Practice Questions

A Lambda function must read objects from one specific S3 bucket and nothing else. What is the MOST secure way to grant this access?

A partner AWS account needs read access to CloudTrail logs in your S3 bucket. Which approach follows AWS best practices for cross-account access?

Which combination of measures best protects highly privileged IAM users according to AWS best practices?

A company uses AWS Organizations with dozens of member accounts. Security wants to guarantee that no member account can disable CloudTrail or move resources to unapproved Regions, even if an account administrator tries. What should they use?

A solutions architect needs to deny traffic from a specific malicious IP range at the subnet boundary. Security groups only support allow rules. Which control can explicitly DENY the IP range?

An application behind an Application Load Balancer is experiencing SQL injection attempts and cross-site scripting in HTTP requests. Which AWS service provides managed rules to block these common web exploits at layer 7?

EC2 instances in a private subnet must download OS patches from the internet, but must NOT accept inbound connections initiated from the internet. What should the architect deploy?

Which AWS service automatically protects resources such as CloudFront distributions and Elastic Load Balancers against common network and transport layer (layer 3/4) DDoS attacks at no additional cost?

Compliance requires that the company controls the keys used to encrypt data in S3, including the ability to rotate keys and audit every key usage. Which encryption option meets these requirements?

An application stores RDS database credentials in a configuration file. The security team requires centralized secret storage with built-in automatic rotation. Which service should be used?

A company wants to serve HTTPS traffic through an Application Load Balancer using a publicly trusted certificate that is provisioned and renewed automatically at no cost. Which service should provide the certificate?

A web application stores regulated data in RDS. Which TWO controls together provide defense-in-depth for BOTH data at rest and application access? (Select TWO.)

Instances in private subnets must call the Amazon SNS API, and security policy forbids routing that traffic through an internet gateway or NAT gateway. What provides private connectivity to the AWS service?

A security team wants a single account-level control that prevents any S3 bucket in the account from becoming publicly accessible, regardless of how bucket policies or ACLs are configured. What should they enable?

Which TWO AWS services provide threat detection and API-activity auditing across an AWS account? (Select TWO.)

A media company sells premium videos served via CloudFront. Videos must be accessible only to paying subscribers for a limited time. Which mechanism enforces this?

A mobile app needs user sign-up/sign-in with MFA, social identity providers (Google, Apple), and JWT tokens the backend can validate — without building an auth system. Which service provides this?

A three-tier app must allow the web tier's instances to reach the app tier on port 8080, and nothing else. Instances in both tiers change frequently due to Auto Scaling. What's the most maintainable security-group design?

A login API behind an ALB is under a credential-stuffing attack — thousands of requests from rotating IPs. Which WAF feature mitigates this without blocking legitimate users?

A mobile app needs sign-up/sign-in for millions of end users, with social login and temporary AWS credentials for calling an API backend. What should you use?

Account A's KMS key encrypts S3 objects that account B must read. Both permissions exist — the key policy lists account B, and B's role allows kms:Decrypt — yet access still fails. What's missing?

Web tier → app tier → database tier. You want the app tier to accept traffic ONLY from web-tier instances, and the DB tier only from app-tier instances — without hardcoding IPs. What mechanism expresses this?

A web tier runs on a single EC2 instance in one Availability Zone. The company needs the application to keep serving requests if that AZ fails. What is the simplest resilient redesign?

A production RDS for PostgreSQL database must fail over automatically to a standby within minutes if the primary DB instance or its AZ becomes unavailable. Which configuration provides this?

A site runs in two Regions. Users should be directed to the secondary Region automatically when health checks detect the primary Region's endpoint is unhealthy. Which Route 53 feature accomplishes this?

A payment API sometimes fails when the downstream invoice-generation service is overloaded or unavailable. Orders must not be lost. Which change makes the architecture resilient?

When an order is placed, three independent systems — fulfillment, analytics, and notifications — must each receive the event. The systems should not know about each other, and adding future consumers should not require producer changes. Which design fits best?

A queue carries financial transactions that must be processed exactly once and strictly in order. Which queue type should be selected?

A workload requires recovery in a second Region with RTO under 1 hour and near-zero RPO, but full multi-site active/active is too expensive. Which DR strategy best balances these requirements?

The company must centrally manage and audit backups for EC2 (EBS), RDS, EFS, and DynamoDB across accounts, with scheduled policies and retention rules. Which service is designed for this?

A business can tolerate losing at most 15 minutes of data. Which statement correctly captures what the backup design must satisfy?

Objects in an S3 bucket must be protected against both accidental deletion and overwrites, while retaining S3's multi-AZ durability. What should be enabled?

An Auto Scaling group of EC2 instances across three AZs must all read and write the same file system, which must remain available if one AZ fails. Which storage service fits?

A consumer repeatedly fails to process a small number of malformed SQS messages, blocking the queue and generating reprocessing noise. What is the standard mechanism to isolate these messages for later analysis?

