AWS Certified Cloud Practitioner

→ Why the correct answer is right:

Deploying across multiple Availability Zones ensures your application remains operational even if an entire data center fails. AZs are physically isolated with independent power and networking, providing true fault isolation.

→ Why the other options are wrong:

B: Relying on one powerful instance is the opposite of fault tolerance. If that instance fails, the entire application fails — this is a single point of failure.

C: Multiple EC2 instances in the same AZ still share the AZ's risk. If the single AZ goes down, all instances become unavailable.

D: Multiple subnets can exist within the same AZ. Without deploying across different AZs, subnets alone do not provide fault tolerance against AZ-level failures.

Exam Tip 🧠

Fault Tolerance = spread across multiple AZs. Not just multiple instances — they must be in DIFFERENT Availability Zones.

→ Why the correct answer is right:

Amazon S3 offers virtually unlimited total storage per account. The only size limit that applies is to individual objects, which can range from 0 bytes to a maximum of 5 TB per object.

→ Why the other options are wrong:

A. 10 Exabytes: This is a fixed number suggesting a hard cap. S3 has no defined total storage limit per account.

B. 5 TeraBytes: 5 TB is the maximum size for a single S3 object, not the total account storage limit.

C. 100 PetaBytes: While enormous, this is a fixed number. S3 storage is marketed as virtually unlimited with no published hard cap.

Exam Tip 🧠

S3 total storage = Virtually Unlimited. Single object max = 5 TB. Multi-part upload required for objects > 5 GB.

→ Why the correct answer is right:

On-Demand instances let you scale capacity up or down instantly with no long-term commitment, eliminating the traditional requirement to pre-purchase 'safety net' excess capacity for traffic spikes.

→ Why the other options are wrong:

B: On-Demand instances are not free. You can get some free tier EC2 usage (t2.micro for 12 months), but On-Demand testing is not free.

C: On-Demand is the most expensive EC2 pricing option. Spot, Reserved, and Savings Plans all offer lower prices.

E: EC2 instances can be launched in minutes, not 1-2 days. The setup time claim is false — this is one of the main cloud advantages.

Exam Tip 🧠

On-Demand = flexibility + no commitment + no upfront cost. Most expensive per hour but no risk. Use for unpredictable workloads.

→ Why the correct answer is right:

Amazon Route 53 is AWS's highly available and scalable DNS web service. It translates domain names into IP addresses and supports multiple routing policies including latency-based, geo-DNS, and failover routing.

→ Why the other options are wrong:

A. Rekognition: Amazon Rekognition is an AI/ML service for image and video analysis (facial recognition, object detection). It has nothing to do with DNS.

B. Lightsail: Lightsail is a simplified VPS platform for deploying applications and websites. It is not a DNS service.

C. Active Directory Domain Service: Active Directory Domain Services is a Microsoft Windows service for enterprise directory management. It is not an AWS DNS web service.

Exam Tip 🧠

Route 53 = AWS DNS service. Named after port 53 (DNS port). It routes users to your applications globally.

→ Why the correct answer is right:

Amazon RDS is a fully managed relational database service that handles administrative tasks like backups, patching, and monitoring automatically, while making it easy to provision, scale, and operate relational databases like MySQL, PostgreSQL, and SQL Server.

→ Why the other options are wrong:

A: RDS is for relational databases (SQL). For nonrelational (NoSQL) databases, AWS provides Amazon DynamoDB.

B: The 99.999999999% (11 nines) durability applies to Amazon S3, not RDS. RDS provides high availability through Multi-AZ deployments but not this extreme durability figure.

D: RDS does not automatically scale the instance size. Instance type changes require manual modification. Aurora Serverless can auto-scale, but standard RDS does not.

Exam Tip 🧠

RDS = Managed relational DB (MySQL, PostgreSQL, Oracle, SQL Server). DynamoDB = NoSQL. Aurora = MySQL/PostgreSQL-compatible with more scalability.

→ Why the correct answer is right:

Amazon EC2 Dedicated Hosts provide a physical server fully dedicated to your use, with visibility into sockets, cores, and host IDs. This allows you to use existing server-bound BYOL (Bring Your Own License) software like Windows Server, SQL Server, or SUSE Linux.

→ Why the other options are wrong:

B. Reserved Instance: RIs are a billing commitment for cost savings. They run on shared hardware and do not provide the physical server visibility needed for BYOL licensing.

C. Dedicated Instance: Dedicated Instances run on dedicated hardware but lack the socket/core visibility and instance placement control needed for license compliance.

D. On-Demand Instance: On-Demand Instances run on shared AWS hardware. They do not provide physical server-level information required for server-bound license compliance.

Exam Tip 🧠

BYOL server-bound licenses (Windows Server, SQL Server) = Dedicated Host. You need the physical server info (sockets, cores) to be compliant.

