AWS CLF-C02 Practice Questions with Explanations

Correct answer: A

AWS Snowball Edge pricing follows a model where customers pay for the appliance service itself, but the first 10 days of use are included at no additional cost beyond the service fee. The transfer of data INTO Amazon S3 (option C) is actually included in the service, but option A more directly answers what activities are available at no cost-the initial 10-day usage period is the no-cost window provided. After 10 days, daily charges apply. Data transfers out of S3 to Snowball (option B) and continued use after day 10 (option D) both incur costs.

Why the other options are wrong:

• B. Data transfer out of S3 to Snowball Edge incurs standard data transfer costs.
• C. While data transfer into S3 is part of the service, the 10-day usage period is what is specifically provided at no cost.
• D. Daily charges apply after the complimentary 10-day period expires.

Correct answer: B

Amazon Inspector is specifically designed to assess EC2 instances for security vulnerabilities and network exposure, identifying deviations from best practices and compliance standards. It performs automated security assessments on EC2 instances and provides detailed findings. AWS Trusted Advisor provides general best practice checks but is not specialized for application vulnerability assessment; AWS Config monitors configuration compliance but not vulnerabilities; Amazon GuardDuty focuses on threat detection rather than vulnerability assessment.

Why the other options are wrong:

• A. AWS Trusted Advisor provides general best practice guidance but is not specialized for application vulnerabilities on EC2.
• C. AWS Config tracks configuration changes and compliance but does not perform vulnerability scanning.
• D. Amazon GuardDuty is designed for threat detection and anomalous behavior, not vulnerability assessment.

Correct answer: B

AWS Storage Gateway file gateway is the most operationally efficient solution for this scenario. It provides a local NFS/SMB interface that users can mount like a standard network share, maintaining local performance benefits while seamlessly extending storage to Amazon S3 in the cloud. This approach requires no application changes, provides local caching for performance, and scales storage capacity without on-premises infrastructure expansion. S3 bucket mounting (option A) lacks the seamless local performance; WorkSpaces (option C) requires major infrastructure changes; EC2 with EBS (option D) doesn't extend beyond on-premises capacity effectively.

Why the other options are wrong:

• A. Mounting individual S3 buckets via utility does not provide the same seamless local performance and user experience as Storage Gateway.
• C. Migrating to WorkSpaces is operationally complex and represents a major infrastructure change beyond the storage requirements.
• D. An EC2 instance with EBS does not extend on-premises capacity and requires managing another cloud resource rather than transparently extending storage.

Correct answer: C

According to AWS security best practices, EC2 instances should assume an IAM role to gain temporary, limited-scope credentials for accessing S3. This approach uses temporary security credentials, follows the principle of least privilege, enables audit logging, and avoids storing long-term secrets on the instance. Hard-coding credentials (option A) and storing them in files (option B) both create significant security risks by exposing permanent credentials. Opening the S3 bucket to any service (option D) violates the principle of least privilege and creates uncontrolled access.

Why the other options are wrong:

• A. Hard-coding credentials in application code is a critical security vulnerability and makes credential rotation impossible.
• B. Storing credentials in text files on the EC2 instance exposes them to compromise if the instance is breached.
• D. Modifying bucket policy to allow any service at any time violates least privilege principles and creates security risks.

Correct answer: C

Under the AWS Shared Responsibility Model, customers are responsible for controlling access to DynamoDB tables through IAM policies, application-level controls, and access management. AWS is responsible for the physical security of the infrastructure, patching and maintaining the DynamoDB service itself, and managing encryption at rest. While encryption can be customer-managed with KMS, the fundamental responsibility for providing encryption is AWS's as part of the managed service.

Why the other options are wrong:

• A. Physical security of the underlying infrastructure is AWS's responsibility in the managed service model.
• B. AWS is responsible for patching and maintaining the DynamoDB service as a fully managed database.
• D. Encryption at rest in DynamoDB is provided and maintained by AWS; customers may manage encryption keys but not the encryption service itself.

Correct answer: C

The AWS Cloud Adoption Framework (AWS CAF) consists of six perspectives: Business, People, Governance, Platform, Security, and Operations. Governance is one of the foundational capability perspectives that addresses organizational structures, policies, and controls. Sustainability is not an official CAF perspective; Performance Efficiency and Reliability are AWS Well-Architected Framework pillars, not CAF perspectives.

