Which AWS service can be used to send alerts when a specific Amazon CloudWatch alarm is invoked?
A. AWS CloudTrail
B. Amazon Simple Notification Service (Amazon SNS)
C. Amazon Simple Queue Service (Amazon SQS)
D. Amazon EventBridge
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch alarms can be configured to perform actions when they enter a specific state. A common and native action is publishing a message to an Amazon SNS topic, which then sends alerts via email, SMS, HTTP endpoints, or other subscribers. The other services do not directly serve as the standard notification mechanism for CloudWatch alarms.
Question 32
A company runs an application on AWS that performs batch jobs. The application is fault-tolerant and can handle interruptions. The company wants to optimize the cost to run the application.
Which AWS offering will meet these requirements?
A. Amazon Macie
B. Amazon Neptune
C. Amazon EC2 Spot Instances
D. Amazon EC2 On-Demand Instances
Show Answer
Correct Answer: C
Explanation: The application runs batch jobs, is fault-tolerant, and can handle interruptions, which makes it well-suited for Amazon EC2 Spot Instances. Spot Instances offer significantly lower costs by using spare EC2 capacity, with the trade-off of possible interruptions. This matches the requirement to optimize cost while tolerating interruptions. Other options are unrelated services or higher-cost instance types.
Question 33
Which AWS tool or feature acts as a VPC firewall at the subnet level?
A. Security group
B. Network ACL
C. Traffic Mirroring
D. Internet gateway
Show Answer
Correct Answer: B
Explanation: A Network ACL (NACL) acts as a firewall at the subnet level in a VPC. It is stateless, applies to all resources within the associated subnet, and supports explicit ALLOW and DENY rules for inbound and outbound traffic. Security groups operate at the instance level, not the subnet level.
Question 35
Which AWS service provides machine learning capability to detect and analyze content in images and videos?
A. Amazon Connect
B. Amazon Lightsail
C. Amazon Personalize
D. Amazon Rekognition
Show Answer
Correct Answer: D
Explanation: Amazon Rekognition is the AWS service designed to analyze images and videos using machine learning, including detecting objects, faces, text, scenes, and activities. The other options serve different purposes unrelated to image or video content analysis.
Question 36
Which of the following are AWS best practice recommendations for the use of AWS Identity and Access Management (IAM)? (Choose two.)
A. Use the AWS account root user for daily access.
B. Use access keys and secret access keys on Amazon EC2.
C. Rotate credentials on a regular basis.
D. Create a shared set of access keys for system administrators.
E. Configure multi-factor authentication (MFA).
Show Answer
Correct Answer: C, E
Explanation: AWS IAM best practices include regularly rotating credentials to reduce the risk of compromise, and enabling multi-factor authentication (MFA) to add an extra layer of security. Using the root user for daily access, sharing access keys, or embedding access keys on EC2 instances are explicitly discouraged by AWS.
Question 37
Which AWS service gives users on-demand, self-service access to AWS compliance control reports?
A. AWS Config
B. Amazon GuardDuty
C. AWS Trusted Advisor
D. AWS Artifact
Show Answer
Correct Answer: D
Explanation: AWS Artifact is the service that provides on-demand, self-service access to AWS compliance reports and security documentation. It allows customers to download audit reports such as SOC, ISO, and PCI directly. The other options focus on configuration tracking (AWS Config), threat detection (GuardDuty), and best-practice recommendations (Trusted Advisor), not compliance report access.
Question 38
Which combination of AWS services can be used to move a commercial relational database to an Amazon-managed open-source database? (Choose two.)
A. AWS Database Migration Service (AWS DMS)
B. AWS software development kits (SDKs)
C. AWS Schema Conversion Tool
D. AWS Systems Manager
E. Amazon EMR
Show Answer
Correct Answer: A, C
Explanation: AWS Schema Conversion Tool converts the schema and code from a commercial relational database to a compatible open-source engine, and AWS Database Migration Service migrates the data with minimal downtime. Together they enable moving a commercial database to an Amazon-managed open-source database.
Question 39
A company uses Amazon WorkSpaces.
Which task is the responsibility of AWS, according to the AWS shared responsibility model?
A. Set up multi-factor authentication (MFA) for each WorkSpaces user account.
B. Ensure the environmental safety and security of the AWS infrastructure that hosts WorkSpaces.
C. Provide security for WorkSpaces user accounts through AWS Identity and Access Management (IAM).
D. Configure AWS CloudTrail to log API calls and user activity.
Show Answer
Correct Answer: B
Explanation: Under the AWS shared responsibility model, AWS is responsible for the security **of** the cloud, including the physical data centers, hardware, networking, and environmental safety that host services like Amazon WorkSpaces. Customers are responsible for security **in** the cloud, such as MFA setup, IAM user management, and configuring CloudTrail.
Question 40
A company is building AWS architecture to deliver real-time data feeds from an on-premises data center into an application that runs on AWS. The company needs a consistent network connection with minimal latency.
What should the company use to connect the application and the data center to meet these requirements?
A. AWS Direct Connect
B. Public internet
C. AWS VPN
D. Amazon Connect
Show Answer
Correct Answer: A
Explanation: AWS Direct Connect provides a dedicated, private network connection between the on‑premises data center and AWS, delivering consistent performance and minimal latency. Public internet and VPN connections have variable latency, and Amazon Connect is a contact center service, not a networking solution.
Question 41
A company wants to use Amazon EC2 instances for a stable production workload that will run for 1 year.
Which instance purchasing option meets these requirements MOST cost-effectively?
A. Dedicated Hosts
B. Reserved Instances
C. On-Demand Instances
D. Spot Instances
Show Answer
Correct Answer: B
Explanation: The workload is stable and will run continuously for 1 year, which makes Reserved Instances the most cost-effective option. Reserved Instances provide significant discounts compared to On-Demand pricing in exchange for a 1-year or 3-year commitment. Dedicated Hosts are for compliance or licensing needs, Spot Instances are interruptible and unsuitable for stable production workloads, and On-Demand Instances are more expensive for long-term steady use.
$19
Get all 715 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.