→ Why the correct answer is right:

Convertible Reserved Instances allow you to change instance attributes — including instance family, operating system, and tenancy — at any time during the reservation term, making them ideal for evolving workloads like this beta program.

→ Why the other options are wrong:

B. Zonal RI: Zonal RIs provide capacity reservation in a specific Availability Zone. They do not allow changes to instance family, OS, or tenancy.

C. Standard RI: Standard RIs offer the highest discount but are fixed to the selected instance type and attributes for the entire term. No changes are allowed.

D. Scheduled RI: Scheduled RIs (now largely deprecated) are for workloads running on a recurring schedule. They do not allow changes to instance attributes.

Exam Tip 🧠

Need flexibility to change instance type/OS/tenancy? = Convertible RI. Need max discount with no changes? = Standard RI.

→ Why the correct answer is right:

The AWS Cost and Usage Report (CUR) provides line-item detail for every charge, including which resources received RI discounts and the exact discounted rate applied. It is the most comprehensive billing data source.

→ Why the other options are wrong:

A. AWS Budgets: Budgets is for setting spending limits and alerts. It does not show RI usage details or discounted rate breakdowns.

C. AWS Cost Explorer: Cost Explorer can show RI utilization trends visually but does not provide the detailed per-resource RI rate breakdown that CUR does.

D. AWS Price List Bulk API: The Price List API provides current pricing information for AWS services. It does not track your actual RI usage or applied discounts.

Exam Tip 🧠

Detailed RI tracking with exact rates = AWS Cost and Usage Report (CUR). Most granular = CUR. Visuals/trends = Cost Explorer.

→ Why the correct answer is right:

Amazon S3 is an object storage service designed for 99.999999999% (11 9s) durability with virtually unlimited storage capacity. It stores objects (files) in buckets accessible over the internet.

→ Why the other options are wrong:

A: High-performance block storage describes Amazon EBS (Elastic Block Store), which provides persistent storage volumes for EC2 instances.

B: Hybrid cloud storage describes AWS Storage Gateway, which bridges on-premises storage with AWS cloud storage.

E: Durable, high-throughput file system describes Amazon EFS (Elastic File System), a managed NFS file system for EC2 instances.

Exam Tip 🧠

S3 = Object storage (unlimited, 11 9s durability). EBS = Block storage (EC2 volumes). EFS = File system (NFS for EC2). Storage Gateway = Hybrid.

→ Why the correct answer is right:

A Virtual Private Gateway is the AWS-side endpoint for site-to-site VPN connections between on-premises networks and VPCs. Amazon Route 53 provides DNS resolution for resources within your VPC, which is essential for name resolution during VPN connectivity.

→ Why the other options are wrong:

C. Egress-Only Internet Gateway: Egress-Only Internet Gateway allows outbound-only IPv6 traffic from VPC to the internet. It does not handle VPN connections.

D. VPC Peering: VPC Peering connects two VPCs together. It does not connect an on-premises network to a VPC.

E. NAT Gateway: NAT Gateway allows private subnet resources to access the internet outbound. It does not facilitate VPN connections.

Exam Tip 🧠

On-premises VPN to VPC = Virtual Private Gateway (AWS side) + Customer Gateway (on-premises side). Route 53 resolves DNS across the VPN.

→ Why the correct answer is right:

AWS CloudTrail records all API calls and actions taken in your AWS account across all tools (Console, CLI, SDK, other services), creating a complete audit trail for governance, compliance, and security analysis.

→ Why the other options are wrong:

B. Amazon CloudWatch: CloudWatch collects performance metrics and logs. It monitors the health of services but does not record who performed which API actions.

C. AWS Config: Config records configuration changes to AWS resources and evaluates them against compliance rules. It does not provide an API call history like CloudTrail.

D. AWS Infrastructure Event Management: This is a support program for planning large business events (product launches, migrations), not a service for tracking AWS API activity.

Exam Tip 🧠

CloudTrail = Who did WHAT in AWS? (API audit log). CloudWatch = What is HAPPENING now? (metrics & logs).

→ Why the correct answer is right:

The Developer plan provides access to only the 7 core Trusted Advisor checks (not all checks) and does not include access to the AWS Support API, which is available only from Business tier and above.

→ Why the other options are wrong:

A: Full Trusted Advisor access requires Business or Enterprise plan. Developer plan only gets the 7 core checks.

B: Developer plan is for testing and experimenting, not production or mission-critical workloads. Business or Enterprise is recommended for those.

D: Full AWS Support API access starts at the Business plan. Developer plan has no API access.

Exam Tip 🧠

Developer = 7 core TA checks, no Support API, for testing/experimentation. Business = full TA + Support API + 3rd party support.