Which disaster-recovery approach keeps only the minimal data-replication components running in the DR Region — the data layer always live but the application stack provisioned only when needed?

A global app has identical deployments in eu-west-1 and us-east-1. Users in Europe should reach the European deployment and US users the American one — routed by user geography, not measured latency. Which Route 53 policy?

An EBS volume's data must survive an AZ outage and be recoverable into a different AZ within minutes. What mechanism enables this?

A web tier stores user sessions in local memory on each EC2 instance. When Auto Scaling replaces instances, users lose sessions. What change makes the tier properly stateless?

A global application needs a relational database readable with low latency in three Regions, able to promote a secondary Region to full read-write within about a minute for regional DR. Which option fits?

When an Auto Scaling group terminates an instance, in-flight uploads must finish and a cleanup script must run before the instance dies. Which feature holds the instance in a wait state for this?

Worker failures occasionally poison SQS messages — after 3 receives they should move aside for inspection, then return to the queue once fixed. Which configuration does this?

An Aurora cluster's writer instance fails. What happens to availability and what is the expected failover time?

DR policy requires encrypted backups of RDS and EBS in a second region, managed under one policy with retention rules. What's the simplest compliant approach?

Images uploaded to S3 must be resized. Work is bursty — zero to thousands of uploads per hour — and each resize finishes in seconds. Which compute option is the best operational fit?

A latency-sensitive API has constant high traffic, requires sub-millisecond internal calls between microservices, and needs full control of the runtime environment including a custom kernel module. Which platform is most appropriate?

A nightly analytics job runs thousands of parallel, fault-tolerant tasks for 4 hours. Tasks can be interrupted and retried without harm. Which approach provides scalable, efficient capacity?

A reporting feature adds heavy read traffic to an RDS MySQL database, slowing the primary writer. Most reads are tolerant of slight staleness. What is the standard way to scale reads?

A session store needs single-digit-millisecond key-value reads and writes that must scale to unpredictable internet-scale traffic, with no relational queries required. Which database is the best fit?

A DynamoDB-backed catalog suffers hot-key read spikes on popular items during flash sales, pushing reads from ~5ms to higher latency. What reduces read latency and offloads repeated reads MOST effectively?

Users worldwide download static media from a single-Region S3 bucket and experience high latency. What reduces latency with minimal architecture change?

A product service re-computes the same complex SQL query for every request, and the result changes only hourly. The team wants microsecond-to-millisecond lookups and to relieve the database. What should they add?

Web traffic roughly doubles every weekday at noon and halves overnight, but the exact level varies. The architecture must maintain response times without paying for permanent peak capacity. Which approach is most appropriate?

A fleet of containers exposes HTTP/HTTPS APIs that need path-based routing to different services and integration with AWS WAF. Which load balancer type is required?

A real-time bidding API (non-cacheable, dynamic TCP traffic) must reduce latency for global users hitting an ALB in one Region. CloudFront cannot cache this traffic. Which service improves performance using the AWS global network?

A database on EC2 needs consistently high IOPS beyond what general-purpose volumes deliver, with provisioned IOPS independent of volume size. Which EBS volume family is designed for this?

A platform must ingest clickstream events in real time and let multiple downstream applications each process the same stream independently, with replay of recent records. Which service is designed for this?

A distributed team uploads large files to an S3 bucket in one Region and uploads are slow over long distances. The content itself doesn't need edge caching. Which feature improves upload speed most directly?

A session store needs an in-memory cache with persistence, replication, failover, and data structures like sorted sets for leaderboards. Which ElastiCache engine is required?

A DynamoDB table uses a partition key with only a handful of distinct values (e.g., a status field), so a few keys receive most of the traffic and get throttled. What's the fix?

A tightly-coupled HPC workload needs the lowest possible network latency between its EC2 instances within a single AZ. Which EC2 placement group should be used?

A real-time multiplayer game needs millions of concurrent TCP connections at ultra-low latency, with a static IP for whitelisting. Which load balancer fits?

A cache needs persistence, replication with failover, pub/sub for cache invalidation events, and sorted-set data structures. Which ElastiCache engine?

A latency-sensitive API on Lambda has acceptable median latency but occasional multi-second spikes on the first request after idle. What eliminates these cold-start spikes?

A DynamoDB table throttles during a promotion: reads hit a single 'promo' partition key, while the rest of the table sits idle. What's the fix?

Regulatory archives must be retained 7 years, are retrieved at most once a year, and a retrieval time of several hours is acceptable. Which S3 storage class minimizes storage cost?

Application logs in S3 are actively queried for 30 days, rarely read for the next 60 days, and must be retained for 1 year. Which approach reduces cost automatically over time?

A data lake holds objects whose access frequency is unknown and changes over time; some objects go untouched for months then spike. Retrieval must remain millisecond-latency. Which storage class automatically optimizes cost?

A production database server runs 24/7 on EC2 at a stable size for at least the next year. The company wants the largest legitimate discount without changing the architecture. What should they purchase?

