Your FREE AWS Certified Cloud Practitioner (CLF-C02) Practice Test 2026 – 120+ Q&A

AWS Cloud Practitioner Practice Questions

1. How many pillars make up the AWS Well-Architected Framework?
   • Four
   • Five
   • Six
   • Eight

   Correct answer: Six

   Six is correct because the AWS Well-Architected Framework is built on six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Four and five reflect older versions of the framework before sustainability was added, and eight is simply too many.

2. A retailer adds servers automatically when shopping traffic spikes during a sale and removes them when traffic falls afterward, so it pays only for what it uses at any moment. Which cloud characteristic does this describe?
   • Fault tolerance
   • Vendor lock-in
   • Elasticity
   • High availability

   Correct answer: Elasticity

   Elasticity is correct because it is the ability to automatically acquire resources when demand rises and release them when demand falls, matching capacity to actual load. High availability and fault tolerance focus on keeping systems running through failures, not on demand-driven sizing, and vendor lock-in is unrelated.

3. Which statement best captures one of the six advantages of cloud computing as described by AWS?
   • Increase ongoing data center maintenance staff
   • Trade capital expense for variable expense
   • Lock applications to a single physical server
   • Pay a fixed monthly fee regardless of usage

   Correct answer: Trade capital expense for variable expense

   Trading capital expense for variable expense is correct because it maps to the first of the six canonical advantages AWS lists -- officially phrased as 'trade fixed expense for variable expense' -- which lets you pay only for what you consume instead of investing heavily up front in hardware. Increasing maintenance staff and locking to a single server contradict cloud benefits, and a fixed fee regardless of usage opposes the variable, pay-as-you-go model.

4. A team designs an application to run across multiple Availability Zones so that if one zone becomes unavailable the application continues serving users with minimal disruption. Which design goal are they primarily pursuing?
   • Cost optimization
   • Data residency
   • Capital expenditure
   • High availability

   Correct answer: High availability

   High availability is correct because spreading workloads across multiple Availability Zones is the standard AWS approach to keep an application operational despite the loss of a single zone. Cost optimization concerns spending efficiency, capital expenditure describes up-front hardware investment, and data residency concerns where data physically lives.

5. What is the core distinction between fault tolerance and high availability for a workload on AWS?
   • Fault tolerance is cheaper to achieve than high availability in every case
   • Fault tolerance and high availability mean exactly the same thing
   • Fault tolerance applies only to storage, while high availability applies only to compute
   • Fault tolerance lets a system keep operating with no interruption despite component failure, while high availability minimizes downtime but may allow brief recovery time

   Correct answer: Fault tolerance lets a system keep operating with no interruption despite component failure, while high availability minimizes downtime but may allow brief recovery time

   The correct choice is that fault tolerance keeps a system running with no interruption when a component fails, whereas high availability focuses on minimizing downtime and may tolerate short recovery periods. Fault tolerance is not limited to storage, it is generally more expensive rather than cheaper, and the two terms are not synonymous.

6. An organization moving to AWS wants to compare the full cost of running workloads on-premises against running them in the cloud, including hardware, power, cooling, and staffing. Which concept frames this comparison?
   • Total cost of ownership
   • Edge caching
   • Object lifecycle policy
   • Service level agreement

   Correct answer: Total cost of ownership

   Total cost of ownership is correct because it captures all direct and indirect costs of a solution, such as hardware, power, cooling, and labor, which is exactly what AWS encourages comparing on-premises versus cloud. A service level agreement defines uptime commitments, object lifecycle policy governs stored data transitions, and edge caching relates to content delivery.

7. The AWS Cloud Adoption Framework (CAF) organizes guidance into how many perspectives?
   • Six
   • Nine
   • Five
   • Three

   Correct answer: Six

   Six is correct because the AWS Cloud Adoption Framework is structured around six perspectives: business, people, governance, platform, security, and operations. Three, five, and nine do not match the established CAF structure.

8. Which pillar of the AWS Well-Architected Framework is most directly concerned with running and monitoring systems to deliver business value and continually improving processes?
   • Sustainability
   • Operational excellence
   • Performance efficiency
   • Cost optimization

   Correct answer: Operational excellence

   Operational excellence is correct because it focuses on running and monitoring systems, delivering business value, and continually improving supporting processes and procedures. Cost optimization targets avoiding unnecessary spend, performance efficiency targets using resources efficiently, and sustainability targets reducing environmental impact.

9. A startup launches with a small infrastructure footprint but expects to grow worldwide. By choosing AWS, it can deploy in new geographic areas within minutes rather than building data centers. Which of the six advantages of cloud computing does this illustrate?
   • Stop guessing capacity
   • Increase speed and agility
   • Go global in minutes
   • Benefit from massive economies of scale

   Correct answer: Go global in minutes

   Go global in minutes is correct because it specifically describes deploying applications in multiple regions around the world quickly and with low cost. Stop guessing capacity addresses sizing decisions, economies of scale addresses lower pay-as-you-go pricing from aggregated demand, and increasing speed and agility addresses faster access to resources.

10. How does elasticity differ from scalability in cloud computing?
    • Elasticity and scalability are interchangeable terms with no difference
    • Elasticity automatically adds and removes capacity in response to real-time demand, while scalability is the broader ability of a system to handle increased load
    • Elasticity applies to databases only, while scalability applies to compute only
    • Elasticity only reduces capacity, while scalability only increases it

    Correct answer: Elasticity automatically adds and removes capacity in response to real-time demand, while scalability is the broader ability of a system to handle increased load

    The correct answer is that elasticity automatically adds and removes capacity to match real-time demand, while scalability is the more general capability of a system to grow to handle larger workloads. Elasticity is not limited to reducing capacity, neither term is restricted to a single service category, and they are not interchangeable.

11. Which security control responsibility falls under the security pillar of the AWS Well-Architected Framework as a design consideration for an architect?
    • Reducing the carbon footprint of a workload
    • Selecting the cheapest storage class to minimize the bill
    • Choosing instance types that run fastest
    • Protecting information and systems through identity management and least-privilege access

    Correct answer: Protecting information and systems through identity management and least-privilege access

    Protecting information and systems through identity management and least-privilege access is correct because the security pillar centers on safeguarding data, systems, and assets, including identity and access controls. Choosing the cheapest storage maps to cost optimization, reducing carbon footprint maps to sustainability, and selecting the fastest instances maps to performance efficiency.

12. A finance team is concerned that purchasing servers up front ties up cash that could fund growth. Moving to AWS converts these large up-front purchases into ongoing operational charges based on use. Which financial shift does this represent?
    • A change from variable pricing to flat-rate billing
    • A shift from capital expenditure to operational expenditure
    • A shift from operational expenditure to capital expenditure
    • An increase in fixed depreciation schedules

    Correct answer: A shift from capital expenditure to operational expenditure

    Shifting from capital expenditure to operational expenditure is correct because cloud adoption replaces large up-front hardware purchases with ongoing usage-based charges, a central element of cloud economics and total cost of ownership. The reverse shift, increasing depreciation, and moving to flat-rate billing all contradict the pay-for-use cloud model.

13. An architect wants to ensure a workload can recover quickly from failures and is sized to meet demand without over-provisioning. Which AWS Well-Architected Framework pillar most directly addresses the ability to recover from disruptions and meet availability targets?
    • Operational excellence
    • Cost optimization
    • Reliability
    • Sustainability

    Correct answer: Reliability

    Reliability is correct because this pillar focuses on a workload performing its intended function correctly and consistently, including recovering from failures and dynamically meeting demand. Operational excellence centers on process improvement, cost optimization on avoiding unneeded spend, and sustainability on environmental impact.

14. Which scenario best demonstrates the cloud advantage of stopping guessing about capacity?
    • A company signs a three-year hardware lease before launch
    • A company keeps idle servers running year-round just in case
    • A company scales resources up or down on demand instead of buying for a peak it must predict in advance
    • A company stores all data in a single on-premises server

    Correct answer: A company scales resources up or down on demand instead of buying for a peak it must predict in advance

    Scaling resources up or down on demand is correct because stopping guessing capacity means you no longer have to predict peak needs and risk over- or under-provisioning. Signing a long hardware lease and keeping idle servers running year-round are exactly the guessing-and-overbuying behaviors cloud eliminates, and consolidating to one on-premises server is unrelated.

15. Within the AWS Cloud Adoption Framework, which perspective focuses on aligning IT strategy and investments with business outcomes and creating a strong business case for cloud adoption?
    • Operations perspective
    • Platform perspective
    • Security perspective
    • Business perspective

    Correct answer: Business perspective

    The business perspective is correct because it helps ensure cloud investments accelerate digital transformation and business outcomes, aligning IT with business goals. The platform perspective addresses building and modernizing infrastructure, the operations perspective addresses running and supporting services, and the security perspective addresses protecting data and workloads.

16. Why can AWS offer lower pay-as-you-go pricing than most organizations could achieve on their own, according to the six advantages of cloud computing?
    • Massive aggregated usage across many customers creates economies of scale
    • Customers are required to sign multi-decade commitments
    • AWS sells hardware below manufacturing cost to every customer
    • AWS limits each account to a single Region to cut costs

    Correct answer: Massive aggregated usage across many customers creates economies of scale

    Aggregated usage creating economies of scale is correct because pooling demand from hundreds of thousands of customers lets AWS achieve higher efficiencies and pass savings on as lower pricing. Selling hardware below cost, requiring multi-decade commitments, and restricting accounts to one Region are not how these economies of scale work.

17. A workload is designed so that redundant components automatically take over with zero interruption to users if any single component fails. Which property is this design optimizing for?
    • Capital expenditure
    • Fault tolerance
    • Data classification
    • Pay-as-you-go pricing

    Correct answer: Fault tolerance

    Fault tolerance is correct because it is the ability of a system to keep operating without interruption even when a component fails, achieved through redundancy and automatic failover. Pay-as-you-go pricing is a billing model, capital expenditure is an up-front spending concept, and data classification concerns categorizing information sensitivity.

