.)
Why: AWS Availability Zones within the same Region are connected via high-bandwidth, low-latency, fully redundant private networking, enabling synchronous replication and fast communication between them.
Why: Each data center belongs to only one Availability Zone — a data center is never shared across multiple AZs. This is precisely what allows AZs to provide true fault isolation. The other three statements are all accurate descriptions of AZs.
Why: A Region is a defined geographic area (e.g., US East, Europe, Asia Pacific) that contains multiple isolated Availability Zones, and each Region is geographically separate from the others (for fault isolation and to meet data residency needs). Regions are not all in one place, and they represent AWS infrastructure locations, not customer locations.
Why: Spreading compute resources across multiple AZs increases fault tolerance and high availability — if one AZ experiences an issue, the application keeps running in the others. Relying on a single AZ creates a single point of failure.
Why: Edge locations are part of Amazon CloudFront's global content delivery network and are deployed in many more cities around the world than AWS Regions — including locations where AWS has no Region at all — specifically to bring content closer to end users everywhere.
AWS Cloud Security
Why: Under the AWS Shared Responsibility Model, AWS is responsible for "security of the cloud" — protecting the underlying infrastructure that runs all AWS services (hardware, software, networking, and facilities). The customer is responsible for "security in the cloud" (their data, configurations, and access management).
Why: "Security in the cloud" is the customer's responsibility and includes things the customer controls and configures, such as security group (firewall) rules and encrypting their own data. Physical facility security and protecting the global infrastructure are AWS's responsibility ("security of the cloud").
Why: AWS owns and maintains the physical infrastructure — data centers, physical servers, networking hardware, and host operating systems. Configuring applications, managing AMIs, and securing application access/data are all customer responsibilities.
Why: IAM users can be granted programmatic access (via access keys, for CLI/SDK/API use) and/or AWS Management Console access (via a username and password, for browser-based use). "Institutional access," "authorized access," and "administrative root access" are not standard IAM access types.
Why: AWS Organizations is a governance service that lets you group multiple AWS accounts into an organization, apply policies (like Service Control Policies) across accounts, and centrally manage billing, security, and compliance.
Why: IAM best practices follow the principle of least privilege: grant only the access users actually need (fine-grained access rights) and actively manage/control who can access which AWS resources. Giving default admin privileges, leaving unused credentials active, and avoiding IAM groups are all poor security practices (the opposite of recommended guidance).
Why: Certain account-level tasks — such as changing the AWS Support plan, closing the account, or changing account settings — can only be performed by the root user and cannot be delegated through IAM. Day-to-day tasks like managing application access, service integration, and granular permissions should be handled by IAM users/roles, not the root user.
Why: AWS recommends not using the root user for everyday tasks and restricting/limiting its use to only the few account-level actions that require it. The root user cannot be deleted, and revoking all permissions isn't possible (nor is that the standard-practice phrasing AWS uses) — the correct, recommended action is to restrict its use.
Why: Multi-factor authentication (MFA) adds an extra layer of login security beyond just a username and password, requiring a second verification factor (like a code from a device) to sign in. Auditing IAM roles and enabling CloudTrail relate to monitoring/logging, not adding a login security layer, and Amazon Cloud Directory is a legacy directory service, not a login security feature.
Why: That description is of AWS Config, not AWS KMS. AWS KMS is a service for creating and managing cryptographic keys used to encrypt and decrypt data — it is not used to assess, audit, or evaluate resource configurations.
Networking and Content Delivery
1. With Amazon Virtual Private Cloud (Amazon VPC), what is the smallest size subnet you can have in a VPC? (Select the best answer.)
Why: AWS VPC subnets require a minimum size of /28 (16 total addresses, 11 usable after AWS reserves 5). /30 isn't valid for VPC subnets.
2. With Amazon Virtual Private Cloud (Amazon VPC), what is the maximum size IP address range you can have in a VPC? (Select the best answer.)
Why: A VPC can range from /16 (largest, 65,536 addresses) to /28 (smallest). /16 is the maximum allowed size.
3. You need to allow resources in a private subnet to access the internet. Which of the following must be present to enable this access? (Select the best answer.)
Why: Route tables alone aren't enough — the private subnet's route table must point to a NAT gateway (in a public subnet) to translate private IPs and route traffic out to an internet gateway. Security groups and NACLs control traffic filtering, not the actual path to the internet.