Why the other options are wrong:

• A. Sustainability is not one of the six perspectives in the AWS Cloud Adoption Framework.
• B. Performance Efficiency is a pillar of the Well-Architected Framework, not a CAF perspective.
• D. Reliability is a pillar of the Well-Architected Framework, not a CAF perspective.

Correct answer: C

AWS Fargate is a serverless container orchestration service that abstracts away cluster management, scheduling, and environment maintenance for Docker containers. It allows companies to run containerized applications without managing the underlying EC2 infrastructure, automatically handling scaling, patching, and cluster operations. AWS Lambda is for serverless functions, not container orchestration; Amazon RDS is a managed database service; Amazon Athena is a query service for data in S3.

Why the other options are wrong:

• A. AWS Lambda is for serverless function execution, not for managing Docker containers and cluster scheduling.
• B. Amazon RDS is a managed relational database service, not a container orchestration platform.
• D. Amazon Athena is a query service for analyzing data in S3, not a container management solution.

Correct answer: C

When running a NoSQL database on EC2 instances, AWS is responsible for patching and maintaining the physical infrastructure that hosts the instances, including servers, networking hardware, and facilities. The customer is responsible for the guest operating system updates (option A), database high availability (option B), and security group configuration (option D). These customer responsibilities stem from the fact that the customer controls and manages the database software and instance configuration.

Why the other options are wrong:

• A. Updating the guest operating system of EC2 instances is the customer's responsibility.
• B. Maintaining high availability at the database layer is the customer's responsibility; AWS provides the infrastructure foundation.
• D. Configuring security group firewall rules is the customer's responsibility for their EC2 instances.

Correct answer: A

When organizations move on-premises workloads to AWS, they eliminate the ongoing expenses associated with running and maintaining physical data centers, including facility costs, cooling, power, and maintenance staff. This is a primary financial advantage of cloud migration and represents a shift from capital expenditure to operational expenditure models.

Why the other options are wrong:

• B. AWS pricing discounts differ from hardware provider discounts and are based on AWS's own pricing model and reserved instance programs.
• C. Operational controls are shared between the customer and AWS according to the shared responsibility model; not all controls are distributed to AWS.
• D. While some operational expenses decrease, cloud services still have operational expenses for licensing, management, and service fees.

Correct answer: B

AWS Service Catalog enables organizations to manage and govern deployed IT services and infrastructure as code templates. It provides a curated catalog of approved products, allowing organizations to enforce governance policies, maintain compliance, and standardize infrastructure deployments across the organization while giving users self- service access to approved resources.

Why the other options are wrong:

• A. AWS Resource Explorer is used for discovering and searching AWS resources, not for managing IaC templates.
• C. AWS Organizations manages multiple AWS accounts and consolidated billing, not IaC governance.
• D. AWS Systems Manager is for operational management and automation of resources, not for governing IaC templates through a service catalog.

Correct answer: C

AWS Cost Explorer is the primary service designed to help users visualize, understand, and manage their AWS spending and usage over time. It provides interactive dashboards, cost analysis tools, and forecasting capabilities that allow organizations to track expenses by service, region, and other dimensions to optimize their cloud spending.

Why the other options are wrong:

• A. AWS Organizations manages multiple AWS accounts and consolidated billing, not detailed cost visualization.
• B. AWS Pricing Calculator is used to estimate costs for resources before deployment, not to analyze historical spending.
• D. AWS Service Catalog manages approved IT service offerings, not cost analysis and visualization.

Correct answer: B

AWS Professional Services provides expert guidance and implementation support for cloud migrations, leveraging a global team of certified professionals who follow AWS best practices and methodologies. This service is specifically designed to help organizations complete complex migrations faster and more reliably by providing strategic planning, architecture guidance, and hands-on implementation assistance.

Why the other options are wrong:

• A. AWS Support provides technical support and troubleshooting, but not comprehensive migration planning and execution services.
• C. AWS Launch Wizard is an automated tool for deploying applications, not a service providing expert team support for migrations.
• D. AWS Managed Services focuses on ongoing operational management of deployed infrastructure, not migration execution.

