MC Core Services High

A company needs a tool that publishes messages and notifications to multiple subscribers. Which AWS service best fits? | A) Amazon Simple Queue Service (Amazon SQS) | B) Amazon API Gateway | C) Amazon EventBridge | D) Amazon Simple Notification Service (Amazon SNS)

D) Amazon Simple Notification Service (Amazon SNS). SNS delivers messages or notifications to subscribers; SQS stores messages for later processing.

A company needs a tool that decouples applications by storing messages in queues for asynchronous processing. Which AWS service best fits? | A) Amazon Simple Queue Service (Amazon SQS) | B) Amazon Kinesis Data Streams | C) Amazon Simple Notification Service (Amazon SNS) | D) Amazon EventBridge

A) Amazon Simple Queue Service (Amazon SQS). SQS decouples producers and consumers with durable message queues; SNS is publish/subscribe.

A company needs a tool that sets cost or usage budgets and sends threshold alerts. Which AWS service best fits? | A) AWS Budgets | B) AWS Cost Anomaly Detection | C) AWS Pricing Calculator | D) AWS Cost Explorer

A) AWS Budgets. Budgets tracks spending or usage against a defined threshold; Cost Explorer is for analysis.

A company needs a tool that visualizes and forecasts AWS costs and usage trends. Which AWS service best fits? | A) AWS Pricing Calculator | B) AWS Budgets | C) AWS Cost Anomaly Detection | D) AWS Cost Explorer

D) AWS Cost Explorer. Cost Explorer helps visualize and forecast spending; Budgets alerts on thresholds.

A company needs a tool that provides resizable virtual servers with configurable instance types. Which AWS service best fits? | A) Amazon EC2 | B) AWS Lambda | C) AWS Fargate | D) AWS Elastic Beanstalk

A) Amazon EC2. EC2 provides virtual machine instances; Lambda runs functions without managing servers.

A company needs a tool that orchestrates and runs containers with AWS-native tooling. Which AWS service best fits? | A) Amazon Elastic Container Service (Amazon ECS) | B) Amazon EKS | C) Amazon EC2 | D) AWS Fargate

A) Amazon Elastic Container Service (Amazon ECS). ECS orchestrates containers; Fargate provides serverless compute capacity for containers.

A company needs a tool that provides guidance, case-based assistance, and support plans for AWS customers. Which AWS service best fits? | A) AWS Well-Architected Tool | B) AWS Trusted Advisor | C) AWS Artifact | D) AWS Support

D) AWS Support. AWS Support provides support plans and case-based help, rather than architecture-audit tooling.

A company needs a tool that aWS-built relational database compatible with MySQL and PostgreSQL. Which AWS service best fits? | A) Amazon Redshift | B) Amazon RDS | C) Amazon Aurora | D) Amazon DynamoDB

C) Amazon Aurora. Aurora is an AWS-designed relational database compatible with MySQL and PostgreSQL.

A company needs a tool that fully managed serverless NoSQL key-value/document database. Which AWS service best fits? | A) Amazon DynamoDB | B) Amazon RDS | C) Amazon Aurora | D) Amazon ElastiCache

A) Amazon DynamoDB. DynamoDB is a fully managed NoSQL key-value/document database, not a relational database.

A company needs a tool that managed relational database service for several database engines. Which AWS service best fits? | A) Amazon DynamoDB | B) Amazon Aurora | C) Amazon RDS | D) Amazon Redshift

C) Amazon RDS. RDS manages relational database engines; Aurora is one engine family available through RDS.

A company needs a tool that command-line interface for interacting with AWS services. Which AWS service best fits? | A) AWS CLI | B) AWS Management Console | C) AWS SDKs | D) AWS CloudShell

A) AWS CLI. AWS CLI runs commands to operate AWS services; the Management Console is web-based.

A company needs a tool that adjusts provisioned capacity in response to demand or schedules. Which AWS service best fits? | A) Elastic Load Balancing | B) AWS CloudFormation | C) AWS Compute Optimizer | D) AWS Auto Scaling

D) AWS Auto Scaling. Auto Scaling changes capacity as demand changes; Compute Optimizer makes rightsizing recommendations.

A company needs a tool that provisions and manages AWS infrastructure using templates (IaC). Which AWS service best fits? | A) AWS CloudFormation | B) AWS Service Catalog | C) AWS Config | D) AWS Systems Manager

A) AWS CloudFormation. CloudFormation deploys infrastructure from templates (infrastructure as code).