18. Which AWS Well-Architected Framework pillar was added to the framework to help organizations minimize the environmental impact of running cloud workloads?
    • Sustainability
    • Performance efficiency
    • Reliability
    • Security

    Correct answer: Sustainability

    Sustainability is correct because it is the pillar focused on reducing energy consumption and the environmental impact of workloads, and it was the most recent addition to the framework. Reliability concerns consistent operation, security concerns protecting assets, and performance efficiency concerns using resources effectively.

19. An organization estimates that moving from its own data center to AWS will reduce spending on hardware refresh cycles, facility power, and the staff needed to maintain physical servers. Which categories of cost reduction does a total cost of ownership analysis capture here?
    • Only software licensing fees
    • Only the cost of internet bandwidth
    • Both direct hardware costs and indirect operational costs such as power and labor
    • Only the price of compute instances per hour

    Correct answer: Both direct hardware costs and indirect operational costs such as power and labor

    Capturing both direct hardware costs and indirect operational costs is correct because a total cost of ownership analysis accounts for the full picture, including hardware, power, cooling, and personnel, not just one line item. Limiting the analysis to compute prices, software licensing alone, or bandwidth alone would understate the true comparison.

20. A development team can provision the resources they need in minutes through self-service rather than waiting weeks for hardware procurement, letting them experiment and innovate faster. Which of the six advantages of cloud computing does this reflect?
    • Trade capital expense for variable expense
    • Stop guessing capacity
    • Go global in minutes
    • Increase speed and agility

    Correct answer: Increase speed and agility

    Increasing speed and agility is correct because making resources available in minutes lowers the cost and time of experimentation and accelerates innovation. Trading capital for variable expense is about spending models, going global in minutes is about geographic reach, and stopping guessing capacity is about right-sizing without prediction.

21. Which AWS Cloud Adoption Framework perspective is primarily concerned with the people, training, and organizational change needed to support a cloud transformation?
    • People perspective
    • Governance perspective
    • Operations perspective
    • Platform perspective

    Correct answer: People perspective

    The people perspective is correct because it focuses on culture, organizational structures, leadership, and workforce skills required for cloud adoption. The governance perspective addresses managing and measuring the cloud effort, the platform perspective addresses building infrastructure, and the operations perspective addresses running services.

22. A company runs identical copies of its application in two separate Availability Zones behind a load balancer. The chief goal is that a single zone outage should not take the application offline for users. Which combination of cloud principles is the company applying?
    • Capital expenditure through up-front purchases
    • Vendor lock-in through proprietary tooling
    • Cost optimization through reserved capacity
    • High availability through redundancy across Availability Zones

    Correct answer: High availability through redundancy across Availability Zones

    High availability through redundancy across Availability Zones is correct because running redundant copies in separate zones behind a load balancer keeps the application reachable when one zone fails. Cost optimization and capital expenditure address spending rather than uptime, and vendor lock-in is a constraint, not a resilience design goal.

23. Which AWS Well-Architected Framework pillar focuses specifically on using computing resources efficiently to meet requirements and maintaining that efficiency as demand changes and technologies evolve?
    • Cost optimization
    • Performance efficiency
    • Operational excellence
    • Reliability

    Correct answer: Performance efficiency

    Performance efficiency is correct because this pillar centers on using IT and computing resources efficiently, selecting the right resource types and sizes, and maintaining efficiency as needs evolve. Operational excellence focuses on processes, reliability on consistent operation, and cost optimization on avoiding unnecessary spending.

24. An architect must justify a cloud migration to executives by quantifying long-term savings beyond just the monthly AWS invoice. Which two elements would a thorough total cost of ownership analysis most appropriately include alongside service usage charges?
    • The retail price of competitor cloud services only
    • Avoided data center facility costs and reduced infrastructure management labor
    • The number of marketing campaigns planned for the year
    • The brand color palette used in the company logo

    Correct answer: Avoided data center facility costs and reduced infrastructure management labor

    Avoided facility costs and reduced infrastructure labor are correct because total cost of ownership weighs the on-premises expenses the cloud removes, such as buildings, power, and the staff to run hardware, against cloud usage charges. Competitor retail prices, marketing campaign counts, and logo colors are irrelevant to a TCO comparison.

25. Within the AWS Cloud Adoption Framework, which perspective focuses on managing, measuring, and minimizing the risks of the cloud transformation, including compliance and decision-making structures?
    • Platform perspective
    • People perspective
    • Business perspective
    • Governance perspective

    Correct answer: Governance perspective

    The governance perspective is correct because it concentrates on orchestrating cloud initiatives while maximizing benefits and managing risk, including compliance and oversight. The people perspective addresses workforce and culture, the platform perspective addresses building infrastructure, and the business perspective addresses aligning IT with business outcomes.

26. A team automatically scales out additional capacity during a marketing-driven traffic surge and scales back in afterward, never paying for idle resources. By avoiding both over-provisioning for peaks and under-provisioning during lulls, which cloud benefit are they realizing through elasticity?
    • Matching resource supply precisely to demand to avoid wasted spend
    • Eliminating the need for any monitoring of usage
    • Permanently fixing capacity at the historical maximum
    • Guaranteeing the lowest possible price with a long-term commitment

    Correct answer: Matching resource supply precisely to demand to avoid wasted spend

    Matching resource supply precisely to demand is correct because elasticity lets capacity track real usage so you neither overpay for idle peak capacity nor run short during lulls. Permanently fixing capacity at the maximum is the opposite of elasticity, elasticity does not remove the need for monitoring, and long-term commitments describe a pricing model rather than elasticity itself.

27. Which statement correctly relates the AWS Well-Architected Framework to designing workloads on AWS?
    • It provides a consistent set of best-practice pillars and questions architects can use to evaluate and improve their designs
    • It is a hardware product customers install in their own data centers
    • It is a billing tool that automatically lowers monthly charges
    • It is a support plan tier that includes a technical account manager

    Correct answer: It provides a consistent set of best-practice pillars and questions architects can use to evaluate and improve their designs

    Providing a consistent set of best-practice pillars and evaluation questions is correct because the Well-Architected Framework is guidance for designing and reviewing secure, reliable, efficient, cost-effective, and sustainable workloads. It is not a billing tool, not a physical hardware product, and not a support plan tier.

28. A company notices it is paying for compute resources that sit idle most of the day and wants guidance on eliminating unneeded spend while still meeting requirements. Which AWS Well-Architected Framework pillar should it consult?
    • Operational excellence
    • Security
    • Cost optimization
    • Reliability

    Correct answer: Cost optimization

    Cost optimization is correct because this pillar focuses on avoiding unnecessary costs, understanding spending, and selecting the most appropriate and right-sized resources for the need. Reliability concerns consistent operation, security concerns protecting assets, and operational excellence concerns running and improving processes.

29. In the AWS shared responsibility model, the line dividing customer and AWS duties is often summarized as security "of" the cloud versus security "in" the cloud. Which item belongs to security "of" the cloud?
    • The IAM policies a customer writes for their staff
    • The networking infrastructure, edge locations, and data center facilities
    • The firewall rules a customer configures in security groups
    • The encryption settings a customer applies to their S3 objects

    Correct answer: The networking infrastructure, edge locations, and data center facilities

    The networking infrastructure, edge locations, and data center facilities is correct because security "of" the cloud is AWS's responsibility for the global infrastructure that runs all services. Writing IAM policies, setting object encryption, and configuring security group rules are all customer-controlled tasks that fall under security "in" the cloud.

30. A customer stores objects in Amazon S3 using a managed storage service. Which control over those objects remains the customer's responsibility rather than AWS's under the shared responsibility model?
    • Configuring bucket access policies and choosing whether to encrypt the data
    • Operating the data center network switches
    • Replacing failed disks in the storage fleet
    • Maintaining the durability of the storage hardware

    Correct answer: Configuring bucket access policies and choosing whether to encrypt the data

    Configuring bucket access policies and choosing whether to encrypt the data is correct because the customer always governs access to and protection of their own data, even on a managed service. Maintaining storage durability, operating network switches, and replacing failed disks are infrastructure duties AWS performs as security "of" the cloud.

31. A business is selecting between Amazon EC2, Amazon RDS, and AWS Lambda for a workload and wants to minimize the security and maintenance tasks its own team must handle. Analyzing the shared responsibility model, which choice shifts the most responsibility to AWS?
    • All three place identical responsibility on the customer
    • AWS Lambda, because AWS manages the operating system, runtime, and scaling
    • Amazon EC2, because the customer fully controls the instance
    • Amazon RDS, because the customer patches the database engine

    Correct answer: AWS Lambda, because AWS manages the operating system, runtime, and scaling

    AWS Lambda shifting the most responsibility to AWS is correct because the more abstracted a service is, the more of the stack AWS operates, leaving the customer mainly their code, data, and permissions. EC2 leaves the guest OS and more to the customer, RDS does not require the customer to patch the engine, and the three services clearly do not impose identical responsibility.

32. Which IAM element is best described as an identity that can be assumed temporarily by a user, application, or AWS service and provides short-lived credentials instead of permanent ones?
    • An IAM role
    • A permissions boundary document
    • An access key pair
    • An IAM group

    Correct answer: An IAM role

    An IAM role is correct because a role is an identity with permissions that can be assumed to obtain temporary credentials rather than long-term keys. An IAM group is only a container for users, an access key pair is a long-term credential, and a permissions boundary is a policy that limits rather than grants identity.

33. An administrator needs to give a contractor sign-in access to the AWS Management Console for ninety days. Which IAM identity type is intended to represent that single person with their own credentials?
    • An IAM permissions boundary
    • A service control policy
    • An IAM policy
    • An IAM user

    Correct answer: An IAM user

    An IAM user is correct because a user represents a single person or application with its own long-term credentials such as a console password. An IAM policy and a service control policy are permission documents, and a permissions boundary limits permissions, none of which is an identity that a person signs in as.

34. Which AWS service is the central place to create users, organize them into groups, attach permission policies, and define roles for the account?
    • Amazon CloudWatch
    • Amazon Inspector
    • AWS Identity and Access Management
    • AWS Config

    Correct answer: AWS Identity and Access Management

    AWS Identity and Access Management is correct because IAM is the service for managing users, groups, roles, and policies that control access to AWS resources. Amazon CloudWatch monitors metrics, AWS Config tracks resource configurations, and Amazon Inspector scans for vulnerabilities, none of which manage identities and permissions.