Correct answer: D

On-Demand Instances are the most cost-effective option for this scenario because the application runs for only 2 months per year with no downtime tolerance. Reserved Instances require long-term commitments that would be wasteful for short-duration usage, Spot Instances carry interruption risk incompatible with zero-downtime requirements, and Dedicated Hosts provide unnecessary isolation. On-Demand pricing is appropriate for short, predictable workload periods.

Why the other options are wrong:

• A. Reserved Instances require 1 or 3-year commitments, making them uneconomical when the application only runs 2 months annually.
• B. Dedicated Hosts provide physical server isolation at premium cost, which is unnecessary and cost-ineffective for this use case.
• C. Spot Instances can be interrupted without notice, which directly conflicts with the requirement to avoid any application downtime.

Correct answer: B

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) that automatically handles the deployment, scaling, and management of applications without requiring manual resource creation. It abstracts away infrastructure complexity, allowing developers to upload code and have Beanstalk provision the necessary EC2 instances, load balancers, databases, and other resources automatically.

Why the other options are wrong:

• A. Amazon EC2 requires manual creation and configuration of instances, which is not quick or automatic.
• C. AWS CodeBuild is a compilation and testing service, not a deployment platform for running applications.
• D. Amazon Personalize is a machine learning service for recommendations, unrelated to application deployment.

Correct answer: B

S3 Versioning enables protection against accidental deletion or overwriting by maintaining multiple versions of objects. When versioning is enabled, deleted objects are marked as deleted but previous versions remain available for recovery, and overwrites create new versions rather than replacing the original.

Why the other options are wrong:

• A. S3 Lifecycle rules manage object transitions and expiration but do not prevent accidental deletion.
• C. S3 bucket policies control access permissions but do not prevent authorized users from deleting or overwriting objects.
• D. S3 server-side encryption protects data confidentiality during transmission and storage but does not prevent deletion or modification.

Correct answer: D

AWS CloudFormation is the primary service for managing infrastructure as code, allowing users to define AWS resources in templates (JSON or YAML) and provision entire infrastructure stacks programmatically. It enables version control, reproducible deployments, and automated resource management.

Why the other options are wrong:

• A. AWS CodePipeline orchestrates continuous integration and deployment workflows but is not the infrastructure-as-code service.
• B. AWS CodeDeploy automates application deployment to compute resources but does not manage infrastructure provisioning as code.
• C. AWS Direct Connect establishes dedicated network connections and is unrelated to infrastructure-as-code management.

Correct answer: B

Reserved Instances provide the most cost-effective option for predictable, consistent workloads with guaranteed uptime over a 1-year commitment. They offer significant discounts (typically 40-70%) compared to On-Demand pricing while ensuring availability without interruption.

Why the other options are wrong:

• A. On-Demand Instances have the highest per-hour cost and are not cost-effective for predictable, long-term workloads.
• C. Spot Instances offer low prices but can be interrupted with 2-minute notice, making them unsuitable for applications requiring uninterrupted availability.
• D. Spot Fleet manages collections of Spot Instances, which still face interruption risks and are not appropriate for mission-critical consistent traffic.

Correct answer: A

AWS Direct Connect provides a dedicated physical network connection between an on- premises data center and AWS, offering consistent network performance, reduced bandwidth costs, and enhanced security compared to internet-based connections.

Why the other options are wrong:

• B. VPC peering connects multiple VPCs together but does not establish connections to on-premises infrastructure.
• C. AWS VPN encrypts traffic over the internet but uses shared internet bandwidth, not a dedicated connection.
• D. Amazon Route 53 is a DNS service and does not establish network connections to on-premises data centers.

Correct answer: B

An AWS Region is a physical geographic location consisting of multiple Availability Zones where AWS services are deployed. Regions are the fundamental building blocks of AWS's global infrastructure and are what users select when provisioning resources.

Why the other options are wrong:

• A. AWS DataSync is a data transfer service, not a physical location.
• C. Amazon Connect is a cloud-based contact center service, not an infrastructure location.
• D. AWS Organizations is an account management service, not a physical geographic location.

Correct answer: B

The Security pillar of the AWS Well-Architected Framework encompasses protecting cloud information, systems, and assets, performing risk assessments, implementing security controls, and establishing mitigation strategies to ensure confidentiality and integrity.