4. Which AWS networking service enables a company to create a virtual network within AWS? (Select the best answer.)
Why: VPC is specifically the AWS service for provisioning a logically isolated virtual network. Route 53 is DNS, Direct Connect is a dedicated physical network link, and Config is for resource compliance/auditing.
5. True or False? Private subnets have direct access to the internet.
Why: By definition, a private subnet has no route to an internet gateway. Any outbound access requires a NAT gateway/instance in a public subnet.
6. Which component of AWS Global Infrastructure does Amazon CloudFront use to ensure low-latency delivery? (Select the best answer.)
Why: CloudFront (a CDN) caches content at edge locations, which are geographically distributed points of presence closer to end users, reducing latency. Regions and Availability Zones are core infrastructure, not CDN caching points.
7. Which of the following is an optional security control that can be applied at the subnet layer of a VPC? (Select the best answer.)
Why: NACLs operate at the subnet level and are optional (a default NACL allows all traffic unless customized). Security groups operate at the instance/ENI level, not the subnet level.
8. What happens when you use Amazon Virtual Private Cloud (Amazon VPC) to create a new VPC? (Select the best answer.)
Why: When you create a VPC, AWS automatically creates a default (main) route table, a default NACL, and a default security group. No subnets or internet gateway are created automatically — you must create those yourself.
9. Which of the following can be used to protect Amazon Elastic Compute Cloud (Amazon EC2) instances hosted in AWS? (Select the best answer.)
Why: Security groups act as instance-level virtual firewalls controlling inbound/outbound traffic. An Internet Gateway enables connectivity (not protection), and an AMI is just a machine image template — neither protects instances. "All of the above" is incorrect since Internet Gateway and AMI aren't protective controls.
10. You are a solutions architect who works at a large retail company that is migrating its existing infrastructure to AWS. You recommend that they use a custom VPC. When you create a VPC, you assign it to an IPv4 Classless Inter-Domain Routing (CIDR) block of 10.0.1.0/24 (which has 256 total IP addresses). How many IP addresses are available? (Select the best answer.)
Why: A /24 has 256 total addresses, but AWS reserves 5 IP addresses in every VPC subnet (network address, VPC router, DNS server, future use, and broadcast address) — 256 − 5 = 251 usable addresses.
Compute
Why: With traditional data centers, you must buy/provision enough hardware to handle peak demand and it sits idle the rest of the time. With AWS, you can launch instances on-demand and scale capacity up or down to match actual workload, so you only pay for what you use rather than for permanently-provisioned peak capacity.
Why: Scheduled Reserved Instances are designed for workloads that recur on a predictable time-based schedule (e.g., a job that runs once a month) — they let you reserve capacity for those recurring windows at a discount, which fits a predictable monthly reporting job far better than paying full On-Demand price or risking interruption with Spot.
Why: An AMI packages everything needed to launch an instance: a template for the root volume (OS, apps, and settings), launch permissions (controlling which accounts can use it), and a block device mapping (specifying the storage volumes to attach). All three are components of an AMI.
Why: Dedicated Instances run on hardware that is dedicated to a single customer — they are physically isolated at the host level from instances belonging to other AWS accounts. VPC provides network isolation (not physical hardware isolation), placement groups control instance placement strategy for performance, and Reserved Instances are a pricing model, not a hardware isolation feature.
Why: AWS Lambda lets you run code without provisioning or managing servers — you simply upload code and it runs in response to events, scaling automatically. EC2 requires you to manage servers, OpsWorks is a configuration management service, and AWS Config is a resource-auditing/compliance service.
Why: AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) offering that lets developers simply upload their application code, and it automatically handles the deployment details — provisioning, load balancing, scaling, and monitoring. CloudFormation is for infrastructure-as-code provisioning, ECS is specifically for container orchestration, and OpsWorks is a configuration-management service (using Chef/Puppet).
Why: For the steady, predictable baseline load (4 instances running constantly), Reserved Instances offer the best discount since they're committed and always in use. For the short, temporary spike (triple traffic for one day a month), On-Demand Instances are best since you only pay for the brief period you need them — committing to Reserved pricing for capacity you rarely use (12 Reserved Instances) would waste money.
Why: Containers package an application and its dependencies/libraries, but they share the host machine's OS kernel rather than including a full, separate operating system. This is what makes containers much more lightweight and faster to start than virtual machines, which do each run a full guest OS.