→ Why the correct answer is right:

The AWS Pricing Calculator (calculator.aws) allows you to model your planned AWS infrastructure and estimate monthly costs before deploying anything. It is the tool for pre-deployment cost planning.

→ Why the other options are wrong:

A. Cost allocation tag: Cost allocation tags help categorize and track existing AWS spending. They cannot estimate future costs for planned architectures.

C. Consolidated Billing: Consolidated Billing manages and combines billing across existing accounts. It cannot forecast or estimate new deployment costs.

D. AWS Cost Explorer: Cost Explorer analyzes historical usage patterns to forecast future costs. Since this company has no prior AWS usage, it cannot be used for estimation.

Exam Tip 🧠

Planning = AWS Pricing Calculator (estimate before you deploy). Existing usage = Cost Explorer (analyze what you've spent).

→ Why the correct answer is right:

With Consolidated Billing, AWS combines usage across all linked accounts to determine volume pricing tiers, which results in lower overall costs. Higher combined usage means you qualify for greater discounts.

→ Why the other options are wrong:

A: It is the master (payer) account that pays for all member accounts, not the other way around. This option reverses the relationship.

C: AWS and AISPL (Amazon Internet Services Private Limited, used in India) accounts cannot be consolidated together — they are treated as separate entities.

D: 'Go global in minutes' is an advantage of AWS Cloud Computing in general, not specifically of Consolidated Billing.

Exam Tip 🧠

Consolidated Billing benefits: 1 bill for all accounts + volume discounts from combined usage + no extra fee.

→ Why the correct answer is right:

The five official AWS Trusted Advisor categories are: Cost Optimization, Security, Fault Tolerance, Performance, and Service Limits. Both Fault Tolerance and Performance are valid categories.

→ Why the other options are wrong:

A. Storage Capacity: Storage Capacity is not an official Trusted Advisor category. The five official categories do not include storage-specific analysis.

C. Infrastructure: Infrastructure is not one of the five Trusted Advisor categories. This is a distractor.

D. Instance Usage: Instance Usage is not an official category. Cost Optimization covers unused resources, but Instance Usage alone is not a category.

Exam Tip 🧠

Trusted Advisor 5 categories: Cost Optimization, Security, Fault Tolerance, Performance, Service Limits. Remember: CS FPS!

→ Why the correct answer is right:

Amazon EventBridge is a serverless event bus that enables event-driven applications by routing events from AWS services, SaaS tools, and custom applications to targets like Lambda, SNS, or Step Functions. It decouples producers and consumers of events.

→ Why the other options are wrong:

A. Amazon SQS: SQS is a message queuing service for decoupling microservices using a pull-based message queue model, not an event bus for routing events between services.

B. Amazon Kinesis: Kinesis is designed for real-time streaming data analytics and ingestion of large-scale data streams. It is not an event bus for application decoupling.

C. Amazon SNS: SNS is a publish/subscribe messaging service for fan-out notifications. While it decouples components, EventBridge is the designated event bus service with more advanced routing and filtering.

Exam Tip 🧠

EventBridge = serverless event bus (route events between services). SQS = message queue. SNS = pub/sub notifications. EventBridge has more routing rules.

→ Why the correct answer is right:

AWS IAM Access Analyzer identifies resources (like S3 buckets or IAM roles) shared with external entities outside your AWS account, and can generate IAM policies based on actual access activity recorded in CloudTrail logs.

→ Why the other options are wrong:

A. AWS License Manager: License Manager tracks and manages software licenses from vendors. It has no IAM policy generation or external access detection capabilities.

B. AWS Systems Manager Parameter Store: Parameter Store is a centralized configuration store for secrets and application parameters. It does not analyze IAM access or generate policies.

C. AWS Proton: AWS Proton is a deployment automation tool for containerized and serverless applications. It does not analyze resource sharing or generate IAM policies.

Exam Tip 🧠

IAM Access Analyzer = find external access + generate least-privilege policies from CloudTrail. Think 'Analyze who has access.'

→ Why the correct answer is right:

AWS classifies storage devices as Critical assets and follows decommissioning procedures as detailed in NIST 800-88 standards. Media containing customer data is never removed from AWS control until securely decommissioned to prevent any data leakage.

→ Why the other options are wrong:

Option A: Simply wiping and disposing doesn't meet the strict compliance standards AWS follows (NIST 800-88).

Option B: AWS does not return storage devices to manufacturers. Devices remain under AWS control until properly destroyed.

Option C: AWS does not archive old storage devices for potential future customer data requests. Data is destroyed per compliance procedures.

Exam Tip 🧠

AWS storage decommission = NIST 800-88 compliant process. AWS never returns drives to manufacturers or allows them to leave AWS control.

Reference Link: https://aws.amazon.com/compliance/data-center/controls/

→ Why the correct answer is right:

Agility in cloud computing refers to the speed at which new IT resources can be accessed and deployed. Reducing the time to provision testing environments from weeks (on-premises procurement) to days (AWS) is a direct example of improved agility.