Cost Explorer shows a fleet of EC2 instances averaging 5% CPU for months. The team wants the lowest-effort way to cut compute spend while keeping capacity headroom. What should they do first?

An internal tool serves a few dozen requests per day, mostly during business hours, with occasional idle days. Which compute approach minimizes cost?

Which TWO choices can reduce database cost for the described workloads? (Select TWO.)

Instances in private subnets transfer terabytes to S3 through a NAT gateway, generating high hourly and data-processing charges. What is the most cost-effective fix that keeps the traffic off the internet?

An infrequently accessed EC2 data volume uses a large general-purpose SSD where a cheaper option would suffice. Which EBS volume type is the least expensive for cold, infrequently accessed data?

Most files on an EFS file system are rarely accessed. Which feature reduces cost automatically without moving files to another service?

An account's bill is growing and the team suspects idle EC2 instances, underutilized EBS volumes, and over-provisioned databases. Which AWS service analyzes resource utilization and recommends rightsizing?

A company runs workloads across dozens of AWS accounts. They want combined volume discounts and a single bill with per-account visibility. Which AWS Organizations feature provides this?

A compliance team must retain audit logs for 7 years. Retrievals happen rarely and can wait up to 12 hours. Which S3 storage class minimizes cost for this archive?

Log objects must be kept 7 years: queried daily for 30 days, rarely after a year, almost never after that. What's the most cost-effective storage strategy?

Nightly video-transcoding jobs are checkpointed and can restart without data loss. Which EC2 purchasing option cuts compute cost the most?

A stateless web tier compiles cleanly on ARM64. Which change most improves price-performance with zero app redesign?

A dev environment's private subnets need occasional outbound internet (package updates — a few GB/month). Production needs managed HA. Most cost-effective approach for dev?

Under the AWS shared responsibility model, who is responsible for patching the guest operating system on an Amazon EC2 instance?

Which is a key benefit of running workloads on AWS compared to on-premises data centers?

Which TWO components are part of the AWS global infrastructure? (Select TWO.)

A company manages 20 AWS accounts under AWS Organizations. Which benefit does consolidated billing provide at no extra cost?

Which set correctly lists the pillars of the AWS Well-Architected Framework?

A startup can provision servers in minutes instead of waiting weeks for hardware procurement. Which cloud benefit does this illustrate?

Which TWO items is AWS responsible for under the shared responsibility model? (Select TWO.)

What is the recommended best practice for using the AWS account root user?

Which AWS service provides intelligent threat detection by continuously monitoring for malicious activity and unauthorized behavior?

Which AWS service lets you run code in response to events without provisioning or managing servers?

Which AWS service provides object storage for storing and retrieving any amount of data, such as images, backups, and static website files?

Which AWS service caches content at edge locations worldwide to deliver it to users with lower latency?

Which AWS service is a fully managed NoSQL database that provides single-digit-millisecond performance at any scale?

An e-commerce site automatically adds server capacity before holiday traffic peaks and releases it afterward. Which cloud characteristic does this demonstrate?

Moving from on-premises servers to AWS changes IT spending primarily from capital expenditure (CapEx) to what model?

Why does AWS recommend enabling multi-factor authentication (MFA) on the root user and privileged IAM users?

Which AWS service continuously records resource configurations and lets you evaluate them against desired settings — useful for compliance auditing?

Which AWS service provides managed relational databases supporting MySQL, PostgreSQL, Oracle, and SQL Server?

Which AWS service collects metrics, logs, and events from AWS resources and lets you set alarms and dashboards?

Which AWS tool lets you visualize and analyze your spending patterns over time with graphs and filters?

A company needs a Technical Account Manager (TAM), 24/7 phone support, and architectural guidance. Which AWS Support plan provides this?

Which list correctly names the AWS Well-Architected Framework's six pillars?

Under the shared responsibility model for Amazon RDS, which task remains the CUSTOMER's responsibility?

A batch rendering job can be interrupted and restarted anytime — it's not time-sensitive. Which EC2 purchase option minimizes cost?

Which AWS infrastructure component is designed to serve cached content closest to end users — lowering latency for a global audience?

A mobile game needs single-digit-millisecond reads at massive scale for player session data — key-value lookups only, no joins or SQL. Which database service fits?

A finance team wants (a) to visualize WHERE last quarter's spend went by service, and (b) alerts when next month's forecast exceeds a threshold. Which two tools map to these needs?

A startup wants 24/7 access to AWS engineers by phone/chat plus a Technical Account Manager for proactive guidance. Which support plan is the minimum tier that includes a TAM?

Which statement best describes the financial benefit of moving from on-premises servers to AWS?

Which framework does AWS provide to help organizations plan their cloud adoption across people, processes, and technology?

A company wants to manage billing and enforce permission guardrails across its 30 AWS accounts from one place. Which service provides this?

Security asks 'who terminated that EC2 instance yesterday?' Which service answers API-activity questions like this?

A web app needs to route HTTP requests to different backend services based on the URL path (e.g., /api vs /images). Which Elastic Load Balancing type fits?

