MC Scenarios High

An application has overprovisioned EC2 instances. Which AWS service recommends better instance sizes based on their utilization? | A) AWS Compute Optimizer | B) AWS Auto Scaling | C) AWS Cost Explorer | D) AWS CloudFormation

A) AWS Compute Optimizer. Compute Optimizer recommends rightsizing. Auto Scaling adjusts capacity, and Cost Explorer analyzes spend.

Website traffic fluctuates throughout the day. Which capability automatically adds or removes EC2 instances? | A) AWS CloudTrail | B) AWS Trusted Advisor | C) AWS Auto Scaling | D) AWS Compute Optimizer

C) AWS Auto Scaling. Auto Scaling changes provisioned capacity with demand, unlike the recommendations made by Compute Optimizer.

An auditor needs to know who called an AWS API to modify an account resource. Which service should they consult? | A) Amazon CloudWatch | B) Amazon GuardDuty | C) AWS CloudTrail | D) AWS Config

C) AWS CloudTrail. CloudTrail records API/account events; CloudWatch monitors metrics and alarms; Config tracks resource settings.

An operations team wants an alarm when an EC2 CPU metric exceeds a threshold. Which service should it use? | A) AWS Config | B) AWS CloudTrail | C) Amazon CloudWatch | D) AWS Artifact

C) Amazon CloudWatch. CloudWatch provides metrics and alarms; CloudTrail records account/API events for auditing.

A company needs a rapidly deployable encrypted connection from its office network to a VPC over the internet. What should it use? | A) AWS Site-to-Site VPN | B) AWS Global Accelerator | C) AWS PrivateLink | D) AWS Direct Connect

A) AWS Site-to-Site VPN. Site-to-Site VPN uses encrypted internet tunnels; Direct Connect provisions dedicated private connections.

A data center needs dedicated, private connectivity to AWS rather than an internet-based VPN. Which service fits? | A) AWS Site-to-Site VPN | B) AWS Direct Connect | C) Amazon CloudFront | D) AWS Client VPN

B) AWS Direct Connect. Direct Connect provides dedicated private network connectivity, while Site-to-Site VPN uses internet tunnels.

An EC2 instance should accept inbound traffic only on a specified port from an approved source. Which control is appropriate? | A) Security group | B) AWS WAF | C) AWS Shield | D) Network ACL

A) Security group. Security groups apply stateful allow rules at network interfaces. NACLs apply stateless rules at subnet boundaries.

An administrator must create allow AND deny rules at the VPC subnet boundary. Which control should be used? | A) Security group | B) AWS Shield | C) Network ACL | D) AWS IAM policy

C) Network ACL. NACLs operate at subnet boundaries and support allow and deny rules. Security groups use allow rules at interfaces.

A business can commit to a fixed amount of eligible AWS compute usage for one or three years. Which offering discounts that usage? | A) Spot Instances | B) Savings Plans | C) AWS Free Tier | D) On-Demand pricing

B) Savings Plans. Savings Plans exchange a 1- or 3-year usage-spend commitment for lower rates on eligible compute usage.

A public web application needs to filter malicious HTTP requests based on rules. Which service fits best? | A) AWS Shield | B) Amazon GuardDuty | C) AWS WAF | D) AWS Secrets Manager

C) AWS WAF. AWS WAF inspects and filters web requests; Shield addresses DDoS protection and GuardDuty detects threats.

Which description correctly contrasts Amazon SNS and Amazon SQS? | A) SNS holds messages for workers; SQS routes event patterns to targets | B) SNS filters events using rules; SQS pushes notifications to subscribers | C) SNS stores messages in a queue; SQS delivers messages to multiple subscribers | D) SNS publishes to subscribers; SQS queues messages for later processing

D) SNS publishes to subscribers; SQS queues messages for later processing. SNS is publish/subscribe fan-out; SQS is queued asynchronous messaging.