35. An application running on Amazon EC2 needs to read from an Amazon S3 bucket. Following AWS security guidance, what is the recommended way to grant the application this access?
    • Make the S3 bucket public so no credentials are needed
    • Attach an IAM role to the EC2 instance that grants read access to the bucket
    • Store the root user credentials in an environment variable on the instance
    • Hard-code an IAM user's access keys into the application code

    Correct answer: Attach an IAM role to the EC2 instance that grants read access to the bucket

    Attaching an IAM role to the EC2 instance is correct because roles supply temporary credentials automatically, avoiding long-term keys on the instance. Hard-coding access keys risks exposure, storing root credentials is extremely dangerous, and making the bucket public exposes the data to anyone on the internet.

36. Why does AWS recommend creating individual IAM users for each person rather than sharing one set of credentials among a team?
    • Individual users provide accountability so each person's actions can be traced and permissions tailored
    • Shared credentials cannot be used in the AWS Management Console
    • Shared credentials are billed at a higher hourly rate
    • Individual users automatically encrypt all account data

    Correct answer: Individual users provide accountability so each person's actions can be traced and permissions tailored

    Individual users providing accountability is correct because separate identities let activity be attributed to a specific person and permissions to be scoped per role. Credentials are not billed by sharing, shared credentials can technically sign in to the console, and creating users does not by itself encrypt data.

37. Which statement about the AWS account root user is accurate?
    • The root user can only access billing information
    • The root user can have its permissions reduced with an IAM policy
    • The root user has complete, unrestricted access to all resources in the account
    • The root user is created manually after the first IAM user

    Correct answer: The root user has complete, unrestricted access to all resources in the account

    The root user having complete, unrestricted access is correct because it is the identity created with the account and can perform every action, which is why it must be protected. Its permissions cannot be limited by an IAM policy, it exists from account creation rather than being made later, and its access extends far beyond billing.

38. After securing the root user, an organization wants ongoing assurance that no one is using the root credentials for everyday work. Which monitoring practice supports this goal?
    • Setting up an alert that notifies the security team whenever the root user is used
    • Deleting the root user entirely from the account
    • Granting the root user to every administrator for shared monitoring
    • Disabling MFA so root sign-ins are logged faster

    Correct answer: Setting up an alert that notifies the security team whenever the root user is used

    Setting up an alert on root user activity is correct because monitoring and notifying on any root usage helps detect unauthorized or unnecessary use of the most powerful identity. The root user cannot be deleted, sharing it broadly increases risk, and disabling MFA weakens rather than strengthens protection.

39. An organization adds a second authentication factor for its IAM users. Beyond a virtual authenticator app, which of the following is also a valid MFA option supported by AWS?
    • A longer minimum password length
    • An access key rotated weekly
    • A FIDO security key (hardware) for sign-in
    • A security group restricting the source IP

    Correct answer: A FIDO security key (hardware) for sign-in

    A FIDO security key is correct because hardware security keys are a supported MFA possession factor alongside virtual authenticator apps. A longer password is still a single knowledge factor, rotating access keys addresses key hygiene rather than adding a factor, and a security group filters network traffic rather than authenticating users.

40. A security policy mandates that the AWS account root user must never sign in with only a password. Which configuration directly enforces a stronger sign-in for root?
    • Turning on AWS Cost Explorer
    • Creating additional IAM groups
    • Enabling multi-factor authentication on the root user
    • Adding more tags to account resources

    Correct answer: Enabling multi-factor authentication on the root user

    Enabling multi-factor authentication on the root user is correct because it requires a second factor in addition to the password for root sign-in. Creating IAM groups changes permission organization, AWS Cost Explorer analyzes spending, and tagging resources aids tracking, none of which strengthen the root sign-in process.

41. Which everyday scenario best illustrates the principle of least privilege being applied correctly?
    • Every employee shares one IAM user with full access
    • A new hire is granted administrator access so they never hit a permission error
    • A developer is given the root user to deploy code
    • A billing analyst is given read-only access to cost reports and nothing else

    Correct answer: A billing analyst is given read-only access to cost reports and nothing else

    Giving the billing analyst read-only access to cost reports is correct because least privilege means granting only the permissions needed for the job. Granting administrator access to a new hire, sharing one full-access user, and handing out the root user all provide far more access than necessary and increase risk.

42. A team applies the principle of least privilege but also wants a safety mechanism that caps the maximum permissions an IAM user could ever receive, even if a broad policy is attached later. Which IAM feature provides this upper limit?
    • A longer password policy
    • An Amazon CloudWatch alarm
    • An additional IAM group for the user
    • A permissions boundary on the IAM user

    Correct answer: A permissions boundary on the IAM user

    A permissions boundary is correct because it sets the maximum permissions an identity can have, so even an over-broad attached policy cannot exceed that ceiling, reinforcing least privilege. Adding a group grants more permissions rather than capping them, a password policy governs credentials, and a CloudWatch alarm monitors metrics.

43. AWS Shield Advanced offers a financial safeguard that AWS Shield Standard does not. What is that safeguard?
    • Cost protection that can reimburse scaling charges caused by a covered DDoS attack
    • Automatic refunds for any monthly bill increase
    • A discount on all EC2 instances during normal operation
    • Free data transfer between Regions

    Correct answer: Cost protection that can reimburse scaling charges caused by a covered DDoS attack

    Cost protection that can reimburse scaling charges from a covered DDoS attack is correct because Shield Advanced includes DDoS cost protection in addition to its enhanced mitigations and response team access. It does not provide general EC2 discounts, free cross-Region transfer, or refunds for ordinary bill increases.

44. Which type of attack is AWS Shield specifically designed to help defend against?
    • Malware installed by an insider on a laptop
    • Misconfigured IAM policies granting excess access
    • Phishing emails that trick employees into revealing passwords
    • Distributed Denial of Service attacks that overwhelm resources with traffic

    Correct answer: Distributed Denial of Service attacks that overwhelm resources with traffic

    Distributed Denial of Service attacks is correct because AWS Shield is the managed service dedicated to detecting and mitigating DDoS attempts that flood applications with traffic. Phishing, insider malware, and IAM misconfigurations are addressed by user awareness, endpoint controls, and access management rather than by Shield.

45. A development team can write managed rule groups and rate-based rules to limit how many requests a single IP can send per five-minute window to their web application. Which AWS service provides this capability?
    • Amazon EBS
    • Amazon SQS
    • AWS WAF
    • AWS Snowball

    Correct answer: AWS WAF

    AWS WAF is correct because it supports managed rule groups and rate-based rules that throttle requests from a single source over a time window at the application layer. Amazon EBS is block storage, AWS Snowball moves data physically, and Amazon SQS is a message queue, none of which filter web requests.

46. A retailer wants to allow legitimate shoppers but block requests that match common web exploit patterns and known bad bots before they reach the application. Which combination of AWS WAF capabilities best meets this need?
    • Encrypting the database and enabling Auto Scaling
    • Creating an IAM group and a password policy
    • AWS Managed Rules to block common exploits plus a bot control rule group
    • Provisioning Reserved Instances and a savings plan

    Correct answer: AWS Managed Rules to block common exploits plus a bot control rule group

    AWS Managed Rules plus a bot control rule group is correct because WAF offers prebuilt managed rules for common exploits and dedicated rule groups to mitigate unwanted bot traffic. Encryption and Auto Scaling address confidentiality and capacity, pricing models address cost, and IAM constructs address access, none of which filter malicious web requests.

47. Amazon GuardDuty analyzes several AWS data sources to detect threats. Which of the following is one of the log sources GuardDuty inspects?
    • CloudFormation template parameters
    • VPC Flow Logs
    • S3 object thumbnails
    • EC2 instance store contents

    Correct answer: VPC Flow Logs

    VPC Flow Logs is correct because GuardDuty analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail events to detect suspicious activity. EC2 instance store contents, S3 object thumbnails, and CloudFormation template parameters are not threat-detection data sources GuardDuty ingests.

48. A small company wants to start detecting threats like unusual API calls and potential account compromise quickly, with minimal setup and no infrastructure to deploy. Which characteristic of Amazon GuardDuty makes this practical?
    • It can be enabled with a few clicks and immediately begins analyzing existing logs
    • It only works after migrating all data to Amazon Redshift
    • It requires building a custom machine learning model first
    • It needs a dedicated EC2 fleet to run its detectors

    Correct answer: It can be enabled with a few clicks and immediately begins analyzing existing logs

    Being enabled with a few clicks and immediately analyzing existing logs is correct because GuardDuty is a fully managed, agentless service that starts detecting threats from current data sources right away. It does not require building a custom model, running a dedicated EC2 fleet, or migrating data to Redshift.

49. When data is encrypted with AWS KMS, what does KMS actually manage on the customer's behalf?
    • The physical hard drives that store the data
    • The lifecycle and access control of the cryptographic keys used to encrypt and decrypt data
    • The DNS records that route traffic to the application
    • The number of EC2 instances running the workload

    Correct answer: The lifecycle and access control of the cryptographic keys used to encrypt and decrypt data

    Managing the lifecycle and access control of cryptographic keys is correct because KMS creates, stores, rotates, and controls permissions on the keys used to protect data. It does not manage physical drives, DNS records, or the count of EC2 instances, which are storage, networking, and compute concerns.

50. A company must meet a contractual requirement that it, not AWS, controls when an encryption key can be disabled or rotated. Which AWS KMS option gives the customer this level of control over the key?
    • An IAM access key pair
    • A customer managed key in AWS KMS
    • A default AWS managed key with no customer control
    • An Amazon Route 53 record set

    Correct answer: A customer managed key in AWS KMS

    A customer managed key in AWS KMS is correct because customer managed keys let the customer define key policies and control rotation, disabling, and access. AWS managed keys offer less direct control, an IAM access key pair is a sign-in credential, and a Route 53 record set is a DNS configuration.