Which TWO statements correctly match AWS storage services to their type? (Select TWO.)

Before deploying anything, a team wants an estimate of what a proposed architecture would cost per month. Which AWS tool provides this?

Which statement about the AWS Free Tier is correct?

Which AWS design approach best delivers HIGH AVAILABILITY — minimizing downtime when a single component fails?

A team wants to define their entire AWS environment — VPCs, databases, and roles — as version-controlled templates that can be deployed repeatably. Which service does this?

What's the FIRST security action AWS recommends for a brand-new account's root user?

A company wants commitment-based discounts on compute spend but needs flexibility to change instance families and even move workloads between EC2, Fargate, and Lambda. Which pricing model fits?

An e-commerce site automatically adds capacity during a flash sale and releases it afterward, paying only for what it used. Which cloud characteristic does this demonstrate?

In AWS migration guidance, what do the '6 R's' describe?

A bank keeps sensitive records in its data center but runs its customer-facing app on AWS, connected via Direct Connect. Which deployment model is this?

Why can AWS offer lower prices than most companies could achieve running their own data centers?

A startup doesn't know how much traffic its launch will get. Which cloud advantage lets it avoid buying servers sized for a guessed peak?

Your security team wants to run a penetration test against your own EC2 instances on AWS. What is required first?

Under the shared responsibility model, who is responsible for encrypting company data stored in Amazon S3?

Your compliance officer needs AWS's SOC 2 and ISO 27001 reports for an audit. Where can they download them?

What does the 'principle of least privilege' mean when writing IAM policies?

Which AWS service inspects your account and recommends improvements across cost, performance, security, fault tolerance, and service quotas?

A company needs genuine AWS infrastructure and APIs inside its own data center for latency and residency reasons. Which service delivers AWS hardware on-premises?

A studio must move 80 TB of footage to S3 but its internet upload would take weeks. Which AWS service ships a physical device to load data offline?

Where do you see AWS service issues and scheduled maintenance that could affect YOUR specific resources?

A team wants managed Apache Spark and Hadoop clusters for large-scale data processing. Which AWS service is designed for this?

An enterprise wants a dedicated private network connection between its data center and AWS that bypasses the public internet. Which service provides it?

Finance wants automatic alerts when daily spend deviates unusually from normal patterns — not just when a budget threshold is crossed. Which feature does this?

How does AWS typically charge for data transferred INTO AWS services (data ingress) from the internet?

Which factors drive Amazon S3 Standard storage costs? (Select TWO.)

Besides sending alerts, what else can AWS Budgets do when a threshold is breached?

Which payment options exist for EC2 Reserved Instances? (Select TWO.)

A team wants a system that learns patterns from historical data to predict future sales — without writing explicit rules. Which approach is this?

A company wants to build generative AI apps using foundation models from multiple providers (Anthropic, Meta, Amazon) through a single API — without managing infrastructure or training models. Which AWS service?

A chatbot built on a foundation model keeps giving outdated answers because the model was trained before the company's latest documentation was written. Which technique grounds responses in the company's current documents without retraining?

A hiring-screening model consistently ranks candidates from one demographic group lower. Which responsible-AI dimension does this violate, and what's the first step to address it?

A retailer wants to group customers into natural segments based on purchase behavior — but there are no labeled categories to learn from. Which ML approach applies?

A content team complains that their generative-AI writing assistant produces nearly identical drafts every run. Which inference parameter should they raise to get more varied, creative output?

A support portal should find articles that mean the same thing even when users phrase questions differently. What converts text into a form that enables this semantic search?

A team needs a foundation model to adopt a consistent brand tone and domain terminology in its responses. They want results fast without training infrastructure. What should they try FIRST?

A finance team receives thousands of scanned invoices and needs to extract vendor names, line items, and totals into structured data. Which AWS service is purpose-built for this?

A company launching a customer-facing chatbot needs configurable filters that block harmful content, redact PII, and restrict disallowed topics — applied consistently across whichever foundation model they use. What's the AWS-native control?

A team is building a generative-AI assistant over customer records. Which TWO controls belong in a sound AI data-governance plan? (Select TWO.)

Which workload is the best fit for a GENERATIVE AI approach rather than traditional ML?

A team wants to train a custom ML model on their own structured data with full control over algorithms and infrastructure. Which service fits — and which is the wrong choice?

In a retrieval-augmented generation (RAG) design, what role do embeddings and a vector store play?

Which prompt-engineering technique gives the model a few input/output examples so it learns the desired response pattern without any training?

A company deploying a generative AI assistant wants to address responsible-AI concerns. Which TWO practices directly reduce the risk of harmful or biased outputs? (Select TWO.)

A company wants to group customers by purchasing behavior without any predefined labels. Which ML approach fits?

A firm needs to (a) extract text and tables from scanned PDF invoices and (b) detect sentiment and entities in the extracted text. Which two services map to these jobs?

Why is a test dataset kept separate during model development?

What is Amazon Bedrock's core value proposition?