Why the other options are wrong:

• A. Reliability focuses on system recovery and availability, not primarily on information protection and risk mitigation.
• C. Operational excellence emphasizes efficient operations, monitoring, and management practices rather than security protection.
• D. Performance efficiency focuses on compute, storage, and resource optimization, not security risk management.

Correct answer: B

An Internet Gateway is a VPC component that enables communication between instances within a VPC and the internet. It provides a route for internet-routable traffic and serves as a target for internet-destined traffic in routing tables.

Why the other options are wrong:

• A. An Internet Gateway enables internet access, not VPN connections; VPN connections require a VPN Gateway.
• C. Internet Gateways do not impose bandwidth constraints; they simply enable connectivity.
• D. Internet Gateways do not perform load balancing; that function is provided by Elastic Load Balancers.

Correct answer: D

The company is moving from a monolithic application to microservices, which is a direct application of the operational excellence pillar's principle of implementing loosely coupled dependencies. Microservices are independent, loosely coupled components that can be developed, deployed, and scaled separately, making the system more maintainable and scalable compared to a tightly coupled monolith.

Why the other options are wrong:

• A. Functional testing integration is a deployment practice but not the core reason or best practice being followed by this architectural shift.
• B. While automation supports deployment, it is not the architectural best practice demonstrated by dividing a monolith into microservices.
• C. Multiple location deployment is unrelated to the decision to migrate and restructure the application into microservices.

Correct answer: C

The IAM credential report is a CSV file that contains details about password and access key rotation for all IAM users in an account. It specifically shows when credentials were created, last used, and when they last changed, making it the ideal tool for compliance auditing of credential rotation details.

Why the other options are wrong:

• A. IAM Access Analyzer is used to identify external access and policies, not credential rotation tracking.
• B. AWS Artifact provides compliance documentation and certifications, not specific credential rotation audit data.
• D. AWS Audit Manager is for managing compliance audit frameworks and evidence collection, not specifically for credential rotation reporting.

Correct answer: D

The AWS Knowledge Center contains frequently asked questions (FAQs) and answers to common security and technical questions that AWS customers encounter. It is a comprehensive resource specifically designed to address the most commonly asked questions across AWS services.

Why the other options are wrong:

• A. AWS Artifact provides compliance documentation and reports, not a FAQ resource for security questions.
• B. Amazon Connect is a contact center service and is unrelated to security information resources.
• C. AWS Chatbot is a Slack and Chime integration tool for notifications and commands, not a knowledge base for security FAQs.

Correct answer: A

Amazon SNS (Simple Notification Service) is designed to send messages via multiple channels including SMS text messages and email notifications from distributed applications. It provides a flexible publish-subscribe messaging model that supports both text and email delivery.

Why the other options are wrong:

• B. Amazon SES is primarily for sending bulk transactional emails but is not typically used for SMS text messages.
• C. CloudWatch alerts generate notifications but are focused on metrics and monitoring rather than general application messaging.
• D. Amazon SQS is a message queue service for decoupling applications and does not send SMS or email messages directly to end users.

Correct answer: B

Access keys consist of an access key ID and secret access key pair that enable programmatic access to AWS services via the AWS CLI, SDKs, and APIs. They are the standard credential type for application-level authentication to AWS resources.

Why the other options are wrong:

• A. Amazon Inspector is a vulnerability assessment service and does not provide access credentials.
• C. SSH public keys are used for EC2 instance access, not for programmatic API access to AWS services.
• D. AWS KMS keys are used for encryption and key management, not for authenticating API requests or CLI commands.

Correct answer: A

AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. It allows you to create rules to filter and block malicious requests based on patterns and signatures. AWS Shield protects against DDoS attacks, Network ACLs filter traffic at the subnet level, and Security Groups filter at the instance level, but none of these provide SQL injection protection like WAF does.

Why the other options are wrong:

• B. AWS Shield protects against DDoS attacks, not SQL injection.
• C. Network ACLs operate at Layer 4 and cannot inspect application-level attacks like SQL injection.
• D. Security Groups control traffic based on IP and ports, not application-layer attack patterns.