51. A company enables server-side encryption on its Amazon RDS database storage and its Amazon S3 buckets. Which security objective does this primarily accomplish?
    • Distributing traffic across multiple Availability Zones
    • Protecting data in transit as it crosses the network
    • Protecting data at rest so stored data is unreadable without the keys
    • Reducing the monthly cost of storage

    Correct answer: Protecting data at rest so stored data is unreadable without the keys

    Protecting data at rest is correct because server-side encryption of stored RDS and S3 data makes that data unreadable on disk without the encryption keys. Protecting data in transit involves TLS on network connections, distributing traffic is a load-balancing function, and encryption does not reduce storage cost.

52. An application sends API requests to AWS over the public internet, and the security team wants to ensure those requests cannot be read if intercepted in transit. Which measure achieves this?
    • Turning on S3 Versioning
    • Enabling encryption on the EBS volume
    • Using HTTPS with TLS for the API connections
    • Adding the application to an IAM group

    Correct answer: Using HTTPS with TLS for the API connections

    Using HTTPS with TLS is correct because TLS encrypts data in transit so intercepted traffic cannot be read. Encrypting an EBS volume protects data at rest, S3 Versioning preserves object versions, and adding an application to an IAM group changes permissions, none of which protect data while it moves over the network.

53. Which AWS resource serves as the self-service portal where customers download AWS compliance documents and accept certain online agreements at no cost?
    • AWS Artifact
    • AWS Config
    • Amazon Macie
    • AWS Trusted Advisor

    Correct answer: AWS Artifact

    AWS Artifact is correct because it is the free self-service portal for downloading AWS audit reports and reviewing select agreements. AWS Trusted Advisor gives best-practice recommendations, Amazon Macie discovers sensitive data, and AWS Config tracks resource configuration, none of which is the compliance-document portal.

54. A vendor-risk team asks for evidence of AWS's independent third-party audits, such as a SOC 1 report, to evaluate AWS as a provider. Which statement correctly describes how AWS Artifact helps?
    • It provides on-demand downloads of AWS's third-party audit reports like SOC 1
    • It generates the customer's own SOC 1 report for them
    • It automatically remediates compliance gaps in customer accounts
    • It performs penetration testing on the customer's applications

    Correct answer: It provides on-demand downloads of AWS's third-party audit reports like SOC 1

    Providing on-demand downloads of AWS's third-party audit reports is correct because Artifact delivers AWS-produced compliance evidence such as SOC reports for the provider's environment. It does not generate the customer's own audit report, perform penetration testing, or remediate the customer's compliance gaps.

55. A merchant that processes credit card payments wants to confirm that the AWS services it uses align with the standard governing cardholder data security. Which compliance program is most relevant?
    • FERPA
    • PCI DSS
    • HIPAA
    • SOX for email retention

    Correct answer: PCI DSS

    PCI DSS is correct because the Payment Card Industry Data Security Standard governs the secure handling of cardholder data, which is exactly the merchant's concern. HIPAA covers health information, FERPA covers education records, and the SOX option misattributes a financial-controls law to email retention.

56. An organization is unsure which AWS compliance certifications cover the Region where it plans to deploy. Evaluating its options, what is the best way to confirm the relevant certifications and obtain the supporting documents?
    • Open an EC2 instance and inspect its operating system
    • Increase the account's spending limit
    • Add cost allocation tags to all resources
    • Review the AWS compliance programs and download the corresponding reports from AWS Artifact

    Correct answer: Review the AWS compliance programs and download the corresponding reports from AWS Artifact

    Reviewing the AWS compliance programs and downloading reports from AWS Artifact is correct because AWS publishes its compliance program coverage and provides the supporting audit documents through Artifact. Inspecting an EC2 operating system, raising a spending limit, and tagging resources do not reveal or document compliance coverage.

57. Which capability does AWS CloudTrail provide that supports security investigations and governance?
    • Automatic distribution of web content to edge locations
    • Provisioning of infrastructure from templates
    • Real-time CPU and memory utilization graphs for instances
    • A record of API calls and account activity, including the identity, time, and source of each call

    Correct answer: A record of API calls and account activity, including the identity, time, and source of each call

    A record of API calls and account activity is correct because CloudTrail logs who did what, when, and from where for governance and security investigations. Utilization graphs come from CloudWatch, content distribution from CloudFront, and template-based provisioning from CloudFormation.

58. A governance team wants a single, account-wide trail that captures management events across all AWS Regions, so activity in any Region is recorded even if no one is actively working there. Which CloudTrail configuration meets this requirement?
    • Create a multi-Region trail that applies to all Regions in the account
    • Enable AWS Shield in every Region
    • Rely on Amazon CloudWatch alarms instead of a trail
    • Create a separate trail only in the home Region and ignore others

    Correct answer: Create a multi-Region trail that applies to all Regions in the account

    Creating a multi-Region trail is correct because it records management events across all Regions of the account, ensuring activity anywhere is captured. A single home-Region trail misses other Regions, CloudWatch alarms monitor metrics rather than log API calls, and AWS Shield mitigates DDoS rather than recording activity.

59. A security analyst must determine the proper response to a GuardDuty finding indicating that an EC2 instance is communicating with a known malicious IP address. Analyzing the situation, which combination of AWS capabilities most directly supports both confirming what happened and detecting the behavior?
    • AWS Budgets for the detection and Amazon SNS to review activity
    • Elastic Load Balancing for the detection and Amazon EBS to review activity
    • Amazon GuardDuty for the detection and AWS CloudTrail to review the related API activity
    • Amazon CloudFront for the detection and AWS KMS to review activity

    Correct answer: Amazon GuardDuty for the detection and AWS CloudTrail to review the related API activity

    Amazon GuardDuty for the detection and AWS CloudTrail to review the related API activity is correct because GuardDuty surfaces the threat finding while CloudTrail lets the analyst trace the associated API calls to understand what occurred. Budgets and SNS, CloudFront and KMS, and ELB and EBS pair services whose purposes do not match threat detection plus activity review.

60. A company wants to enforce, across every account in its multi-account environment, that no one can disable AWS CloudTrail logging. Which AWS mechanism applies such an organization-wide guardrail centrally?
    • A security group rule on each instance
    • An Amazon S3 bucket lifecycle rule
    • An individual IAM user policy in each account
    • A service control policy in AWS Organizations

    Correct answer: A service control policy in AWS Organizations

    A service control policy in AWS Organizations is correct because SCPs set permission guardrails that apply to all member accounts centrally, such as preventing CloudTrail from being disabled. An individual IAM user policy applies only within one account, a security group filters network traffic, and an S3 lifecycle rule manages object expiration.

61. A new IAM user is created with no policies attached and then tries to view an Amazon S3 bucket. The request is denied. Which IAM behavior explains this outcome?
    • New users automatically receive read access to all services
    • Permissions are implicitly denied until a policy explicitly grants them
    • S3 always requires the root user to view buckets
    • The denial means the user's MFA token expired

    Correct answer: Permissions are implicitly denied until a policy explicitly grants them

    Permissions being implicitly denied until explicitly granted is correct because an IAM identity with no policies has no permissions and is denied by default. New users do not automatically get read access, viewing S3 buckets does not require root, and the denial reflects missing permissions rather than an expired MFA token.

62. A startup must encrypt customer records both while they sit in Amazon S3 and while they move between the browser and the application, and it wants AWS to help manage the encryption keys. Evaluating the requirements, which set of measures addresses all three needs?
    • An IAM password policy for storage and a CloudWatch alarm for transit
    • Server-side encryption with AWS KMS keys for data at rest and HTTPS/TLS for data in transit
    • Reserved Instances for storage and Spot Instances for transit
    • Auto Scaling for storage and a load balancer for transit

    Correct answer: Server-side encryption with AWS KMS keys for data at rest and HTTPS/TLS for data in transit

    Server-side encryption with AWS KMS keys plus HTTPS/TLS is correct because KMS-backed encryption protects stored data and lets AWS help manage the keys, while TLS protects data moving over the network. Auto Scaling and load balancers, pricing models, and an IAM policy with a CloudWatch alarm address capacity, cost, and access rather than encrypting data at rest and in transit.

63. A company wants its administrators to authenticate with a second factor before they can change account settings, and it also wants to limit each administrator's permissions to only the services they manage. Which two security practices together address these goals?
    • Sharing the root user and granting administrator access to everyone
    • Using one IAM user for all administrators with full access
    • Disabling MFA and attaching an administrator policy to all users
    • Multi-factor authentication for stronger sign-in and least-privilege permissions scoped to each role

    Correct answer: Multi-factor authentication for stronger sign-in and least-privilege permissions scoped to each role

    Multi-factor authentication plus least-privilege permissions is correct because MFA adds a second factor for stronger authentication while least privilege restricts each administrator to only what they need. Sharing the root user, disabling MFA, and using one shared full-access user all weaken authentication and grant excessive permissions, contradicting both goals.

64. A global retailer notices that AWS keeps adding new Regions and Availability Zones around the world over time. From an architecture standpoint, what does this ongoing expansion of the AWS global infrastructure primarily give customers?
    • More choices of where to place workloads closer to their users and to satisfy local data-residency needs
    • A guarantee that every AWS service launches in every Region on the same day
    • Automatic replication of all customer data to every new Region as it opens
    • A reduction in the number of Availability Zones per Region to simplify management

    Correct answer: More choices of where to place workloads closer to their users and to satisfy local data-residency needs

    More geographic placement choice is what the growing global infrastructure provides; new Regions and Availability Zones let customers position workloads nearer to end users for lower latency and within specific jurisdictions for data residency. Services do not all launch everywhere simultaneously, AWS never copies customer data to new Regions automatically, and adding Regions does not shrink the AZ count per Region.

65. During exam prep, a candidate is asked which of these is physically located inside an AWS Region rather than spread independently around the globe. Which option belongs inside a Region?
    • A Local Zone in a separate, unrelated city with no parent Region
    • An edge location that operates independently of any Region
    • An Availability Zone that is part of that Region
    • A separate AWS account billing boundary

    Correct answer: An Availability Zone that is part of that Region

    An Availability Zone is the element contained within a Region; each Region is made up of multiple Availability Zones in that geographic area. Edge locations are distributed globally and are not contained within a single Region the way AZs are, Local Zones extend a parent Region rather than standing alone, and a billing boundary is an account construct, not a physical infrastructure element.