A GenAI assistant occasionally invents plausible-sounding but false facts (hallucinations). Which TWO techniques directly reduce hallucination? (Select TWO.)

A company wants (a) a chatbot that answers questions from their document set, and (b) the assistant to complete multi-step tasks like looking up an order and issuing a refund. Which Bedrock capabilities map to each?

A summarization app needs MORE creative, varied outputs from the same model. Which inference parameter should be increased?

Before sending customer data to a foundation model, a compliance team requires PII redaction and audit logging of prompts. Which approach addresses both?

A Lambda function processes uploaded images. Processing occasionally takes 20 minutes and the function times out. What is the maximum Lambda execution timeout, and what's the right fix if the task regularly exceeds it?

A Lambda function needs to read items from a DynamoDB table. What's the correct way to grant the function access — following least-privilege?

A real-time chat application needs persistent two-way communication between clients and backend — messages pushed in both directions without polling. Which API Gateway type should be used?

A team wants zero-downtime deployments where a new environment runs alongside the old, traffic shifts only when the new version is verified, and rollback is instant. Which deployment strategy is this?

A DynamoDB table backs a flash-sale feature with unpredictable, spiky traffic that can jump 10x within minutes. The team wants to avoid throttling without capacity planning. Which capacity mode fits best?

Whenever a DynamoDB item is updated, a Lambda function must replicate the change to an OpenSearch index for full-text search. What's the native integration pattern?

An order-processing queue must guarantee messages are processed exactly once and strictly in the order sent. Which SQS configuration is required?

A Lambda function calling a downstream database is overwhelming the database during traffic spikes. How can you cap the function's concurrent executions while leaving the rest of the account unaffected?

Consumers occasionally fail while processing SQS messages, and some messages are being processed twice. Which TWO configurations help correct this? (Select TWO.)

A team wants to shift 5% of production traffic to a new Lambda version while keeping instant rollback, all without changing client code. Which feature enables this?

A mobile app needs users to sign in with social providers and then read their own S3 objects directly. Which Cognito components are required, and what role does each play?

An application stores a third-party database password that must rotate automatically every 30 days without code changes. Which service is designed for this?

A Lambda function must encrypt large payloads before writing them to S3, with keys managed under centralized control and rotation. The AWS Encryption SDK is used. What does 'envelope encryption' mean in this design?

An API Gateway REST API must authorize requests using a custom JWT scheme that Cognito can't validate. What's the integration point for custom authorization logic?

A team wants a Lambda deployment that shifts 10% of traffic to the new version, waits 5 minutes for alarm checks, then completes the shift. Which CodeDeploy deployment configuration matches?

A small team wants to deploy a Node.js web app to AWS without managing infrastructure — upload code, get load balancing, auto scaling, and health monitoring handled automatically. Which service fits?

A developer is writing infrastructure-as-code for a serverless app (Lambda + API Gateway + DynamoDB) and wants terse syntax with local test/debug support. Which tool is designed for this?

Requests through API Gateway → Lambda → DynamoDB are intermittently slow, and the team needs to see which hop adds latency. What tool provides this distributed trace?

A latency-sensitive API backed by Lambda shows occasional 2-3 second spikes on first requests after idle periods — cold starts. What's the most direct fix?

A DynamoDB-backed product catalog serves the same items to millions of readers, and read latency/cost needs to drop. What DynamoDB-specific option adds microsecond read caching without code rewrites?

A Lambda function needs a database password. Which approach keeps the secret out of code AND rotates it automatically?

A mobile team wants a GraphQL API with real-time subscriptions over WebSockets and built-in offline data sync. Which service is designed for this?

A backend receives Cognito JWTs from a SPA and must verify them locally without calling Cognito on every request. What's the correct verification approach?

An application on an EC2 instance must write to S3. Which credential approach follows AWS best practice?

Five Lambda functions share the same heavy utility library, and updating it means redeploying all five packages. What Lambda feature centralizes shared code?

A team wants new Lambda versions rolled out gradually — 10% of traffic first, automatically rolling back if CloudWatch alarms fire. Which service orchestrates this?

Requests through API Gateway → Lambda → DynamoDB are slow, but no single component looks wrong in logs. Which tool shows WHERE latency accumulates across the request path?

A Lambda function's Throttles metric spikes during traffic bursts, and invocations get dropped. What's the direct fix — and which approach is a common mistake?

A DynamoDB table needs queries by an attribute that isn't the partition key, and new query patterns will emerge after launch. Which index type supports this — and what's its key constraint?

Payment events must be processed exactly once, in strict order. Which SQS configuration delivers both guarantees?

An order pipeline has 7 steps — some parallel, some with retries, one needing human approval — spanning hours. Which service models this reliably?

A team stores (a) non-secret config values and (b) database credentials requiring automatic rotation. Which split is correct?

Which mapping of AWS CI/CD services to their jobs is correct?

A latency-sensitive Lambda function occasionally responds slowly on the first invocation after idle periods. Which fix directly eliminates cold-start latency?