Which description correctly contrasts CloudWatch and CloudTrail? | A) CloudWatch collects metrics and alarms; CloudTrail evaluates compliance rules | B) CloudWatch monitors metrics/logs and alarms; CloudTrail records AWS API activity | C) CloudWatch records resource configuration changes; CloudTrail manages metrics and alarms | D) CloudWatch analyzes spending forecasts; CloudTrail tracks resource compliance status

B) CloudWatch monitors metrics/logs and alarms; CloudTrail records AWS API activity. CloudWatch is for monitoring and alerting; CloudTrail is for API/account activity audit trails.

Which statement accurately compares Amazon S3, EBS, and EFS? | A) S3 stores objects; EBS provides shared files; EFS provides EC2 block volumes | B) S3 provides shared file storage; EBS stores objects; EFS provides EC2 block volumes | C) S3 stores objects; EBS provides EC2 block storage; EFS provides shared file storage | D) S3 provides block storage; EBS provides shared file storage; EFS stores objects

C) S3 stores objects; EBS provides EC2 block storage; EFS provides shared file storage. S3 is object storage; EBS provides EC2 block storage; EFS provides managed shared file storage.

Which statement correctly compares Amazon RDS and DynamoDB? | A) RDS manages relational databases; DynamoDB is a NoSQL key-value/document database | B) RDS is a managed NoSQL database; DynamoDB provides managed relational SQL engines | C) RDS manages database backups only; DynamoDB provides SQL database scaling only | D) RDS provides SQL engines; DynamoDB provides in-memory Redis caches

A) RDS manages relational databases; DynamoDB is a NoSQL key-value/document database. RDS is managed relational database hosting; DynamoDB is managed NoSQL key-value/document storage.

Which statement correctly contrasts Amazon Route 53 and CloudFront? | A) Route 53 caches content near users; CloudFront manages DNS records | B) Route 53 distributes API traffic to Lambda; CloudFront assigns domain records | C) Route 53 manages DNS; CloudFront caches and delivers content near users | D) Route 53 accelerates global TCP traffic; CloudFront provides isolated VPC networks

C) Route 53 manages DNS; CloudFront caches and delivers content near users. Route 53 routes DNS traffic; CloudFront is a CDN for delivering content nearer users.

Which statement correctly contrasts AWS Budgets and AWS Cost Explorer? | A) Budgets creates pricing estimates before deployment; Cost Explorer optimizes EC2 instance sizes | B) Budgets analyzes historical cost trends; Cost Explorer alerts when a fixed budget limit is exceeded | C) Budgets predicts unexpected spikes using machine learning; Cost Explorer manages budget threshold alerts | D) Budgets alerts on defined thresholds; Cost Explorer analyzes spending trends and forecasts

D) Budgets alerts on defined thresholds; Cost Explorer analyzes spending trends and forecasts. Budgets watches thresholds; Cost Explorer helps understand spending patterns over time.

Which statement correctly compares IAM with IAM Identity Center? | A) IAM is a workforce sign-in portal; IAM Identity Center only evaluates EC2 configuration compliance | B) IAM centralizes workforce SSO; IAM Identity Center creates KMS encryption keys | C) IAM manages AWS permissions/roles; IAM Identity Center centralizes workforce sign-in across accounts/apps | D) IAM mainly manages cross-account billing; IAM Identity Center controls subnet routing

C) IAM manages AWS permissions/roles; IAM Identity Center centralizes workforce sign-in across accounts/apps. IAM manages AWS resource access policies and roles; IAM Identity Center centralizes workforce authentication and access.

Which statement correctly differentiates GuardDuty from Inspector? | A) GuardDuty monitors CPU thresholds; Inspector identifies unusual spending anomalies | B) GuardDuty scans EC2 packages for vulnerabilities; Inspector detects account-wide suspicious activity | C) GuardDuty reviews framework architecture; Inspector collects API event audit logs | D) GuardDuty detects suspicious activity; Inspector identifies vulnerabilities in supported workloads

D) GuardDuty detects suspicious activity; Inspector identifies vulnerabilities in supported workloads. GuardDuty detects suspicious behavior and threats; Inspector scans supported workloads for vulnerabilities.