66. A gaming company places its multiplayer servers in the Region geographically nearest to the majority of its players. Which benefit is the company most directly pursuing by selecting a nearby Region?
    • Eliminating the need for any load balancing
    • Free data transfer between all Regions
    • Reduced network latency for those players
    • Automatic compliance with every global regulation

    Correct answer: Reduced network latency for those players

    Reduced latency for players is the direct benefit of choosing a nearby Region, because shorter physical distance means faster round-trip network times. Region choice does not remove the need for load balancing, inter-Region data transfer is not free, and proximity alone does not guarantee compliance with every regulation.

67. A news website experiences sudden viral traffic from readers in many countries reading the same article. Why does serving that article through edge locations help the origin servers?
    • It moves the origin servers physically into each country automatically
    • It absorbs repeated requests by serving cached copies near readers, reducing hits on the origin
    • It encrypts the article so fewer readers can access it at once
    • It converts the article into a database table for faster queries

    Correct answer: It absorbs repeated requests by serving cached copies near readers, reducing hits on the origin

    Absorbing repeat requests near readers is the mechanism; edge locations cache copies of the content close to users so many requests are answered there instead of repeatedly reaching the origin, which lowers origin load and latency. Edge locations do not relocate origin servers, encryption does not reduce reader count, and caching does not turn content into a database table.

68. A solutions architect is mapping out where Amazon CloudFront actually delivers cached content to viewers. At which part of the AWS global infrastructure does CloudFront cache and serve that content to end users?
    • Inside a single Availability Zone chosen by the customer
    • Only within the customer's Amazon VPC subnets
    • At edge locations distributed around the world
    • On the customer's on-premises routers

    Correct answer: At edge locations distributed around the world

    Edge locations are where CloudFront caches and delivers content; this global network of points of presence places copies close to viewers for low-latency delivery. CloudFront is not confined to one Availability Zone, it does not serve from inside a customer's VPC subnets, and it does not run on the customer's on-premises hardware.

69. A team migrating a licensed commercial application to AWS must retain the ability to log into the operating system, install a vendor agent, and reboot the server on their own schedule. Which AWS compute service preserves this operating-system-level control?
    • AWS Lambda
    • Amazon S3
    • Amazon SQS
    • Amazon EC2

    Correct answer: Amazon EC2

    Amazon EC2 preserves operating-system control; it provides virtual servers where the customer manages the OS, installs software, and controls the instance lifecycle. AWS Lambda abstracts the server away entirely, Amazon S3 is object storage rather than compute, and Amazon SQS is a message queue.

70. An administrator launches an Amazon EC2 instance and is responsible for keeping the guest operating system patched, while AWS maintains the physical host. Within EC2, what is the customer running their applications on?
    • A serverless function with no underlying machine
    • A virtual server, called an instance, provisioned on AWS hardware
    • A managed database cluster
    • A content delivery edge cache

    Correct answer: A virtual server, called an instance, provisioned on AWS hardware

    A virtual server called an instance is what EC2 provides; the customer operates this virtual machine while AWS runs the underlying physical hardware. EC2 is not serverless, it is not a managed database, and it is not an edge cache.

71. A team needs EC2 instances optimized for relational databases and in-memory caches that demand large amounts of RAM per core. Which EC2 instance family is designed for these memory-hungry workloads?
    • General purpose instances
    • Memory optimized instances
    • Storage optimized instances
    • Compute optimized instances

    Correct answer: Memory optimized instances

    Memory optimized instances are designed for memory-hungry workloads; they deliver high RAM-to-vCPU ratios for databases and in-memory caches. General purpose instances balance resources, storage optimized instances target high disk throughput, and compute optimized instances favor high CPU performance.

72. Two teams need EC2 capacity: one runs a CPU-bound batch encoder, the other runs a large in-memory cache. Why does AWS offering distinct EC2 instance families matter for these two teams?
    • It forces both teams to use identical hardware for consistency
    • It lets each team match an instance family to its dominant resource need for better cost and performance
    • It removes the need to ever resize or change instances later
    • It guarantees both workloads cost exactly the same per hour

    Correct answer: It lets each team match an instance family to its dominant resource need for better cost and performance

    Matching a family to the dominant resource need is the point of distinct instance families; the CPU-bound team can pick a compute-optimized family while the cache team picks a memory-optimized one, improving both performance and cost efficiency. Families do not force identical hardware, they do not eliminate future resizing, and they do not equalize pricing.

73. A company hosts a static marketing website consisting of HTML, images, and downloadable PDFs that visitors retrieve directly over the internet. Which AWS service is the most appropriate, capacity-free place to store these objects?
    • Amazon EBS
    • Amazon S3
    • Amazon Redshift
    • Amazon RDS

    Correct answer: Amazon S3

    Amazon S3 is the appropriate store; it provides highly durable, internet-accessible object storage with no capacity to provision in advance, ideal for static web assets. Amazon EBS is block storage attached to a single instance, Amazon Redshift is a data warehouse, and Amazon RDS is a relational database.

74. An application writes user-uploaded files to Amazon S3 and the team is asked how durable that storage is for the standard storage class. Which statement best reflects a key characteristic of Amazon S3?
    • Objects are stored on a single disk in one Availability Zone by default
    • Stored objects are automatically deleted after 30 days unless renewed
    • S3 can only be accessed from inside a single EC2 instance
    • Objects are designed for very high durability by redundantly storing data across multiple facilities

    Correct answer: Objects are designed for very high durability by redundantly storing data across multiple facilities

    High durability through redundant storage across facilities is the key S3 characteristic; the standard class is engineered to protect data even if a facility fails. S3 standard is not single-disk or single-AZ, objects are not auto-deleted after 30 days, and S3 is reachable over the internet rather than from one instance only.

75. A company keeps active project files in Amazon S3 that are accessed often for a month, then accessed only a couple of times per year afterward, and it wants to pay less for the older files while keeping retrieval in milliseconds. Which storage class fits the aged files?
    • S3 Standard
    • S3 Standard-Infrequent Access
    • S3 Glacier Deep Archive
    • S3 One Zone with manual deletion

    Correct answer: S3 Standard-Infrequent Access

    S3 Standard-Infrequent Access fits the aged files; it lowers storage cost for data accessed infrequently while still offering rapid, millisecond retrieval. S3 Standard is priced for frequent access, Glacier Deep Archive imposes long retrieval times, and manually deleting data is not a storage class for infrequent access.

76. A compliance archive must be kept for ten years, is retrieved at most once or twice ever, and the team will accept retrieval times measured in hours in exchange for the lowest storage price. Which S3 storage class is the best match?
    • S3 Standard
    • S3 Intelligent-Tiering frequent tier
    • S3 Glacier Deep Archive
    • S3 Standard-Infrequent Access

    Correct answer: S3 Glacier Deep Archive

    S3 Glacier Deep Archive is the best match; it offers the lowest storage cost for rarely retrieved long-term archives where multi-hour retrieval is acceptable. S3 Standard and the Intelligent-Tiering frequent tier are priced for active access, and Standard-Infrequent Access costs more than Deep Archive for this almost-never-read case.

77. A single EC2 instance runs a transactional application that needs a low-latency disk volume it can format, mount, and use like a local hard drive that persists after the instance restarts. Which AWS service provides this?
    • Amazon S3
    • Amazon EBS
    • Amazon EFS
    • Amazon CloudFront

    Correct answer: Amazon EBS

    Amazon EBS provides this; it delivers persistent block-level volumes that attach to a single EC2 instance and behave like a formatted hard drive that survives instance restarts. Amazon S3 is object storage, Amazon EFS is a shared file system for many instances, and CloudFront is a content delivery network.

78. An administrator wants to create a point-in-time backup of an EC2 instance's attached volume and store it durably so the volume can be recreated later. Which capability of Amazon EBS supports this?
    • EBS snapshots stored in Amazon S3
    • Mounting the volume on many instances at once
    • Caching the volume at edge locations
    • Converting the volume into a DynamoDB table

    Correct answer: EBS snapshots stored in Amazon S3

    EBS snapshots are the supporting capability; they capture a point-in-time copy of a volume and store it durably in Amazon S3 so the volume can be restored or copied. A standard EBS volume attaches to one instance rather than many, EBS does not cache at edge locations, and volumes are not converted into DynamoDB tables.

79. A data-science cluster of EC2 instances must all mount the same growing file system and read and write the same files using standard file paths at the same time. Which AWS service is designed for this shared file access?
    • Amazon S3 Glacier
    • Amazon EBS
    • Amazon DynamoDB
    • Amazon EFS

    Correct answer: Amazon EFS

    Amazon EFS is designed for shared file access; it provides an elastic, POSIX-style file system that multiple EC2 instances can mount and use concurrently. EBS volumes attach to a single instance, S3 Glacier is archival object storage, and DynamoDB is a NoSQL database, none of which offer concurrent shared file mounts.

80. A web application backed by Amazon RDS must continue running if the entire data center hosting its primary database fails, switching to a standby copy automatically. Which RDS feature provides this resilience?
    • Multi-AZ deployment
    • Read replicas
    • Manual snapshots only
    • Edge caching

    Correct answer: Multi-AZ deployment

    A Multi-AZ deployment provides this resilience; RDS maintains a synchronous standby in a separate Availability Zone and fails over to it automatically if the primary's facility fails. Read replicas scale reads rather than provide automatic failover, manual snapshots are not automatic failover, and edge caching is unrelated to database resilience.

81. A team chooses Amazon RDS instead of installing a database on EC2 themselves, primarily to reduce operational work. Which set of routine tasks does RDS perform for them?
    • Writing the application's SQL queries and schema
    • Designing the company's network topology
    • Automated backups, software patching, and failover handling
    • Creating the front-end user interface

    Correct answer: Automated backups, software patching, and failover handling

    Automated backups, patching, and failover are the routine tasks RDS handles; it manages these undifferentiated database administration chores so the team focuses on data and applications. RDS does not author the application's SQL or schema, design the customer's broader network, or build the user interface.

82. A serverless shopping application must look up cart items by a unique key with single-digit-millisecond responses and scale to unpredictable spikes without the team managing servers or designing joins. Which AWS database fits best?
    • Amazon DynamoDB
    • Amazon RDS
    • Amazon Redshift
    • Amazon EC2 with self-managed MySQL

    Correct answer: Amazon DynamoDB

    Amazon DynamoDB fits best; it is a fully managed, serverless NoSQL database delivering consistent single-digit-millisecond key lookups at any scale without server management. Amazon RDS is relational and requires more capacity planning, Redshift is an analytics warehouse, and self-managed MySQL on EC2 burdens the team with operations.