A read-heavy REST API calls a Lambda that queries DynamoDB — most requests repeat the same lookups. Which API Gateway feature reduces backend load without code changes?

Whenever a new order item is written to a DynamoDB table, a Lambda function must update a search index. What mechanism delivers the item-change events?

A browser SPA on https://app.example.com calls an API Gateway REST API — preflight OPTIONS requests fail and calls get blocked. What's the fix?

A small team wants to deploy a Node.js web app to AWS quickly — they don't want to manage servers, load balancers, or scaling configuration. Which service fits?

Some SQS messages keep failing Lambda processing and disappearing after repeated retries. The team needs to capture and inspect these poison messages. What's the mechanism?

An ops team needs an automated notification whenever any production EC2 instance's CPU stays above 90% for 10 minutes. What should they configure?

By default, EC2 instances publish metrics to CloudWatch every 5 minutes. How do you get 1-minute metric granularity for faster incident response?

An operations team must apply OS security patches to hundreds of EC2 instances on a schedule, with approval controls and compliance reporting. Which service handles this natively?

Instances in a private subnet can reach the internet via a NAT gateway, but the ops team wants to eliminate the NAT gateway's data-processing charges for traffic to S3 and DynamoDB. What's the fix?

An ops team wants CloudWatch alarms on EC2 memory utilization and disk space. CPUUtilization works fine, but memory and disk metrics don't appear in CloudWatch. Why, and what's the fix?

An ops team wants non-compliant resources remediated automatically — e.g., when an S3 bucket becomes public, a runbook removes the public access within minutes. What's the standard event-driven pattern?

An ops team must centrally manage backups across EC2/EBS, RDS, DynamoDB, and EFS — with scheduled plans, retention policies, and cross-account copies for DR. Which service consolidates this?

An Auto Scaling group behind an ALB keeps unhealthy instances in service — the app returns 500s but the ASG health check still reports the instances healthy. What fixes the detection gap?

Someone changed a security group rule manually in the console, and the CloudFormation stack no longer matches its template. How does ops detect this kind of out-of-band change going forward?

Admins currently SSH through a bastion host with port 22 open and shared key pairs. Security wants auditable shell access without inbound ports or SSH keys. What replaces the bastion?

Ops needs continuous proof that all EBS volumes are encrypted and no security group allows 0.0.0.0/0 on port 22. Which TWO services/features provide this? (Select TWO.)

An ALB target group shows targets unhealthy — instances run fine and the app answers on port 8080, but health checks fail. What's the FIRST thing to verify?

Compliance requires application logs kept 7 years and queryable, but CloudWatch Logs costs too much at that retention. What's the cost-effective archive pattern?

A production RDS instance must survive an Availability Zone outage with minimal downtime and no manual failover steps. What configuration provides this?

Ops needs a repeatable, approval-gated process to restart a fleet of instances in batches with health checks between batches. Which SSM capability provides prebuilt or custom multi-step workflows?

Ops suspects an S3 bucket or IAM role grants access to an external AWS account. Which tool analyzes resource policies and flags external access automatically?

Private subnets across three AZs need resilient outbound internet access. What's the operationally sound design?

Ops must keep hundreds of EC2 instances patched to an approved baseline on a schedule, with reports on compliance. Which Systems Manager capability is designed for this?

Regulations require backups that CANNOT be deleted or altered — even by administrators or compromised credentials — for 7 years. Which feature enforces this?

An ops team gets paged by many CloudWatch alarms that all stem from the same underlying incident. Which feature reduces this alarm noise?

A data team needs to run Python-based ETL jobs to transform S3 data into a queryable form — without provisioning servers. Which service is designed for this?

A team needs to land streaming clickstream data directly into S3 as batched files, with optional format conversion — no custom consumers needed. Which Kinesis service fits best?

An analytics team needs to run complex SQL joins and aggregations over terabytes-to-petabytes of structured data for BI dashboards. Which service is designed for this workload?

Analysts need column-level access control over a data lake in S3 — some columns (like salary) visible only to HR. Which service provides centralized, fine-grained data-lake permissions?

A data team has existing Apache Airflow DAGs orchestrating their pipelines and wants managed hosting on AWS without rewriting workflows. Which service runs Airflow natively?

A company already runs Apache Kafka on-premises and wants the same Kafka APIs/ecosystem on AWS with minimal migration friction. Which service fits?

Athena queries over a 10 TB S3 data lake are slow and expensive — Athena bills per TB scanned. What design change most reduces both cost and latency?

A pipeline occasionally ingests files with nulls and schema drift, silently corrupting dashboards. What AWS capability evaluates data quality rules and can stop or alert on bad batches?

Application logs must be delivered to S3 in near-real-time, optionally transformed, with zero infrastructure to manage and no consumer applications reading the stream. Which service fits best?

Analysts run infrequent, ad-hoc SQL queries directly against raw files in an S3 data lake — no regular reporting workload. What's the most cost-effective query layer?

