Explanation
Correct option:
Customer Managed CMK
A customer master key (CMK) is a logical representation of a master key. The CMK
includes metadata, such as the key ID, creation date, description, and key state.
The CMK also contains the key material used to encrypt and decrypt data. These
are created and managed by the AWS customer. Access to these can be
controlled using the AWS IAM service.
Incorrect options:
Secrets Manager – AWS Secrets Manager helps you protect secrets needed to
access your applications, services, and IT resources. The service enables you to
easily rotate, manage, and retrieve database credentials, API keys, and other
secrets throughout their lifecycle. You cannot use Secrets Manager for creating
and using your own keys for encryption on AWS services.
AWS Managed CMK – AWS managed CMKs are CMKs in your account that are
created, managed, and used on your behalf by an AWS service that is integrated
with AWS KMS.
AWS Owned CMK – AWS owned CMKs are a collection of CMKs that an AWS
service owns and manages for use in multiple AWS accounts. AWS owned CMKs
are not in your AWS account. You cannot view or manage these CMKs.
Reference:
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master
_keys

Explanation
Correct options:
There are three best practice areas for Reliability in the cloud – Foundations,
Change Management, Failure Management. Being aware of how change affects a
system (change management) allows you to plan proactively, and monitoring
allows you to quickly identify trends that could lead to capacity issues or SLA
breaches.
AWS Config – AWS Config is a service that enables you to assess, audit, and
evaluate the configurations of your AWS resources. Config continuously monitors
and records your AWS resource configurations and allows you to automate the
evaluation of recorded configurations against desired configurations.
How AWS Config Works: via – https://aws.amazon.com/config/
AWS CloudTrail – AWS CloudTrail is a service that enables governance,
compliance, operational auditing, and risk auditing of your AWS account. With
CloudTrail, you can log, continuously monitor, and retain account activity related
to actions across your AWS infrastructure. CloudTrail provides event history of
your AWS account activity, including actions taken through the AWS Management
Console, AWS SDKs, command-line tools, and other AWS services.
How CloudTrail Works: via – https://aws.amazon.com/cloudtrail/
Incorrect options:
AWS Trusted Advisor – AWS Trusted Advisor is an online tool that provides you
real-time guidance to help you provision your resources following AWS best
practices on cost optimization, security, fault tolerance, service limits, and
performance improvement.
Amazon Inspector – Amazon Inspector is an automated security assessment
service that helps improve the security and compliance of applications deployed
on AWS. Amazon Inspector automatically assesses applications for exposure,
vulnerabilities, and deviations from best practices.
Amazon CloudWatch – Amazon CloudWatch is a monitoring and observability
service built for DevOps engineers, developers, site reliability engineers (SREs),
and IT managers. CloudWatch provides data and actionable insights to monitor
applications, respond to system-wide performance changes, optimize resource
utilization, and get a unified view of operational health.
References:
https://d1.awsstatic.com/whitepapers/architecture/AWS_WellArchitected_Framework.pdf
https://aws.amazon.com/config/
https://aws.amazon.com/cloudtrail/

Explanation
Correct options:
“EBS volume can be attached to a single instance in the same Availability Zone
whereas EFS file system can be mounted on instances across multiple Availability
Zones”
Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully
managed elastic NFS file system for use with AWS Cloud services and onpremises resources. It is built to scale on-demand to petabytes without
disrupting applications, growing and shrinking automatically as you add and
remove files, eliminating the need to provision and manage capacity to
accommodate growth.
The service is designed to be highly scalable, highly available, and highly durable.
Amazon EFS file systems store data and metadata across multiple Availability
Zones in an AWS Region. EFS file system can be mounted on instances across
multiple Availability Zones.
Amazon Elastic Block Store (EBS) is an easy to use, high-performance block
storage service designed for use with Amazon Elastic Compute Cloud (EC2) for
both throughput and transaction-intensive workloads at any scale.
Designed for mission-critical systems, EBS volumes are replicated within an
Availability Zone (AZ) and can easily scale to petabytes of data. EBS volume can
be attached to a single instance in the same Availability Zone.
Incorrect options:
“EBS volume can be attached to instances in multiple Availability Zones and EFS
file system can be mounted on instances in the same Availability Zone”
“EBS volume can be attached to a single instance in the same Availability Zone
and EFS file system can be mounted on instances in the same Availability Zone”
“EBS volume can be attached to instances in multiple Availability Zones and EFS
file system can be mounted on instances across multiple Availability Zones”
These three options contradict the details provided earlier in the explanation, so
these options are incorrect.

Explanation
Correct option:
Configuration Management
Security and Compliance is a shared responsibility between AWS and the
customer. This shared model can help relieve the customer’s operational burden
as AWS operates, manages and controls the components from the host operating
system and virtualization layer down to the physical security of the facilities in
which the service operates.
Controls that apply to both the infrastructure layer and customer layers, but in
completely separate contexts or perspectives are called shared controls. In a
shared control, AWS provides the requirements for the infrastructure and the
customer must provide their own control implementation within their use of AWS
services. Configuration Management forms a part of shared controls – AWS
maintains the configuration of its infrastructure devices, but a customer is
responsible for configuring their own guest operating systems, databases, and
applications.
Shared Responsibility Model Overview: via –
https://aws.amazon.com/compliance/shared-responsibility-model/
Incorrect options:
Infrastructure maintenance of Amazon S3 storage servers – AWS is responsible
for protecting the infrastructure that runs all of the services offered in the AWS
Cloud.
Guarentee data separation among various AWS customers – AWS is responsible
for protecting the infrastructure that runs all of the services offered in the AWS
Cloud. This infrastructure is composed of the hardware, software, networking,
and facilities that run AWS Cloud services.
Availability Zone infrastructure maintenance – AWS is responsible for protecting
the infrastructure that runs all of the services offered in the AWS Cloud.
Reference:
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master
_keys

Explanation
Correct option:
AWS Storage Gateway
AWS Storage Gateway is a hybrid cloud storage service that connects your
existing on-premises environments with the AWS Cloud. Customers use Storage
Gateway to simplify storage management and reduce costs for key hybrid cloud
storage use cases. These include moving tape backups to the cloud, reducing onpremises storage with cloud-backed file shares, providing low latency access to
data in AWS for on-premises applications, as well as various migration, archiving,
processing, and disaster recovery use cases.
AWS Storage Gateway service provides three different types of gateways – Tape
Gateway, File Gateway, and Volume Gateway – that seamlessly connect onpremises applications to cloud storage, caching data locally for low-latency
access.
Incorrect options:
“AWS Direct Connect” – AWS Direct Connect creates a dedicated private
connection from a remote network to your VPC. This is a private connection and
does not use the public internet. Takes at least a month to establish this
connection. Direct Connect is a connectivity service and you cannot use it to
provide AWS Cloud based storage access to on-premises applications.
“AWS Snowball” – AWS Snowball is a data transport solution that accelerates
moving terabytes to petabytes of data into and out of AWS services using storage
devices designed to be secure for physical transport. You cannot use Snowball to
provide AWS Cloud based storage access to on-premises applications.
“Amazon EBS” – Amazon Elastic Block Store (EBS) is an easy to use, highperformance block storage service designed for use with Amazon Elastic
Compute Cloud (EC2) instances for both throughput and transaction-intensive
workloads at any scale. You cannot use EBS to provide AWS Cloud based storage
access to on-premises applications.
Reference:
https://aws.amazon.com/storagegateway/features/

Explanation
Correct options:
Amazon Route 53
AWS Global Accelerator
AWS Shield Standard is activated for all AWS customers, by default. For higher
levels of protection against attacks, you can subscribe to AWS Shield Advanced.
With Shield Advanced, you also have exclusive access to advanced, real-time
metrics and reports for extensive visibility into attacks on your AWS resources.
With the assistance of the DRT (DDoS response team), AWS Shield Advanced
includes intelligent DDoS attack detection and mitigation for not only for network
layer (layer 3) and transport layer (layer 4) attacks but also for application layer
(layer 7) attacks.
AWS Shield Advanced provides expanded DDoS attack protection for web
applications running on the following resources: Amazon Elastic Compute Cloud,
Elastic Load Balancing (ELB), Amazon CloudFront, Amazon Route 53, AWS Global
Accelerator.
Incorrect options:
Amazon API Gateway – Amazon API Gateway is a fully managed service that
makes it easy for developers to create, publish, maintain, monitor, and secure
APIs at any scale. APIs act as the “front door” for applications to access data,
business logic, or functionality from your backend services. Amazon Web
Application Firewall is used to monitor the HTTP and HTTPS requests that are
forwarded to an Amazon API Gateway API. It is not covered under AWS Shield
Advanced.
AWS CloudFormation – AWS CloudFormation allows you to use programming
languages or a simple text file to model and provision, in an automated and
secure manner, all the resources needed for your applications across all regions
and accounts. CloudFormation is not covered under AWS Shield Advanced.
AWS Elastic Beanstalk – AWS Elastic Beanstalk is an easy-to-use service for
deploying and scaling web applications and services developed with various
programming languages. You can simply upload your code and Elastic Beanstalk
automatically handles the deployment, from capacity provisioning, load
balancing, auto-scaling to application health monitoring. Elastic Beanstalk is
covered under AWS Shield Standard. Advanced coverage is not offered for this
service.
Reference: https://docs.aws.amazon.com/waf/latest/developerguide/ddosoverview.html

Explanation
Correct options:
S3 – Amazon Simple Storage Service (Amazon S3) is an object storage service that
offers industry-leading scalability, data availability, security, and performance.
EFS – Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully
managed elastic NFS file system for use with AWS Cloud services and on-
premises resources. It is built to scale on-demand to petabytes without
disrupting applications, growing and shrinking automatically as you add and
remove files, eliminating the need to provision and manage capacity to
accommodate growth.
Incorrect options:
EC2 – Amazon EC2 is a web service that provides secure, resizable compute
capacity in the AWS cloud. You can use EC2 to provision virtual servers on AWS
Cloud.
SQS – Amazon Simple Queue Service (SQS) is a fully managed message queuing
service that enables you to decouple and scale microservices, distributed
systems, and serverless applications. Using SQS, you can send, store, and receive
messages between software components at any volume, without losing messages
or requiring other services to be available.
SNS – Amazon Simple Notification Service (SNS) is a highly available, durable,
secure, fully managed pub/sub messaging service that enables you to decouple
microservices, distributed systems, and serverless applications. Using Amazon
SNS topics, your publisher systems can fan-out messages to a large number of
subscriber endpoints for parallel processing, including Amazon SQS queues, AWS
Lambda functions, and HTTP/S webhooks. Additionally, SNS can be used to fan
out notifications to end users using mobile push, SMS, and email.