Why: Reserved Instances let you commit to a consistent instance configuration for a 1- or 3-year term in exchange for a significant discount compared to On-Demand pricing — making them ideal for long-term, predictable workloads where you know you'll need the capacity continuously.
Why: When launching an EC2 instance, you must choose an AMI (the template defining the OS and software) and an instance type (defining the compute/memory/network resources). The instance ID is automatically generated by AWS after launch (you don't specify it), and for Windows instances the administrator password is auto-generated and retrieved after launch (using the key pair), not specified up front.
Storage
1. True or False? Amazon Simple Storage Service (Amazon S3) is an object storage suitable for the storage of flat files like Microsoft Word documents, photos, etc.
Answer: True. S3 stores data as objects (a file plus metadata) rather than as blocks or in a file-system hierarchy, which is exactly the right fit for discrete flat files like documents, images, and videos.
2. Amazon S3 replicates all objects _____. (Select the best answer)
Answer: In multiple Availability Zones within the same Region. S3 Standard is designed for 99.999999999% (11 nines) durability by synchronously storing copies of each object across a minimum of three AZs in the bucket's Region — it does not automatically span Regions, and it doesn't just live on volumes in a single AZ.
3. Which of the following can be used as a storage class for an S3 object lifecycle policy? (Choose three)
Answer: S3 Standard Access, S3 Infrequent Access, Simple Storage Service Glacier. A lifecycle policy transitions an object between S3 storage classes over time (e.g., Standard → Standard-IA → Glacier) as it ages and is accessed less. AWS Storage Gateway is a hybrid storage connectivity service, not an S3 storage class, and DynamoDB is a separate NoSQL database service — neither can be a target of an S3 lifecycle rule.
4. The name of an S3 bucket must be unique _____. (Select the best answer)
Answer: Worldwide across all AWS accounts. Bucket names share a single global namespace across all of S3 — once someone (in any account, anywhere) claims a name, no one else can use it, regardless of Region.
5. You can use Amazon Elastic File System (Amazon EFS) to: (Select the best answer)
Answer: Implement storage for Amazon EC2 instances that multiple virtual machines can access at the same time. EFS is a shared, network-attached (NFS) file system — its defining feature is that many EC2 instances can mount and read/write the same file system concurrently, unlike EBS which attaches to a single instance. (The CDN option describes Amazon CloudFront, not EFS.)
6. Amazon Elastic Block Store (Amazon EBS) is recommended when data _____ and _____. (Choose two)
Answer: "Must be quickly accessible, requiring long-term persistence" and "needs to be stored in a different Availability Zone than the one the EC2 instance is in." EBS provides low-latency block storage that persists independently of the attached instance's lifecycle — good for databases and other data that needs fast, durable access. It also supports snapshots that can be used to create a new volume in a different AZ than the original, which is the scenario the fourth option is pointing at. ("Object-level storage" describes S3, not EBS, which is block storage; encryption is a capability EBS offers but isn't a defining reason to choose it.)
7. True or False? By default, all data stored in Amazon S3 is viewable by the public.
Answer: False. S3 buckets and objects are private by default — only the bucket/object owner has access until permissions (bucket policies, ACLs, or public access settings) are explicitly changed to allow public access.
8. Regarding Amazon S3 Glacier, what is a Vault? (Select the best answer)
Answer: A container for storing archives. In Glacier, individual pieces of data are stored as "archives," and a Vault is the container that holds and organizes those archives — analogous to a bucket in S3. (The access-rules/policy options describe a Vault Access Policy, which is a related but distinct concept from the Vault itself.)
9. True or False? When you create a bucket in Amazon S3, it is associated with a specific AWS Region.
Answer: True. You choose a Region when you create a bucket, and the bucket (along with the objects in it) resides in that Region unless you explicitly copy or replicate the data elsewhere.
10. Which of the following are features of Amazon Elastic Block Store (Amazon EBS)? (Choose two)
Answer: "Amazon EBS volumes can be encrypted transparently to workloads on the attached instance" and "Data stored on Amazon EBS is automatically replicated within an Availability Zone." EBS encryption works transparently — the attached instance's workloads interact with the volume normally, without managing keys themselves — and EBS replicates volume data within its AZ for durability. EBS does not back up to tape (that's not how the service works), and data on an EBS volume persists through a stop/start of the attached instance — it's only lost if you explicitly delete the volume.