A company needs a tool that records AWS account/API events for audit investigations. Which AWS service best fits? | A) Amazon GuardDuty | B) AWS Config | C) AWS CloudTrail | D) Amazon CloudWatch

C) AWS CloudTrail. CloudTrail records AWS API and account activity; CloudWatch monitors metrics and alarms.

A company needs a tool that collects metrics, logs, and alarms for operational monitoring. Which AWS service best fits? | A) AWS CloudTrail | B) AWS Trusted Advisor | C) Amazon CloudWatch | D) AWS Config

C) Amazon CloudWatch. CloudWatch gathers metrics/logs and provides alarms; CloudTrail records API activity.

A company needs a tool that analyzes resource metrics and recommends right-sized configurations. Which AWS service best fits? | A) AWS Auto Scaling | B) AWS Trusted Advisor | C) AWS Compute Optimizer | D) AWS Cost Explorer

C) AWS Compute Optimizer. Compute Optimizer analyzes utilization to recommend better resource sizes, not just more instances.

A company needs a tool that records resource configurations and evaluates compliance rules. Which AWS service best fits? | A) AWS Identity and Access Management (IAM) | B) AWS Artifact | C) AWS CloudTrail | D) AWS Config

D) AWS Config. AWS Config tracks configurations and compliance against rules; CloudTrail records API actions.

A company needs a tool that web interface for managing AWS resources and services. Which AWS service best fits? | A) AWS Management Console | B) AWS CLI | C) AWS CloudFormation | D) AWS CloudShell

A) AWS Management Console. The Management Console is the browser interface; AWS CLI uses commands.

A company needs a tool that centrally manages accounts, policies, and consolidated billing. Which AWS service best fits? | A) AWS IAM Identity Center | B) AWS Organizations | C) AWS Identity and Access Management (IAM) | D) AWS Control Tower

B) AWS Organizations. Organizations centralizes multiple accounts and consolidated billing.

A company needs a tool that provides checks and guidance across cost, security, and service best practices. Which AWS service best fits? | A) AWS Compute Optimizer | B) AWS Config | C) AWS Trusted Advisor | D) AWS Well-Architected Tool

C) AWS Trusted Advisor. Trusted Advisor gives recommendations on AWS best practices across several check categories.

A company needs a tool that helps assess workloads against AWS Well-Architected best practices. Which AWS service best fits? | A) AWS CloudFormation | B) AWS Trusted Advisor | C) AWS Well-Architected Tool | D) AWS Config

C) AWS Well-Architected Tool. The Well-Architected Tool evaluates workloads against Well-Architected Framework guidance.

A company needs a tool that migrates or replicates databases with minimal downtime. Which AWS service best fits? | A) AWS DataSync | B) AWS Database Migration Service (AWS DMS) | C) AWS Application Migration Service | D) AWS Transfer Family

B) AWS Database Migration Service (AWS DMS). DMS helps migrate and replicate databases, often minimizing application downtime.

A company needs a tool that creates and manages APIs for backend services and Lambda functions. Which AWS service best fits? | A) Amazon EventBridge | B) Amazon Route 53 | C) Amazon API Gateway | D) Amazon CloudFront

C) Amazon API Gateway. API Gateway publishes, manages, and secures APIs; CloudFront distributes content.

A company needs a tool that content delivery network that caches content near users. Which AWS service best fits? | A) AWS Global Accelerator | B) Amazon CloudFront | C) Amazon S3 Transfer Acceleration | D) Amazon Route 53

B) Amazon CloudFront. CloudFront is a CDN, caching content nearer end users; Route 53 is DNS.

A company needs a tool that provides dedicated private connectivity from on-premises networks to AWS. Which AWS service best fits? | A) AWS Site-to-Site VPN | B) AWS Direct Connect | C) AWS Transit Gateway | D) AWS PrivateLink

B) AWS Direct Connect. Direct Connect is dedicated private network connectivity; a VPN uses encrypted internet tunnels.

A company needs a tool that dNS service for domain routing, health checks, and traffic policies. Which AWS service best fits? | A) Amazon Route 53 | B) AWS Global Accelerator | C) Amazon CloudFront | D) Amazon API Gateway

A) Amazon Route 53. Route 53 provides DNS and routing; CloudFront caches and delivers content.