Explanation
Correct option:
Partial upfront payment option with standard 3-years term
You can use Amazon EC2 Reserved Instances to reserve capacity and receive a
discount on your instance usage compared to running On-Demand instances. The
discounted usage price is reserved for the duration of your contract, allowing you
to predict compute costs over the term of the Reserved Instance.
Please review this pricing comparison for EC2 Reserved Instances: via –
https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf
So the percentage savings for each option is as follows:
“No upfront payment option with the standard 1-year term” – 36%
“All upfront payment option with the standard 1-year term” – 40%
“No upfront payment option with the standard 3-years term” – 56%
“Partial upfront payment option with the standard 3-years term” – 59%
Exam Alert:
For the exam, there is no need to memorize these savings numbers. All you need
to remember is that a 3 years term would always be more cost-effective than a 1-
year term. Then within a term, “all upfront” is better than “partial upfront” which
in turn is better than “no upfront” from a cost savings perspective.
Incorrect options:
No upfront payment option with standard 1-year term
No upfront payment option with standard 1-year term
No upfront payment option with standard 3-years term
These three options contradict the details provided earlier in the explanation, so
these options are incorrect.
Reference:
https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf

Explanation
Correct option:
AWS Elastic Load Balancing
Elastic Load Balancing is used to automatically distribute your incoming
application traffic across all the EC2 instances that you are running. You can use
Elastic Load Balancing to manage incoming requests by optimally routing traffic
so that no one instance is overwhelmed. Your load balancer acts as a single point
of contact for all incoming web traffic to your application. When an instance is
added, it needs to register with the load balancer or no traffic is routed to it.
When an instance is removed, it must deregister from the load balancer or traffic
continues to be routed to it.
Incorrect options:
AWS Elastic Beanstalk – AWS Elastic Beanstalk is an easy-to-use service for
deploying and scaling web applications and services developed in a variety of
programming languages. You can simply upload your code and Elastic Beanstalk
automatically handles the deployment, from capacity provisioning, load
balancing, auto-scaling to application health monitoring. You cannot use
Beanstalk to distribute incoming traffic across multiple targets.
Amazon Elasticsearch – The term “Elasticsearch” is used to define a distributed,
open source search and analytics engine for all types of data, including textual,
numerical, geospatial, structured, and unstructured. Amazon Elasticsearch
Service is a fully managed service that makes it easy to deploy, secure, and run
Elasticsearch cost effectively at scale. It is a search and analytics service from
Amazon.
AWS Auto Scaling – AWS Auto Scaling monitors your applications and
automatically adjusts capacity to maintain steady, predictable performance at
the lowest possible cost. Using AWS Auto Scaling, it’s easy to setup application
scaling for multiple resources across multiple services in minutes. This is a scaling
service that helps you spin up resources as and when you need them and scale
down when the high demand reduces. Auto Scaling can be used with Elastic Load
Balacing to build high performance applications.
Reference:
https://aws.amazon.com/elasticloadbalancing/

Explanation
Correct option:
Step Function, DynamoDB, Lambda
AWS provides a set of fully managed services that you can use to build and run
serverless applications. Serverless applications don’t require provisioning,
maintaining, and administering servers for backend components such as
compute, databases, storage, stream processing, message queueing, and more.
You also no longer need to worry about ensuring application fault tolerance and
availability.
The AWS serverless platform overview: via –
https://aws.amazon.com/serverless/
AWS Step Function lets you coordinate multiple AWS services into serverless
workflows. You can design and run workflows that stitch together services such
as AWS Lambda, AWS Glue and Amazon SageMaker.
Amazon DynamoDB is a key-value and document database that delivers singledigit millisecond performance at any scale. It’s a fully managed, multi-Region,
multi-master, durable database with built-in security, backup and restore, and inmemory caching for internet-scale applications.
AWS Lambda lets you run code without provisioning or managing servers.
Incorrect options:
Amazon EMR is the industry-leading cloud big data platform for processing vast
amounts of data using open source tools such as Hadoop, Apache Spark, Apache
Hive, Apache HBase, Apache Flink, Apache Hudi, and Presto. Amazon EMR can be
used to provision resources to run big data workloads on Hadoop clusters. EMR
provisions EC2 instances to manage its workload. EMR is not a serverless
service.
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides
secure, resizable compute capacity in the cloud with support for per-second
billing. It is the easiest way to provision servers on AWS Cloud and access the
underlying OS. EC2 is not a serverless service.
Step Function, DynamoDB, EC2
EMR, DynamoDB, Lambda
EC2, DynamoDB, Lambda
As each of these three stacks has either EC2 or EMR, therefore, these options are
incorrect.
Reference:
https://aws.amazon.com/serverless/

Explanation
The most suitable AWS service for ensuring governance, compliance, and
auditing of AWS account activity is CloudTrail.
Here’s a breakdown of how CloudTrail addresses these requirements:
o Logging and auditing: CloudTrail records all API calls made to your AWS
account, providing a detailed log of all actions performed. This enables
you to track and audit resource changes, identify security incidents, and
ensure compliance with regulations.
o Governance: CloudTrail can be used to enforce governance policies by
analyzing user activity and identifying deviations from established
standards. You can set up alerts and notifications to be notified of any
suspicious or non-compliant activities.
o Compliance: CloudTrail logs can be used to demonstrate compliance with
various industry standards and regulations, such as HIPAA, PCI DSS, and
GDPR. You can use CloudTrail to track access to sensitive data, monitor
user activity, and ensure that your AWS account is configured according
to compliance requirements.
While CloudWatch, Config, and Trusted Advisor can also be used for monitoring
and management of AWS resources, CloudTrail is specifically designed for logging
and auditing of AWS account activity, making it the most suitable choice for this
use case.
Reference:
https://aws.amazon.com/cloudtrail/

Explanation
Correct options:
Leverage AWS Professional Services and set up AWS Landing Zone to accelerate
the infrastructure migration
The AWS Professional Services organization is a global team of experts that can
help you realize your desired business outcomes when using the AWS Cloud. AWS
Professional Services consultants can supplement your team with specialized
skills and experience that can help you achieve quick results.
AWS Landing Zone is a solution that helps customers more quickly set up a
secure, multi-account AWS environment based on AWS best practices. This
solution can help save time by automating the set-up of an environment for
running secure and scalable workloads while implementing an initial security
baseline through the creation of core accounts and resources.
Therefore, leveraging AWS Professional Services along with AWS Landing Zone
can accelerate the infrastructure migration for the startup.
Utilize AWS Partner Network (APN) to build a custom solution for this
infrastructure migration
The AWS Partner Network (APN) is the global partner program for technology and
consulting businesses that leverage Amazon Web Services to build solutions and
services for customers. The startup can work with experts from APN to build a
custom solution for this infrastructure migration.
Incorrect options:
Raise a support ticket with AWS Support for further assistance – AWS Support
cannot help with complex infrastructure migration of this nature. Hence this
option is incorrect.
Consult moderators on AWS Developer Forums – This is a made-up option and
has been added as a distractor.
Use AWS Trusted Advisor to automate the infrastructure migration – AWS
Trusted Advisor is an online tool that provides you real-time guidance to help you
provision your resources following AWS best practices on cost optimization,
security, fault tolerance, service limits, and performance improvement. Trusted
Advisor cannot automate the infrastructure migration.
References:
https://aws.amazon.com/partners/
https://aws.amazon.com/professional-services/
https://aws.amazon.com/solutions/implementations/aws-landing-zone/

Explanation
Correct option:
APN Consulting Partner
The AWS Partner Network (APN) is the global partner program for technology and
consulting businesses that leverage Amazon Web Services to build solutions and
services for customers.
APN Consulting Partners are professional services firms that help customers of
all types and sizes design, architect, build, migrate, and manage their workloads
and applications on AWS, accelerating their migration to AWS cloud.
APN Partner Types Overview: via – https://aws.amazon.com/partners/
Incorrect options:
APN Technology Partner – APN Technology Partners provide hardware,
connectivity services, or software solutions that are either hosted on or
integrated with, the AWS Cloud. APN Technology Partners cannot help in
migrating to AWS and managing applications on AWS Cloud.
AWS Trusted Advisor – AWS Trusted Advisor is an online tool that provides you
real-time guidance to help you provision your resources following AWS best
practices on cost optimization, security, fault tolerance, service limits, and
performance improvement. Whether establishing new workflows, developing
applications, or as part of ongoing improvement, recommendations provided by
Trusted Advisor regularly help keep your solutions provisioned optimally. All AWS
customers get access to the seven core Trusted Advisor checks to help increase
the security and performance of the AWS environment. Trusted Advisor cannot
be used to migrate to AWS and manage applications on AWS Cloud.
Concierge Support Team – The Concierge Support Team are AWS billing and
account experts that specialize in working with enterprise accounts. They will
quickly and efficiently assist you with your billing and account inquiries. The
Concierge Support Team is only available for the Enterprise Support plan.
Concierge Support Team cannot help in migrating to AWS and managing
applications on AWS Cloud.
Reference:
https://aws.amazon.com/partners/

Explanation
Correct option:
The AWS account must be able to operate as a standalone account. Only then it
can be removed from AWS organizations
You can remove an account from your organization only if the account has the
information that is required for it to operate as a standalone account. For each
account that you want to make standalone, you must accept the AWS Customer
Agreement, choose a support plan, provide and verify the required contact
information, and provide a current payment method. AWS uses the payment
method to charge for any billable (not AWS Free Tier) AWS activity that occurs
while the account isn’t attached to an organization.
Incorrect options:
Raise a support ticket with AWS Support to remove the account – AWS Support
does not need to help you in removing an AWS account from AWS
Organizations.
The AWS account can be removed from AWS Systems Manager – AWS Systems
Manager gives you visibility and control of your infrastructure on AWS. Systems
Manager provides a unified user interface so you can view operational data from
multiple AWS services and allows you to automate operational tasks such as
running commands, managing patches, and configuring servers across AWS
Cloud as well as on-premises infrastructure. Systems Manager cannot be used to
remove an AWS account from AWS Organizations.
The AWS account must not have any Service Control Policies (SCPs) attached to
it. Only then it can be removed from AWS organizations – This is not a prerequisite to remove the AWS account. The principals in the AWS account are no
longer affected by any service control policies (SCPs) that were defined in the
organization. This means that restrictions imposed by those SCPs are gone, and
the users and roles in the account might have more permissions than they had
before.
Reference:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_acco
unts_remove.html

Explanation
Correct option:
Elastic Block Store (EBS) backups using EBS snapshots
Security and Compliance is a shared responsibility between AWS and the
customer. This shared model can help relieve the customer’s operational burden
as AWS operates, manages, and controls the components from the host
operating system and virtualization layer down to the physical security of the
facilities in which the service operates.
AWS is responsible for security “of” the Cloud and customer is responsible for
security “in” the cloud. Customers are responsible for managing their data
(including encryption options), classifying their assets, and using IAM tools to
apply the appropriate permissions. Creating a backup for EBS volumes is the
responsibility of the customer.
Shared Responsibility Model Overview: via –
https://aws.amazon.com/compliance/shared-responsibility-model/
Incorrect options:
Edge Location management and maintenance
Availability Zone infrastructure management
Patching/fixing flaws within the AWS infrastructure
AWS is responsible for protecting the infrastructure that runs all of the services
offered in the AWS Cloud. This infrastructure is composed of the hardware,
software, networking, and facilities that run AWS Cloud services. Therefore these
three options fall under the ambit of AWS as per the shared responsibility
model.
Reference:
https://aws.amazon.com/compliance/shared-responsibility-model/

Explanation
Correct option:
Use Amazon Transcribe to convert speech to text for downstream analysis. Then
use Amazon Polly to convey the text results via speech
You can use Amazon Transcribe to add speech-to-text capability to your
applications. Amazon Transcribe uses a deep learning process called automatic
speech recognition (ASR) to convert speech to text quickly and accurately.
Amazon Transcribe can be used to transcribe customer service calls, to automate
closed captioning and subtitling, and to generate metadata for media assets.
Amazon Transcribe Use-Cases: via – https://aws.amazon.com/transcribe/
You can use Amazon Polly to turn text into lifelike speech thereby allowing you to
create applications that talk. Polly’s Text-to-Speech (TTS) service uses advanced
deep learning technologies to synthesize natural sounding human speech.
Amazon Polly Benefits: via – https://aws.amazon.com/polly/
Amazon Translate is used for language translation. Amazon Translate uses neural
machine translation via deep learning models to deliver more accurate and more
natural-sounding translation than traditional statistical and rule-based
translation algorithms.
Incorrect options:
Use Amazon Polly to convert speech to text for downstream analysis. Then use
Amazon Transcribe to convey the text results via speech – Amazon Polly cannot
be used to convert speech to text, so this option is incorrect.
Use Amazon Translate to convert speech to text for downstream analysis. Then
use Amazon Polly to convey the text results via speech – Amazon Translate
cannot convert speech to text, so this option is incorrect.
Use Amazon Polly to convert speech to text for downstream analysis. Then use
Amazon Translate to convey the text results via speech – Amazon Polly cannot be
used to convert speech to text, so this option is incorrect.
References:
https://aws.amazon.com/transcribe/
https://aws.amazon.com/polly