83. During a review, a candidate must state how Amazon DynamoDB differs from Amazon RDS in data model. Which statement is correct?
    • DynamoDB requires you to define a rigid relational schema before storing data
    • DynamoDB is a managed Oracle engine, while RDS is NoSQL
    • Both services use identical SQL join capabilities as their primary interface
    • DynamoDB uses a flexible key-value and document model, while RDS uses fixed relational tables with SQL

    Correct answer: DynamoDB uses a flexible key-value and document model, while RDS uses fixed relational tables with SQL

    DynamoDB using a flexible key-value and document model while RDS uses relational tables is correct; this is the core data-model distinction. DynamoDB does not require a rigid relational schema, it is not a managed Oracle engine, and the two services do not share identical SQL join capabilities.

84. A finance department needs MySQL compatibility but wants an AWS-built relational engine offering higher performance and availability than standard MySQL on RDS. Which database engine option meets this?
    • Amazon DynamoDB
    • Amazon Aurora
    • Amazon Redshift
    • Amazon ElastiCache

    Correct answer: Amazon Aurora

    Amazon Aurora meets this; it is the AWS-built, MySQL- and PostgreSQL-compatible relational engine designed for higher performance and availability than the standard community engines. DynamoDB is NoSQL, Redshift is a data warehouse, and ElastiCache is an in-memory cache rather than a relational database.

85. A retailer wants to analyze several years of structured sales records with complex aggregations that scan billions of rows for executive reporting. Which AWS service is purpose-built as the columnar data warehouse for this?
    • Amazon DynamoDB
    • Amazon RDS
    • Amazon Redshift
    • Amazon S3 Glacier

    Correct answer: Amazon Redshift

    Amazon Redshift is purpose-built for this; it is a managed columnar data warehouse optimized for large-scale analytical queries and aggregations. DynamoDB targets key-based transactional access, RDS is tuned for transactional relational workloads, and S3 Glacier is archival storage, not an analytics engine.

86. An analytics lead must decide whether to keep day-to-day order transactions in Amazon RDS or copy them into Amazon Redshift. Which signal most strongly favors moving the data into Redshift?
    • The need to run large analytical queries scanning huge volumes for reporting
    • The need for many small, individual record inserts and updates per second
    • The desire for a flexible schema-less key-value store
    • The requirement to attach the database to a single EC2 instance as a disk

    Correct answer: The need to run large analytical queries scanning huge volumes for reporting

    Large analytical queries scanning huge volumes most strongly favor Redshift; its columnar warehouse design excels at reporting over big datasets. Frequent small inserts and updates suit a transactional store like RDS, a schema-less key-value need points to DynamoDB, and attaching storage to one instance describes EBS.

87. A startup needs a logically isolated network in AWS where it controls its own IP address ranges, subnets, and routing for its EC2 instances. Which AWS service provides this isolated virtual network?
    • Amazon Route 53
    • Amazon CloudFront
    • AWS Lambda
    • Amazon VPC

    Correct answer: Amazon VPC

    Amazon VPC provides the isolated virtual network; it lets customers define their own IP ranges, subnets, and route tables within a logically isolated section of the AWS Cloud. Route 53 is DNS, CloudFront is a CDN, and Lambda is serverless compute, none of which create a private network.

88. Inside an Amazon VPC, a team wants database servers in a network segment with no route to the internet and web servers in a segment that does have internet access. Which VPC construct lets them create these separate segments?
    • Edge locations
    • Read replicas
    • Storage classes
    • Subnets

    Correct answer: Subnets

    Subnets let them create these separate segments; a VPC is divided into subnets that can be configured as public or private depending on their routing. Edge locations are a CDN concept, read replicas relate to databases, and storage classes apply to S3, none of which segment a VPC.

89. An image-thumbnailing routine should run only when a photo is uploaded to a bucket, scale automatically with upload volume, and incur no charge while idle. Which AWS service is built for this event-driven, pay-per-execution model?
    • Amazon EC2
    • Amazon RDS
    • AWS Lambda
    • Amazon EBS

    Correct answer: AWS Lambda

    AWS Lambda is built for this; it runs code in response to events, scales automatically with demand, and charges only for the compute time consumed, with nothing billed while idle. EC2 bills for running instances regardless of activity, RDS is a database, and EBS is storage.

90. A Cloud Practitioner candidate is asked what AWS manages when an application runs on AWS Lambda. Which responsibility does AWS handle in the Lambda model?
    • Provisioning, patching, and scaling the underlying compute servers
    • Choosing the application's business logic for the developer
    • Writing the function's source code
    • Designing the company's data model

    Correct answer: Provisioning, patching, and scaling the underlying compute servers

    Provisioning, patching, and scaling the underlying servers is what AWS handles in Lambda; the developer supplies only the code and AWS runs it on managed infrastructure that scales automatically. AWS does not write the business logic, author the source code, or design the customer's data model.

91. A developer describes wanting to build an application from managed building blocks where no servers are ever provisioned and they pay only when code actually executes. Which term describes this category of AWS computing?
    • On-premises computing
    • Colocation hosting
    • Serverless computing
    • Dedicated bare-metal hosting

    Correct answer: Serverless computing

    Serverless computing describes this category; the cloud provider manages the underlying infrastructure and the customer pays only for actual execution, with no servers to provision. On-premises computing keeps hardware in the customer's facility, colocation rents data-center space, and dedicated bare-metal still requires managing physical or dedicated servers.

92. A video platform's origin servers are overloaded because viewers worldwide pull the same popular clips directly from them. Which AWS service reduces that origin load by caching and serving copies closer to viewers?
    • Amazon CloudFront
    • Amazon SQS
    • Amazon EBS
    • Amazon Athena

    Correct answer: Amazon CloudFront

    Amazon CloudFront reduces origin load; as a content delivery network it caches copies at edge locations near viewers, so most requests are answered there instead of repeatedly hitting the origin. Amazon SQS is a message queue, Amazon EBS is block storage, and Amazon Athena is a query service.

93. A company already stores its website assets in Amazon S3 and wants global users to download them faster while reducing direct requests to the bucket. Which service should it place in front of the bucket?
    • Amazon Route 53
    • Amazon RDS
    • AWS CloudFormation
    • Amazon CloudFront

    Correct answer: Amazon CloudFront

    Amazon CloudFront should sit in front of the bucket; it caches the S3 content at edge locations worldwide, accelerating downloads and offloading repeated requests from the origin bucket. Route 53 handles DNS, RDS is a database, and CloudFormation provisions infrastructure as code.

94. A company registers a new domain name and needs AWS to translate that name into the IP addresses of its application and route users based on health and geography. Which AWS service provides this DNS functionality?
    • Amazon CloudFront
    • Amazon VPC
    • Elastic Load Balancing
    • Amazon Route 53

    Correct answer: Amazon Route 53

    Amazon Route 53 provides this DNS functionality; it offers scalable domain name resolution plus routing policies based on factors like health checks and geography. CloudFront is a CDN, Amazon VPC is a private network, and Elastic Load Balancing distributes traffic across instances rather than resolving domain names.

95. An application must route incoming HTTP requests to different backend target groups based on the URL path, such as sending /images and /api to separate fleets. Which Elastic Load Balancing type is designed for this content-based routing?
    • Network Load Balancer
    • Application Load Balancer
    • Gateway endpoint
    • Direct Connect link

    Correct answer: Application Load Balancer

    An Application Load Balancer is designed for content-based routing; it operates at the HTTP layer and can direct requests to different target groups based on the request path or host. A Network Load Balancer routes at the connection level without path awareness, a gateway endpoint is a VPC connectivity feature, and Direct Connect is a private network link.

96. A web fleet behind an Elastic Load Balancer has one instance fail its health check. What does the load balancer do with traffic destined for that instance?
    • It stops sending new requests to the unhealthy instance and routes them to healthy ones
    • It shuts down the entire fleet until the instance recovers
    • It forwards the requests to the unhealthy instance anyway
    • It permanently deletes the unhealthy instance from AWS

    Correct answer: It stops sending new requests to the unhealthy instance and routes them to healthy ones

    Stopping traffic to the unhealthy instance and routing to healthy ones is what the load balancer does; health checks let it route requests only to instances that respond correctly. It does not shut down the whole fleet, keep sending traffic to a failed instance, or delete the instance from AWS.

97. A retailer's web tier must add EC2 instances automatically during a flash-sale spike and remove them when demand falls so it never pays for idle capacity. Which cloud benefit is Auto Scaling putting directly into practice?
    • Elasticity, matching capacity to actual demand
    • Fixed, long-term capacity reservation
    • Eliminating the need for any compute at all
    • Guaranteed lowest possible storage cost

    Correct answer: Elasticity, matching capacity to actual demand

    Elasticity is the benefit Auto Scaling puts into practice; it automatically adjusts capacity up and down so resources track real demand instead of being statically provisioned. It is the opposite of fixed reservation, it does not remove the need for compute, and it addresses capacity rather than storage cost.

98. A growing company manages dozens of separate AWS accounts for different teams and wants a single service to centrally govern them, apply policies across all of them, and combine their invoices into one payment. Which AWS service provides this capability?
    • AWS Organizations
    • AWS Control Tower
    • AWS Systems Manager
    • AWS Config

    Correct answer: AWS Organizations

    AWS Organizations is correct because it lets a business centrally create and manage multiple AWS accounts, attach service control policies across them, and group them into organizational units, all while consolidating their billing into a single payer account. The other choices do not provide multi-account central management with consolidated billing as their primary purpose.

99. After joining several member accounts under one management account in AWS Organizations, a company notices its combined usage now qualifies for larger volume discounts on services such as Amazon S3, and the Free Tier limits are shared across the accounts. Which billing feature produces these effects?
    • Cost allocation tags
    • Savings Plans
    • Reserved Instance sharing
    • Consolidated billing

    Correct answer: Consolidated billing

    Consolidated billing is correct because it aggregates the usage of all accounts in an organization so they are billed as one, allowing combined usage to reach tiered volume-discount thresholds sooner and sharing a single Free Tier across the accounts. Cost allocation tags only label spending for reporting, while Savings Plans and Reserved Instances are pricing commitments rather than the billing aggregation mechanism described.