Correct answer: C

AWS IAM Access Analyzer is the service specifically designed to identify whether Amazon S3 buckets, IAM roles, KMS keys, and other resources have been shared with external entities. It validates resource-based policies and alerts on unintended external access. AWS Service Catalog manages IT service offerings, AWS Systems Manager provides operational insights, and AWS Organizations manages multi-account environments-none of these provide external sharing detection.

Why the other options are wrong:

• A. AWS Service Catalog is for managing approved IT services and products.
• B. AWS Systems Manager provides operational capabilities but not external access detection.
• D. AWS Organizations manages multiple AWS accounts but does not analyze resource sharing.

Correct answer: B

AWS Artifact is the official AWS service that provides on-demand access to AWS compliance and security documentation, including compliance reports, certifications, and audit findings. Users can download these reports directly without contacting support. This is the standard and most efficient way to obtain compliance reports before migration. Contacting the Compliance team or Support are indirect methods, and Amazon Macie is a data security service, not a compliance reporting tool.

Why the other options are wrong:

• A. Contacting the AWS Compliance team is inefficient when self-service reports are available.
• C. Opening an AWS Support case is unnecessary when reports are available directly via Artifact.
• D. Amazon Macie is a data discovery and protection service, not a compliance reporting service.

Correct answer: A

Under the AWS Shared Responsibility Model, the company is responsible for application software licenses. AWS is responsible for the hardware infrastructure, power, cooling, physical security, and data center operations. Software licenses are customer-owned intellectual property and costs that the customer brings to or purchases for use in AWS, making this the direct responsibility of the migrating company.

Why the other options are wrong:

• B. AWS is responsible for the cost and maintenance of hardware infrastructure.
• C. AWS is responsible for power and cooling costs for data centers.
• D. AWS is responsible for physical security of data centers.

Correct answer: C

Enabling multi-factor authentication (MFA) is a core IAM security best practice that significantly enhances account protection by requiring a second factor beyond passwords. Option A is wrong because root user access keys should never be created or used. Option B violates the principle of least privilege by granting excessive permissions. Option D is wrong because rotating credentials regularly is a critical security practice, not something to avoid.

Why the other options are wrong:

• A. The root user should not use access keys; administrative tasks should be performed by IAM users with appropriate permissions.
• B. Broad permissions violate the principle of least privilege and increase security risk.
• D. Credentials should be rotated regularly to minimize the risk of compromised credentials.

Correct answer: A

AWS CloudTrail is the primary service designed to audit and log API calls made within AWS accounts. It provides a complete history of API activity, enabling compliance monitoring, security analysis, and troubleshooting. CloudTrail records who made the call, when it was made, what resources were affected, and the response returned.

Why the other options are wrong:

• B. AWS Trusted Advisor provides recommendations for optimizing AWS resources but does not audit API calls.
• C. Amazon Inspector performs security assessments on EC2 instances and applications, not API call auditing.
• D. AWS X-Ray traces and analyzes application requests and performance, not general API call auditing.

Correct answer: A

Under the AWS shared responsibility model for Lambda, customers are responsible for managing the code within their Lambda functions. AWS handles the underlying infrastructure, operating system patching, runtime management, and hardware maintenance. The customer's responsibility extends to writing secure code, managing dependencies, and configuring proper permissions.

Why the other options are wrong:

• B. Hardware monitoring in the data center is AWS's responsibility, not the customer's.
• C. Operating system patching is entirely AWS's responsibility in the Lambda serverless model.
• D. While good practice, shutting down Lambda functions is not a formal responsibility requirement; functions are event-driven and auto-scale.

Correct answer: B

Amazon Athena is the most cost-effective service for running occasional queries on data stored in S3. It uses a pay-per-query pricing model based on data scanned, making it ideal for infrequent analysis. Athena requires no infrastructure setup or management and works directly with S3 data, minimizing costs for occasional query workloads.

Why the other options are wrong:

• A. Amazon Redshift is designed for continuous, large-scale data warehousing and requires provisioned clusters, making it costly for occasional queries.
• C. Amazon Kinesis is for real-time streaming data processing, not for querying historical data stored in S3.
• D. Amazon RDS would require loading data from S3 into a database and maintaining instances, adding unnecessary cost and complexity for occasional queries.

Correct answer: C

AWS Organizations is provided at no additional cost. It allows customers to manage multiple AWS accounts and consolidate billing without incurring separate charges. All other services listed have associated costs, though CloudWatch does offer a free tier with limited metrics.