Explanation
Correct options:
Each AWS Region consists of two or more Availability Zones
Each Availability Zone (AZ) consists of one or more discrete data centers
AWS has the concept of a Region, which is a physical location around the world
where AWS clusters data centers. Each AWS Region consists of multiple (two or
more), isolated, and physically separate AZ’s within a geographic area. Each AZ
has independent power, cooling, and physical security and is connected via
redundant, ultra-low-latency networks.
An Availability Zone (AZ) is one or more discrete data centers with redundant
power, networking, and connectivity in an AWS Region. All AZ’s in an AWS Region
are interconnected with high-bandwidth, low-latency networking, over fully
redundant, dedicated metro fiber providing high-throughput, low-latency
networking between AZ’s.
AWS Regions and Availability Zones Overview: via –
https://aws.amazon.com/about-aws/global-infrastructure/regions_az/
Incorrect options:
Each AWS Region consists of one or more Availability Zones
Each Availability Zone (AZ) consists of two or more discrete data centers
Each AWS Region consists of two or more Edge Locations
These three options contradict the details provided earlier in the explanation, so
these options are incorrect.
Reference:
https://aws.amazon.com/about-aws/global-infrastructure/regions_az/

Explanation
Correct option:
SQS – Amazon Simple Queue Service (SQS) is a fully managed message queuing
service that enables you to decouple and scale microservices, distributed
systems, and serverless applications. Using SQS, you can send, store, and receive
messages between software components at any volume, without losing messages
or requiring other services to be available.
SNS – Amazon Simple Notification Service (SNS) is a highly available, durable,
secure, fully managed pub/sub messaging service that enables you to decouple
microservices, distributed systems, and serverless applications. Using Amazon
SNS topics, your publisher systems can fan-out messages to a large number of
subscriber endpoints for parallel processing, including Amazon SQS queues, AWS
Lambda functions, and HTTP/S webhooks. Additionally, SNS can be used to fan
out notifications to end users using mobile push, SMS, and email.
Therefore, both SNS and SQS can be used to decouple components of a
microservices-based application.
Please review this reference architecture for building a decoupled order
processing system using SNS and SQS: via –
https://aws.amazon.com/blogs/compute/building-loosely-coupled-scalable-capplications-with-amazon-sqs-and-amazon-sns/
Incorrect options:
EC2 – Amazon Elastic Compute Cloud (Amazon EC2) is a web service that
provides secure, resizable compute capacity in the cloud with support for persecond billing. It is the easiest way to provision servers on AWS Cloud and access
the underlying OS. EC2 cannot be used to decouple components of a
microservices-based application.
Lambda – AWS Lambda lets you run code without provisioning or managing
servers. You pay only for the compute time you consume. Lambda cannot be
used to decouple components of a microservices-based application.
Step Function – AWS Step Function lets you coordinate multiple AWS services
into serverless workflows. You can design and run workflows that stitch together
services such as AWS Lambda, AWS Glue and Amazon SageMaker. Step Function
cannot be used to decouple components of a microservices-based application.
Reference:
https://aws.amazon.com/blogs/compute/building-loosely-coupled-scalable-capplications-with-amazon-sqs-and-amazon-sns/
https://aws.amazon.com/microservices/

Explanation
Correct option:
AWS Budgets
AWS Budgets gives you the ability to set custom budgets that alert you when
your costs or usage exceed (or are forecasted to exceed) your budgeted
amount.
You can also use AWS Budgets to set reservation utilization or coverage targets
and receive alerts when your utilization drops below the threshold you define.
Reservation alerts are supported for Amazon EC2, Amazon RDS, Amazon
Redshift, Amazon ElastiCache, and Amazon Elasticsearch reservations.
Incorrect options:
AWS Simple Monthly Calculator – The Simple Monthly Calculator provides an
estimate of usage charges for AWS services based on certain information you
provide. It helps customers and prospects estimate their monthly AWS bill more
efficiently. You cannot use this service to receive alerts when the reservation
utilization falls below the defined threshold.
AWS CloudTrail – AWS CloudTrail is a service that enables governance,
compliance, operational auditing, and risk auditing of your AWS account. With
CloudTrail, you can log, continuously monitor, and retain account activity related
to actions across your AWS infrastructure. CloudTrail provides event history of
your AWS account activity, including actions taken through the AWS Management
Console, AWS SDKs, command-line tools, and other AWS services. You cannot
use this service to receive alerts when the reservation utilization falls below the
defined threshold.
AWS Trusted Advisor – AWS Trusted Advisor is an online tool that provides realtime guidance to help provision your resources following AWS best practices.
Whether establishing new workflows, developing applications, or as part of
ongoing improvement, recommendations provided by Trusted Advisor regularly
help keep your solutions provisioned optimally. AWS Trusted Advisor analyzes
your AWS environment and provides best practice recommendations in five
categories: Cost Optimization, Performance, Security, Fault Tolerance, Service
Limits. You cannot use this service to receive alerts when the reservation
utilization falls below the defined threshold.
References:
https://aws.amazon.com/aws-cost-management/aws-budgets/
https://aws.amazon.com/premiumsupport/technology/trusted-advisor/bestpractice-checklist/

Explanation
Correct option:
CloudTrail Logs
AWS CloudTrail is a service that enables governance, compliance, operational
auditing, and risk auditing of your AWS account. CloudTrail can be used to record
AWS API calls and other activity for your AWS account and save the recorded
information to log files in an Amazon Simple Storage Service (Amazon S3) bucket
that you choose. By default, the log files delivered by CloudTrail to your S3
bucket are encrypted using server-side encryption with Amazon S3–managed
encryption keys (SSE-S3).
Incorrect options:
Elastic File Storage (EFS) – Amazon Elastic File System (Amazon EFS) provides a
simple, scalable, fully managed elastic NFS file system for use with AWS Cloud
services and on-premises resources. Amazon EFS supports two forms of
encryption for file systems, encryption of data in transit and encryption at rest.
This is an optional feature and has to be enabled by user if needed.
Elastic Block Storage (EBS) – Amazon Elastic Block Store (EBS) is an easy to use,
high-performance block storage service designed for use with Amazon Elastic
Compute Cloud (EC2) instances for both throughput and transaction-intensive
workloads at any scale. Encryption (at rest and during transit) is an optional
feature for EBS and has to be enabled by the user.
Amazon S3 – Amazon Simple Storage Service is storage for the Internet. To
upload data into S3 you need to create an S3 bucket in one of the AWS Regions.
Amazon S3 default encryption provides a way to set the default encryption
behavior for an S3 bucket. Encryption for an S3 bucket is an additional feature
and the user needs to enable it.
Reference:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encryptingcloudtrail-log-files-with-aws-kms.html

Correct options:
CloudWatch – Amazon CloudWatch is a monitoring and observability service built
for DevOps engineers, developers, site reliability engineers (SREs), and IT
managers. CloudWatch provides data and actionable insights to monitor
applications, respond to system-wide performance changes, optimize resource
utilization, and get a unified view of operational health. You can create an
CloudWatch alarm that sends an email message using Amazon SNS when the
alarm changes state from OK to ALARM. The alarm changes to the ALARM state
when the average CPU use of an EC2 instance exceeds a specified threshold for
consecutive specified periods.
SNS – Amazon Simple Notification Service (SNS) is a highly available, durable,
secure, fully managed pub/sub messaging service that enables you to decouple
microservices, distributed systems, and serverless applications.
How SNS Works: via – https://aws.amazon.com/sns/
Incorrect options:
CloudTrail – AWS CloudTrail is a service that enables governance, compliance,
operational auditing, and risk auditing of your AWS account. With CloudTrail, you
can log, continuously monitor, and retain account activity related to actions
across your AWS infrastructure. Think account-specific activity and audit; think
CloudTrail. CloudTrail cannot be used to monitor CPU utilization for EC2
instances or send emails.
Lambda – AWS Lambda lets you run code without provisioning or managing
servers. You pay only for the compute time you consume. Lambda cannot be
used to monitor CPU utilization for EC2 instances or send emails.
SQS – Amazon Simple Queue Service (SQS) is a fully managed message queuing
service that enables you to decouple and scale microservices, distributed
systems, and serverless applications. SQS offers two types of message queues –
Standard queues vs FIFO queues. SQS cannot be used to monitor CPU utilization
for EC2 instances or send emails.
References:
https://aws.amazon.com/cloudwatch/
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/US_AlarmA
tThresholdEC2.html

Correct option:
AWS Fargate
AWS Fargate is a serverless compute engine for containers. It works with both
Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service
(EKS). Fargate makes it easy for you to focus on building your applications.
Fargate removes the need to provision and manage servers, lets you specify and
pay for resources per application, and improves security through application
isolation by design. Fargate allocates the right amount of compute, eliminating
the need to choose instances and scale cluster capacity. You only pay for the
resources required to run your containers, so there is no over-provisioning and
paying for additional servers. Fargate runs each task or pod in its kernel providing
the tasks and pods their own isolated compute environment. This enables your
application to have workload isolation and improved security by design.
How Fargate Works: via – https://aws.amazon.com/fargate/
Incorrect options:
Amazon Elastic Container Service (Amazon ECS) – Amazon Elastic Container
Service (Amazon ECS) is a highly scalable, fast, container management service
that makes it easy to run, stop, and manage Docker containers on a cluster.
Unlike Fargate, this is not a fully managed service and you need to manage the
underlying servers yourself.
AWS Lambda – AWS Lambda is a compute service that lets you run code without
provisioning or managing servers. AWS Lambda executes your code only when
needed and scales automatically, from a few requests per day to thousands per
second. Lambda does not support running container applications.
Amazon Elastic Compute Cloud (Amazon EC2) – Amazon Elastic Compute Cloud
(Amazon EC2) is a web service that provides secure, resizable compute capacity
in the cloud, per-second billing, and access to the underlying OS. It is designed to
make web-scale cloud computing easier for developers. Maintenance of the
server and its software has to be done by the customer, so this option is ruled
out.
Reference:
https://aws.amazon.com/fargate/

Correct options:
Quickly resize photos to create thumbnails – You cannot use Rekognition to
resize photos to create thumbnails.
With Amazon Rekognition, you can identify objects, people, text, scenes, and
activities in images and videos, as well as detect any inappropriate content.
Amazon Rekognition also provides highly accurate facial analysis and facial
search capabilities that you can use to detect, analyze, and compare faces for a
wide variety of user verification, people counting, and public safety use cases.
Amazon Rekognition Use-Cases:
via – https://aws.amazon.com/rekognition/
via – https://aws.amazon.com/rekognition/
Incorrect options:
Identify person in a photo
Detect text in a photo
Label objects in a photo
As mentioned in the explanation above, Amazon Rekognition can be used to build
solutions for these use-cases.
Reference: https://aws.amazon.com/rekognition/