A nightly Glue ETL job silently fails some weeks — dashboards go stale before anyone notices. What's the standard way to get alerted on job failures?

Analysts should query a data lake table but must not see the salary column. Which Lake Formation capability enforces this — and why is a table-level deny insufficient?

A data lake in S3 adds new files daily. Analysts want to query them in Athena without manually defining table schemas. What keeps table metadata up to date automatically?

A large fact table in Redshift is always joined to a customer dimension table on customer_id. Which distribution minimizes data movement across nodes during those joins?

A team has interdependent ETL jobs — job B only after job A succeeds, with retries and alerting — and wants managed Apache Airflow. Which service runs Airflow on AWS without self-managing?

Analysts should query a data lake table but only see non-sensitive columns — salary and SSN must be hidden. Which approach enforces column-level access centrally?

Before data lands in the curated zone, the team must validate row counts, null rates, and value ranges — failing checks should stop the pipeline. Which Glue feature expresses these rules?

Analysts run complex SQL joins over terabytes of curated data several times a day, need sub-minute response, and concurrency for ~50 users. Which engine fits best?

A new event stream's volume is unpredictable — spiky, ranging 10x between quiet and peak. The team wants no capacity planning or shard management. Which Kinesis mode applies?

Before opening a data lake to more teams, governance wants an automated inventory of which S3 objects contain PII. Which service discovers this?

A security team wants a single pane of glass aggregating findings from GuardDuty, Inspector, Macie, and third-party tools across all accounts, with severity scoring and automated remediation. Which service?

A platform team wants every developer to manage their own IAM roles, but no role a developer creates may exceed a defined permission ceiling. Which mechanism enforces this ceiling on self-service role creation?

An application encrypts large volumes of data. KMS has a 4 KB limit per Encrypt call. How does KMS handle encryption of larger data?

Which TWO services record WHO did WHAT and WHEN in an AWS account — forming the audit trail for security investigations? (Select TWO.)

CloudTrail shows an IAM user's access key making API calls from an unknown IP — the key is compromised. What's the correct FIRST response?

A public web application behind an ALB faces repeated SQL-injection attempts and L7 floods. Which AWS services address application-layer attacks? (Choose the best single answer.)

Which service detects a pattern like 'IAM credentials being used from an unusual geography combined with crypto-mining API calls' as a managed threat-detection finding?

A security team must ensure no member account can disable CloudTrail or remove itself from the organization. Which control enforces this at the organization level?

GuardDuty flags an EC2 instance communicating with a known botnet C2 server. The IR playbook requires isolating the instance while preserving it for forensics. What's the correct containment step?

A security review requires defense-in-depth at the network layer for a three-tier app. Which TWO controls operate at DIFFERENT network layers and complement each other? (Select TWO.)

A security team uses GuardDuty, Inspector, and third-party tools — each producing findings in different formats. They want one normalized store where findings can be correlated and routed to response. What's the aggregation point?

Account A's application (running as an IAM role) must read objects in Account B's S3 bucket. What's the complete permission requirement for a cross-account role assumption pattern?

You want developers to create IAM roles for their Lambda functions but never grant those roles more permissions than a defined maximum. What enforces that ceiling?

Your security policy requires yearly rotation of KMS keys encrypting S3 data. Which option rotates backing key material with the least operational effort?

A team pushes container images to ECR and wants vulnerabilities detected automatically on push and continuously as new CVEs publish. What should they use?

Security wants one audit trail capturing API activity across all 80 accounts in the AWS Organization, delivered to a dedicated log-archive account. What is the cleanest setup?

GuardDuty flags an EC2 instance for crypto-mining. IR must preserve evidence while cutting the instance off from the network immediately. Which first actions isolate it?

Landing zone design: which statement correctly maps Control Tower guardrail types?

Why can a security group allow outbound HTTPS to the internet without an explicit inbound rule for the response traffic?

A GuardDuty finding shows an EC2 instance talking to a known-malicious IP. The team wants to visualize related API calls, network flows, and IAM activity around it — without building queries. Which service is designed for this triage?

A company needs a dedicated, private connection from their data center to AWS with consistent low-latency bandwidth that bypasses the public internet. Which service provides this?

An organization has 50 VPCs across 3 Regions plus on-premises networks that all need to communicate. VPC peering would create an unmanageable mesh. What provides scalable hub-and-spoke connectivity?

On-premises servers must resolve private Route 53 hosted zone records, and AWS resources must resolve the on-premises corporate DNS zone. Which Route 53 Resolver feature pair enables both directions?

Security policy requires all egress traffic from workload VPCs to be inspected by an inline stateful firewall before reaching the internet. Which managed service provides this?

An EC2 instance in one VPC can't reach an RDS instance in a peered VPC. Security groups look correct. Which AWS tool analyzes the full network path — route tables, NACLs, peering — and identifies the blocking hop?

A live-streaming platform needs global TCP/UDP traffic delivered with the lowest possible latency to a regional endpoint — not HTTP content caching. Which service fits?