→ Why the other options are wrong:

Option A: Cost savings may be a secondary benefit, but the scenario emphasizes speed of deployment, not cost reduction.

Option C: 'Deploy globally in minutes' refers to deploying applications across multiple worldwide regions, not the speed of spinning up test environments.

Option D: Elasticity refers to scaling resources up or down based on demand, not the speed of initial environment provisioning.

Exam Tip 🧠

Agility = Faster time to deploy resources. Elasticity = Scale up/down with demand. Global = Deploy across regions. Know the difference!

Reference Link: https://aws.amazon.com/what-is-cloud-computing/

→ Why the correct answer is right:

The AWS Developer Support plan is the lowest-cost paid plan that allows an unlimited number of technical support cases. While responses are limited to business hours and focused on development/test environments, case submission is unlimited.

→ Why the other options are wrong:

Option B: Enterprise also allows unlimited cases but is a much higher-tier plan — not the lowest offering unlimited cases.

Option C: Basic Support is free but does not allow technical support cases. It only provides access to documentation and forums.

Option D: Business also allows unlimited cases but is a higher tier than Developer, making it not the lowest option.

Exam Tip 🧠

Support case limits: Basic = No tech cases. Developer = Unlimited (business hours). Business = Unlimited (24/7). Enterprise = Unlimited (24/7 + TAM).

→ Why the correct answer is right:

Idle on-premises servers represent wasted capital investment. Cloud computing's on-demand provisioning means you only spin up resources when needed and scale to zero when not in use, eliminating the cost of idle hardware.

→ Why the other options are wrong:

Option B: AWS manages its physical infrastructure, but standard EC2 gives you virtual servers, not managed physical machines. This isn't the core benefit for this scenario.

Option C: Paying for only what you use is a valid cloud benefit, but provisioning only when needed more directly addresses the problem of idle, dusty servers.

Option D: AWS offers many automated services, but automation doesn't specifically address the problem of idle on-premises server capacity.

Exam Tip 🧠

Idle servers = Wasted CapEx. Cloud = Provision only when needed + Scale to zero. Stop paying for capacity you're not using!

→ Why the correct answer is right:

Amazon S3 is purpose-built for object storage, offering industry-leading scalability, durability (99.999999999%), and the lowest cost per GB for the data it was designed to store. It scales infinitely without provisioning, and you pay only for what you use.

→ Why the other options are wrong:

Option A: AWS Storage Gateway is a hybrid storage service that connects on-premises to S3, adding cost overhead compared to using S3 directly.

Option C: Amazon EFS is a Linux shared file system storage service, not object storage. It is also more expensive per GB than S3.

Option D: Amazon EBS is block storage that must be attached to an EC2 instance, making it more expensive and less scalable for object storage use cases.

Exam Tip 🧠

Object storage = Amazon S3. Block storage = EBS. Shared file system = EFS. S3 is the cheapest and most scalable for objects!

Reference Link: https://aws.amazon.com/s3/

→ Why the correct answer is right:

AWS Storage Gateway is a hybrid cloud storage service that provides on-premises applications with access to virtually unlimited AWS cloud storage using standard protocols (NFS, SMB, iSCSI). It seamlessly extends on-premises storage to the cloud without requiring data migration.

→ Why the other options are wrong:

Option A: AWS Snowball Edge is a physical device for large-scale data transfer and edge computing, which involves moving data — not the requirement here.

Option B: AWS Direct Connect provides dedicated network connectivity between on-premises and AWS but doesn't extend storage capacity.

Option C: AWS Backup requires data to be migrated to AWS first and has no local on-premises component to extend storage seamlessly.

Exam Tip 🧠

Hybrid storage extension (no migration) = AWS Storage Gateway. Bulk data migration = Snowball. Network connection = Direct Connect.

Reference Link: https://aws.amazon.com/storagegateway

→ Why the correct answer is right:

Instance Store provides temporary block-level storage physically attached to the host computer. Because the disks are directly attached (not network-attached like EBS or EFS), they offer the highest disk I/O performance. However, the data is lost when the instance stops or terminates.

→ Why the other options are wrong:

Option A: EFS is a network-attached file system for Linux, offering shared access but not the fastest raw disk performance.

Option B: EBS Throughput Optimized HDD is network-attached persistent storage optimized for throughput workloads, slower than Instance Store.

Option D: EBS Provisioned IOPS SSD offers high IOPS for persistent workloads but is still network-attached, making it slower than directly attached Instance Store.

Exam Tip 🧠

Fastest storage = Instance Store (physically attached, ephemeral). Persistent = EBS. Shared Linux = EFS. Temporary ≠ Reliable for data!