Correct option:
Tape Gateway, File Gateway and Volume Gateway
AWS Storage Gateway is a hybrid cloud storage service that connects your
existing on-premises environments with the AWS Cloud. Customers use Storage
Gateway to simplify storage management and reduce costs for key hybrid cloud
storage use cases. These include moving tape backups to the cloud, reducing onpremises
storage with cloud-backed file shares, providing low latency access to
data in AWS for on-premises applications, as well as various migration, archiving,
processing, and disaster recovery use cases.
AWS Storage Gateway service provides three different types of gateways – Tape
Gateway, File Gateway, and Volume Gateway – that seamlessly connect onpremises
applications to cloud storage, caching data locally for low-latency
access.
Gateway Storage Types Overview: via –
https://aws.amazon.com/storagegateway/features/
Incorrect options:
Object Gateway, File Gateway and Block Gateway
Tape Gateway, Object Gateway and Volume Gateway
Tape Gateway, File Gateway and Block Gateway
Block Gateway and Object Gateway are made-up options, so these three options
are incorrect.
Reference:
https://aws.amazon.com/storagegateway/features/

Correct option:
Private – For this deployment model, resources are deployed on-premises using
virtualization technologies. On-premises deployment does not provide many of
the benefits of cloud computing but is sometimes sought for its ability to provide
dedicated resources to meet compliance and regulatory guidelines.
Overview of Cloud Computing Deployment Models: via –
https://aws.amazon.com/types-of-cloud-computing/
Incorrect options:
Cloud – For this type of deployment, a cloud-based application is fully deployed
in the cloud, and all parts of the application run in the cloud. Applications in the
cloud have either been created in the cloud or have been migrated from an
existing infrastructure to take advantage of the benefits of cloud computing.
Hybrid – A hybrid deployment is a way to connect your on-premises
infrastructure to the cloud. The most common method of hybrid deployment is
between the cloud and existing on-premises infrastructure to extend an
organization’s infrastructure into the cloud while connecting cloud resources to
internal systems.
Mixed – This is a made-up option and has been added as a distractor.
Reference:
https://aws.amazon.com/types-of-cloud-computing/

Correct option:
Use S3 One-Zone Infrequent Access (One-Zone IA) to store the thumbnails
S3 One Zone-IA is for data that is accessed less frequently but requires rapid
access when needed. Unlike other S3 Storage Classes which store data in a
minimum of three Availability Zones (AZs), S3 One Zone-IA stores data in a single
AZ and costs 20% less than S3 Standard-IA. S3 One Zone-IA offers the same high
durability, high throughput, and low latency of S3 Standard, with a low per GB
storage price and per GB retrieval fee. Although S3 One Zone-IA offers less
availability than S3 Standard but that’s not an issue for the given use-case since
the thumbnails can be regenerated easily.
As the thumbnails are rarely used but need to be rapidly accessed when
required, so S3 One Zone-IA is the best choice for this use-case.
Exam Alert:
Please review this detailed comparison on S3 Storage Classes as you can expect a
few questions on this aspect of S3: via – https://aws.amazon.com/s3/storageclasses/
Incorrect options:
Use S3 Standard Infrequent Access (Standard-IA) to store the thumbnails – S3
Standard-IA storage class is for data that is accessed less frequently but requires
rapid access when needed. S3 Standard-IA matches the high durability, high
throughput, and low latency of S3 Standard, with a low per GB storage price and
per GB retrieval fee. S3 One Zone-IA costs 20% less than S3 Standard-IA, so this
option is incorrect.
Use S3 Standard to store the thumbnails – S3 Standard offers high durability,
availability, and performance object storage for frequently accessed data. As
described above, S3 One Zone-IA is a better fit than S3 Standard, hence using S3
standard is ruled out for the given use-case.
Use S3 Glacier to store the thumbnails – S3 Glacier is a secure, durable, and lowcost
storage class for data archiving. Although Glacier is cheaper than One Zone-
IA, however the retrieval time ranges from a minute to hours, so this option is
also ruled out for the given use-case.
Reference:
https://aws.amazon.com/s3/storage-classes/

Correct option: AWS Service Health Dashboard
AWS Service Health Dashboard publishes most up-to-the-minute information on
the status and availability of all AWS services in tabular form for all Regions that
AWS is present in. You can check on this page https://status.aws.amazon.com/ to
get current status information.
AWS Service Health Dashboard Overview: via – https://status.aws.amazon.com/
Incorrect options:
AWS CloudFormation – AWS CloudFormation allows you to use programming
languages or a simple text file to model and provision, in an automated and
secure manner, all the resources needed for your applications across all Regions
and accounts. Think infrastructure as code; think CloudFormation.
CloudFormation does not provide the general status of AWS services availability
for all Regions.
AWS Personal Health Dashboard – AWS Personal Health Dashboard provides
alerts and remediation guidance when AWS is experiencing events that may
impact you.
AWS Personal Health Dashboard Overview: via –
https://status.aws.amazon.com/
Exam Alert:
While the Service Health Dashboard displays the general status of AWS services,
Personal Health Dashboard gives you a personalized view of the performance
and availability of the AWS services underlying your AWS resources.
Amazon CloudWatch – Amazon CloudWatch is a monitoring and observability
service built for DevOps engineers, developers, site reliability engineers (SREs),
and IT managers. CloudWatch provides data and actionable insights to monitor
applications, respond to system-wide performance changes, optimize resource
utilization, and get a unified view of operational health. This is an excellent
service for building Resilient systems. Think resource performance monitoring,
events, and alerts; think CloudWatch. CloudWatch does not provide the general
status of AWS services availability for all Regions.
Reference:
https://status.aws.amazon.com/

Correct option:
Amazon Elastic Container Registry (ECR) – Amazon Elastic Container Registry
(ECR) can be used to store, manage, and deploy Docker container images.
Amazon ECR eliminates the need to operate your container repositories. You can
then pull your docker images from ECR and run those on Amazon Elastic
Container Service (ECS).
Please see this schematic diagram to understand how ECR works: via –
https://aws.amazon.com/ecr/
Incorrect options:
Amazon Elastic Container Service (ECS) – Amazon Elastic Container Service
(Amazon ECS) is a highly scalable, fast, container management service that makes
it easy to run, stop, and manage Docker containers on a cluster. You cannot use
ECS to store and deploy docker container images.
Please see this schematic diagram to understand how ECS works: via –
https://aws.amazon.com/ecs/
Amazon EC2 – Amazon EC2 is a web service that provides secure, resizable
compute capacity in the AWS cloud. You can use EC2 to provision virtual servers
on AWS Cloud. You cannot use EC2 to store and deploy docker container
images.
Amazon Lambda – AWS Lambda lets you run code without provisioning or
managing servers. You pay only for the compute time you consume. You cannot
use Lambda to store and deploy docker container images.
References:
https://aws.amazon.com/ecr/
https://aws.amazon.com/ecs/

Correct option: AWS Personal Health Dashboard
AWS Personal Health Dashboard provides alerts and remediation guidance when
AWS is experiencing events that may impact you. With Personal Health
Dashboard, alerts are triggered by changes in the health of your AWS resources,
giving you event visibility, and guidance to help quickly diagnose and resolve
issues.
AWS Personal Health Dashboard Overview: via –
https://status.aws.amazon.com/
Incorrect options:
Amazon Inspector – Amazon Inspector is an automated security assessment
service that helps improve the security and compliance of applications deployed
on AWS. Amazon Inspector automatically assesses applications for exposure,
vulnerabilities, and deviations from best practices. Amazon Inspector cannot be
used to prevent Distributed Denial-of-Service (DDoS) attack. It cannot provide
the status of your AWS resources.
Amazon CloudWatch – Amazon CloudWatch is a monitoring and observability
service built for DevOps engineers, developers, site reliability engineers (SREs),
and IT managers. CloudWatch provides data and actionable insights to monitor
applications, respond to system-wide performance changes, optimize resource
utilization, and get a unified view of operational health. This is an excellent
service for building Resilient systems. Think resource performance monitoring,
events, and alerts; think CloudWatch. It cannot provide the status of your AWS
resources.
AWS Service Health Dashboard – AWS Service Health Dashboard publishes most
up-to-the-minute information on the status and availability of all AWS services in
tabular form for all Regions that AWS is present in. You can check on this page
(https://status.aws.amazon.com/) any time to get current status information or
subscribe to an RSS feed to be notified of interruptions to each service.
AWS Service Health Dashboard Overview: via – https://status.aws.amazon.com/
Exam Alert:
While the Service Health Dashboard displays the general status of AWS services,
Personal Health Dashboard gives you a personalized view of the performance
and availability of the AWS services underlying your AWS resources.
Reference:
https://aws.amazon.com/premiumsupport/technology/personal-healthdashboard/

Correct option:
A VPC spans all of the Availability Zones in the Region whereas a subnet spans
only one Availability Zone in the Region
Amazon Virtual Private Cloud (Amazon VPC) is a logically isolated section of the
AWS Cloud where you can launch AWS resources in a virtual network that you
define. You have complete control over your virtual networking environment,
including the selection of your IP address range, creation of subnets, and
configuration of route tables and network gateways. A VPC spans all of the
Availability Zones in the Region.
A subnet is a range of IP addresses within your VPC. A subnet spans only one
Availability Zone in the Region.
VPC and Subnet Overview: via –
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
Incorrect options:
Both the VPC and the subnet span all of the Availability Zones in the Region
Both the VPC and the subnet span only one Availability Zone in the Region
A subnet spans all of the Availability Zones in the Region whereas a VPC spans
only one Availability Zone in the Region
These three options contradict the details provided earlier in the explanation, so
these options are incorrect.
Reference:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

Correct option:
Latency routing policy
Amazon Route 53 is a highly available and scalable cloud Domain Name System
(DNS) web service. It is designed to give developers and businesses an extremely
reliable and cost-effective way to route end users to Internet applications by
translating names like http://www.example.com into the numeric IP addresses
like 192.0.2.1 that computers use to connect to each other.
If your application is hosted in multiple AWS Regions, you can use latency routing
policy to improve the performance for your users by serving their requests from
the AWS Region that provides the lowest latency. To use latency-based routing,
you create latency records for your resources in multiple AWS Regions. When
Route 53 receives a DNS query for your domain or subdomain (example.com or
acme.example.com), it determines which AWS Regions you’ve created latency
records for, determines which region gives the user the lowest latency, and then
selects a latency record for that region. Route 53 responds with the value from
the selected record, such as the IP address for a web server.
Route 53 Routing Policy Overview: via –
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routingpolicy.
html
Incorrect options:
Failover routing policy – This routing policy is used when you want to configure
active-passive failover.
Weighted routing policy – This routing policy is used to route traffic to multiple
resources in proportions that you specify.
Simple routing policy – With simple routing, you typically route traffic to a single
resource, for example, to a web server for your website.
Reference:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routingpolicy.
html