Databases
1. You are designing an ecommerce web application that will scale to hundreds of thousands of concurrent users. Which database technology is best suited to hold the session state in this example?
Answer: Amazon DynamoDB. Session state (key-value lookups by session ID) needs single-digit-millisecond reads/writes at massive, unpredictable scale — exactly what DynamoDB, a fully managed NoSQL database, is built for. RDS would struggle to scale writes that wide, Redshift is a data warehouse for analytics rather than transactional lookups, and S3 isn't a database at all.
2. You need to find an item in an Amazon DynamoDB table using an attribute other than the item's primary key. Which of the following operations should you use? (Select the best answer.)
Answer: Scan. Scan reads every item in a table and can then filter on any attribute, which is what's required when the primary key isn't available to search on. GetItem and Query both require the primary key (Query also needs the partition key), and PutItem writes an item rather than retrieving one.
3. In Amazon DynamoDB, what does the query operation enable you to do? (Select the best answer.)
Answer: All of the above. Query finds items by partition key (with an optional sort-key condition to narrow results), can be run against secondary indexes as well as the base table, and does all of this efficiently since it uses the key schema rather than scanning the whole table — so each of the first three statements is a true, valid description of what Query does.
4. Which AWS Cloud service is best suited for analyzing your data by using standard structured query language (SQL) and your existing business intelligence (BI) tools? (Select the best answer.)
Answer: Amazon Redshift. Redshift is AWS's data warehouse service, purpose-built for large-scale analytical (OLAP) queries over big datasets using standard SQL, and it integrates directly with common BI tools. RDS is meant for transactional (OLTP) workloads, DynamoDB isn't queried with SQL, and Glacier is archival storage, not a query engine.
5. In Amazon DynamoDB, an attribute is _____. (Select the best answer.)
Answer: A fundamental data element. In DynamoDB's data model, an attribute is the basic unit of data (like a column value) — items are made up of one or more attributes, and a table is a collection of items. So "a collection of items" describes a table and "a collection of attributes" describes an item, not an attribute itself.
6. If you are developing an application that requires a database with extremely fast performance, fast scalability, and flexibility in the database schema, which service should you consider? (Select the best answer.)
Answer: Amazon DynamoDB. DynamoDB is a schema-flexible NoSQL database (only the primary key is fixed; other attributes can vary item to item) that delivers consistent, fast performance and scales seamlessly with demand. RDS requires a fixed relational schema, ElastiCache is an in-memory cache rather than a primary data store, and Redshift is built for analytics, not flexible, low-latency transactional access.
7. Which of the following use cases is appropriate for using Amazon Relational Database Service (Amazon RDS)? (Select the best answer.)
Answer: Complex transactions. RDS runs managed relational database engines, which are designed for complex, multi-table transactions with joins and ACID guarantees. Massive read/write rates and simple GET/PUT-style access patterns are better served by a NoSQL database like DynamoDB, so "all of the above" isn't correct.
8. A company has an application, which consists of a .NET layer that connects to a MySQL database. They want to move this application on to AWS and use AWS features such as high availability and automated backups. Which of the following would be an ideal database for this use case? (Select the best answer)
Answer: Amazon RDS. RDS supports MySQL as a managed engine, so the existing .NET/MySQL application can move over with minimal changes while gaining RDS's built-in high availability (Multi-AZ) and automated backups. Aurora is MySQL/PostgreSQL-compatible but is a distinct engine that would still require some migration effort, making RDS the more direct fit; Redshift and DynamoDB aren't drop-in replacements for a relational MySQL database.
9. True or false? Amazon RDS automatically patches the database software and backs up your database, storing the backups for a user-defined retention period and enabling point-in-time recovery.
Answer: True. RDS handles routine database management tasks — including software patching and automated backups — and lets you set a backup retention period, which together with transaction logs enables restoring the database to any point in time within that window.
10. What should you consider when choosing a database type? (Select the best answer.)
Answer: All of the above. Choosing the right database type depends on multiple factors together — how much data you have (size), how often it needs to be accessed and for how long (access period), how frequently and in what patterns it will be queried, and what availability requirements the workload has — so no single factor alone determines the best fit.
Cloud Architecture
| vym 3.0.0 - 2026-09-23 |