Reference Link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

→ Why the correct answer is right:

An AMI (Amazon Machine Image) captures the full configuration of an EC2 instance including the OS, applications, and settings. You can copy an AMI to another region using the AWS Console or API, then launch identical instances in that region.

→ Why the other options are wrong:

Option A: This is incorrect — AWS supports cross-region AMI copying natively, making manual transfer unnecessary.

Option B: Elastic Load Balancers and Auto Scaling Groups cannot span multiple AWS regions. They operate within a single region.

Option D: EBS snapshots capture the volume data but not the full instance configuration (instance type, security groups, network settings) that an AMI preserves.

Exam Tip 🧠

Cross-region EC2 copy = Create AMI → Copy AMI to target region → Launch from copied AMI. Quick and accurate!

Reference Link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html

→ Why the correct answer is right:

DynamoDB automatically scales throughput and storage to match application demand with no capacity planning required. As a NoSQL database, it supports key-value pairs, JSON documents, and other unstructured data formats that don't fit relational database schemas.

→ Why the other options are wrong:

Option A: 11 nines of durability is a characteristic of Amazon S3, not DynamoDB.

Option B: DynamoDB is not optimized for complex SQL joins and queries. Complex relational queries belong to RDS or Redshift.

Option C: DynamoDB is not a self-healing database. Self-healing storage concepts apply to Aurora's underlying storage layer, not DynamoDB.

Exam Tip 🧠

DynamoDB = Auto-scaling + Unstructured/NoSQL data. S3 = 11 nines durability. RDS = Complex SQL queries.

Reference Link: https://aws.amazon.com/dynamodb/

→ Why the correct answer is right:

One of the six advantages of cloud computing is trading capital expenditure (CapEx) — large upfront hardware and data center investments — for variable expense, where you pay only for what you consume with no long-term commitments.

→ Why the other options are wrong:

Option A: Operational expense is not traded for variable expense. Cloud computing trades CapEx (capital) for variable expense.

Option B: This is the reverse of reality. Cloud computing eliminates CapEx, not the other way around.

Option D: While you still manage operations in the cloud, the primary cost shift is from capital expense to variable/usage-based expense.

Exam Tip 🧠

Cloud advantage: Trade CapEx (buy servers upfront) for variable expense (pay for what you use). 'Pay only when you consume.'

Reference Link: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

→ Why the correct answer is right:

The AWS Enterprise Support plan is the only plan that includes a designated Technical Account Manager (TAM) who provides proactive guidance, best practices, and ongoing support. The Enterprise On-Ramp plan provides access to a pool of TAMs but not a designated one.

→ Why the other options are wrong:

Option B: Developer Support provides business-hours technical support for development/test environments with no TAM.

Option C: Business Support provides 24/7 technical support but does not include a TAM.

Option D: Enterprise On-Ramp provides a pool of TAMs shared across customers, not a single designated TAM.

Exam Tip 🧠

Designated TAM = Enterprise only. Pool of TAMs = Enterprise On-Ramp. No TAM = Business, Developer, Basic.

Reference Link: https://aws.amazon.com/premiumsupport/plans/

→ Why the correct answer is right:

AWS Secrets Manager enables secure storage, management, and automatic rotation of database credentials, API keys, and other secrets. It has built-in rotation integration with Amazon RDS, Redshift, and DocumentDB, eliminating hardcoded credentials in application code.

→ Why the other options are wrong:

Option A: AWS Artifact is a compliance portal for accessing AWS security and compliance reports, not a secrets management service.

Option B: AWS KMS manages encryption keys and provides key rotation, but it is not designed to store and rotate application credentials or database passwords.

Option D: AWS Systems Manager Parameter Store can store passwords and credentials but does not provide automatic secret rotation like Secrets Manager.

Exam Tip 🧠

Automatic secret rotation = AWS Secrets Manager. Parameter Store = Manual credential storage without auto-rotation.

Reference Link: https://aws.amazon.com/secrets-manager/

→ Why the correct answer is right:

AWS Cost Explorer provides up to 12 months of historical cost and usage data for trend analysis, pattern identification, and forecasting. For longer retention, AWS Cost and Usage Reports stored in S3 can retain data indefinitely.

→ Why the other options are wrong:

Option A: 3 months is insufficient for meaningful annual trend analysis. Cost Explorer supports 12 months.

Option B: 6 months is closer but still incorrect. The standard retention period is 12 months.

Option D: Cost Explorer does not provide 15 months of historical data. For longer retention, use CUR with S3.

Exam Tip 🧠

Cost Explorer = 12 months historical data. Need more? Use AWS Cost and Usage Reports (CUR) stored in S3 for unlimited retention.

→ Why the correct answer is right:

AWS Access Keys consist of an Access Key ID and a Secret Access Key. They are the long-term credentials required for programmatic access to AWS services via the CLI, SDKs, or API calls. Developers configure the AWS CLI with these keys using the 'aws configure' command.