Correct option:
AWS offers three different support plans to cater to each of its customers –
Developer, Business, and Enterprise Support plans.
A basic support plan is included for all AWS customers.
Business – AWS recommends Business Support if you have production workloads
on AWS and want 24×7 phone, email and chat access to technical support and
architectural guidance in the context of your specific use-cases. Enterprise
Support plan also provides 24×7 phone, email and chat access to technical
support however it’s much costlier than Business Support plan. Developer plan
does not provide 24×7 phone based technical support. Therefore Business
Support plan is the correct option for the given use-case.
Exam Alert:
Please review the differences between the Developer, Business, and Enterprise
support plans as you can expect at least a couple of questions on the exam:
via – https://aws.amazon.com/premiumsupport/plans/
Incorrect options:
Basic – The basic plan only provides access to the following:
Customer Service & Communities – 24×7 access to customer service,
documentation, whitepapers, and support forums. AWS Trusted Advisor – Access
to the 7 core Trusted Advisor checks and guidance to provision your resources
following best practices to increase performance and improve security. AWS
Personal Health Dashboard – A personalized view of the health of AWS services,
and alerts when your resources are impacted.
Developer – AWS recommends Developer Support if you are testing or doing
early development on AWS and want the ability to get email based technical
support during business hours as well as general architectural guidance as you
build and test. This plan does not support 24×7 phone based technical support.
Enterprise – AWS Enterprise Support provides customers with concierge-like
service where the main focus is helping the customer achieve their outcomes and
find success in the cloud. With Enterprise Support, you get 24×7 technical
support from high-quality engineers, tools and technology to automatically
manage the health of your environment, consultative architectural guidance
delivered in the context of your applications and use-cases, and a designated
Technical Account Manager (TAM) to coordinate access to
proactive/preventative programs and AWS subject matter experts. Enterprise
Support plan provides 24×7 phone, email and chat access to technical support
however it’s much costlier than Business Support plan.
Reference:
https://aws.amazon.com/premiumsupport/plans/

Correct option:
High Availability – A system that is available is capable of delivering the designed
functionality at a given point in time. Highly available systems are those that can
withstand some measure of degradation while still remaining available. On AWS
Cloud, you can run instances for an application across multi AZ to achieve High
Availability.
Incorrect options:
Horizontal Scaling – A “horizontally scalable” system is one that can increase
capacity by adding more computers to the system. This is in contrast to a
“vertically scalable” system, which is constrained to running its processes on
only one computer; in such systems, the only way to increase performance is to
add more resources into one computer in the form of faster (or more) CPUs,
memory or storage. Horizontally scalable systems are oftentimes able to
outperform vertically scalable systems by enabling parallel execution of
workloads and distributing those across many different computers. Auto Scaling
Group is an example of Horizontal Scaling on AWS.
Vertical Scaling – Vertical Scaling is adding more resources (like CPU, RAM) to a
single node or machine. Example- Resizing an instance of EC2.
Performance Efficiency – Is the ability to use computing resources efficiently to
meet system requirements and to maintain that efficiency as demand changes
and technologies evolve.
References:
https://wa.aws.amazon.com/wat.concept.availability.en.html
https://wa.aws.amazon.com/wat.concept.horizontal-scaling.en.html

Correct option:
Artifact
AWS Artifact is your central resource for compliance-related information on AWS
Cloud. It provides on-demand access to AWS’ security and compliance reports
and select online agreements. Reports available in AWS Artifact include the
Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports,
and certifications from accreditation bodies across geographies. Agreements
available in AWS Artifact also include the Business Associate Addendum (BAA)
and the Nondisclosure Agreement (NDA).
Incorrect options:
Trusted Advisor – AWS Trusted Advisor is an online tool that provides you realtime
guidance to help you provision your resources following AWS best practices
on cost optimization, security, fault tolerance, service limits, and performance
improvement. Whether establishing new workflows, developing applications, or
as part of ongoing improvement, recommendations provided by Trusted Advisor
regularly help keep your solutions provisioned optimally. Trusted Advisor cannot
be used to review the compliance and governance-related documents on AWS.
Service Catalog – AWS Service Catalog allows organizations to create and manage
catalogs of IT services that are approved for use on AWS. These IT services can
include everything from virtual machine images, servers, software, and databases
to complete multi-tier application architectures. Service Catalog cannot be used
to review the compliance and governance-related documents on AWS.
Secrets Manager – AWS Secrets Manager helps you protect secrets needed to
access your applications, services, and IT resources. The service enables you to
easily rotate, manage, and retrieve database credentials, API keys, and other
secrets throughout their lifecycle. Users and applications retrieve secrets with a
call to Secrets Manager APIs, eliminating the need to hardcode sensitive
information in plain text. Secrets Manager cannot be used to review the
compliance and governance-related documents on AWS.
Reference:
https://aws.amazon.com/artifact/

Correct option:
On-Demand Instances – An On-Demand Instance is an instance that you use ondemand.
You have full control over its lifecycle — you decide when to launch,
stop, hibernate, start, reboot, or terminate it. There is no long-term commitment
required when you purchase On-Demand Instances. There is no upfront payment
and you pay only for the seconds that your On-Demand Instances are running.
The price per second for running an On-Demand Instance is fixed. On-demand
instances cannot be interrupted.
EC2 Pricing Options Overview: via – https://aws.amazon.com/ec2/pricing/
Incorrect options:
Reserved Instances – Reserved Instances provide you with significant savings on
your Amazon EC2 costs compared to On-Demand Instance pricing. Reserved
Instances are not physical instances, but rather a billing discount applied to the
use of On-Demand Instances in your account. You can purchase a Reserved
Instance for a one-year or three-year commitment, with the three-year
commitment offering a bigger discount. You will be charged for the entire
duration, irrespective of your usage, so this option is not correct for running
weekly workloads. So this option is not correct for the given use-case.
Spot Instances – A Spot Instance is an unused EC2 instance that is available for
less than the On-Demand price. Because Spot Instances enable you to request
unused EC2 instances at steep discounts, you can lower your Amazon EC2 costs
significantly. Spot Instances are well-suited for data analysis, batch jobs,
background processing, and optional tasks. These can be terminated at short
notice, so these are not suitable for critical workloads that need to run at a
specific point in time. So this option is not correct for the given use-case.
Dedicated Hosts – Amazon EC2 Dedicated Hosts allow you to use your eligible
software licenses from vendors such as Microsoft and Oracle on Amazon EC2 so
that you get the flexibility and cost-effectiveness of using your licenses, but with
the resiliency, simplicity, and elasticity of AWS. An Amazon EC2 Dedicated Host is
a physical server fully dedicated for your use, so you can help address corporate
compliance requirement. They’re not cost-efficient compared to On-Demand
instances. So this option is not correct.
Reference:
https://aws.amazon.com/ec2/pricing/

Correct options:
Security
Performance Efficiency
The AWS Well-Architected Framework helps you understand the pros and cons of
decisions you make while building systems on AWS. By using the Framework you
will learn architectural best practices for designing and operating reliable, secure,
efficient, and cost-effective systems in the cloud. It provides a way for you to
consistently measure your architectures against best practices and identify areas
for improvement.
The AWS Well-Architected Framework is based on five pillars — Operational
Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.
“Security” – The ability to protect information, systems, and assets while
delivering business value through risk assessments and mitigation strategies.
“Performance Efficiency” – The ability to use computing resources efficiently to
meet system requirements, and to maintain that efficiency as demand changes
and technologies evolve.
Incorrect options:
Configuration Management – This is not part of the five pillars of the AWS Well-
Architected Framework.
Privacy – This is not part of the five pillars of the AWS Well-Architected
Framework.
Scalability – This is not part of the five pillars of the AWS Well-Architected
Framework.
Reference:
This is not part of the five pillars of AWS Well-Architected Framework.

Correct option:
AWS Identity and Access Management (IAM)
In AWS, privilege management is primarily supported by the AWS Identity and
Access Management (IAM) service, which allows you to control user and
programmatic access to AWS services and resources. You should apply granular
policies, which assign permissions to a user, group, role, or resource. You also can
require strong password practices, such as complexity level, avoiding re-use, and
enforcing multi-factor authentication (MFA). You can use federation with your
existing directory service. For workloads that require systems to have access to
AWS, IAM enables secure access through roles, instance profiles, identity
federation, and temporary credentials.
Incorrect options:
AWS CloudTrail – AWS CloudTrail is a service that enables governance,
compliance, operational auditing, and risk auditing of your AWS account. With
CloudTrail, you can log, continuously monitor, and retain account activity related
to actions across your AWS infrastructure. CloudTrail provides an event history
of your AWS account activity, including actions taken through the AWS
Management. CloudTrail cannot be used to manage account privileges.
AWS Web Application Firewall (WAF) – AWS WAF is a web application firewall that
helps protect your web applications or APIs against common web exploits that
may affect availability, compromise security, or consume excessive resources. It
is not an access management system. CloudTrail cannot be used to manage
account privileges.
AWS Secrets Manager – AWS Secrets Manager helps you protect secrets needed
to access your applications, services, and IT resources. The service enables you
to easily rotate, manage, and retrieve database credentials, API keys, and other
secrets throughout their lifecycle. You cannot use Secrets Manager for creating
and using your own keys for encryption on AWS services.
Reference: https://aws.amazon.com/iam/

Correct option:
Business – AWS recommends Business Support if you have production workloads
on AWS and want 24×7 phone, email and chat access to technical support and
architectural guidance in the context of your specific use-cases. You get full
access to AWS Trusted Advisor Best Practice Checks. Also, you get access to
Infrastructure Event Management for an additional fee.
Incorrect options:
Developer – AWS recommends Developer Support if you are testing or doing
early development on AWS and want the ability to get email-based technical
support during business hours as well as general architectural guidance as you
build and test. You do not get access to Infrastructure Event Management with
this plan.
Basic – The basic plan only provides access to the following:
Customer Service & Communities – 24×7 access to customer service,
documentation, whitepapers, and support forums. AWS Trusted Advisor – Access
to the 7 core Trusted Advisor checks and guidance to provision your resources
following best practices to increase performance and improve security. AWS
Personal Health Dashboard – A personalized view of the health of AWS services,
and alerts when your resources are impacted. You do not get access to
Infrastructure Event Management with this plan.
Enterprise – AWS Enterprise Support provides customers with concierge-like
service where the main focus is helping the customer achieve their outcomes and
find success in the cloud. With Enterprise Support, you get 24×7 technical
support from high-quality engineers, tools and technology to automatically
manage the health of your environment, consultative architectural guidance
delivered in the context of your applications and use-cases, and a designated
Technical Account Manager (TAM) to coordinate access to
proactive/preventative programs and AWS subject matter experts. Access to
Infrastructure Event Management is included in the plan.
Reference:
https://aws.amazon.com/premiumsupport/plans/

Correct option: Reserved Instance – Reserved Instances provide you with significant savings (up to 75%) on your Amazon EC2 costs compared to On-Demand Instance pricing. Reserved Instances are not physical instances, but rather a billing discount applied to the use of On-Demand Instances in your account. You can purchase a Reserved Instance for a one-year or three-year commitment, with the three-year
commitment offering a bigger discount. Reserved instances cannot be interrupted. So this is the correct option. EC2 Pricing Options Overview: via – https://aws.amazon.com/ec2/pricing/ Incorrect options: On-Demand Instance – An On-Demand Instance is an instance that you use on-demand. You have full control over its lifecycle — you decide when to launch, stop, hibernate, start, reboot, or terminate it. There is no long-term commitment required when you purchase On-Demand Instances. There is no upfront payment and you pay only for the seconds that your On-Demand Instances are running. The price per second for running an On-Demand Instance is fixed. On-demand instances cannot be interrupted. However, On-demand instances are not as cost-effective as Reserved instances, so this option is not correct. Spot Instance – A Spot Instance is an unused EC2 instance that is available for less than the On-Demand price. Because Spot Instances enable you to request unused EC2 instances at steep discounts (up to 90%), you can lower your Amazon EC2 costs significantly. Spot Instances are well-suited for data analysis, batch jobs, background processing, and optional tasks. These can be terminated at short notice, so these are not suitable for critical workloads that need to run at a specific point in time. So this option is not correct for the given use-case. Dedicated Host – Amazon EC2 Dedicated Hosts allow you to use your eligible software licenses from vendors such as Microsoft and Oracle on Amazon EC2 so that you get the flexibility and cost-effectiveness of using your licenses, but with the resiliency, simplicity, and elasticity of AWS. An Amazon EC2 Dedicated Host is a physical server fully dedicated for your use, so you can help address corporate compliance requirement. They’re not cost-efficient compared to On-Demand instances. So this option is not correct. Reference: https://aws.amazon.com/ec2/pricing/