A company needs a tool that provides an isolated virtual network with subnets and routing in AWS. Which AWS service best fits? | A) Amazon Route 53 | B) AWS Direct Connect | C) AWS Site-to-Site VPN | D) Amazon VPC

D) Amazon VPC. A VPC is your logically isolated AWS network, including subnets and routes.

A company needs a tool that creates encrypted tunnels between on-premises networks and AWS over the internet. Which AWS service best fits? | A) AWS Site-to-Site VPN | B) AWS Direct Connect | C) AWS PrivateLink | D) AWS Client VPN

A) AWS Site-to-Site VPN. Site-to-Site VPN links on-premises networks to AWS using encrypted tunnels over the internet.

A company needs a tool that provides on-demand AWS compliance reports and agreements. Which AWS service best fits? | A) AWS Artifact | B) AWS Trusted Advisor | C) AWS Config | D) AWS Audit Manager

A) AWS Artifact. Artifact provides access to AWS compliance reports and agreements.

A company needs a tool that detects suspicious activity and threats in AWS accounts and workloads. Which AWS service best fits? | A) AWS Security Hub | B) Amazon GuardDuty | C) Amazon Macie | D) Amazon Inspector

B) Amazon GuardDuty. GuardDuty detects threats and suspicious activity; Inspector assesses software vulnerabilities.

A company needs a tool that controls access to AWS resources using identities, roles, and policies. Which AWS service best fits? | A) AWS Key Management Service (AWS KMS) | B) AWS IAM Identity Center | C) AWS Organizations | D) AWS Identity and Access Management (IAM)

D) AWS Identity and Access Management (IAM). IAM controls AWS permissions using users, roles, and policies; Identity Center manages workforce SSO.

A company needs a tool that centrally provides single sign-on access to AWS accounts and applications. Which AWS service best fits? | A) AWS Organizations | B) AWS Identity and Access Management (IAM) | C) Amazon Cognito | D) AWS IAM Identity Center

D) AWS IAM Identity Center. IAM Identity Center centralizes access/sign-in across accounts and applications.

A company needs a tool that creates and controls encryption keys used across AWS services. Which AWS service best fits? | A) AWS Key Management Service (AWS KMS) | B) AWS Secrets Manager | C) AWS CloudHSM | D) Amazon Macie

A) AWS Key Management Service (AWS KMS). KMS creates and controls encryption keys; Secrets Manager manages credentials/secrets.

A company needs a tool that stores, retrieves, and rotates application secrets and credentials. Which AWS service best fits? | A) AWS Secrets Manager | B) AWS Key Management Service (AWS KMS) | C) AWS Systems Manager Parameter Store | D) AWS Identity and Access Management (IAM)

A) AWS Secrets Manager. Secrets Manager stores and can rotate credentials and other application secrets.

A company needs a tool that protects applications against distributed denial-of-service attacks. Which AWS service best fits? | A) AWS WAF | B) Amazon GuardDuty | C) AWS Shield | D) AWS Firewall Manager

C) AWS Shield. Shield protects against DDoS; WAF filters malicious web requests.

A company needs a tool that filters malicious HTTP(S) requests to protect web applications. Which AWS service best fits? | A) AWS WAF | B) Amazon GuardDuty | C) AWS Network Firewall | D) AWS Shield

A) AWS WAF. WAF filters HTTP(S) requests to web applications; Shield is for DDoS.

A company needs a tool that runs containers without managing the underlying EC2 servers. Which AWS service best fits? | A) AWS Fargate | B) Amazon EKS | C) AWS Lambda | D) Amazon Elastic Container Service (Amazon ECS)

A) AWS Fargate. Fargate provides serverless compute for containers; ECS and EKS orchestrate them.

A company needs a tool that runs code in response to events without provisioning servers. Which AWS service best fits? | A) AWS Fargate | B) AWS Lambda | C) Amazon EC2 | D) AWS Elastic Beanstalk

B) AWS Lambda. Lambda runs event-triggered code without server provisioning.

A company needs a tool that provides block storage volumes for Amazon EC2. Which AWS service best fits? | A) Amazon Elastic File System (Amazon EFS) | B) Amazon FSx | C) Amazon Elastic Block Store (Amazon EBS) | D) Amazon S3

C) Amazon Elastic Block Store (Amazon EBS). EBS supplies block volumes to EC2; EFS offers managed shared files.