A SaaS runs active endpoints in us-east-1 and eu-west-1. European users should hit the EU stack — and if it becomes unhealthy, traffic must failover automatically. Which Route 53 configuration applies?

A company must expose an internal API to partner VPCs — without internet exposure, VPC peering (CIDRs overlap), or giving partners broad network access. What's the secure sharing mechanism?

An app intermittently loses connectivity to a partner API. Ops suspects a stateless rule is dropping return traffic. Which log record would confirm a blocked connection attempt?

A financial firm's production workloads depend on Direct Connect to AWS. Leadership requires the hybrid link to survive any single facility or device failure. What's the resilient design?

A Transit Gateway connects prod, dev, and shared-services VPCs. Prod and dev must NOT reach each other but both must reach shared services. How is this enforced at the TGW layer?

Security policy requires all outbound internet traffic from 20 workload VPCs to pass through deep packet inspection. What's the scalable architecture?

A company will peer five VPCs and later connect on-prem networks over Direct Connect. What is the most important design decision up front?

A workload needs consistent, low-latency private connectivity between a data center and AWS with predictable bandwidth — the connection must not traverse the public internet. Which option fits?

Ten VPCs attach to a Transit Gateway. Two 'shared services' VPCs must be reachable by all, but the eight workload VPCs must not reach each other. How is this enforced?

A security team needs full packet copies from specific EC2 instances sent to an appliance for deep-packet inspection — without installing agents. What provides this?

A VPC runs dual-stack. IPv6 instances in a private subnet must reach the internet but must NOT accept inbound connections initiated from the internet. What provides this?

A failover record should point to an internal ALB in a private subnet. Route 53 health checkers can't reach private IPs. How do you health-check it?

Ops wants a single topology view of Transit Gateways, attachments, and on-prem devices across all regions and accounts — including DX and VPN status. Which service provides it?

On-prem needs private connectivity to 30 VPCs across regions via a single Direct Connect link, with full VPC-to-VPC segmentation control. Which architecture scales?

An enterprise wants separate AWS accounts per environment (dev/staging/prod) and per business unit, with centrally enforced guardrails and shared logging. Which approach provides scalable multi-account governance?

A legacy application runs on physical servers. The business wants to migrate quickly with minimal code changes now, then modernize later. Which migration strategy fits best?

A financial services app needs: RPO near zero, RTO under 5 minutes, and cost sensitivity for non-production environments. Which DR architecture balances all three constraints?

Shared services (DNS, security inspection, logging collectors) must be reachable from 100+ workload VPCs across accounts. What's the scalable way to provide centralized shared services?

A company with 40 accounts in AWS Organizations can't tell which teams drive cost growth and wants per-team visibility plus right-sizing recommendations. Which combination addresses this?

An Aurora MySQL cluster's read traffic has grown 10x; the writer is fine but read queries queue. What's the simplest scaling path that keeps the current architecture?

A global app needs low-latency reads for users on three continents with writes consolidated to one Region — no multi-Region write conflict handling allowed. Which design fits?

A 4 TB Oracle database must migrate to Aurora PostgreSQL with under 30 minutes of downtime. Which approach achieves near-zero-downtime migration including heterogeneous schema conversion?

A company wants to guarantee — across 50 accounts — that workloads run only in two approved Regions, even for account admins. Which mechanism enforces this?

A payments system needs RTO under 15 minutes and RPO under 1 minute in a second Region, but finance rejects the cost of full capacity standby. Which DR strategy fits the budget and targets?

A data lake holds 3 PB in S3 Standard. Access patterns: hot for 90 days, occasional for a year, then rare but must stay retrievable for compliance. What's the most cost-effective design?

Before designing a migration, architects need inventory: which servers exist, their dependencies, and utilization for right-sizing. Which TWO AWS tools support this discovery? (Select TWO.)

A company needs a governed multi-account environment — account vending with guardrails, centralized logging, and a dashboard — provisioned quickly rather than hand-built. Which service delivers the managed landing zone?

An on-premises app generates files that must stay locally accessible with low latency while tiering seamlessly to cloud storage with NFS/SMB access. Which hybrid storage pattern fits?

Two migration needs: (a) 500 TB over a slow, congested link — bandwidth math says months; (b) 20 TB on a decent connection that must sync repeatedly until cutover. Which services fit each?

Leadership can't tell which team owns which cloud spend. What's the foundational step toward per-team cost allocation and accountability?

A global app must accept writes in two regions simultaneously, survive a full regional outage with near-zero RPO, and resolve write conflicts. Which data-layer combination supports true active-active?

200 on-prem VMs must reach AWS in 6 months. The team wants minimal app changes now, then modernize later. Which migration approach and service fit?

A security team in a dedicated account must centrally manage GuardDuty findings, Security Hub, and Config aggregator for the whole organization — without using the management account daily. What pattern applies?

Across dozens of accounts, leadership wants data-driven recommendations to downsize over-provisioned EC2 instances and pick better instance types. Which service generates these recommendations from utilization history?