Why the other options are wrong:

• A. Amazon SageMaker charges for compute instances, storage, and data processing used in machine learning operations.
• B. AWS Config incurs charges for the number of configuration items recorded and evaluated.
• D. Amazon CloudWatch charges for custom metrics, logs ingestion, and dashboards, though it offers limited free tier capabilities.

Correct answer: C

Cloud fluency is a capability within the People perspective of the AWS Cloud Adoption Framework. The People perspective focuses on organizational change management, training, and developing workforce skills needed to succeed with cloud adoption. Cloud fluency directly addresses the knowledge and skills employees need to work effectively in the cloud.

Why the other options are wrong:

• A. Data architecture is part of the Platform perspective, focusing on technical infrastructure and applications.
• B. Event management belongs to the Operations perspective, which handles running cloud workloads.
• D. Strategic partnership is part of the Business perspective, addressing business strategy and market positioning.

Correct answer: C

AWS Regions are the appropriate choice for selecting a deployment area close to a company's geographical location. Each Region is a separate geographic area with multiple Availability Zones, allowing customers to choose infrastructure physically near their on- premises location to minimize latency and comply with data residency requirements.

Why the other options are wrong:

• A. Amazon Connect is a cloud contact center service, not a resource selection tool for database deployment.
• B. AWS Wavelength brings AWS services to the edge of 5G networks with ultra-low latency, not for general geographic region selection.
• D. AWS Direct Connect provides dedicated network connections to AWS but does not determine geographic deployment location selection.

Correct answer: B

The AWS Pricing Calculator is designed to estimate costs before infrastructure is deployed. It allows users to select AWS services, configure them according to their requirements, and receive detailed cost estimates. This tool is specifically built for pre- deployment cost planning and budgeting.

Why the other options are wrong:

• A. AWS Free Tier provides free usage limits for services but is not designed for cost estimation of specific projects.
• C. AWS Billing and Cost Management tracks actual incurred costs and usage after deployment, not pre-deployment estimates.
• D. AWS Cost and Usage Report provides detailed analysis of past usage and costs, not pre-deployment estimation.

Correct answer: A

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, delivering images and videos with minimal latency in a cost-effective manner. It automatically routes requests to the nearest edge location and reduces data transfer costs compared to serving directly from origin servers.

Why the other options are wrong:

• B. S3 cross-region replication stores copies but doesn't provide a CDN with edge locations for low-latency delivery.
• C. A VPN across regions would increase latency and complexity rather than optimize content delivery.
• D. AWS PrivateLink is for private connectivity between AWS services and on-premises networks, not for public content delivery optimization.

Correct answer: C

Economies of scale in cloud computing enable lower variable costs because AWS spreads infrastructure costs across millions of customers, allowing individual companies to pay less per unit of compute, storage, or bandwidth compared to maintaining fixed costs for dedicated on-premises infrastructure.

Why the other options are wrong:

• A. Trading variable for fixed expense is a benefit but not specifically about economies of scale.
• B. Increased speed and agility is a cloud benefit but not directly related to economies of scale.
• D. Cloud computing decreases operational costs; this statement is backwards and incorrect.

Correct answer: C

AWS CDK is a software development framework that allows developers to define cloud resources as code using programming languages, which CloudFormation then uses to provision the resources. It provides higher-level abstractions compared to writing raw CloudFormation templates.

Why the other options are wrong:

• A. AWS CLI is a command-line tool for interacting with AWS services, not a framework for defining infrastructure as code.
• B. AWS Developer Center is a resource hub, not a framework for defining cloud resources.
• D. AWS CodeStar is a project management service for developing and deploying applications, not primarily an infrastructure-as-code framework.

Correct answer: C

AWS Security Token Service (STS) provides temporary, limited-privilege credentials for authentication with AWS APIs. These short-lived credentials are ideal for applications needing to assume roles or obtain federated access without managing long-term access keys.

Why the other options are wrong:

• A. API Gateway is used for creating and managing APIs, not for providing temporary credentials.
• B. IAM users have long-term credentials, not temporary ones, and don't meet the temporary requirement.
• D. IAM instance profiles provide temporary credentials to EC2 instances but are specific to that use case, not the general solution for application authentication.