A company needs a tool that managed shared file storage used by Linux-based workloads. Which AWS service best fits? | A) Amazon S3 | B) Amazon Elastic Block Store (Amazon EBS) | C) Amazon Elastic File System (Amazon EFS) | D) Amazon FSx

C) Amazon Elastic File System (Amazon EFS). EFS provides managed shared file storage; EBS is block storage for EC2.

A company needs a tool that scalable object storage for files, backups, static assets, and data lakes. Which AWS service best fits? | A) Amazon Elastic File System (Amazon EFS) | B) Amazon S3 | C) Amazon S3 Glacier | D) Amazon Elastic Block Store (Amazon EBS)

B) Amazon S3. S3 provides object storage; EBS provides block storage and EFS file storage.

A company needs a tool that low-cost S3 archival storage classes with retrieval trade-offs. Which AWS service best fits? | A) Amazon S3 Standard | B) Amazon Elastic File System (Amazon EFS) | C) Amazon Elastic Block Store (Amazon EBS) | D) Amazon S3 Glacier

D) Amazon S3 Glacier. S3 Glacier storage classes are for archival with cost/retrieval tradeoffs.

Which list describes common cloud computing benefits? | A) Agility, elasticity, global reach, and usage-based spending | B) No responsibility for data security or identity permissions | C) Guaranteed zero downtime and fixed monthly infrastructure costs | D) Fixed capacity, slow provisioning, and larger upfront purchases

A) Agility, elasticity, global reach, and usage-based spending. Cloud benefits include agility, elasticity/scalability, global reach, high availability options, and replacing many fixed upfront costs with variable usage-based costs.

Which set lists all SIX AWS Well-Architected Framework pillars? | A) Operational Excellence; Compliance; Reliability; Performance Efficiency; Cost Optimization; Sustainability | B) Operational Excellence; Security; Reliability; Performance Efficiency; Availability; Sustainability | C) Operational Excellence; Security; Scalability; Performance Efficiency; Cost Optimization; Sustainability | D) Operational Excellence; Security; Reliability; Performance Efficiency; Cost Optimization; Sustainability

D) Operational Excellence; Security; Reliability; Performance Efficiency; Cost Optimization; Sustainability. The six pillars are Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

Which Well-Architected pillar includes performing operations as code and making frequent, small, reversible changes? | A) Security | B) Performance Efficiency | C) Operational Excellence | D) Reliability

C) Operational Excellence. Operational Excellence emphasizes effective operations, frequent small reversible changes, and continuous improvement.

A team repeatedly tests recovery from outages to keep applications available. Which pillar is most directly addressed? | A) Reliability | B) Cost Optimization | C) Sustainability | D) Operational Excellence

A) Reliability. Reliability focuses on correct, continuous operation, recovery, and resilience, including testing recovery procedures.

Which objective best captures the Cost Optimization pillar? | A) Encrypt data at rest and in transit using approved mechanisms | B) Track deployment runbooks and improve incident procedures | C) Deliver business value while avoiding unnecessary costs through measurement and right resource selection | D) Automatically recover a workload after component failure

C) Deliver business value while avoiding unnecessary costs through measurement and right resource selection. Cost Optimization emphasizes cost awareness, efficient resource selection, measuring consumption, and removing waste.

Which is a GENERAL AWS Well-Architected design principle rather than a pillar-specific principle? | A) Test recovery procedures | B) Test systems at production scale | C) Protect data in transit | D) Perform operations as code

B) Test systems at production scale. General principles include test at production scale, stop guessing capacity, drive architectures using data, automate experimentation, allow evolution, and improve through game days.

An EC2 instance uses only a small fraction of its allocated resources. What does rightsizing mean? | A) Buy a reserved price discount without changing the instance | B) Place a load balancer in front of the same instance size | C) Select resource configurations that better match actual workload needs | D) Run identical instances in additional Availability Zones

C) Select resource configurations that better match actual workload needs. Rightsizing adjusts resource capacity/types to suit actual usage and performance needs; changing only purchasing terms does not rightsize.

Which statement correctly describes the AWS shared responsibility model? | A) AWS is responsible for every security setting after a customer enables an AWS service | B) Customers secure the physical AWS data centers while AWS configures workload permissions | C) AWS secures the underlying cloud infrastructure; customers secure their data, identities, and configurations as applicable | D) AWS secures customer IAM policies and application data for every service

C) AWS secures the underlying cloud infrastructure; customers secure their data, identities, and configurations as applicable. AWS is responsible for security OF the cloud; customers remain responsible for security IN the cloud to varying degrees depending on the service.

