Which AWS service or feature provides a firewall at the subnet level within a VPC?
A. Security group
B. Network ACL
C. Elastic network interface
D. AWS WAF
Show Answer
Correct Answer: B
Explanation: Network ACLs operate at the subnet level within a VPC and act as a stateless firewall controlling inbound and outbound traffic. Security groups apply at the instance/ENI level, AWS WAF protects web applications at the application layer, and an elastic network interface is not a firewall.
Question 22
Which task is the customer's responsibility, according to the AWS shared responsibility model?
A. Patch a guest operating system that is deployed on an Amazon EC2 instance.
B. Control physical access to an AWS data center.
C. Control access to AWS underlying hardware.
D. Patch a host operating system that is deployed on Amazon S3.
Show Answer
Correct Answer: A
Explanation: Under the AWS shared responsibility model, customers are responsible for security *in* the cloud. This includes managing and patching the guest operating system on Amazon EC2 instances. AWS is responsible for physical data center security, underlying hardware, and host operating systems for managed services like Amazon S3.
Question 23
Which of the following can the AWS Pricing Calculator do?
A. Project monthly AWS costs.
B. Calculate historical AWS costs.
C. Provide in-depth information about AWS pricing strategies.
D. Provide users with access to their monthly bills.
Show Answer
Correct Answer: A
Explanation: The AWS Pricing Calculator is designed to estimate and project future AWS costs based on selected services and usage assumptions. It does not analyze historical spending, provide billing access, or explain pricing strategies in depth.
Question 24
When designing AWS workloads to be operational even when there are component failures, what is an AWS best practice?
A. Perform quarterly disaster recovery tests.
B. Place the main component on the us-east-1 Region.
C. Design for automatic failover to healthy resources.
D. Design workloads to fit on a single Amazon EC2 instance.
Show Answer
Correct Answer: C
Explanation: AWS best practice for resilient, fault-tolerant architectures is to design systems that automatically detect failures and fail over to healthy resources without manual intervention. This aligns with the AWS Well-Architected Framework’s Reliability pillar. The other options are either insufficient on their own or incorrect for ensuring continuous operation during component failures.
Question 25
Which AWS service provides DNS resolution?
A. Amazon CloudFront
B. Amazon VPC
C. Amazon Route 53
D. AWS Direct Connect
Show Answer
Correct Answer: C
Explanation: Amazon Route 53 is AWS's managed Domain Name System (DNS) service. It provides DNS resolution by translating domain names into IP addresses. The other options serve different purposes: CloudFront is a CDN, VPC is networking infrastructure, and Direct Connect is a dedicated network connection service.
Question 26
Which AWS service supports a company's ability to treat infrastructure as code?
A. AWS CodeDeploy
B. AWS Elastic Beanstalk
C. Amazon API Gateway
D. AWS CloudFormation
Show Answer
Correct Answer: D
Explanation: Infrastructure as code (IaC) means defining and provisioning infrastructure using declarative templates. AWS CloudFormation provides this capability by allowing resources to be modeled, provisioned, and managed using code (templates). The other services do not primarily provide IaC functionality.
Question 27
A company wants to migrate all of its on-premises infrastructure to the AWS Cloud. Before migration, the company wants estimate of costs for running its as-is infrastructure.
Which AWS service or principle should the company use to meet this requirement?
A. AWS Pricing Calculator
B. AWS Well-Architected Framework
C. AWS shared responsibility model
D. AWS Cloud Adoption Framework (AWS CAF)
Show Answer
Correct Answer: A
Explanation: The AWS Pricing Calculator is specifically designed to estimate the cost of running workloads on AWS, including migrating existing on-premises infrastructure in an as-is state. The other options are frameworks or models for best practices and responsibilities, not cost estimation tools.
Question 28
Which task is the responsibility of the customer, according to the AWS shared responsibility model?
A. Patch the Amazon DynamoDB operating system.
B. Secure Amazon CloudFront edge locations by allowing physical access according to the principle of least privilege.
C. Protect the hardware that runs AWS services.
D. Use AWS Identity and Access Management (IAM) according to the principle of least privilege.
Show Answer
Correct Answer: D
Explanation: Under the AWS shared responsibility model, AWS is responsible for the security *of* the cloud (physical facilities, hardware, and managed service infrastructure such as DynamoDB OS patching and CloudFront edge security). Customers are responsible for security *in* the cloud, including identity and access management. Using IAM according to the principle of least privilege is therefore a customer responsibility.
Question 29
A company is learning about its responsibilities that are related to the management of Amazon EC2 instances.
Which tasks for EC2 instances are the company’s responsibility, according to the AWS shared responsibility model? (Choose two.)
A. Install and patch the machine hypervisor.
B. Patch the guest operating system.
C. Encrypt data at rest on associated storage.
D. Install the physical hardware and cabling.
E. Provide physical security for the EC2 instances.
Show Answer
Correct Answer: B, C
Explanation: Under the AWS shared responsibility model for Amazon EC2, AWS is responsible for the underlying infrastructure (physical data centers, hardware, networking, and the hypervisor). The customer is responsible for what runs on the EC2 instance and how data is protected. This includes patching and maintaining the guest operating system (B) and encrypting data at rest on attached storage such as EBS volumes (C).
Question 30
A cloud practitioner wants to use a highly available and scalable DNS service for its AWS workload.
Which AWS service will meet this requirement?
A. Amazon Route 53
B. Amazon Lightsail
C. AWS Amplify Hosting
D. Amazon S3
Show Answer
Correct Answer: A
Explanation: Amazon Route 53 is AWS’s managed Domain Name System (DNS) service. It is designed to be highly available, scalable, and reliable, making it the correct choice for DNS needs in AWS workloads. The other options provide hosting or storage services, not DNS.
$19
Get all 715 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.