Correct answer: A

AWS Security Hub is a cloud security posture management service that aggregates and prioritizes security findings from various AWS services (like GuardDuty, Inspector, Macie) and third-party security products in a standardized format for centralized security monitoring.

Why the other options are wrong:

• B. Trusted Advisor provides recommendations on cost, performance, and security best practices but is not a CSPM service.
• C. EventBridge is an event routing service, not a security posture management tool.
• D. GuardDuty is a threat detection service but doesn't aggregate alerts in the standardized way that CSPM services do.

Correct answer: B

AWS Identity and Access Management (IAM) is always provided at no charge. There are no costs for creating users, groups, roles, or policies, making it a foundational service available to all AWS accounts.

Why the other options are wrong:

• A. Amazon S3 charges for storage capacity, data transfer, and requests.
• C. Elastic Load Balancers incur hourly charges and data processing fees.
• D. AWS WAF charges per web ACL and per rule evaluated.

Correct answer: C

Amazon DynamoDB is a fully managed NoSQL database service that automatically scales throughput capacity based on demand. It handles provisioning, patching, and scaling transparently, making it ideal for applications with variable workloads.

Why the other options are wrong:

• A. Amazon Redshift is a data warehouse for analytical queries, not a NoSQL database.
• B. Amazon Aurora is a relational database, not NoSQL.
• D. Amazon RDS is a relational database service; while it can auto-scale, it's not NoSQL.

Correct answer: C

Under the AWS shared responsibility model, AWS manages DynamoDB's infrastructure, patching, and operating system. The company is responsible for managing database access permissions through IAM policies and controlling who can access the database.

Why the other options are wrong:

• A. Patching the operating system is AWS's responsibility in the managed DynamoDB service.
• B. Provisioning hosts is AWS's responsibility as part of the managed service.
• D. Securing the operating system is AWS's responsibility for a fully managed database service.

Correct answer: C

Spot Instances are the most cost-effective option for workloads that can be interrupted and don't need to run continuously. They offer up to 90% discount compared to On-Demand pricing, making them ideal for test environments where application testing can be paused or restarted. The interruptible nature of the workload aligns perfectly with Spot Instance characteristics.

Why the other options are wrong:

• A. On-Demand Instances are more expensive than Spot Instances and don't provide the cost savings needed for optional testing workloads.
• B. Dedicated Instances are for compliance/licensing requirements and are not cost- effective for temporary testing scenarios.
• D. Reserved Instances require long-term commitment and upfront payment, unsuitable for short-term testing that can be interrupted.

Correct answer: A

Amazon Macie is a fully managed service that uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3 buckets. It automatically identifies personally identifiable information (PII) and other sensitive data, making it the dedicated solution for this requirement.

Why the other options are wrong:

• B. Amazon Detective is used for investigating security findings and analyzing logs, not for discovering sensitive data in S3.
• C. Amazon GuardDuty detects malicious activity and threats to AWS accounts, not for identifying sensitive data in storage.
• D. AWS IAM Access Analyzer reviews IAM permissions and resource access policies, not for discovering sensitive data within S3 objects.

Correct answer: B

AWS CloudTrail is the service that logs and tracks API calls made within AWS accounts, including EC2 TerminateInstances API calls. It provides a complete audit trail showing when an instance was terminated, by whom, and from where, making it the definitive source for identifying instance termination events.

Why the other options are wrong:

• A. AWS IAM manages access control and permissions but does not track or log when instances are terminated.
• C. AWS Compute Optimizer provides recommendations for optimizing compute resources but does not identify termination events.
• D. Amazon EventBridge can react to termination events but does not identify or log when terminations occurred; CloudTrail is the source of that information.

Correct answer: D

Amazon Aurora is a fully managed relational database service that is MySQL-compatible, providing high performance, reliability, and cost-effectiveness. It is designed as a drop-in replacement for MySQL while offering additional features and performance improvements.

Why the other options are wrong:

• A. Amazon S3 is an object storage service, not a relational database.
• B. Amazon DynamoDB is a NoSQL key-value database, not a MySQL-compatible relational database.
• C. Amazon Redshift is a data warehouse service optimized for OLAP analytics, not a MySQL-compatible OLTP database.