100. A company needs to break down its monthly AWS bill by department and project to charge costs back internally, but the raw bill only shows totals per service. What should the company implement so that spending can be filtered and grouped by these business dimensions?
     • A separate AWS account for every project
     • An AWS Budgets alert for each team
     • AWS cost allocation tags
     • A higher AWS Support plan

     Correct answer: AWS cost allocation tags

     AWS cost allocation tags are correct because applying key-value tags such as department or project to resources, then activating them in the billing console, lets the company filter and group costs by those dimensions in cost reports and Cost Explorer. Creating many accounts is heavier than needed, Budgets only alerts on thresholds, and a higher Support plan does not categorize spend.

101. A business wants to compare the long-term cost of running an application in its own data center against running it on AWS, accounting for hardware, power, cooling, and staffing it would avoid by moving to the cloud. Which financial analysis concept best describes this comparison?
     • Total cost of ownership
     • Return on investment
     • Capital expenditure budgeting
     • Amortized cost reporting

     Correct answer: Total cost of ownership

     Total cost of ownership is correct because it captures the full direct and indirect costs of a solution, making it the proper basis for comparing on-premises expenses such as hardware, power, cooling, and staffing against the consumption-based cost of running on AWS. Return on investment measures gains relative to cost, while capital budgeting and amortized reporting describe narrower accounting activities rather than this whole-cost comparison.

102. Which statement best describes how AWS pricing fundamentally differs from a traditional on-premises model where companies buy servers years ahead of demand?
     • AWS requires a fixed multi-year hardware purchase before any usage
     • AWS shifts large upfront capital expense to variable operating expense paid only for what is used
     • AWS charges a flat monthly fee regardless of consumption
     • AWS bills only once per year based on peak capacity

     Correct answer: AWS shifts large upfront capital expense to variable operating expense paid only for what is used

     Shifting upfront capital expense to variable operating expense is correct because AWS lets customers trade buying and maintaining their own hardware for paying only for the resources they actually consume, converting a fixed capital outlay into a flexible operating cost that scales with demand. The remaining options describe rigid prepaid or flat-fee schemes that contradict AWS's consumption-based pricing.

103. A team plans to deploy a fleet of EC2 instances for a brand-new project and wants to estimate the monthly bill, including storage and data transfer, so management can approve the budget before launch. Besides modeling the architecture, which tool gives a shareable cost estimate they can save and revisit?
     • Amazon CloudWatch
     • AWS Cost and Usage Report
     • AWS CloudTrail
     • AWS Pricing Calculator

     Correct answer: AWS Pricing Calculator

     AWS Pricing Calculator is correct because it lets users configure proposed services and quantities to generate a forward-looking, shareable monthly cost estimate that can be saved and revised before any resources exist. CloudWatch monitors live metrics, the Cost and Usage Report details charges already incurred, and CloudTrail logs API activity, so none of them estimate the cost of an unbuilt project.

104. An organization wants to receive an email the moment its forecasted monthly Amazon EC2 spending is projected to exceed 5,000 dollars, so it can react before the bill arrives. Which AWS tool is designed to create that proactive, threshold-based alert?
     • AWS Budgets
     • AWS Cost Explorer
     • AWS Trusted Advisor
     • AWS Pricing Calculator

     Correct answer: AWS Budgets

     AWS Budgets is correct because it lets a customer define a custom cost or usage limit for a specific service and triggers notifications when actual or forecasted spending is projected to cross that limit. Cost Explorer visualizes historical spend without setting alerts, Trusted Advisor offers best-practice checks, and the Pricing Calculator only estimates costs for planning.

105. A financial analyst wants an interactive console view that charts the last six months of AWS spend, lets her group by linked account and service, and shows a forecast of next month's cost. Which native AWS tool best supports this exploration?
     • AWS Cost and Usage Report
     • AWS Artifact
     • AWS Cost Explorer
     • AWS Marketplace

     Correct answer: AWS Cost Explorer

     AWS Cost Explorer is correct because it offers an interactive interface with built-in graphs for visualizing and forecasting spending, with the ability to group and filter by account, service, and tag. The Cost and Usage Report delivers raw line-item data rather than interactive charts, Artifact supplies compliance documents, and Marketplace is a software catalog.

106. A data-science team runs large, fault-tolerant batch simulations that can be paused and resumed, and they want the deepest possible discount on EC2 compute while accepting that instances may be reclaimed when AWS needs the capacity. Which purchasing option fits best?
     • On-Demand Instances
     • Reserved Instances
     • Dedicated Hosts
     • Spot Instances

     Correct answer: Spot Instances

     Spot Instances are correct because they sell spare EC2 capacity at the steepest discounts in exchange for the possibility that AWS reclaims the instances with short notice, which suits interruptible, fault-tolerant batch work that can resume later. On-Demand and Reserved options avoid interruption but cost more for this use case, and Dedicated Hosts focus on physical isolation rather than cheap interruptible capacity.

107. A company commits to a consistent dollar-per-hour amount of compute usage for three years and wants the discount to apply automatically even if it later switches between EC2 instance families, Fargate, and Lambda. Which pricing model delivers this flexibility?
     • Standard Reserved Instances
     • Spot Instances
     • Compute Savings Plans
     • On-Demand Instances

     Correct answer: Compute Savings Plans

     Compute Savings Plans are correct because they grant lower prices in return for committing to a steady hourly spend over one or three years and automatically apply that discount across EC2 instance families and sizes, as well as Fargate and Lambda usage. Standard Reserved Instances are locked to narrower configurations, while Spot and On-Demand involve no such consistent commitment with this breadth of coverage.

108. A new account holder wants to know which support resources come included at no extra charge before deciding whether to upgrade. Which combination is provided by the AWS Basic Support plan?
     • 24/7 phone access to Cloud Support Engineers and full Trusted Advisor checks
     • A dedicated Technical Account Manager and architectural reviews
     • Documentation, whitepapers, support forums, and a core set of Trusted Advisor checks
     • Business-hours email support with general guidance from engineers

     Correct answer: Documentation, whitepapers, support forums, and a core set of Trusted Advisor checks

     Documentation, whitepapers, support forums, and a core set of Trusted Advisor checks is correct because the free Basic Support plan included with every account provides self-service resources and a limited set of Trusted Advisor checks but no case-based technical support. A Technical Account Manager, 24/7 engineer access with full Trusted Advisor, and email support from engineers are features of paid tiers.

109. An enterprise running mission-critical production workloads wants the highest level of AWS support, including a designated Technical Account Manager and a 15-minute response target for business-critical system-down cases. Which support plan should it select?
     • Developer Support
     • Enterprise Support
     • Business Support
     • Basic Support

     Correct answer: Enterprise Support

     Enterprise Support is correct because it is the top tier that assigns a designated Technical Account Manager and offers the fastest response objective for business-critical, system-down situations, suiting mission-critical production workloads. Developer and Business plans provide lower service levels without a dedicated Technical Account Manager, and Basic offers no technical support at all.

110. A solo developer is building and testing a non-production application on AWS and wants the cheapest paid plan that still gives access to technical support by email during business hours. Which AWS Support plan is the best fit?
     • Basic Support
     • Developer Support
     • Business Support
     • Enterprise Support

     Correct answer: Developer Support

     Developer Support is correct because it is the lowest-cost paid tier and provides access to AWS technical support through email during business hours, which matches a developer testing a non-production workload. Basic includes no technical support, while Business and Enterprise add 24/7 and higher-touch services at greater cost than this scenario requires.

111. A company wants automated recommendations that could reduce its bill, such as flagging idle EC2 instances and underutilized resources, alongside checks for security and service limits. Which AWS service is built to surface these cost-optimization recommendations?
     • AWS Trusted Advisor
     • AWS Cost Explorer
     • AWS Budgets
     • AWS Organizations

     Correct answer: AWS Trusted Advisor

     AWS Trusted Advisor is correct because it inspects an account against best practices and produces actionable recommendations across cost optimization, security, performance, fault tolerance, and service limits, including flagging idle or underused resources. Cost Explorer visualizes spend, Budgets only alerts on thresholds, and Organizations manages accounts rather than generating optimization recommendations.

112. A gaming studio needs single-digit-millisecond latency for players in a single large metro area and wants to run latency-sensitive compute physically close to those end users while staying connected to its main AWS Region. Which part of the AWS global infrastructure is purpose-built for this metro-proximity need?
     • An Amazon S3 bucket configured for transfer acceleration
     • An additional AWS Region on another continent
     • A second Availability Zone in a distant Region
     • An AWS Local Zone

     Correct answer: An AWS Local Zone

     An AWS Local Zone is the correct choice; Local Zones place compute, storage, and select services in large metropolitan areas close to end users so latency-sensitive applications run nearer to them while remaining tied to a parent Region. A distant Availability Zone or a faraway Region would add latency, and S3 Transfer Acceleration speeds uploads to S3 rather than running general compute near users.

113. A mobile carrier wants to deploy application compute inside its 5G network so that data from mobile devices does not have to travel to a Region, minimizing latency for connected-device apps. Which AWS infrastructure offering is designed specifically for embedding compute at the edge of 5G networks?
     • AWS Outposts in the carrier data center
     • Amazon CloudFront edge locations
     • AWS Wavelength
     • An AWS Local Zone

     Correct answer: AWS Wavelength

     AWS Wavelength is the answer; Wavelength embeds AWS compute and storage inside telecommunications providers' 5G networks so application traffic from mobile devices avoids the trip to a Region. CloudFront caches content, Outposts brings AWS hardware to a customer's own facility, and Local Zones serve metro areas but are not placed inside 5G networks.

