According to the AWS shared responsibility model, which task is the customer's responsibility?
A. Maintaining the infrastructure needed to run AWS Lambda
B. Updating the operating system of Amazon DynamoDB instances
C. Maintaining Amazon S3 infrastructure
D. Updating the guest operating system on Amazon EC2 instances
Show Answer
Correct Answer: D
Explanation: Under the AWS shared responsibility model, AWS manages the underlying cloud infrastructure, while customers are responsible for managing the guest operating system, patches, and applications on Amazon EC2 instances. AWS maintains the infrastructure for Lambda, DynamoDB, and Amazon S3.
Question 243
A company is building a new application on AWS. The company needs the application to remain available if an individual application component fails.
Which design principle should the company use to meet this requirement?
A. Disposable resources
B. Automation
C. Rightsizing
D. Loose coupling
Show Answer
Correct Answer: D
Explanation: Loose coupling is the AWS Well-Architected design principle that minimizes interdependencies between application components so that a failure in one component does not cascade to others. This improves resilience and availability. Disposable resources, automation, and rightsizing are useful design concepts but do not directly address isolating component failures.
Question 244
A company wants to design its cloud architecture so that it can support development innovations, and continuously improve processes and procedures.
This is an example of which pillar of the AWS Well-Architected Framework?
A. Security
B. Performance efficiency
C. Operational excellence
D. Reliability
Show Answer
Correct Answer: C
Explanation: The AWS Well-Architected Framework's Operational Excellence pillar focuses on running and monitoring workloads while continuously improving processes and procedures. It also emphasizes supporting development practices and innovation through automation, iterative improvement, and operational learning.
Question 245
A company wants a report that lists the status of multi-factor authentication (MFA) devices that all users in the company's AWS account use.
Which AWS feature or service will meet this requirement?
A. AWS Cost and Usage Reports
B. IAM credential reports
C. Detailed Billing Reports - D AWS Cost Explorer reports
Show Answer
Correct Answer: B
Explanation: IAM credential reports provide account-wide information about IAM users, including whether MFA is enabled and the status of their credentials. The other options are billing and cost reporting services and do not report MFA device status.
Question 246
Which AWS solution gives companies the ability to use protocols such as NFS to store and retrieve objects in Amazon S3?
A. Amazon FSx for Lustre
B. AWS Storage Gateway volume gateway
C. AWS Storage Gateway file gateway
D. Amazon Elastic File System (Amazon EFS)
Show Answer
Correct Answer: C
Explanation: AWS Storage Gateway file gateway presents Amazon S3 objects as files over NFS or SMB, allowing on-premises applications to store and retrieve data in S3 using standard file protocols. FSx for Lustre can link to S3 for HPC workloads but is not the general-purpose gateway service for exposing S3 via NFS. Volume gateway exposes block storage, and Amazon EFS is a separate file system rather than an S3 gateway.
Question 247
A company wants to use a centralized AWS service to enforce compliance with the organizational business standards. The company wants to use an AWS service that can govern and control who can deploy, manage, and decommission AWS resources.
Which AWS service will meet these requirements?
A. Amazon CloudWatch
B. AWS Service Catalog
C. Amazon GuardDuty
D. AWS Security Hub
Show Answer
Correct Answer: B
Explanation: AWS Service Catalog provides centralized governance over approved AWS products and services. It enables organizations to define, control, and enforce compliant resource deployments, while governing who can deploy, manage, and decommission approved resources. CloudWatch is for monitoring, GuardDuty is for threat detection, and Security Hub aggregates security findings rather than controlling resource provisioning.
Question 248
A company needs a firewall that will control network connections to and from a single Amazon EC2 instance. This firewall will not control network connections to and from other instances that are in the same subnet.
Which AWS service or feature can the company use to meet these requirements?
A. Network ACL
B. AWS WAF
C. Route table
D. Security group
Show Answer
Correct Answer: D
Explanation: Security groups are stateful virtual firewalls attached to individual EC2 instances or ENIs, allowing control of inbound and outbound traffic for a single instance. Network ACLs operate at the subnet level and affect all instances in the subnet. AWS WAF protects web applications, and route tables determine routing rather than filtering traffic.
Question 249
A retail company is building a new mobile app. The company is evaluating whether to build the app at an on-premises data center or in the AWS Cloud.
Which of the following are benefits of building this app in the AWS Cloud? (Choose two.)
A. A large, upfront capital expense and low variable expenses
B. Increased speed for trying out new projects
C. Complete control over the physical security of the infrastructure
D. Flexibility to scale up in minutes as the application becomes popular
E. Ability to pick the specific data centers that will host the application servers
Show Answer
Correct Answer: B, D
Explanation: AWS Cloud benefits include increased agility and speed to experiment with new projects, and the ability to scale resources up or down within minutes based on demand. AWS also avoids large upfront capital expenses by using a pay-as-you-go model, so option A is incorrect. Customers do not have complete control over physical security (AWS manages it), making C incorrect. While customers can choose AWS Regions and often Availability Zones, they cannot choose the specific physical data centers hosting servers, so E is incorrect.
Question 250
A systems administrator wants to monitor the CPU utilization of a company's Amazon EC2 instances.
Which AWS service can provide this information?
A. AWS Config
B. AWS Trusted Advisor
C. AWS CloudTrail
D. Amazon CloudWatch
Show Answer
Correct Answer: D
Explanation: Amazon CloudWatch provides monitoring metrics for Amazon EC2 instances, including CPUUtilization, memory (with custom metrics), disk, and network metrics. CPU utilization is a standard EC2 metric available in CloudWatch. AWS Config tracks resource configuration, Trusted Advisor provides best-practice recommendations, and CloudTrail records API activity rather than performance metrics.
Question 251
A user wants to invoke an AWS Lambda function when an Amazon EC2 instance enters the “stopping” state.
Which AWS service is appropriate for this use case?
A. Amazon EventBridge
B. AWS Config
C. Amazon Simple Notification Service (Amazon SNS)
D. AWS CloudFormation
Show Answer
Correct Answer: A
Explanation: Amazon EventBridge can capture Amazon EC2 instance state-change events, including when an instance enters the stopping state, and use a rule to invoke an AWS Lambda function. AWS Config tracks resource configuration and compliance, SNS is a messaging service rather than the event source for EC2 state changes, and CloudFormation provisions infrastructure rather than reacting to runtime events.
$19
Get all 713 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.