Which statement correctly distinguishes IAM users, roles, and policies? | A) A user controls network subnets; a role stores secrets; a policy manages payment methods | B) A role is a long-term password; a user is a JSON permissions document; a policy is an identity | C) A policy is a temporary identity; a role is a security group; a user is an encryption key | D) A user is an identity; a role is an assumable identity; a policy specifies permissions

D) A user is an identity; a role is an assumable identity; a policy specifies permissions. IAM users and roles are identities; a role can be assumed, while JSON policies define allowed or denied actions.

An application needs to store database credentials securely and rotate them. Which AWS service fits best? | A) AWS Secrets Manager | B) AWS Key Management Service (AWS KMS) | C) AWS Certificate Manager | D) Amazon CloudWatch

A) AWS Secrets Manager. Secrets Manager stores and rotates application secrets. KMS manages encryption keys; TLS protects data in transit and encryption at rest protects stored data.

Which mapping of three monitoring and audit services is correct? | A) CloudTrail: API activity; CloudWatch: metrics/alarms; Config: configurations/compliance | B) CloudTrail: configurations; CloudWatch: API activity; Config: metrics/alarms | C) CloudTrail: metrics/alarms; CloudWatch: configurations; Config: API activity | D) CloudTrail: IAM logins only; CloudWatch: billing forecasts; Config: object storage

A) CloudTrail: API activity; CloudWatch: metrics/alarms; Config: configurations/compliance. CloudTrail records AWS API/account events; CloudWatch monitors metrics/logs/alarms; Config records resource configurations and evaluates rules.

Which AWS security-service mapping is accurate? | A) GuardDuty: vulnerabilities; Inspector: threats; Macie: sensitive S3 data; Artifact: compliance documents | B) GuardDuty: threats; Inspector: vulnerabilities; Macie: compliance documents; Artifact: sensitive S3 data | C) GuardDuty: threats; Inspector: sensitive S3 data; Macie: vulnerabilities; Artifact: compliance documents | D) GuardDuty: threats; Inspector: vulnerabilities; Macie: sensitive S3 data; Artifact: compliance documents

D) GuardDuty: threats; Inspector: vulnerabilities; Macie: sensitive S3 data; Artifact: compliance documents. GuardDuty detects threats; Inspector assesses supported workloads for vulnerabilities; Macie finds sensitive S3 data; Artifact offers compliance documents.

Which statement correctly compares security groups with network ACLs? | A) Both are stateful, and both only support allow rules | B) Both apply only to buckets and are stateless | C) Security groups are stateful at network interfaces; NACLs are stateless at subnets | D) Security groups are stateless at subnets; NACLs are stateful at instances

C) Security groups are stateful at network interfaces; NACLs are stateless at subnets. Security groups are stateful with allow rules at network interfaces; NACLs are stateless with allow/deny rules at subnet boundaries.

Which mapping of AWS infrastructure components is correct? | A) Region: individual physical server; Availability Zone: continent; edge location: virtual private cloud | B) Region: geographic area; Availability Zone: isolated grouping in a Region; edge location: near users | C) Region: subnet; Availability Zone: IAM boundary; edge location: customer data center | D) Region: CDN cache only; Availability Zone: support plan; edge location: database replica

B) Region: geographic area; Availability Zone: isolated grouping in a Region; edge location: near users. Regions are geographic areas, AZs are isolated groupings of data centers in a Region, and edge locations bring certain services closer to users.

Which statement correctly distinguishes ECS, EKS, and Fargate? | A) ECS orchestrates containers; EKS manages Kubernetes; Fargate supplies serverless container compute | B) ECS manages Kubernetes; EKS is AWS-native container orchestration; Fargate offers serverless compute | C) ECS is serverless container compute; EKS provides ECS orchestration; Fargate manages Kubernetes clusters | D) ECS is AWS-native container orchestration; EKS supplies serverless compute; Fargate manages Kubernetes

A) ECS orchestrates containers; EKS manages Kubernetes; Fargate supplies serverless container compute. ECS is AWS-native container orchestration; EKS is managed Kubernetes; Fargate is serverless compute for containers. EC2 provides virtual servers and Lambda event-driven functions.