Correct options: Benefit from massive economies of scale Trade capital expense for variable expense Go global in minutes and deploy applications in multiple regions around the world with just a few clicks Exam Alert: Please check out the following six advantages of Cloud Computing. You would certainly be asked questions on the advantages of Cloud Computing compared to a traditional on-premises setup: via – https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html
Incorrect options: Spend money on building and maintaining data centers – With Cloud Computing, you can focus on projects that differentiate your business, not the infrastructure. You don’t need to spend money on building and maintaining data centers as the Cloud provider takes care of that. Allocate a few months of planning for your infrastructure capacity needs – With Cloud Computing, you don’t need to guess on your infrastructure capacity needs. You can access as much or as little capacity as you need, and scale up and down as required with only a few minutes’ notice. There is no need to allocate a few months of infrastructure planning. Trade variable expense for capital expense – With Cloud Computing, you actually trade capital expense for variable expense. Reference: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

Correct options: A Security Group can have allow rules only A NAT Gateway is managed by AWS A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. Security groups act at the instance level, not at the subnet level. You can specify allow rules, but not deny rules. You can specify separate rules for inbound and outbound traffic. Security Group Overview: via – https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html A Network Access Control List (NACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets (i.e. it works at subnet level). A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic. Network Access Control List (NACL) Overview: via – https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html You can use a network address translation (NAT) gateway or a NAT Instance to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances. NAT Gateway is managed by AWS but NAT Instance is managed by you. Please see this comparison table for differences between NAT Gateway and NAT Instance: via – https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-
comparison.html Incorrect options: A Security Group can have both allow and deny rules A NAT Instance is managed by AWS A NACL can have allow rules only These three options contradict the details provided earlier in the explanation, so these options are incorrect. References: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Correct option: AWS Simple Monthly Calculator The Simple Monthly Calculator provides an estimate of usage charges for AWS services based on certain information you provide. It helps customers and prospects estimate their monthly AWS bill more efficiently. This calculator provides a visual interface to enter details about the AWS services that you plan to use and then it outputs a detailed estimate of the monthly AWS
bill. Please see the illustration for more details: via – https://calculator.s3.amazonaws.com/index.html Incorrect options: AWS Total Cost of Ownership (TCO) Calculator TCO calculator helps to compare the cost of your applications in an on-premises or traditional hosting environment to AWS. AWS helps reduce Total Cost of Ownership (TCO) by reducing the need to invest in large capital expenditures and providing a pay-as-you-go model that empowers to invest in the capacity you need and use it only when the business requires it. Once you describe your on-premises or hosting environment configuration, it produces a detailed cost comparison with AWS. TCO Calculator cannot provide the estimate of the monthly AWS bill based on the list of AWS services. AWS Cost Explorer – AWS Cost Explorer has an easy-to-use interface that lets you visualize, understand, and manage your AWS costs and usage over time. AWS Cost Explorer includes a default report that helps you visualize the costs and usage associated with your top five cost-accruing AWS services, and gives you a detailed breakdown of all services in the table view. The reports let you adjust the time range to view historical data going back up to twelve months to gain an understanding of your cost trends. AWS Cost Explorer cannot provide the estimate of the monthly AWS bill based on the list of AWS services. AWS Budgets – AWS Budgets gives the ability to set custom budgets that alert you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount. You can also use AWS Budgets to set reservation utilization or coverage targets and receive alerts when your utilization drops below the threshold you define. Budgets can be created at the monthly, quarterly, or yearly level, and you can customize the start and end dates. You can further refine your budget to track costs associated with multiple dimensions, such as AWS service, linked account, tag, and others. AWS Budgets cannot provide the estimate of the monthly AWS bill based on the list of AWS services. Reference: https://calculator.s3.amazonaws.com/index.html

Correct option: S3 DynamoDB A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network. There are two types of VPC endpoints: interface endpoints and gateway endpoints. An interface endpoint is an elastic network interface with a private IP address from the IP address range of your subnet that serves as an entry point for traffic destined to a supported service. Interface endpoints are powered by AWS PrivateLink, a technology that enables you to privately access services by using private IP addresses. A gateway endpoint is a gateway that you specify as a target for a route in your route table for traffic destined to a supported AWS service. The following AWS
services are supported: Amazon S3 DynamoDB Exam Alert: You may see a question around this concept in the exam. Just remember that only S3 and DynamoDB support VPC Endpoint Gateway. All other services that support VPC Endpoints use a VPC Endpoint Interface. Incorrect options: Amazon EC2 Amazon SQS Amazon SNS As explained earlier, these services support VPC Endpoint Interfaces. Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html

Correct option: Use Access Key ID and Secret Access Key to access AWS resources programmatically Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK). Access keys consist of two parts: an access key ID and a secret access key. As a user name and password, you must use both the access key ID and secret access key together to authenticate your requests. When you create an access key pair, save the access key ID and secret access key in a secure location. The secret access key is available only at the time you create it. If you lose your secret access key, you must delete the access key and create a new one. Incorrect options: Create a new IAM user and share the username and password – This is not a viable option, IAM user credentials are not needed to access resources programmatically. Use Multi Factor Authentication to access AWS resources programmatically – For increased security, AWS recommends that you configure multi-factor authentication (MFA) to help protect your AWS resources. You can enable MFA for IAM users or the AWS account root user. MFA adds extra security because it requires users to provide unique authentication from an AWS supported MFA mechanism in addition to their regular sign-in credentials when they access AWS websites or services. MFA cannot be used for programmatic access to AWS resources. Use IAM Groups to access AWS resources programmatically – An IAM Group is a collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users. IAM Group is
for managing users and not for programmatic access to AWS resources. Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

Correct option: Enterprise AWS offers three different support plans to cater to each of its customers –
Developer, Business, and Enterprise Support plans. A basic support plan is included for all AWS customers. AWS Enterprise Support provides customers with concierge-like service where the main focus is on helping the customer achieve their outcomes and find success in the cloud. With Enterprise Support, you get access to online training with self-paced labs, 24×7 technical support from high-quality engineers, tools and technology to automatically manage the health of your environment, consultative architectural guidance, a designated Technical Account Manager (TAM) to coordinate access to proactive/preventative programs and AWS subject matter experts. AWS Enterprise Support Plan Offerings: via – https://aws.amazon.com/premiumsupport/plans/enterprise/ Incorrect options: Developer – AWS recommends Developer Support if you are testing or doing early development on AWS and want the ability to get technical support during business hours as well as general architectural guidance as you build and test. Business – AWS recommends Business Support if you have production workloads on AWS and want 24×7 access to technical support and architectural guidance in the context of your specific use-cases. Basic – A basic support plan is included for all AWS customers. None of these three support plans provide access to online training with self-paced labs. References: https://aws.amazon.com/premiumsupport/plans/ https://aws.amazon.com/premiumsupport/plans/enterprise/

Correct option: Data center hardware infrastructure expenditure Data center physical security expenditure
The company does not need to spend on the computing hardware infrastructure and data center physical security. So these expense areas would result in cost savings. The expenditure on the SaaS application license fee, developer salary, and project manager salary would remain the same. Exam Alert: Please check out the following six advantages of Cloud Computing. You would certainly be asked questions on the advantages of Cloud Computing compared to a traditional on-premises setup: via – https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html Incorrect options: SaaS application license fee Developer salary Project manager salary As explained earlier, the expenditure on the SaaS application license fee, developer salary, and project manager salary would remain the same, so these options are incorrect. Reference: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

Correct option: “EFS” – Amazon EFS is a file storage service for use with Amazon EC2. Amazon EFS provides a file system interface, file system access semantics, and concurrently-accessible storage for up to thousands of Amazon EC2 instances. Amazon EFS
uses the Network File System protocol. How EFS works: via – https://aws.amazon.com/efs/ Incorrect options: EBS – Amazon Elastic Block Store (EBS) is an easy to use, high-performance block storage service designed for use with Amazon Elastic Compute Cloud (EC2) for both throughput and transaction-intensive workloads at any scale. EBS volumes cannot be accessed simultaneously by multiple EC2 instances, so this option is incorrect. Instance Store – An instance store provides temporary block-level storage for your instance. This storage is located on disks that are physically attached to the host computer. Instance Store volumes cannot be accessed simultaneously by multiple EC2 instances, so this option is incorrect. S3 – Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. S3 is object storage and it does not support file append operations, so this option is incorrect. Reference: https://aws.amazon.com/efs/

Correct option: AWS Shield Standard AWS Shield Standard defends against most common, frequently occurring network and transport layer DDoS attacks that target your website or applications. While AWS Shield Standard helps protect all AWS customers, you get better protection if you are using Amazon CloudFront and Amazon Route 53. All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. Incorrect options: AWS Web Application Firewall (AWS WAF) – AWS WAF is a web application firewall
that lets you monitor the HTTP(S) requests that are forwarded to an Amazon CloudFront distribution, an Amazon API Gateway API, or an Application Load Balancer. AWS WAF charges based on the number of web access control lists (web ACLs) that you create, the number of rules that you add per web ACL, and the number of web requests that you receive (it is not a free service). AWS Secrets Manager – AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. With Secrets Manager, you pay based on the number of secrets stored and API calls made. AWS Shield Advanced – AWS Shield Advanced includes intelligent DDoS attack detection and mitigation for not only for network layer (layer 3) and transport layer (layer 4) attacks but also for application layer (layer 7) attacks. AWS Shield Advanced is a paid service that provides additional protections for internet-facing applications. Reference: https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html

Correct option: AWS Artifact AWS Artifact is your go-to, central resource for compliance-related information that matters to your organization. It provides on-demand access to AWS’ security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. Different types of agreements are available in AWS Artifact Agreements to address the needs of customers subject to specific regulations. For example, the Business Associate Addendum (BAA) is available for customers that need to comply with the Health Insurance Portability and Accountability Act (HIPAA). It is not a service, it’s a no-cost, self-service portal for on-demand access to AWS’ compliance reports. Incorrect options: AWS Trusted Advisor – AWS Trusted Advisor is an online tool that provides you real-time guidance to help you provision your resources following AWS best practices. Whether establishing new workflows, developing applications, or as part of ongoing improvement, recommendations provided by Trusted Advisor regularly help keep your solutions provisioned optimally. AWS Secrets Manager – AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you
to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Users and applications retrieve secrets with a call to Secrets Manager APIs, eliminating the need to hardcode sensitive information in plain text. AWS Systems Manager – AWS Systems Manager gives you visibility and control of your infrastructure on AWS. Systems Manager provides a unified user interface so you can view operational data from multiple AWS services and allows you to automate operational tasks across your AWS resources. With Systems Manager, you can group resources, like Amazon EC2 instances, Amazon S3 buckets, or Amazon RDS instances, by application, view operational data for monitoring and troubleshooting, and take action on your groups of resources. Reference: https://aws.amazon.com/artifact/