→ Why the other options are wrong:

Option A: API keys are credentials used to authenticate with specific APIs, such as Amazon API Gateway endpoints. They are different from AWS Access Keys and are not used to configure the AWS CLI for service access.

Option C: IAM username and password credentials are used to authenticate to the AWS Management Console (web-based GUI). They cannot be used directly with the AWS CLI.

Option D: SSH keys are cryptographic key pairs used to establish secure shell connections to EC2 instances. They are unrelated to AWS service authentication for the CLI.

Exam Tip 🧠

🧠 AWS CLI = Access Keys (Key ID + Secret Key). Console = Username + Password + MFA. EC2 SSH = Key Pairs. Never share access keys. Use IAM roles for EC2/Lambda instead of long-term access keys.

→ Why the correct answer is right:

Edge locations are CloudFront cache points distributed globally. By caching content at the edge location nearest to the end user, CloudFront reduces latency and improves performance. Since cached content is served directly from edge locations, the load on origin servers (S3, EC2, ALB) is significantly reduced.

→ Why the other options are wrong:

Option C: Highly scalable object storage is the function of Amazon S3, not Edge locations. CloudFront edge locations cache content but do not provide persistent, scalable storage.

Option D: An easy-to-use edge computing device for data migration describes AWS Snowball Edge, a physical device for data transfer and edge computing. This is unrelated to CloudFront edge locations.

Option E: Seamlessly extending AWS to edge devices for local data processing describes AWS IoT Greengrass, not CloudFront edge locations.

Exam Tip 🧠

🧠 CloudFront Edge Locations = Cache content + reduce latency + reduce origin server load. Not the same as AWS Outposts, Wavelength Zones, or Snowball Edge. Edge location = CDN cache point.

→ Why the correct answer is right:

Amazon RDS supports Microsoft SQL Server as a managed database engine, enabling quick setup with automated backups, patching, and high availability. Amazon EC2 with Windows Server and SQL Server AMIs also allows rapid deployment of SQL Server with full control over the configuration.

→ Why the other options are wrong:

Option B: Amazon Aurora Backtrack is a feature of Aurora databases that lets you rewind a DB cluster to a specific point in time. It is not a database service and cannot host SQL Server.

Option D: Amazon Aurora is compatible only with MySQL and PostgreSQL. It does not support Microsoft SQL Server as a database engine.

Option E: Amazon Redshift is a data warehousing service for analytical (OLAP) workloads. It is not designed to host transactional relational databases like Microsoft SQL Server.

Exam Tip 🧠

🧠 SQL Server on AWS: Amazon RDS (managed, automated setup) or EC2 (self-managed, full control). Aurora does NOT support SQL Server. For quick setup: RDS is fastest. For full control: EC2.

→ Why the correct answer is right:

An Availability Zone (AZ) consists of one or more physical data centers, each with independent power, cooling, networking, and physical security. They are geographically separated within a metropolitan area to protect against localized disasters while being connected by low-latency, high-bandwidth fiber links.

→ Why the other options are wrong:

Option B: Edge locations are sites used by Amazon CloudFront to cache content closer to end users for faster delivery. They are smaller infrastructure points, not full data centers with redundant power and networking.

Option C: A VPC (Virtual Private Cloud) is a logical networking construct in the AWS cloud. It is a software-defined network, not a physical infrastructure component.

Option D: An AWS Region is a geographic area containing multiple Availability Zones. A Region is the parent container; each AZ within it is the physical infrastructure unit described in the question.

Exam Tip 🧠

🧠 AWS Infrastructure hierarchy: Region (geographic area) → AZ (1+ data centers, isolated) → Edge Location (CDN cache). AZs in a region are connected by low-latency fiber but are physically separate.

→ Why the correct answer is right:

AWS enforces default service limits (also called service quotas) to protect customers from accidental over-provisioning and billing surprises. To increase these limits, you must open a support case in the AWS Support Center and submit a service limit increase request. Note: You can also use AWS Service Quotas console as an alternative method.

→ Why the other options are wrong:

Option A: Enhanced Networking improves network throughput and reduces latency for EC2 instances. It does not affect EC2 instance launch limits or service quotas.

Option B: AWS Trusted Advisor can identify services that are approaching their limits, but it cannot increase service limits. Limit increases require a support case or Service Quotas request.

Option C: AWS does not automatically increase service limits. Limits are fixed unless you proactively request an increase. Attempting to launch beyond the limit will result in an error.

Exam Tip 🧠

🧠 Need more than the default EC2/RDS/S3 limits? Go to AWS Support Center → Service Limit Increase request, OR use the AWS Service Quotas console. Trusted Advisor warns you; it doesn't fix limits.