A team needs object storage, EC2 block volumes, and shared Linux file storage. Which mapping is right? | A) S3: shared file storage; EBS: objects; EFS: block volumes | B) S3: objects; EBS: block volumes; EFS: shared file storage | C) S3: block volumes; EBS: shared file storage; EFS: objects | D) S3: archival tape library; EBS: CDN caching; EFS: data warehouse

B) S3: objects; EBS: block volumes; EFS: shared file storage. S3 is object storage, EBS is block storage for EC2, and EFS is managed shared file storage; Glacier is a family of S3 archival classes.

Which mapping of AWS database services is accurate? | A) RDS/Aurora: relational; DynamoDB: NoSQL; ElastiCache: in-memory caching | B) RDS/Aurora: in-memory caching; DynamoDB: relational; ElastiCache: NoSQL document storage | C) RDS/Aurora: NoSQL; DynamoDB: relational; ElastiCache: archive storage | D) RDS/Aurora: analytics dashboard; DynamoDB: object storage; ElastiCache: managed DNS

A) RDS/Aurora: relational; DynamoDB: NoSQL; ElastiCache: in-memory caching. RDS and Aurora serve relational SQL workloads; DynamoDB is NoSQL key-value/document; ElastiCache speeds access with in-memory caching.

A company compares Site-to-Site VPN and Direct Connect. Which statement is correct? | A) Both are DNS services for routing users to applications | B) VPN uses encrypted internet tunnels; Direct Connect uses dedicated private connectivity | C) Both are used exclusively to connect S3 buckets | D) VPN requires a dedicated private circuit; Direct Connect always uses an internet tunnel

B) VPN uses encrypted internet tunnels; Direct Connect uses dedicated private connectivity. Site-to-Site VPN commonly connects more quickly over the internet; Direct Connect requires dedicated private network provisioning.

Which mapping correctly matches AWS networking services to their roles? | A) Route 53: APIs; CloudFront: CDN; API Gateway: global application networking; Global Accelerator: DNS | B) Route 53: DNS; CloudFront: CDN; API Gateway: APIs; Global Accelerator: global application networking | C) Route 53: DNS; CloudFront: global application networking; API Gateway: CDN; Global Accelerator: APIs | D) Route 53: CDN; CloudFront: DNS; API Gateway: APIs; Global Accelerator: global application networking

B) Route 53: DNS; CloudFront: CDN; API Gateway: APIs; Global Accelerator: global application networking. Route 53 handles DNS; CloudFront distributes/caches content; API Gateway manages APIs; Global Accelerator improves global application traffic performance.

Which mapping of application integration services is correct? | A) SNS: event routing; SQS: queues; EventBridge: publish/subscribe | B) SNS: publish/subscribe; SQS: queues; EventBridge: event routing | C) SNS: queues; SQS: publish/subscribe; EventBridge: event routing | D) SNS: publish/subscribe; SQS: event routing; EventBridge: queues

B) SNS: publish/subscribe; SQS: queues; EventBridge: event routing. SNS fans out messages, SQS holds messages for asynchronous consumers, and EventBridge routes events based on rules.

Which statement correctly distinguishes AWS Compute Optimizer from Auto Scaling? | A) Both manage DNS records but use different routing policies | B) Compute Optimizer increases instance counts; Auto Scaling analyzes instance type recommendations | C) Both are AWS pricing discount programs | D) Compute Optimizer recommends suitable resource sizes; Auto Scaling changes capacity as demand changes

D) Compute Optimizer recommends suitable resource sizes; Auto Scaling changes capacity as demand changes. Compute Optimizer suggests rightsizing based on utilization; Auto Scaling adjusts provisioned capacity in response to changing workload demands.

A company compares On-Demand, Savings Plans, and Spot. Which statement is accurate? | A) On-Demand requires capacity reservations; Savings Plans only cover S3; Spot bills by annual contract | B) On-Demand is always the cheapest; Savings Plans reserve a subnet; Spot is a compliance tool | C) On-Demand requires three years; Savings Plans are free; Spot guarantees uninterrupted EC2 capacity | D) On-Demand has no long-term commitment; Savings Plans use 1- or 3-year commitments; Spot can be interrupted

D) On-Demand has no long-term commitment; Savings Plans use 1- or 3-year commitments; Spot can be interrupted. On-Demand is flexible pay-as-you-go; Savings Plans discount eligible usage for a commitment; Spot uses spare EC2 capacity that can be interrupted.