Correct option: AWS X-Ray – You can use AWS X-Ray to analyze and debug serverless and distributed applications such as those built using a microservices architecture. With X-Ray, you can understand how your application and its underlying services are performing to identify and troubleshoot the root cause of performance issues and errors. How X-Ray Works: via – https://aws.amazon.com/xray/ Incorrect options: AWS Trusted Advisor – AWS Trusted Advisor is an online tool that provides you real-time guidance to help you provision your resources following AWS best practices on cost optimization, security, fault tolerance, service limits and performance improvement. Whether establishing new workflows, developing applications, or as part of ongoing improvement, recommendations provided by Trusted Advisor regularly help keep your solutions provisioned optimally. Trusted Advisor cannot be used to debug performance issues for this serverless application built using a microservices architecture. Amazon Pinpoint – Amazon Pinpoint allows marketers and developers to deliver customer-centric engagement experiences by capturing customer usage data to draw real-time insights. Pinpoint cannot be used to debug performance issues for this serverless application built using a microservices architecture. AWS CloudFormation – AWS CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all Regions and accounts. Think infrastructure as code; think CloudFormation. CloudFormation cannot be used to debug performance issues for this serverless application built using a microservices architecture. How Amazon Pinpoint Works: via – https://aws.amazon.com/pinpoint/ Reference: https://aws.amazon.com/xray/

Why Option B is correct: S3 Standard-IA is specifically designed for this exact use case—data accessed infrequently but requiring rapid, millisecond-level retrieval when needed. It costs only $0.0125 per GB per month, which is about 45% cheaper than S3 Standard ($0.023 per GB), making it highly cost-effective. You get the same performance, durability (99.999999999%), and availability as S3 Standard, but at a lower storage cost because AWS knows you won't access it frequently. It's perfect for backups, disaster recovery, and long-term storage where you need instant access occasionally.​

Why the others are wrong:
→ Option A is incorrect because S3 Standard costs nearly twice as much ($0.023 per GB) and is optimized for frequently accessed data—you'd be paying premium prices for features you don't need.​
→ Option C is incorrect because S3 Glacier has retrieval times ranging from minutes to hours, not the "rapid access" required in the question.​
→ Option D is incorrect because S3 Intelligent-Tiering adds monitoring and automation fees ($0.0025 per 1,000 objects) on top of storage costs, making it more expensive than Standard-IA when your access pattern is already known to be infrequent.

Reference: https://aws.amazon.com/s3/storage-classes/

Why Option C is correct: AWS Organizations is specifically designed for multi-account management and comes with automatic Reserved Instance sharing through consolidated billing. When you consolidate accounts under AWS Organizations, RI discounts are automatically applied across all member accounts that have matching instance usage—no manual configuration needed. If Unit A purchases RIs but only uses 50%, and Unit B needs more capacity, AWS automatically applies Unit A's unused RI discount to Unit B's matching On-Demand instances. This happens in real-time and maximizes your RI utilization across the entire organization, making it the most cost-optimal solution.​

Why the others are wrong:
→ Option A is incorrect because AWS Systems Manager is for operational tasks like patching and automation—it doesn't manage multi-account structures or handle RI sharing.​
→ Option B is incorrect because AWS Cost Explorer is a cost visualization and analysis tool, not an account management service that enables RI sharing.​
→ Option D is incorrect because AWS Trusted Advisor provides recommendations and best practices but doesn't manage accounts or enable RI sharing functionality.

https://aws.amazon.com/systems-manager/ References: https://aws.amazon.com/organizations/ https://aws.amazon.com/premiumsupport/technology/trusted-advisor/ https://aws.amazon.com/systems-manager/

Why B, D, and E are correct: These three services all support reservation-based pricing models. EC2 Reserved Instances offer up to 72% discount compared to On-Demand pricing when you commit to one or three-year terms. RDS Reserved DB Instances provide up to 69% savings for database workloads with the same commitment options. DynamoDB Reserved Capacity allows you to save up to 77% on provisioned capacity by committing to usage over one or three years. All three services offer flexible payment options including All Upfront, Partial Upfront, and No Upfront to match your budget needs.​

Why the others are wrong:
→ Option A (Lambda) is incorrect because Lambda uses on-demand and Compute Savings Plans pricing, not traditional Reserved Instances.​
→ Option C (S3) is incorrect because S3 is a pure pay-as-you-go storage service without reservation options—you only pay for what you store and transfer.​
→ Option F (DocumentDB) is incorrect because while DocumentDB may have some pricing options, it's not listed among the primary AWS services with reservation models like EC2, RDS, Redshift, ElastiCache, OpenSearch, and DynamoDB.

Reference: https://d0.awsstatic.com/whitepapers/aws_pricing_overview.pdf

Why Option D is correct: Physical and Environmental controls are classified as "Inherited Controls" in the AWS Shared Responsibility Model—these are controls that AWS fully manages and customers completely inherit. AWS is 100% responsible for protecting the physical infrastructure including data centers, hardware, servers, networking equipment, and environmental protections like fire suppression, power systems, and climate control. This is part of AWS's core responsibility for "Security OF the Cloud"—the foundation that runs all AWS services. Customers never need to worry about physical security, facility access, or environmental disasters at AWS data centers.​

Why the others are wrong:
→ Option A is incorrect because Service and Communications Protection/Zone Security are shared controls where both AWS and customers have responsibilities in different contexts.​
→ Option B is incorrect because patching the guest operating system is entirely the customer's responsibility—AWS only patches the underlying host OS and hypervisor.​
→ Option C is incorrect because configuring and securing customer applications is 100% the customer's responsibility under "Security IN the Cloud"

Please review the IT controls under the Shared Responsibility Model: via – https://aws.amazon.com/compliance/shared-responsibility-model/ Reference: https://aws.amazon.com/compliance/shared-responsibility-model/

Why Option D is correct: According to AWS official documentation, Spot Instances offer discounts of up to 90% off compared to On-Demand pricing. This is the maximum possible discount you can achieve when using Spot Instances to access unused EC2 capacity in the AWS cloud. The actual discount varies by region, instance type, and current market demand—typically ranging from 70-90%—but the highest possible savings can reach 90%. For example, an instance that costs $0.10/hour On-Demand might only cost $0.01/hour as a Spot Instance. The trade-off is that AWS can reclaim these instances with just a two-minute notice when capacity is needed elsewhere, making them ideal for fault-tolerant, flexible workloads like batch processing, data analysis, and development/testing.​

Why the others are wrong:
→ Option A (75%) is incorrect because while substantial, it's less than the maximum 90% discount AWS actually offers.​
→ Option B (10%) is incorrect because this would be an extremely minimal discount that wouldn't reflect the significant cost savings Spot Instances provide.​
→ Option C (50%) is incorrect because although this represents good savings, AWS Spot Instances can offer up to 90% discount, making this answer too conservative

EC2 Pricing Options Overview: via – https://aws.amazon.com/ec2/pricing/ Incorrect options: 75 10 50 These three options contradict the details provided earlier in the explanation, so these options are incorrect. Reference: https://aws.amazon.com/ec2/spot/

Why Option A is correct: Amazon Redshift is a fully managed, petabyte-scale cloud data warehouse service specifically designed for storing and analyzing massive amounts of data. It uses columnar storage and massively parallel processing (MPP) to deliver fast query performance on datasets ranging from gigabytes to exabytes.​

Why the others are wrong:
→ Option B (Glue) - ETL service for data preparation, not a database.​
→ Option C (Storage Gateway) - Hybrid storage service, not a database.
→ Option D (Database Migration Service) - Migration tool, not a database itself.

⚡ Quick Takeaway:
Memory Tip: Remember "RED-DATA-WAREHOUSE" → Redshift is a data warehouse database service. The other three are helper tools: Glue = ETL glue that sticks data together, Storage Gateway = bridge between on-prem and cloud, DMS = moves databases around.

https://aws.amazon.com/redshift/ https://aws.amazon.com/dms/

Why Option A is correct: Instance Store is the perfect match for this scenario because it delivers the highest raw IOPS and lowest latency—offering over 5x faster uncached reads and over 10x faster writes compared to EBS-SSD. Instance Store volumes are physically attached directly to the EC2 host, providing sub-millisecond latencies with NVMe SSDs. Most importantly, Instance Store is the most cost-effective because the storage is included in the EC2 instance price—you don't pay separately for storage like you do with EBS. Since the application has "built-in fault tolerance," the ephemeral (temporary) nature of Instance Store isn't a problem—if an instance fails, the fault-tolerant app will simply recover the computation on another instance.​​

Why the others are wrong:
→ Option B (EBS) is incorrect because while EBS is persistent and reliable, it's network-attached storage that has higher latency than Instance Store and costs extra money on top of your EC2 charges.​​
→ Option C (EFS) is incorrect because EFS is a shared network file system designed for multiple instances to access the same files—it's not optimized for the high-performance, fast I/O needed for scientific computations.​
→ Option D (S3) is incorrect because S3 is object storage for long-term data storage and backups, not for direct compute workloads requiring fast disk I/O performance.​

⚡ Quick Takeaway:
Memory Tip: "Fault-tolerant + Fast I/O = Free Instance Store!" When you see "built-in fault tolerance" + "high-performance I/O" + "cost-effective" together, choose Instance Store. Remember: Instance Store is the fastest and cheapest but ephemeral (temporary)—perfect when data loss is acceptable.

Why Option A is correct: Amazon EC2 is a classic example of Infrastructure as a Service (IaaS) because it provides you with fundamental computing infrastructure—virtual servers (instances), storage, networking, and operating systems—that you have complete control over. With EC2, you rent the hardware and get the "basic building blocks for cloud and IT" without managing physical servers. You control everything from the operating system, security configurations, networking, and applications running on your instances. IaaS is the most flexible cloud service model, giving you maximum control while AWS handles the physical infrastructure, data centers, and hardware maintenance.​

Why the others are wrong:
→ Option B (NaaS) is incorrect because Network as a Service isn't one of the three primary cloud service models, and EC2 is about compute resources, not just networking.​
→ Option C (PaaS) is incorrect because Platform as a Service provides a ready-made platform for deploying applications (like AWS Elastic Beanstalk or Heroku)—you don't manage the underlying infrastructure. EC2 requires you to manage the OS and environment.​
→ Option D (SaaS) is incorrect because Software as a Service delivers fully managed applications that end-users consume (like Gmail or Office 365)—EC2 provides infrastructure, not end-user software.​

⚡ Quick Takeaway:
Memory Tip: "EC2 = I Control Everything" → Remember EC2 is IaaS because I (you) have complete control from OS upward. Think of the service model pyramid: IaaS (most control, like EC2) → PaaS (medium control) → SaaS (least control, just use the app). EC2 sits at the bottom = maximum flexibility and control.

. Reference: https://aws.amazon.com/types-of-cloud-computing/

Why Option B is correct: AWS Direct Connect is specifically designed to establish a dedicated, private network connection from your on-premises data center to AWS VPC without traversing the public internet. It uses physical fiber optic connections (1 Gbps or 10 Gbps) between your network and AWS Direct Connect locations, providing lower latency, predictable performance, higher throughput, and enhanced security compared to internet-based connections. Direct Connect uses private virtual interfaces (VIFs) with industry-standard 802.1Q VLANs to connect to VPCs using private IP addresses only. This makes it ideal for scenarios requiring large daily data transfers, compliance requirements prohibiting internet usage, or applications needing consistent network performance.​

Why the others are wrong:
→ Option A (VPC Endpoint) is incorrect because VPC Endpoints create private connections between your VPC and other AWS services (like S3 or DynamoDB) within AWS—they don't connect on-premises environments to AWS.​
→ Option C (Internet Gateway) is incorrect because it's literally designed to enable communication between your VPC and the public internet—the exact opposite of what's needed.​
→ Option D (Site-to-Site VPN) is incorrect because while it's encrypted and secure, VPN connections still travel over the public internet—they just encrypt the data in transit. The question specifically asks for a solution that doesn't use the public internet at all.​

⚡ Quick Takeaway:
Memory Tip: "Direct Connect = Direct Private Cable" → When you see "on-premises to VPC" + "WITHOUT public internet," always choose AWS Direct Connect. Remember: VPN = Encrypted tunnel OVER internet, Direct Connect = Private dedicated cable BYPASSES internet entirely. Direct Connect is the only option that physically avoids the public internet!