114. A bank must keep certain workloads running on AWS-managed hardware physically inside its own on-premises data center to meet strict low-latency and data-residency requirements, while still using familiar AWS APIs. Which service delivers AWS infrastructure on the customer's premises?
     • AWS Wavelength
     • AWS Outposts
     • Amazon EC2 with a Dedicated Host in the cloud
     • An AWS Local Zone

     Correct answer: AWS Outposts

     AWS Outposts is correct; Outposts ships fully managed AWS racks that run AWS services in the customer's own data center, supporting on-premises latency and data-residency needs with consistent AWS APIs. Wavelength targets 5G networks, a cloud Dedicated Host still lives in an AWS Region, and Local Zones sit in metro areas rather than the customer's building.

115. An online retailer routes all global users to applications in two AWS Regions and wants traffic to enter the AWS backbone at the nearest edge and reach the healthiest endpoint over Amazon's private network, with static anchor IP addresses. Which service is designed to improve performance and availability for these non-HTTP and HTTP endpoints using the AWS global network?
     • An Application Load Balancer in one Region
     • Amazon Route 53 with simple routing
     • AWS Global Accelerator
     • Amazon CloudFront

     Correct answer: AWS Global Accelerator

     AWS Global Accelerator is the right service; it provides static anchor IP addresses and routes user traffic onto the AWS global network at the nearest edge, directing it to the optimal healthy regional endpoint. CloudFront caches content rather than accelerating arbitrary endpoints with fixed IPs, Route 53 resolves DNS but does not move traffic onto the AWS backbone, and a single load balancer covers only one Region.

116. A company needs a dedicated, private physical network connection between its on-premises data center and AWS to achieve consistent bandwidth and avoid sending sensitive traffic over the public internet. Which AWS service provides this private physical link?
     • An AWS Site-to-Site VPN over the internet
     • An internet gateway attached to the VPC
     • Amazon Route 53 Resolver
     • AWS Direct Connect

     Correct answer: AWS Direct Connect

     AWS Direct Connect is correct; it establishes a dedicated private physical connection from the customer's premises to AWS for consistent throughput and traffic that bypasses the public internet. A Site-to-Site VPN is encrypted but still rides the public internet, an internet gateway exposes a VPC to the internet, and Route 53 Resolver handles DNS.

117. Within an Amazon VPC, an administrator wants a stateful firewall that controls inbound and outbound traffic for individual EC2 instances and that, by default, allows return traffic for any allowed request automatically. Which VPC feature fits this description?
     • A route table
     • An internet gateway
     • A security group
     • A network access control list (network ACL)

     Correct answer: A security group

     A security group is the answer; security groups act as stateful virtual firewalls attached to instances, and because they are stateful, return traffic for an allowed request is permitted automatically. A network ACL is stateless and operates at the subnet level, a route table directs traffic paths, and an internet gateway provides internet connectivity rather than filtering.

118. Instances in a private subnet of an Amazon VPC need to download software updates from the internet but must not accept any unsolicited inbound connections from the internet. Which VPC component enables this outbound-only internet access for private instances?
     • An internet gateway attached directly to the private subnet
     • A NAT gateway
     • A security group rule allowing all inbound traffic
     • An Elastic IP address on each private instance

     Correct answer: A NAT gateway

     A NAT gateway is correct; it lets instances in a private subnet initiate outbound connections to the internet, for tasks like patching, while blocking inbound connections initiated from the internet. An internet gateway would make the subnet public, opening all inbound traffic defeats the security goal, and assigning Elastic IPs to private instances would make them publicly reachable.

119. A company storing media files in Amazon S3 sees slow uploads from users in distant countries because they transfer large files directly to the bucket's Region over the public internet. Which S3 capability speeds these long-distance uploads by routing them through nearby edge locations onto the AWS network?
     • Amazon S3 Glacier Deep Archive
     • Amazon S3 Transfer Acceleration
     • S3 Versioning
     • S3 Cross-Region Replication

     Correct answer: Amazon S3 Transfer Acceleration

     Amazon S3 Transfer Acceleration is the answer; it uses CloudFront edge locations to bring uploads onto the optimized AWS network path, speeding transfers from distant users to the bucket. Glacier Deep Archive is a low-cost archival storage class, Cross-Region Replication copies objects between buckets, and Versioning preserves object versions rather than accelerating transfers.

120. A read-heavy web application repeatedly queries the same database results, adding load and latency. The team wants a fully managed in-memory caching layer, compatible with Redis or Memcached, to serve those frequent reads in microseconds. Which AWS service provides this managed in-memory cache?
     • Amazon ElastiCache
     • Amazon Redshift
     • Amazon EBS Provisioned IOPS volumes
     • Amazon DynamoDB

     Correct answer: Amazon ElastiCache

     Amazon ElastiCache is correct; it is a fully managed in-memory caching service supporting Redis and Memcached engines, used to serve frequently requested data with microsecond latency and offload the database. DynamoDB is a NoSQL database, Redshift is a data warehouse, and EBS is block storage rather than an in-memory cache.

121. A company runs Docker containers on Amazon ECS and no longer wants to provision, patch, or scale any EC2 instances to host those containers, instead paying only for the compute its tasks consume. Which launch option lets ECS run containers without managing the underlying servers?
     • AWS Lambda layers
     • AWS Fargate
     • Amazon EC2 Spot Instances
     • Amazon Elastic Kubernetes Service (EKS)

     Correct answer: AWS Fargate

     AWS Fargate is the answer; it is the serverless compute engine that runs ECS (and EKS) containers without the customer provisioning or managing EC2 instances, charging for the resources tasks use. Spot Instances are still EC2 servers the team must manage, EKS is a different orchestration service, and Lambda layers package code dependencies for functions.

122. A development team wants to store, manage, and pull their private Docker container images from a fully managed AWS registry that integrates with ECS and EKS. Which AWS service provides this managed container image registry?
     • Amazon Elastic Container Service (ECS)
     • AWS CodeCommit
     • Amazon Elastic Container Registry (ECR)
     • Amazon Simple Storage Service (S3)

     Correct answer: Amazon Elastic Container Registry (ECR)

     Amazon Elastic Container Registry (ECR) is correct; it is the fully managed registry for storing, managing, and deploying container images that integrates with ECS and EKS. S3 stores general objects rather than serving as a container registry, CodeCommit is a managed source-code Git repository, and ECS orchestrates and runs containers rather than storing their images.

123. A team needs to coordinate a multi-step order-fulfillment process where each step depends on the previous one, with built-in error handling, retries, and a visual workflow. Which AWS service is designed to orchestrate such workflows as a series of steps?
     • AWS Step Functions
     • AWS CloudFormation
     • Amazon CloudWatch
     • Amazon Simple Queue Service (SQS)

     Correct answer: AWS Step Functions

     AWS Step Functions is the answer; it coordinates multi-step workflows as state machines with built-in sequencing, error handling, retries, and a visual representation. SQS is a message queue rather than a workflow orchestrator, CloudWatch monitors metrics and logs, and CloudFormation provisions infrastructure from templates.

124. An application must react to events from many AWS services and software-as-a-service partners by routing those events to different targets based on rules, acting as a central event bus. Which AWS service provides this serverless event-bus capability?
     • Amazon Simple Notification Service (SNS)
     • Amazon Kinesis Data Streams
     • Amazon EventBridge
     • AWS Lambda

     Correct answer: Amazon EventBridge

     Amazon EventBridge is correct; it is a serverless event bus that ingests events from AWS services and SaaS partners and routes them to targets according to rules. SNS is a pub/sub messaging service without the rich rule-based event-bus and partner-integration model, Lambda runs code in response to events, and Kinesis Data Streams handles high-volume streaming data ingestion.

125. A company must ingest and process millions of streaming clickstream and telemetry records per second in real time so analytics applications can consume the data as it arrives. Which AWS service is purpose-built for real-time streaming data ingestion at this scale?
     • Amazon Kinesis
     • Amazon S3 Glacier
     • Amazon Redshift
     • Amazon Athena

     Correct answer: Amazon Kinesis

     Amazon Kinesis is the answer; it is designed to collect, process, and analyze real-time streaming data such as clickstreams and telemetry at large scale so consumers can act on the data as it arrives. Athena queries data already stored in S3, Redshift is a batch-oriented data warehouse, and Glacier is archival storage.

126. A small business wants the simplest possible way to launch a website or basic application with a predictable low monthly price that bundles a virtual server, storage, and data transfer, without configuring individual AWS services. Which service is intended for this easy, bundled, low-cost path?
     • AWS Fargate
     • Amazon EC2 with On-Demand pricing
     • AWS Elastic Beanstalk
     • Amazon Lightsail

     Correct answer: Amazon Lightsail

     Amazon Lightsail is correct; it bundles a virtual server, storage, and data transfer into preconfigured plans with predictable low monthly pricing, aimed at simple websites and small applications. EC2 On-Demand requires assembling and managing components separately, Fargate runs containers, and Elastic Beanstalk deploys application code but is not the simple fixed-price bundle Lightsail offers.

127. A research team must run hundreds of thousands of short, independent batch computing jobs and wants AWS to dynamically provision the right amount and type of compute, queue the jobs, and scale the fleet automatically. Which fully managed service is built specifically for running batch workloads at scale?
     • AWS Batch
     • AWS Step Functions
     • AWS Lambda
     • Amazon EC2 Auto Scaling on its own

     Correct answer: AWS Batch

     AWS Batch is the answer; it is a fully managed service that plans, schedules, queues, and runs large numbers of batch computing jobs while provisioning and scaling the appropriate compute automatically. Lambda targets short event-driven functions rather than large batch fleets, EC2 Auto Scaling alone does not queue and schedule batch jobs, and Step Functions orchestrates workflow steps rather than managing a batch compute environment.

128. An administrator wants one centralized, fully managed service to automate and govern backups across many AWS services such as Amazon EBS, Amazon RDS, Amazon DynamoDB, and Amazon EFS using backup policies. Which AWS service provides this centralized backup management?
     • Amazon S3 Versioning
     • An EBS snapshot taken manually per volume
     • AWS CloudFormation
     • AWS Backup

     Correct answer: AWS Backup

     AWS Backup is correct; it centrally automates and governs backups across multiple AWS services, including EBS, RDS, DynamoDB, and EFS, through policy-based backup plans. S3 Versioning only protects objects within S3, manual per-volume EBS snapshots are not centralized cross-service governance, and CloudFormation provisions infrastructure rather than managing backups.