Which AWS financial-tool mapping is correct? | A) Budgets: unusual spend; Cost Explorer: trends; Pricing Calculator: estimates; Cost Anomaly Detection: threshold alerts | B) Budgets: estimates; Cost Explorer: threshold alerts; Pricing Calculator: unusual spend; Cost Anomaly Detection: trends | C) Budgets: threshold alerts; Cost Explorer: estimates; Pricing Calculator: trends; Cost Anomaly Detection: unusual spend | D) Budgets: threshold alerts; Cost Explorer: trends; Pricing Calculator: estimates; Cost Anomaly Detection: unusual spend

D) Budgets: threshold alerts; Cost Explorer: trends; Pricing Calculator: estimates; Cost Anomaly Detection: unusual spend. Budgets provides threshold alerts; Cost Explorer analyzes trends; Pricing Calculator estimates future architectures; Cost Anomaly Detection flags unusual spend.

An application has overprovisioned EC2 instances. Which AWS service recommends better instance sizes based on their utilization? | A) AWS Compute Optimizer | B) AWS Auto Scaling | C) AWS Cost Explorer | D) AWS CloudFormation

A) AWS Compute Optimizer. Compute Optimizer recommends rightsizing. Auto Scaling adjusts capacity, and Cost Explorer analyzes spend.

Website traffic fluctuates throughout the day. Which capability automatically adds or removes EC2 instances? | A) AWS CloudTrail | B) AWS Trusted Advisor | C) AWS Auto Scaling | D) AWS Compute Optimizer

C) AWS Auto Scaling. Auto Scaling changes provisioned capacity with demand, unlike the recommendations made by Compute Optimizer.

An auditor needs to know who called an AWS API to modify an account resource. Which service should they consult? | A) Amazon CloudWatch | B) Amazon GuardDuty | C) AWS CloudTrail | D) AWS Config

C) AWS CloudTrail. CloudTrail records API/account events; CloudWatch monitors metrics and alarms; Config tracks resource settings.

An operations team wants an alarm when an EC2 CPU metric exceeds a threshold. Which service should it use? | A) AWS Config | B) AWS CloudTrail | C) Amazon CloudWatch | D) AWS Artifact

C) Amazon CloudWatch. CloudWatch provides metrics and alarms; CloudTrail records account/API events for auditing.

A company needs a rapidly deployable encrypted connection from its office network to a VPC over the internet. What should it use? | A) AWS Site-to-Site VPN | B) AWS Global Accelerator | C) AWS PrivateLink | D) AWS Direct Connect

A) AWS Site-to-Site VPN. Site-to-Site VPN uses encrypted internet tunnels; Direct Connect provisions dedicated private connections.

A data center needs dedicated, private connectivity to AWS rather than an internet-based VPN. Which service fits? | A) AWS Site-to-Site VPN | B) AWS Direct Connect | C) Amazon CloudFront | D) AWS Client VPN

B) AWS Direct Connect. Direct Connect provides dedicated private network connectivity, while Site-to-Site VPN uses internet tunnels.

An EC2 instance should accept inbound traffic only on a specified port from an approved source. Which control is appropriate? | A) Security group | B) AWS WAF | C) AWS Shield | D) Network ACL

A) Security group. Security groups apply stateful allow rules at network interfaces. NACLs apply stateless rules at subnet boundaries.

An administrator must create allow AND deny rules at the VPC subnet boundary. Which control should be used? | A) Security group | B) AWS Shield | C) Network ACL | D) AWS IAM policy

C) Network ACL. NACLs operate at subnet boundaries and support allow and deny rules. Security groups use allow rules at interfaces.

A business can commit to a fixed amount of eligible AWS compute usage for one or three years. Which offering discounts that usage? | A) Spot Instances | B) Savings Plans | C) AWS Free Tier | D) On-Demand pricing

B) Savings Plans. Savings Plans exchange a 1- or 3-year usage-spend commitment for lower rates on eligible compute usage.

A public web application needs to filter malicious HTTP requests based on rules. Which service fits best? | A) AWS Shield | B) Amazon GuardDuty | C) AWS WAF | D) AWS Secrets Manager

C) AWS WAF. AWS WAF inspects and filters web requests; Shield addresses DDoS protection and GuardDuty detects threats.

Which description correctly contrasts Amazon SNS and Amazon SQS? | A) SNS holds messages for workers; SQS routes event patterns to targets | B) SNS filters events using rules; SQS pushes notifications to subscribers | C) SNS stores messages in a queue; SQS delivers messages to multiple subscribers | D) SNS publishes to subscribers; SQS queues messages for later processing

D) SNS publishes to subscribers; SQS queues messages for later processing. SNS is publish/subscribe fan-out; SQS is queued asynchronous messaging.