→ Why the correct answer is right:

Amazon Kinesis is the AWS service for real-time data streaming. It can ingest video, audio, application logs, website clickstreams, and IoT telemetry data and enables you to process and analyze data in real time — delivering insights in seconds rather than hours or days.

→ Why the other options are wrong:

Option A: Amazon OpenSearch Service is used for deploying and managing OpenSearch/Elasticsearch clusters for search, log analytics, and monitoring. It is not a data ingestion or streaming service.

Option B: Amazon Data Pipeline is a web service for orchestrating and automating the movement and transformation of data between AWS services and on-premises data sources. It is batch-oriented, not real-time streaming.

Option C: Amazon EMR (Elastic MapReduce) is a big data platform for processing large datasets using Apache Spark, Hadoop, and other frameworks. It is designed for large-scale batch analytics, not real-time streaming.

Exam Tip 🧠

🧠 Kinesis = Real-time streaming. 4 services: Kinesis Data Streams, Firehose (to S3/Redshift), Data Analytics (SQL on streams), Video Streams. Think IoT, clickstreams, log analysis in real time.

→ Why the correct answer is right:

The IAM Policy Simulator allows you to test and troubleshoot IAM policies, resource-based policies, and SCPs by simulating API calls. It shows whether a user or role would be allowed or denied a specific action without making any real changes to your live environment.

→ Why the other options are wrong:

Option B: AWS Config assesses and records configuration changes of AWS resources for compliance and auditing purposes. It does not simulate or test IAM policy permissions.

Option C: AWS Systems Manager provides operational management tools for EC2 instances and other resources. It does not have a policy simulation capability.

Option D: Amazon Inspector is an automated vulnerability assessment service that checks EC2 instances and container images for security vulnerabilities. It does not test IAM policies.

Exam Tip 🧠

🧠 IAM Policy Simulator = Test policies without real API calls. Safe for testing destructive actions. Find out if a specific user/role is ALLOWED or DENIED before deploying. Available in IAM console.

→ Why the correct answer is right:

Under the Shared Responsibility Model, customers are responsible for the 'security IN the cloud,' which includes managing and patching the guest operating system of EC2 instances. AWS only manages the physical hardware, virtualization layer, and underlying infrastructure.

→ Why the other options are wrong:

Option A: AWS only patches the underlying hypervisor and physical infrastructure. AWS does not manage the guest operating system installed on EC2 instances — that is the customer's responsibility.

Option C: OS patching is not a shared responsibility — it falls entirely on the customer. AWS manages infrastructure; customers manage everything they install and run on top of it.

Option D: Patching the OS is mandatory for security and is explicitly the customer's responsibility. Ignoring OS patches exposes the instance to vulnerabilities and is a compliance risk.

Exam Tip 🧠

🧠 EC2 Shared Responsibility: AWS = Hardware + Hypervisor. Customer = Guest OS + patches + apps + data + security groups + IAM. If you can access it via RDP/SSH, you own it.

→ Why the correct answer is right:

User policies (IAM identity-based policies) attach to users, groups, or roles and define what AWS actions they can perform, including S3 operations. Bucket policies are resource-based policies attached directly to S3 buckets and control access at the bucket level, including cross-account access.

→ Why the other options are wrong:

Option A: Routing policies are used in Amazon Route 53 to determine how DNS queries are resolved and routed to endpoints. They are unrelated to S3 access permissions.

Option B: There is no standalone 'object policy' type in Amazon S3. Access to individual objects is controlled through bucket policies, IAM policies, or ACLs — not a separate object policy.

Option D: Network Access Control Lists (NACLs) are subnet-level firewalls in Amazon VPC that filter network traffic. They do not control access permissions for S3 buckets or objects.

Exam Tip 🧠

🧠 S3 Access Control: Bucket Policy (resource-based, attached to bucket) + IAM/User Policy (identity-based, attached to user/role). Use both for fine-grained control. ACLs are legacy — prefer policies.

→ Why the correct answer is right:

AWS Artifact is a self-service portal that provides on-demand access to AWS compliance documentation, including SOC 1, SOC 2, SOC 3 reports, PCI DSS reports, ISO certifications, and other compliance agreements. It is the central repository for AWS audit and compliance reports.

→ Why the other options are wrong:

Option B: AWS Organizations is an account management service for consolidating multiple AWS accounts under a single organizational unit. It does not provide compliance reports or audit documentation.

Option C: AWS Certificate Manager (ACM) manages SSL/TLS certificates for securing web traffic. It has no role in storing or providing compliance reports.

Option D: AWS GovCloud is an isolated region designed for sensitive U.S. government workloads. While it supports compliance, it is not a portal for downloading compliance reports like SOC or PCI.

