A company is learning about its responsibilities that are related to the management of Amazon EC2 instances.
Which tasks for EC2 instances are the company’s responsibility, according to the AWS shared responsibility model? (Choose two.)
A. Install and patch the machine hypervisor.
B. Patch the guest operating system.
C. Encrypt data at rest on associated storage.
D. Install the physical hardware and cabling.
E. Provide physical security for the EC2 instances.
Show Answer
Correct Answer: B, C
Explanation: Under the AWS shared responsibility model for Amazon EC2, AWS is responsible for the security of the cloud, including the physical facilities, hardware, networking, and the hypervisor. Customers are responsible for security in the cloud, including patching the guest operating system they install on EC2 instances and configuring protections such as encryption for data at rest on attached storage (for example, using EBS encryption).
Question 30
A cloud practitioner wants to use a highly available and scalable DNS service for its AWS workload.
Which AWS service will meet this requirement?
A. Amazon Route 53
B. Amazon Lightsail
C. AWS Amplify Hosting
D. Amazon S3
Show Answer
Correct Answer: A
Explanation: Amazon Route 53 is AWS's highly available and scalable Domain Name System (DNS) web service. It is designed to route end users to internet applications and supports DNS routing, health checks, and domain registration. The other options are not managed DNS services.
Question 31
Which AWS service can be used to send alerts when a specific Amazon CloudWatch alarm is invoked?
A. AWS CloudTrail
B. Amazon Simple Notification Service (Amazon SNS)
C. Amazon Simple Queue Service (Amazon SQS)
D. Amazon EventBridge
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch alarms can be configured to publish notifications to an Amazon SNS topic when they enter a specified state (such as ALARM). SNS then delivers alerts via email, SMS, HTTP endpoints, Lambda, and other supported subscribers. CloudTrail records API activity, SQS queues messages rather than sending notifications, and EventBridge can react to alarm state changes but the standard service used to send alerts from CloudWatch alarms is Amazon SNS.
Question 32
A company runs an application on AWS that performs batch jobs. The application is fault-tolerant and can handle interruptions. The company wants to optimize the cost to run the application.
Which AWS offering will meet these requirements?
A. Amazon Macie
B. Amazon Neptune
C. Amazon EC2 Spot Instances
D. Amazon EC2 On-Demand Instances
Show Answer
Correct Answer: C
Explanation: Amazon EC2 Spot Instances are designed for fault-tolerant, interruption-tolerant workloads such as batch processing. They use spare EC2 capacity at significant discounts compared to On-Demand Instances, making them the most cost-effective choice for this scenario. Amazon Macie is a data security service, Neptune is a graph database, and On-Demand Instances do not optimize cost for interruptible batch jobs.
Question 33
Which AWS tool or feature acts as a VPC firewall at the subnet level?
A. Security group
B. Network ACL
C. Traffic Mirroring
D. Internet gateway
Show Answer
Correct Answer: B
Explanation: Network ACLs act as stateless firewalls at the subnet level in a VPC. They control inbound and outbound traffic for subnets using allow and deny rules. Security groups operate at the instance/ENI level, Traffic Mirroring is for packet capture, and an Internet gateway provides internet connectivity rather than firewalling.
Question 35
Which AWS service provides machine learning capability to detect and analyze content in images and videos?
A. Amazon Connect
B. Amazon Lightsail
C. Amazon Personalize
D. Amazon Rekognition
Show Answer
Correct Answer: D
Explanation: Amazon Rekognition is the AWS computer vision service that uses machine learning to analyze images and videos, including object and scene detection, facial analysis, text detection, moderation, and celebrity recognition. Amazon Connect is a contact center service, Lightsail is a simplified VPS offering, and Personalize provides recommendation capabilities rather than image/video analysis.
Question 36
Which of the following are AWS best practice recommendations for the use of AWS Identity and Access Management (IAM)? (Choose two.)
A. Use the AWS account root user for daily access.
B. Use access keys and secret access keys on Amazon EC2.
C. Rotate credentials on a regular basis.
D. Create a shared set of access keys for system administrators.
E. Configure multi-factor authentication (MFA).
Show Answer
Correct Answer: C, E
Explanation: AWS IAM best practices include rotating credentials regularly and enabling multi-factor authentication (MFA) for additional account protection. AWS also recommends avoiding use of the root user for daily tasks, avoiding long-term access keys on EC2 in favor of IAM roles, and not sharing access keys among administrators.
Question 37
Which AWS service gives users on-demand, self-service access to AWS compliance control reports?
A. AWS Config
B. Amazon GuardDuty
C. AWS Trusted Advisor
D. AWS Artifact
Show Answer
Correct Answer: D
Explanation: AWS Artifact provides on-demand, self-service access to AWS compliance reports (such as SOC reports, ISO certifications, and PCI documents) and agreements. AWS Config assesses resource configurations, GuardDuty detects threats, and Trusted Advisor provides best-practice recommendations.
Question 38
Which combination of AWS services can be used to move a commercial relational database to an Amazon-managed open-source database? (Choose two.)
A. AWS Database Migration Service (AWS DMS)
B. AWS software development kits (SDKs)
C. AWS Schema Conversion Tool
D. AWS Systems Manager
E. Amazon EMR
Show Answer
Correct Answer: A, C
Explanation: AWS Database Migration Service (AWS DMS) migrates data from the source database to the target. AWS Schema Conversion Tool (AWS SCT) converts database schemas and code objects from commercial database engines to compatible open-source engines such as PostgreSQL or MySQL, making them the standard combination for heterogeneous database migration.
Question 40
A company is building AWS architecture to deliver real-time data feeds from an on-premises data center into an application that runs on AWS. The company needs a consistent network connection with minimal latency.
What should the company use to connect the application and the data center to meet these requirements?
A. AWS Direct Connect
B. Public internet
C. AWS VPN
D. Amazon Connect
Show Answer
Correct Answer: A
Explanation: AWS Direct Connect provides a dedicated private network connection between an on-premises data center and AWS, offering more consistent performance, lower latency, and higher reliability than internet-based connections. AWS VPN traverses the public internet and cannot guarantee minimal latency. Amazon Connect is a contact center service, and the public internet does not provide the required consistency.
$19
Get all 713 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.