Which description correctly contrasts CloudWatch and CloudTrail? | A) CloudWatch collects metrics and alarms; CloudTrail evaluates compliance rules | B) CloudWatch monitors metrics/logs and alarms; CloudTrail records AWS API activity | C) CloudWatch records resource configuration changes; CloudTrail manages metrics and alarms | D) CloudWatch analyzes spending forecasts; CloudTrail tracks resource compliance status

B) CloudWatch monitors metrics/logs and alarms; CloudTrail records AWS API activity. CloudWatch is for monitoring and alerting; CloudTrail is for API/account activity audit trails.

Which statement accurately compares Amazon S3, EBS, and EFS? | A) S3 stores objects; EBS provides shared files; EFS provides EC2 block volumes | B) S3 provides shared file storage; EBS stores objects; EFS provides EC2 block volumes | C) S3 stores objects; EBS provides EC2 block storage; EFS provides shared file storage | D) S3 provides block storage; EBS provides shared file storage; EFS stores objects

C) S3 stores objects; EBS provides EC2 block storage; EFS provides shared file storage. S3 is object storage; EBS provides EC2 block storage; EFS provides managed shared file storage.

Which statement correctly compares Amazon RDS and DynamoDB? | A) RDS manages relational databases; DynamoDB is a NoSQL key-value/document database | B) RDS is a managed NoSQL database; DynamoDB provides managed relational SQL engines | C) RDS manages database backups only; DynamoDB provides SQL database scaling only | D) RDS provides SQL engines; DynamoDB provides in-memory Redis caches

A) RDS manages relational databases; DynamoDB is a NoSQL key-value/document database. RDS is managed relational database hosting; DynamoDB is managed NoSQL key-value/document storage.

Which statement correctly contrasts Amazon Route 53 and CloudFront? | A) Route 53 caches content near users; CloudFront manages DNS records | B) Route 53 distributes API traffic to Lambda; CloudFront assigns domain records | C) Route 53 manages DNS; CloudFront caches and delivers content near users | D) Route 53 accelerates global TCP traffic; CloudFront provides isolated VPC networks

C) Route 53 manages DNS; CloudFront caches and delivers content near users. Route 53 routes DNS traffic; CloudFront is a CDN for delivering content nearer users.

Which statement correctly contrasts AWS Budgets and AWS Cost Explorer? | A) Budgets creates pricing estimates before deployment; Cost Explorer optimizes EC2 instance sizes | B) Budgets analyzes historical cost trends; Cost Explorer alerts when a fixed budget limit is exceeded | C) Budgets predicts unexpected spikes using machine learning; Cost Explorer manages budget threshold alerts | D) Budgets alerts on defined thresholds; Cost Explorer analyzes spending trends and forecasts

D) Budgets alerts on defined thresholds; Cost Explorer analyzes spending trends and forecasts. Budgets watches thresholds; Cost Explorer helps understand spending patterns over time.

Which statement correctly compares IAM with IAM Identity Center? | A) IAM is a workforce sign-in portal; IAM Identity Center only evaluates EC2 configuration compliance | B) IAM centralizes workforce SSO; IAM Identity Center creates KMS encryption keys | C) IAM manages AWS permissions/roles; IAM Identity Center centralizes workforce sign-in across accounts/apps | D) IAM mainly manages cross-account billing; IAM Identity Center controls subnet routing

C) IAM manages AWS permissions/roles; IAM Identity Center centralizes workforce sign-in across accounts/apps. IAM manages AWS resource access policies and roles; IAM Identity Center centralizes workforce authentication and access.

Which statement correctly differentiates GuardDuty from Inspector? | A) GuardDuty monitors CPU thresholds; Inspector identifies unusual spending anomalies | B) GuardDuty scans EC2 packages for vulnerabilities; Inspector detects account-wide suspicious activity | C) GuardDuty reviews framework architecture; Inspector collects API event audit logs | D) GuardDuty detects suspicious activity; Inspector identifies vulnerabilities in supported workloads

D) GuardDuty detects suspicious activity; Inspector identifies vulnerabilities in supported workloads. GuardDuty detects suspicious behavior and threats; Inspector scans supported workloads for vulnerabilities.