References: https://aws.amazon.com/directconnect/ https://aws.amazon.com/vpn/

Why Option A is correct: AWS Lambda is the quintessential serverless computing service, operating as a "Function as a Service" (FaaS) platform. With Lambda, you only upload your code as functions, and AWS automatically handles absolutely everything else—server provisioning, scaling from zero to infinity, patching, security, monitoring, and infrastructure management. Lambda follows the core serverless tenets: no server management, pay-per-use billing (you're only charged for actual compute time by the millisecond), continuous automatic scaling, and built-in fault tolerance. Lambda functions are event-driven, meaning they sit idle until triggered by events from 200+ AWS services like S3 uploads, API Gateway requests, or DynamoDB updates. This eliminates the need to pay for idle servers running 24/7.​

Why the others are wrong:
→ Option B (EC2) is incorrect because EC2 is Infrastructure as a Service (IaaS) where YOU must manually provision, configure, manage, patch, and scale virtual servers—the complete opposite of serverless.​
→ Option C (Beanstalk) is incorrect because while Elastic Beanstalk is a managed Platform as a Service (PaaS) that simplifies deployment, it still provisions and manages EC2 instances behind the scenes—you're still dealing with servers, just abstracted away.​
→ Option D (EMR) is incorrect because Elastic MapReduce requires you to configure and manage clusters of EC2 instances for big data processing—it's not serverless architecture.​

⚡ Quick Takeaway:
Memory Tip: "Lambda = Zero Server Worries" → Lambda is serverless because you upload code and AWS handles EVERYTHING. Remember the formula: Serverless = No provisioning + No managing + No scaling + Pay only when code runs. If you see "run code without managing servers" or "event-driven compute," think Lambda!

Reference: https://aws.amazon.com/lambda/

Why Option B is correct: Amazon EC2 Dedicated Hosts are specifically designed for server-bound software licenses that require BYOL (Bring Your Own License). A Dedicated Host is a physical server fully dedicated for your use, giving you complete visibility of the number of sockets and physical cores supporting your instances. This visibility is critical because server-bound licenses from vendors like Microsoft, Oracle, SAP, and IBM are often tied to physical hardware attributes—per-socket, per-core, or per-VM licensing. Dedicated Hosts allow you to use your existing eligible software licenses that are bound to VMs, sockets, or physical cores, subject to your license terms. The service is integrated with AWS License Manager, which helps track and manage licenses, enforce licensing rules (like 90-day affinity requirements), and provides compliance reporting. You also get instance placement controls to deploy instances to specific hosts for meeting licensing and regulatory requirements. For example, you can license SQL Server Enterprise Edition at the physical core level instead of vCPU level, potentially reducing license usage by 50% or more.​

Why the others are wrong:
→ Option A (Reserved Instance) is incorrect because Reserved Instances are a pricing model offering discounts for 1 or 3-year commitments—they don't provide the physical hardware visibility needed for server-bound licenses.​
→ Option C (Dedicated Instance) is incorrect because while Dedicated Instances run on hardware dedicated to a single customer, they don't provide visibility into the underlying physical server's sockets and cores—you can't track the physical infrastructure needed for license compliance.​
→ Option D (On-Demand Instance) is incorrect because On-Demand is a pricing model where instances run on shared hardware (multi-tenant) without any hardware visibility, making it impossible to track server-bound licenses.​

⚡ Quick Takeaway:
Memory Tip: "Dedicated Host = Hardware Visibility for Licenses" → When you see "server-bound licenses," "BYOL," "per-socket," or "per-core licensing," always choose Dedicated Host ! Remember: Dedicated Host = See physical hardware (ware (sockets/cores) | Dedicated Instance = Dedicated but no hardware visibility | Reserved/On-Demand = Pricing models, not tenancy ​. Dedicated Hosts are the only option that lets you prove license compliance to software vendors like Microsoft and Oracle by showing exactly what physical hardware your instances run on!

Why Option A is correct: Amazon Inspector is specifically designed for automated vulnerability management and security assessments of EC2 instances. Once enabled, Inspector automatically discovers all EC2 instances and immediately begins scanning them for software vulnerabilities, OS vulnerabilities, and unintended network exposure without manual scheduling. It continuously monitors for Common Vulnerabilities and Exposures (CVEs), package vulnerabilities in operating systems and programming language dependencies, and automatically rescans when changes occur—like installing new software or when new CVEs are published. Inspector offers both agent-based and agentless scanning capabilities, so you can scan instances even without SSM Agents installed. It also supports CIS Benchmark assessments for OS-level configuration checks across Amazon Linux, Windows Server, and other operating systems. The service provides highly contextualized risk scores for each finding by correlating CVE information with network access and exploitability, helping prioritize remediation. All findings are automatically aggregated in the Inspector console and integrate with AWS Security Hub and Amazon EventBridge for automated workflows.​​

Why the others are wrong:
→ Option B (GuardDuty) is incorrect because GuardDuty is a threat detection service that monitors for malicious activity, unauthorized behavior, and compromised credentials using machine learning—it doesn't scan for OS vulnerabilities or software patches.​
→ Option C (AWS Shield) is incorrect because Shield is a DDoS (Distributed Denial of Service) protection service that safeguards applications from network and transport layer attacks—it has nothing to do with vulnerability assessments.​
→ Option D (Amazon Macie) is incorrect because Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3 buckets—it doesn't assess EC2 instances for vulnerabilities.​

⚡ Quick Takeaway:
Memory Tip: "Inspector = Inspect EC2 for Vulnerabilities" → When you see "vulnerability assessments," "OS vulnerabilities," or "security scanning" for EC2, choose Amazon Inspector ! Remember the security service roles: Inspector = Vulnerability scanninganning | GuardDuty = Threat detection | Shield = DDoS protection | Macie = Data discovery/classification ​. Inspector continuously scans with minimal performance impact and automatically closes findings when vulnerabilities are patched!

Reference: https://aws.amazon.com/inspector/

Why Option C is correct: AWS WAF operates exclusively at Layer 7 (the Application Layer) of the OSI model. Layer 7 is where HTTP and HTTPS web traffic occurs, and WAF specifically monitors and filters these web requests to protect against application-level attacks. WAF functions as a reverse proxy that inspects the actual content of web requests—examining URLs, query strings, headers, and request bodies for malicious patterns. It protects against common web exploits like SQL injection attacks, cross-site scripting (XSS), cross-site request forgery (CSRF), and other OWASP Top 10 vulnerabilities that occur at the application layer. Unlike traditional network firewalls that operate at Layers 3-4 and only see IP addresses and ports, WAF understands the application protocol and can detect if malicious code is being injected into legitimate HTTP requests. AWS WAF integrates with CloudFront, Application Load Balancer (ALB), API Gateway, and AppSync—all services that operate at Layer 7. Importantly, WAF cannot be deployed on Network Load Balancers (NLB) because NLB operates at Layer 4, not Layer 7.​​

Why the others are wrong:
→ Option A (Layer 3) is incorrect because Layer 3 is the Network Layer where IP routing happens—this is protected by network firewalls and security groups, not WAF.​
→ Option B (Layer 4 and 7) is incorrect because WAF only operates at Layer 7, not Layer 4—Layer 4 (Transport Layer) deals with TCP/UDP connections and is protected by different security mechanisms.​
→ Option D (Layer 4) is incorrect because Layer 4 is the Transport Layer where TCP/UDP port filtering occurs—WAF doesn't operate here, which is why it can't be deployed on Network Load Balancers.​

⚡ Quick Takeaway:
Memory Tip: "WAF = Web App Layer 7" → WAF protects the application layer (Layer 7) where HTTP/HTTPS web traffic flows. Remember the OSI layerI layer security: Layer 3 = Network firewalls | Layer 4 = Transport (NLB, NACLs) | Layer 7 = Application (WAF, ALB) ​​. Think "WAF inspects web content like SQL injections and XSS attacks—that's Layer 7!"

Reference: https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html

Why Option A is correct: S3 Glacier Deep Archive has the longest retrieval time of all S3 storage classes, with data retrieval taking up to 12 hours. This is the slowest first byte latency available, designed for data that is very rarely accessed—typically once or twice a year. Glacier Deep Archive is AWS's lowest-cost storage option (up to 95% savings compared to S3 Standard), serving as an ideal alternative to magnetic tape libraries for long-term archival and compliance data. The extreme latency is intentional—you're trading speed for cost savings. When you initiate a retrieval request, AWS must physically restore the data from deep cold storage, which is why it takes so long. This storage class is perfect for regulatory archives, medical records retention, or backup data that you hope you'll never need but must keep for 7-10 years.​

Why the others are wrong:
→ Option B (S3 Standard) is incorrect because S3 Standard provides millisecond-latency access—it's the fastest storage class designed for frequently accessed data with low latency and high throughput performance.​
→ Option C (S3 Glacier) is incorrect because S3 Glacier Flexible Retrieval has configurable retrieval times ranging from minutes to hours (typically 3-5 hours for standard retrieval), which is significantly faster than Deep Archive's 12-hour retrieval time.​
→ Option D (S3 Intelligent-Tiering) is incorrect because the Frequent, Infrequent, and Archive Instant Access tiers all provide millisecond latency—the same low-latency performance as S3 Standard.​

⚡ Quick Takeaway:
Memory Tip: "Deep Archive = Deepest Wait" → S3 Glacier Deep Archive has the longest retrieval time (up to 12 hours) because it's the deepest, coldest storage. Remember the retrieval time hierarchy: S3 Standard/Intelligent-Tiering = millisecondsds** | Glacier Instant Retrieval = milliseconds | Glacier Flexible Retrieval = minutes to hours | Glacier Deep Archive = up to 12 hours ​. The deeper you go in cold storage, the longer the wait—but the bigger the cost savings!

Reference: https://aws.amazon.com/s3/storage-classes/

Why Option D is INCORRECT (and thus the right answer): Fault tolerance is NOT achieved through vertical scaling. Vertical scaling means increasing the size/power of a single resource (upgrading from a t3.medium to a t3.2xlarge instance), which creates a single point of failure. If that one powerful machine fails, your entire application goes down. Vertical scaling improves performance and capacity but does nothing for fault tolerance or high availability. In contrast, horizontal scaling achieves fault tolerance by distributing workload across multiple instances—if one instance fails, the remaining instances continue serving traffic, ensuring the workload remains operational. The AWS Well-Architected Framework's Reliability pillar emphasizes designing workloads that can withstand component failures, which is accomplished through horizontal scaling and redundancy across multiple Availability Zones, not by making individual machines more powerful.​

Why the others are CORRECT statements:
→ Option A is correct because horizontal scaling DOES achieve fault tolerance by distributing workload across multiple resources, eliminating single points of failure.​
→ Option B is correct because this is the accurate definition of horizontal scaling—adding more instances to handle increased load.​
→ Option C is correct because this is the accurate definition of vertical scaling—upgrading the specifications of an existing machine.​

⚡ Quick Takeaway:
Memory Tip: "Horizontal = High Availability, Vertical = No Redundancy" → Horizontal scaling provides fault tolerance through multiple instances, while vertical scaling creates a single powerful instance (single point of failure). Remember: Horizontal = Scale OUT (more instances) = Fault tolert tolerant | Vertical = Scale UP (bigger instance) = NOT fault tolerant ​. The Reliability pillar emphasizes horizontal scaling with auto-scaling across multiple Availability Zones for true resilience!

Reference: https://wa.aws.amazon.com/wat.concept.horizontal-scaling.en.html