Exam Tip 🧠

🧠 AWS Artifact = Download AWS compliance reports (SOC 1/2/3, PCI DSS, ISO). Think: Artifact = AWS's compliance document library. Free to access from the AWS console.

→ Why the correct answer is right:

AWS Health provides personalized, real-time notifications about events that may affect your AWS resources and services. It includes the AWS Health Dashboard (formerly Personal Health Dashboard) which shows service outages, planned maintenance windows, and account-specific alerts relevant to your environment.

→ Why the other options are wrong:

Option A: Amazon SNS (Simple Notification Service) is a messaging service for sending push notifications and alerts. AWS does not use SNS as the primary channel for notifying customers of service-impacting events.

Option C: Amazon CloudWatch monitors your AWS resources and applications and sends metric-based alarms. It is used by customers to monitor their own systems, not for AWS to communicate service health events.

Option D: AWS Support Center is where you file and manage support cases. It provides reactive support but is not the proactive notification mechanism AWS uses for service events.

Exam Tip 🧠

🧠 AWS Health = AWS notifies you of events impacting your resources (outages, maintenance). Health Dashboard = your personalized event feed. CloudWatch = you monitor your own resources.

→ Why the correct answer is right:

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3. It identifies PII, financial data, intellectual property, and other sensitive content, then provides dashboards and alerts to help you understand and control data access and movement.

→ Why the other options are wrong:

Option A: Amazon GuardDuty is a threat detection service that monitors AWS account activity and network traffic for malicious behavior. It detects threats like compromised credentials and unauthorized API calls, but does not classify data.

Option B: Amazon Cognito is an identity service for adding user authentication and authorization to web and mobile apps. It manages user sign-up and sign-in, not data classification.

Option C: Amazon Rekognition is a computer vision service that analyzes images and videos. While it uses ML, it is designed for visual analysis (object detection, facial recognition), not for discovering PII in stored data.

Exam Tip 🧠

🧠 Macie = ML + S3 data classification + PII detection. GuardDuty = Threat detection (account + network). Inspector = Application vulnerability assessment. Macie protects data at rest.

→ Why the correct answer is right:

AWS IAM is a global service — IAM users, roles, and policies are available across all AWS regions without needing to be recreated per region. Amazon CloudFront is also a global CDN service — it operates across a worldwide network of edge locations and is not tied to any specific region.

→ Why the other options are wrong:

Option A: AWS Batch is a regional service. Batch computing environments and job queues are provisioned within a specific AWS region.

Option B: Amazon DynamoDB is a regional service. DynamoDB tables are created within a specific region (though you can enable Global Tables for multi-region replication).

Option D: Amazon RDS is a regional service. RDS instances are deployed within a specific region and Availability Zone.

Exam Tip 🧠

🧠 Global AWS services: IAM, STS, Route 53, CloudFront, WAF. Everything else is typically regional. 'Global' = available in all regions without recreation. Regional = tied to one region.

→ Why the correct answer is right:

On-Demand instances are the best choice for short-term, uninterruptible workloads. They have no commitment period, so you pay only for what you use (by the hour or second), and you are guaranteed capacity without the risk of interruption. For a 3-month workload, On-Demand is more cost-effective than a Reserved Instance commitment.

→ Why the other options are wrong:

Option B: Spot Instances can be interrupted by AWS when capacity is reclaimed. This makes them unsuitable for uninterruptible workloads, regardless of the cost savings they offer.

Option C: Dedicated Instances run on hardware dedicated to a single customer for compliance and isolation needs. They are more expensive than On-Demand and do not specifically address the short-term or uninterruptible requirements.

Option D: Reserved Instances require a 1-year or 3-year commitment. For a 3-month workload, committing to a 1-year RI would be wasteful and more expensive than just using On-Demand.

Exam Tip 🧠

🧠 EC2 Pricing Match: Short-term + uninterruptible = On-Demand. Long-term stable = Reserved. Fault-tolerant flexible = Spot (cheapest, can be interrupted). Compliance isolation = Dedicated.

→ Why the correct answer is right:

AWS charges for data transferred between different AWS Regions. This inter-region data transfer is treated similarly to data flowing out to the public internet, incurring standard data transfer fees. All other options in this question are free of charge.

→ Why the other options are wrong:

Option A: Inbound data transfer into AWS (from on-premises to S3 via VPN) is free. AWS only charges for outbound data transfer out of AWS to the internet or between regions.

Option B: Elastic IPs are free when attached to running EC2 instances. AWS charges for Elastic IPs only when they are unattached (idle), not when they are in use.

Option D: Creating additional VPCs in your AWS account is free. VPCs are a logical networking construct with no provisioning cost.

Exam Tip 🧠

🧠 AWS Data Transfer Costs: Inbound (into AWS) = FREE. Within same AZ = FREE. Same region, different AZ = small charge. Between regions = CHARGED. Internet egress = CHARGED.